Amazon Practice Questions, Discussions & Exam Topics by our Authors
A CloudOps engineer has an Amazon S3 bucket and a new AWS Lambda function. The CloudOps engineer tries to configure a new event notification from the S3 bucket to the Lambda function by using the Lambda console. The configuration fails and returns the following error: "Unable to validate the following destination configurations."
...
Key concept: S3 → Lambda event notification validation
When you configure an Amazon S3 event notification to invoke an AWS Lambda function, Amazon S3 performs a validation check before saving the configuration.
For the validation to succeed:
1. The Lambda function must exist.
2. The Lambda function must allow Amazon S3 to invoke it.
3. The Lambda function's resource-based policy must contain permission for the S3 bucket to call `lambda:InvokeFunction`.
4. The S3 bucket configuration must not contain invalid destination references.
The error:
> "Unable to validate the following destination configurations."
usually means S3 cannot verify that it is allowed to send events to the destination.
---
Option analysis
A) The maximum number of S3 event notification destinations has been exceeded for the S3 bucket.
❌ Rejected
S3 buckets have limits on event notification configurations, but exceeding the limit produces a different issue.
Key factor:
This problem occurs when adding too many notification configurations (for example, too many Lambda, SNS, or SQS destinations).
It does not cause a destination validation failure.
Scenario where this applies:
A bucket already has many event notifications and an engineer attempts to add another one beyond the service quota.
Why rejected here:
The error specifically indicates S3 cannot validate the destination, not that the quota was exceeded.
---
B) The S3 bucket owner needs to grant the Lambda function explicit cross-account permissions by using a resource policy.
❌ Rejected
Cross-account invocation requires additional permissions, but the wording is incorrect.
Key factor:
Lambda permissions are controlled through the Lambda function resource-based policy, not by the S3 bucket owner granting permissions to Lambda.
The Lambda function owner must allow S3 to invoke the function.
Scenario where this applies:
The S3 bucket is in AWS Account A and the Lambda function is in AWS Account B.
The Lambda function policy must allow the S3 service principal (`s3.amazonaws.com`) to invoke it.
Why rejected here:
The question states the Lambda function and IAM role are correctly configured, but it does not indicate a cross-account setup.
---
C) The new Lambda function's resource-based policy is missing the `lambda:InvokeFunction` permission for Amazon S3.
✅ Correct
This is the most common cause of this error.
Key factor:
Lambda...
Author: StarlightBear · Last updated Jul 11, 2026
A company runs a workload in an Amazon VPC. The company configures Amazon CloudWatch Logs for the workload. The company needs a solution to automatically detect unusual API activity and securit...
Question Analysis
Requirement:
The company wants to automatically detect unusual API activity and security events in an AWS account.
Key factors:
The focus is on security threat detection.
The requirement mentions unusual API activity.
The workload is already using Amazon CloudWatch Logs, but the solution should detect account-level threats and suspicious behavior.
AWS exam questions often test the difference between:
GuardDuty → threat detection
CloudTrail Insights → unusual API call patterns
Inspector → vulnerability scanning
Config → compliance/configuration tracking
---
Option Analysis
A) Use Amazon Inspector to scan VPC flow logs.
❌ Rejected
Why:
Amazon Inspector is a vulnerability management service.
It identifies:
Software vulnerabilities
Package vulnerabilities
Network exposure issues
EC2/ECR/Lambda security findings
It does not analyze VPC Flow Logs to detect unusual API activity or account threats.
When to use Amazon Inspector:
Finding CVEs on EC2 instances
Scanning container images in Amazon ECR
Assessing Lambda package vulnerabilities
Example scenario:
> A company wants to identify vulnerable operating system packages running on EC2 instances.
Use Amazon Inspector.
---
B) Use Amazon GuardDuty to monitor CloudWatch logs.
❌ Rejected (partially correct concept, but incorrect implementation)
Why:
Amazon GuardDuty is the correct service for threat detection, but it does not monitor CloudWatch Logs as its primary input.
GuardDuty analyzes sources such as:
AWS CloudTrail management events
VPC Flow Logs
DNS logs
Kubernetes audit logs
S3 data events
Malware scans
GuardDuty automatically detects:
Credential compromise
Suspicious API calls
Reconnaissance activity
Malware behavior
Unauthorized access attempts
The problem is the option says "monitor CloudWatch logs", which is not how GuardDuty works.
When to use Amazon GuardDuty:
Detecting suspicious AWS account activity
Detecting compromised credentials
Identifying malicious network activity
Example scenario:
> A company wants a managed service that detects compromised IAM credentials making unusual API calls.
Use Amazon GuardDuty.
---
...
Author: Rohan · Last updated Jul 11, 2026
A CloudOps engineer needs to ensure that AWS resources across multiple AWS accounts are tagged consistently. The company uses an organization in AWS Organizations to centrally manage the accounts. The company wants to implement cost allocation tags to accurately track the costs tha...
Key requirement analysis
The company needs:
1. Consistent tagging across multiple AWS accounts
The accounts are centrally managed using AWS Organizations.
The solution should work across the organization, not require account-by-account management.
2. Cost allocation tags
Tags must be activated in AWS Billing and Cost Management so AWS can use them for cost tracking and reporting.
3. Least operational overhead
Prefer native AWS organization-level governance features over custom automation.
---
Option A — Use Organizations tag policies to enforce mandatory tagging on all resources. Enable cost allocation tags in the AWS Billing and Cost Management console.
Why this is correct
AWS Organizations tag policies are designed specifically for centralized tag governance across multiple AWS accounts.
Key factors:
Tag policies allow an organization to define:
Required tag keys.
Allowed tag values.
Tagging standards that accounts must follow.
Policies can be applied at:
The entire organization.
Organizational Units (OUs).
Individual accounts.
This provides centralized control with minimal maintenance.
After defining the tagging standard, enabling those tags as cost allocation tags in AWS Billing and Cost Management allows AWS Cost Explorer, Cost and Usage Reports, and billing tools to categorize costs by business unit.
Example:
Organization tag policy:
```
CostCenter = Finance | Marketing | Engineering
Environment = Production | Development
```
Resources created in member accounts can then follow the company's cost tracking standards.
Why this has the least operational overhead
No custom code.
No monitoring infrastructure.
No Lambda functions to maintain.
No additional services required.
Native AWS Organizations integration.
---
Why the other options are rejected
Option B — Configure CloudTrail events to invoke Lambda to detect untagged resources and automatically assign tags.
Why it is rejected
This approach requires building and maintaining a custom remediation solution.
Operational overhead includes:
Creating CloudTrail event rules.
Developing Lambda functions.
Maintaining tagging logic.
Handling different AWS services and resource types.
Managing permissions for automated tagging.
Troubleshooting failures.
Also, CloudTrail only records API activity. It does not provide a native organization-wide tagging governance mechanism.
When this option can be used
Use this approach when:
The organization requires custom tagging remediation.
Tags depend on complex business logic.
Automatic correction of noncompliant resources is required.
Example:
"Whenever an EC2 instance is launched without an Owner tag, automatically add the owner's email from the IAM identity."
---
Option C — Use AWS Config to evaluate ...
Author: Emma · Last updated Jul 11, 2026
A company runs a web-based application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. Users from around the world access the application. Users from outside North America report high latency and inconsistent application performance. The co...
Correct Answer: A) Use AWS Global Accelerator in front of the ALB.
Key factors in the question
Application is running on Amazon EC2 instances behind an ALB.
Users are globally distributed.
Users outside North America experience:
High latency
Inconsistent performance
Requirement:
Improve latency
Improve application performance
Support global users
The important clue is that the application is in one AWS Region (us-east-1), but users are worldwide. The solution should improve the network path between users and the existing application without requiring application changes or multi-Region deployment.
---
Option A: Use AWS Global Accelerator in front of the ALB. ✅ Correct
Why this works
AWS Global Accelerator improves global application performance by using the AWS global network.
How it helps:
Provides users with static Anycast IP addresses.
Traffic enters the AWS network through the nearest AWS edge location.
Uses the AWS private global backbone instead of relying heavily on the public internet.
Routes user traffic to the optimal AWS endpoint (the ALB in this case).
Automatically detects unhealthy endpoints and routes traffic away from failures.
Architecture:
```
Global Users
|
|
AWS Global Accelerator
|
|
Application Load Balancer
|
|
EC2 Instances (us-east-1)
```
Why it improves latency
Without Global Accelerator:
```
User → Public Internet → ALB in us-east-1 → EC2
```
Users far from North America may experience:
Multiple internet hops
ISP routing issues
Variable latency
With Global Accelerator:
```
User → Nearest AWS Edge Location
→ AWS Global Network
→ ALB in us-east-1
→ EC2
```
The AWS backbone provides:
Lower latency
More consistent network performance
Faster failover
When to use AWS Global Accelerator
Use Global Accelerator when:
Users are globally distributed.
The application runs in one or multiple AWS Regions.
You need lower latency for TCP/UDP applications.
You want static IP addresses.
You want intelligent traffic routing without changing DNS.
Examples:
Global gaming applications
Financial trading applications
SaaS applications with worldwide users
APIs serving customers globally
---
Why other options are rejected
B) Deploy a Network Load Balancer (NLB) in front of the ALB. ❌
Why it is not correct
An NLB improves:
Layer 4 (TCP/UDP) performance
High connection handling
Static IP support
Very low latency within a Region
However, placing an NLB in front of an ALB:
```
Users
|
NLB
|
ALB
|
EC2
```
does not solve the global latency problem.
The traffic still reaches the same AWS Region through the public internet.
Problems:
No global routing capability.
No AWS edge location acceleration.
No improvement for users far from us-east-1.
When NLB is used
Use NLB when:
You need e...
Author: Suresh · Last updated Jul 11, 2026
A company has multiple Amazon EC2 instances that run the Ubuntu operating system (OS). The company must patch the OS regularly. A CloudOps engineer installs patches manually every week. The company adds new EC2 instances that run Ubuntu continuously. The CloudOps engineer needs...
Question Summary
A company has multiple Ubuntu EC2 instances. New EC2 instances are continuously added. The company currently patches manually every week and wants to automate OS patching in the most operationally efficient way.
Key requirements:
Automate Linux OS patch installation
Support many EC2 instances
Support new instances added continuously
Reduce operational overhead
Use AWS managed services where possible
---
Option Analysis
A) Create an AWS Lambda function to connect to the EC2 instances by using SSH and install patches. Configure Lambda to run every week.
Why this is rejected:
Lambda can automate tasks, but using it for OS patching through SSH is not operationally efficient.
Problems:
Requires managing SSH keys and credentials.
Requires handling network access, security groups, and connection failures.
Requires custom code for:
discovering instances
connecting to instances
running patch commands
handling errors
reporting results
Does not automatically handle newly launched EC2 instances unless additional discovery logic is built.
When this option can be used:
When you need a highly customized automation workflow.
When patching systems that do not support AWS Systems Manager.
For small environments where custom scripts are acceptable.
For EC2 fleet management, AWS provides Systems Manager specifically for this purpose.
---
B) Install AWS Systems Manager Agent (SSM Agent) on EC2 instances. Configure Systems Manager Patch Manager to install patches every week.
Why this is correct:
AWS Systems Manager Patch Manager is designed specifically to automate OS patching for EC2 instances.
Benefits:
1. Managed patching
Patch Manager can:
Scan instances for missing patches.
Install required patches automatically.
Schedule patch operations.
Generate compliance reports.
2. No SSH management required
SSM Agent communicates securely with Systems Manager.
Advantages:
No SSH keys.
No inbound SSH access required.
Uses IAM permissions instead of server credentials.
3. Supports growing EC2 environments
New Ubuntu EC2 instances can automatically participate when:
SSM Agent is installed.
IAM instance permissions are configured.
Instances match Patch Manager targets.
This is operationally efficient because the company does not need to maintain custom scripts.
When this option should be used:
Use Systems Manager Patch Manager when:
Managing many EC2 instances.
Automating security pa...
Author: Ahmed97 · Last updated Jul 11, 2026
A CloudOps engineer wants to configure observability of specific metrics for a public website that runs on Amazon Elastic Kubernetes Service (Amazon EKS). The CloudOps engineer wants to observe latency, traffic, errors, and saturation metrics. The CloudOps engineer wants to define service level objectives (SLOs) and to monitor service level indicators (SLIs). The CloudOps engineer also wa...
Correct Answer: A) Use Amazon CloudWatch Application Signals to automatically collect and monitor the specified metrics for the EKS workloads.
Key requirements in the question
The CloudOps engineer needs:
1. Observability for an Amazon EKS public website
2. Monitor the four golden signals:
Latency
Traffic
Errors
Saturation
3. Define SLOs (Service Level Objectives)
4. Monitor SLIs (Service Level Indicators)
5. Correlate:
Metrics
Logs
Traces
6. Achieve this with the least operational effort
The important exam clue is "least operational effort" combined with SLOs, SLIs, and correlation of metrics/logs/traces.
---
Option A — ✅ Correct
Amazon CloudWatch Application Signals
Why it is selected:
CloudWatch Application Signals is designed specifically for application performance monitoring (APM) and automatically provides:
Golden signals:
Latency
Traffic
Errors
Saturation
Automatic discovery of services running on platforms such as:
Amazon EKS
Amazon ECS
EC2
SLI generation
SLO creation and monitoring
Service dependency visualization
Correlation between:
Metrics
Logs
Traces
It reduces operational overhead because engineers do not need to manually:
Configure telemetry pipelines
Create Prometheus rules
Build dashboards
Instrument every metric manually
Connect logs, metrics, and traces separately
When to use CloudWatch Application Signals:
Use it when:
You need application-level observability
You need SLO/SLA monitoring
You need the golden signals
You want automatic service discovery
You want AWS-managed observability with minimal configuration
Example:
> A company runs microservices on EKS and wants to know which service is causing increased latency while automatically tracking availability SLOs.
CloudWatch Application Signals is the best fit.
---
Option B — ❌ Rejected
AWS Distro for OpenTelemetry + Amazon Managed Service for Prometheus + Amazon Managed Grafana
This is a powerful observability architecture, but it requires significantly more operational work.
The engineer must configure:
OpenTelemetry instrumentation
Collectors
Metric pipelines
Prometheus scraping
Recording rules
Alert rules
Grafana dashboards
Correlation between telemetry sources
When to use this option:
Use this when:
You need an open-source observability stack
You require Prometheus compatibility
You already have Grafana/Prometheus expertise
You need customized metrics collection
Example:
> An organization has existing Prometheus dashboards and wants to migrate them to AWS-managed Prometheus.
However, it is not the least operational effort.
---
Option C — ❌ Rejected
CloudWatch RUM + CloudWatch Synthetics Canaries
These services focus mainly on end-user experience mo...
Author: Mia · Last updated Jul 11, 2026
A global company runs a critical primary workload in the us-east-1 Region. The company wants to ensure business continuity with minimal downtime in case of a workload failure. The company wants to replicate the workload to a second AWS Region.
A CloudOps engineer needs a solution that achieves a recovery time objective (RTO) of ...
Key requirements from the scenario
The important clues are:
| Requirement | Meaning |
| --------------------------------------------- | ----------------------------------------------------------------- |
| Critical primary workload | The application cannot tolerate long outages. |
| Replicate workload to a second AWS Region | A multi-Region disaster recovery (DR) strategy is required. |
| RTO < 10 minutes | Recovery must happen very quickly after failure. |
| Zero RPO | No data loss is acceptable. Data must be continuously replicated. |
The two most important factors are:
1. RTO (Recovery Time Objective) → How quickly the system must become available after failure.
2. RPO (Recovery Point Objective) → How much data loss is acceptable.
A zero RPO requirement generally requires real-time data replication. Regular backups or periodic replication will not satisfy it.
---
Option A: Pilot light architecture with real-time data replication
Why it looks correct:
Pilot light keeps a minimal version of the environment running in the secondary Region.
It can replicate data continuously.
Route 53 health checks can redirect traffic during failure.
Why it is rejected:
Pilot light usually keeps only the core components (such as databases) running, while application servers and other resources must be started during recovery.
Even though data replication is real-time, additional infrastructure startup and configuration steps increase recovery time.
It may achieve minutes to hours of recovery depending on complexity, but it is not the best choice for a strict RTO under 10 minutes.
When to use pilot light:
When cost must be minimized.
When some downtime is acceptable.
Example: A business application that can tolerate 30 minutes to several hours of recovery.
---
Option B: Warm standby architecture with regular data replication
Why it looks correct:
Warm standby maintains a scaled-down but functional copy of the environment in another Region.
Route 53 health checks can automatically fail over traffic.
Why it is rejected:
The requirement is zero RPO.
Regular replication introduces a possibility of data loss between replication intervals.
Warm standby is normally designed for near-zero downtime but not necessarily zero data loss unless continuous replication is specifically configured.
When to use warm standby:
When the business needs faster recovery than pilot light.
When a small amount of downtime is acceptable.
Example: An application requiring recovery within minutes but allowing seconds or minutes of data loss.
---
Option C: Active-active architecture with real-time replication across two Regions
Why it is correct:
Active-active keeps the workload running in both Regions simultaneousl...
Author: James · Last updated Jul 11, 2026
A company has a VPC that contains a public subnet and a private subnet. The company deploys an Amazon EC2 instance that uses an Amazon Linux Amazon Machine Image (AMI) and has the AWS Systems Manager Agent (SSM Agent) installed in the private subnet. The EC2 instance is in a security group that allows only outbound traffic.
A CloudOps engineer needs to give a group of privil...
Key requirement analysis
The company needs:
1. SSH access to an EC2 instance in a private subnet
2. No exposure of the instance to the internet
3. Access only for privileged administrators
4. The instance already has SSM Agent installed
5. The instance security group allows only outbound traffic
Important AWS exam factors:
A private subnet instance cannot be reached directly from the internet.
EC2 Instance Connect Endpoint is designed specifically to allow SSH access to private instances without requiring a public IP, bastion host, or inbound internet access.
AWS Systems Manager Session Manager is another option for shell access, but the question specifically asks for SSH access, not an SSM session.
IAM permissions must provide the correct ability. PowerUserAccess is not an appropriate permission for SSH connectivity.
---
Option A
> Create an EC2 Instance Connect endpoint in the private subnet. Update the security group to allow inbound SSH traffic. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy.
Why this is correct
EC2 Instance Connect Endpoint allows administrators to connect to EC2 instances in private subnets using SSH through AWS private connectivity.
Key points:
The endpoint is deployed inside the VPC, not exposed to the internet.
Administrators connect through the endpoint using AWS IAM authentication.
The EC2 instance does not need:
Public IP address
Internet gateway
Bastion host
The security group must allow SSH from the EC2 Instance Connect Endpoint security group, because the endpoint becomes the path for SSH traffic.
Why PowerUserAccess is not ideal
The option includes:
> Assign the PowerUserAccess managed policy
This policy grants broad AWS permissions, far more than required. In a real environment, administrators would normally receive a more restrictive policy allowing EC2 Instance Connect Endpoint usage.
However, compared with the other options, this is still the only solution that provides the correct private SSH connectivity mechanism.
Exam reasoning: The connectivity design is correct; the IAM choice is less restrictive but does not invalidate the main solution.
When to use EC2 Instance Connect Endpoint
Use it when:
You need SSH/RDP access to private EC2 instances.
You do not want a bastion host.
You do not want public IP exposure.
Users authenticate using IAM permissions.
---
Option B
> Create a Systems Manager endpoint in the private subnet. Update the security group to allow SSH traffic from the private network where the Systems Manager endpoint is connected. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy.
Why this is rejected
Systems Manager endpoints (Interface VPC endpoints) are used for SSM Agent communication, not for providing SSH connectivity.
The normal SSM architecture:
```
Administrator
|
AWS Systems Manager
|
SSM Agent on EC2
|
Private EC2 instance
```
The administrator connects using Session Manager, not SSH.
The question specifically requires:
> "connect to the inst...
Author: Aarav2020 · Last updated Jul 11, 2026
A CloudOps engineer creates a new VPC that contains a private subnet, a security group that allows all outbound traffic, and an endpoint for Amazon EC2 Instance Connect in a private subnet. The CloudOps engineer associates the security group with EC2 Instance Connect.
The CloudOps engineer launches an EC2 instance from an Amazon Linux Amazon Machine Image (AMI) in the private subnet. The CloudOps engineer associates the instance with the same subnet that the security group uses. The CloudOps engineer launches the EC2...
Key factors in this AWS exam scenario
The important details are:
1. The EC2 instance is in a private subnet
It has no public IP address.
Direct SSH from the internet is not possible.
2. The instance was launched without an SSH key pair
Traditional SSH authentication using a `.pem` private key is unavailable.
Adding an SSH key pair after launch is not supported for an existing EC2 instance through normal EC2 configuration.
3. The engineer is using an EC2 Instance Connect Endpoint
EC2 Instance Connect Endpoint allows SSH access to private instances without requiring a public IP.
It still requires the instance to accept SSH traffic on port 22.
The security group attached to the instance must allow inbound SSH from the endpoint security group/subnet.
4. The security group currently only allows outbound traffic
Outbound rules do not permit incoming SSH connections.
An inbound rule is required.
---
Option analysis
A) Create an inbound rule in the security group to allow HTTPS traffic on port 443 from the private subnet.
❌ Rejected
Why:
EC2 Instance Connect Endpoint uses an endpoint service, but the connection to the EC2 instance itself is made using SSH on port 22.
Port 443 is not used for the SSH session between the endpoint and the instance.
When this option would be used:
HTTPS port 443 inbound rules are required for applications such as web servers, APIs, or HTTPS-based services.
It is not required for EC2 Instance Connect SSH access.
---
B) Create an inbound rule in the security group to allow SSH traffic on port 22 from the private subnet.
✅ Selected
Why:
The EC2 Instance Connect Endpoint establishes an SSH connection to the private EC2 instance.
The instance security group must allow inbound TCP port 22 traffic.
Because the instance is in a private subnet, the source should be the private network/security group associated with the EC2 Instance Connect Endpoint, not the public internet.
This fixes the missing requirement:
Instance has no SSH key pair.
Instance Connect Endpoint provides the connection path.
Security group allows the SSH session.
When this option is used:
Private EC2 instance.
No public IP address.
EC2 Instance Connect En...
Author: FlamePhoenix2025 · Last updated Jul 11, 2026
A company is implementing security and compliance by using AWS Trusted Advisor. The company's CloudOps team is validating the list of Trusted Advisor checks that it can access....
Correct Answer: B) The AWS Support plan
Key factor to remember:
The number of AWS Trusted Advisor checks available depends primarily on the AWS Support plan attached to the account.
AWS Trusted Advisor provides recommendations across categories such as cost optimization, security, fault tolerance, performance, and service limits. However, the level of access to Trusted Advisor checks varies by AWS Support plan.
---
Option Analysis
✅ B) The AWS Support plan — Correct
Why it is correct:
AWS Support plans determine how many Trusted Advisor checks are available.
Basic and Developer Support plans provide access to a limited set of Trusted Advisor checks (mainly core security and service limit checks).
Business, Enterprise On-Ramp, and Enterprise Support plans provide access to the full set of Trusted Advisor checks.
Scenario where this applies:
A company upgrades from AWS Basic Support to AWS Business Support.
After the upgrade, the CloudOps team sees additional Trusted Advisor checks become available, such as cost optimization and performance recommendations.
Exam key phrase:
> "Quantity of Trusted Advisor checks available" → Think AWS Support plan
---
❌ A) Whether at least one Amazon EC2 instance is in the running state — Incorrect
Why it is rejected:
Trusted Advisor availability is not controlled by whether the account has active EC2 instances.
Some Trusted Advisor checks may evaluate EC2 resources, but having an EC2 instance does not unlock additional checks.
Scenario where this factor matters:
If a Trusted Advisor check evaluates EC2-related issues (for example, security group configuration or instance utilization), the account must have relevant resources for the check to produce results.
However, it does not change the number of available checks.
Exam trap:
> Resource existence affects check results, not the number of checks accessible.
---
❌ C) An AWS Organizations service control policy (...
Author: Leah · Last updated Jul 11, 2026
A company's website runs on an Amazon EC2 Linux instance. The website needs to serve PDF files from an Amazon S3 bucket. All public access to S3 bucket is blocked at the account level. The company needs to allow website users to downlo...
Question Summary
Website runs on an Amazon EC2 Linux instance.
Website needs to serve PDF files stored in Amazon S3.
S3 Block Public Access is enabled at the account level (cannot allow public S3 access).
Need the solution with the least administrative effort while allowing website users to download PDFs.
The key AWS exam concepts involved:
| Key factor | Meaning |
| --------------------------- | -------------------------------------------------------------- |
| S3 Block Public Access | Prevents making S3 buckets/objects publicly accessible |
| Private S3 access | Use AWS services such as CloudFront + OAC or IAM roles |
| Website users | Usually should not get direct S3 permissions |
| Least administrative effort | Avoid manual file handling, custom code, and operational tasks |
| Secure content delivery | Use CloudFront with S3 as a private origin |
---
Option Analysis
A) IAM role for EC2 + employee downloads files manually
Option idea:
Create IAM role for EC2 with `s3:list` and `s3:get`.
Employee downloads requested PDFs from S3 to EC2.
Employee delivers files to users.
Lambda deletes local files periodically.
Why it is rejected
❌ Not least administrative effort
Problems:
1. Manual process
Every user request requires a company employee to download and deliver files.
This does not scale for a website with many users.
2. Poor architecture
The website should automatically serve files.
Human involvement creates delays and operational overhead.
3. Unnecessary components
Lambda is added only to clean temporary files created because of this inefficient design.
When this option could be used
Internal systems where employees manually provide documents.
Small workflows where automation is not required.
---
B) CloudFront distribution with Origin Access Control (OAC) to S3
Option idea:
Create a CloudFront distribution.
Configure S3 bucket as the origin.
Use Origin Access Control (OAC) so only CloudFront can access S3.
Add an S3 bucket policy allowing CloudFront access.
Users download files through CloudFront URLs.
Why it is correct
✅ Meets all requirements
1. Works with S3 Block Public Access
The S3 bucket remains private.
Users never access S3 directly.
CloudFront accesses S3 using OAC authorization.
2. Secure public delivery
The flow becomes:
```
Website User
|
v
CloudFront URL
|
v
CloudFront OAC
|
v
Private S3 Bucket
|
v
PDF File
```
3. Least administrative effort
No employee intervention.
No EC2 file storage management.
No cleanup jobs.
AWS manages content delivery.
4. Designed for this use case
CloudFront + OAC is the AWS recommended method for serving private S3 content publicly.
When this option sh...
Author: Leah Davis · Last updated Jul 11, 2026
A company applies user-defined tags to resources that are associated with the company's AWS workloads. Twenty days after applying the tags, the company notices that it cannot use the tags to ...
Question Summary
A company adds user-defined tags to AWS resources and wants to use those tags as filters in AWS Cost Explorer. After 20 days, the tags do not appear as available filters.
The key concept being tested is:
AWS Cost Explorer can filter costs by tags only after the tags are activated as cost allocation tags.
---
Option Analysis
✅ B) The company has not activated the user-defined tags for cost allocation. (Correct)
Why this is correct:
AWS resource tags and AWS billing tags are not automatically used for cost tracking.
To use user-defined tags in:
AWS Cost Explorer
AWS Cost and Usage Reports
Cost allocation reports
the tags must first be activated as user-defined cost allocation tags in the AWS Billing and Cost Management console.
After activation, AWS starts associating those tags with billing data.
Existing costs before activation are generally not retroactively tagged.
Key exam factor:
> "Can I filter costs by a resource tag?" → Check whether the tag is activated for cost allocation.
Scenario where this option applies:
A company tags EC2 instances with `Environment=Production`.
The tag exists on the resources.
Cost Explorer does not show `Environment` as a filter.
The company forgot to activate the tag under Billing → Cost Allocation Tags.
---
❌ A) It takes at least 30 days to be able to use tags to filter views in Cost Explorer.
Why this is incorrect:
AWS does not require a 30-day waiting period for cost allocation tags.
After activation, tags become available for cost analysis after AWS processes billing data.
The important requirement is activation, not waiting 30 days.
When a time delay might matter:
Cost Explorer data is not real-time.
New billing data can take some time to appear.
But there is no fixed 30-day requirement.
Exam clue:
If an option mentions a specific waiting period that AWS does not document as a requi...
Author: Julian · Last updated Jul 11, 2026
A CloudOps engineer needs to disable automatic backups for an Amazon RDS instance to optimize costs. When the CloudOps engineer attempts to disable the backups, the CloudOps engineer receives an error message that sta...
Question Analysis
The CloudOps engineer is trying to disable automatic backups for an Amazon RDS instance. In RDS, disabling automated backups means setting the backup retention period to 0 days.
However, the error message says:
> "The retention period must be between 1 and 35."
This indicates that RDS is not allowing the retention period to be set to 0, which usually happens when the RDS instance has a feature enabled that requires automated backups to remain enabled.
The key AWS exam concept is:
RDS backup retention period
Normal RDS DB instance: `0–35 days`
`0` disables automated backups.
`1–35` enables automated backups.
RDS read replicas require automated backups to be enabled on the source DB instance.
A source DB instance with read replicas must have a backup retention period of at least 1 day.
---
Option Analysis
A) The RDS instance has insufficient permissions to change the backup retention period.
❌ Rejected
Insufficient permissions would produce an IAM authorization error, such as:
`AccessDenied`
`User is not authorized to perform rds:ModifyDBInstance`
It would not produce an error stating:
> "The retention period must be between 1 and 35."
This error indicates a configuration constraint, not a permissions issue.
When this option applies:
When the IAM user or role lacks permissions such as `rds:ModifyDBInstance`.
---
B) Read replicas are configured for the RDS instance.
✅ Selected
When an RDS instance has read replicas, automated backups cannot be disabled.
Why?
Read replicas rely on the source DB instance's transaction logs and backup mechanisms.
RDS requires the backup retention period to be at least 1 day for DB instances that have read replicas.
Setting retention to `0` is therefore rejected.
The error message showing the valid range as 1–35 is a strong indicator that a read replica dependency exists.
Key exam clue:
> "Cannot set backup retention period to 0 when read replicas exist."
When this option applies:
RDS MySQL, PostgreSQL, MariaDB, Oracle, or SQL...
Author: Henry · Last updated Jul 11, 2026
A CloudOps engineer is examining the following AWS CloudFormation template:
Why will the stack cr...
The correct answer is:
Selected option: D) The VPC was not specified in the CloudFormation template.
Reasoning (AWS exam approach)
The key factor is that some AWS resources must be associated with a VPC, and CloudFormation requires the necessary VPC-related properties when creating those resources.
In this scenario, the stack creation fails because the template attempts to create a resource that requires a VPC ID, but the template does not specify which VPC the resource belongs to. Without a VPC reference, CloudFormation cannot determine where to create the resource, causing stack creation to fail.
For example:
An EC2 instance in a VPC requires `SubnetId`, and the subnet itself belongs to a VPC.
An Elastic Network Interface (ENI) requires a `SubnetId`, which indirectly identifies the VPC.
A private DNS name assignment for resources such as network interfaces depends on VPC DNS settings.
CloudFormation needs the correct network context before provisioning such resources.
---
Why the other options are rejected
A) The Outputs section of the CloudFormation template was omitted.
❌ Incorrect
The `Outputs` section is optional.
Purpose of Outputs:
Displays useful information after stack creation.
Exposes values such as:
EC2 instance IDs
Load balancer DNS names
VPC IDs
Application URLs
A template can successfully create a stack without an `Outputs` section.
When Outputs are used:
When another stack needs to import values using `Export` and `Fn::ImportValue`.
When administrators need easy access to resource identifiers after deployment.
---
B) The Parameters section of the CloudFormation template was omitted.
❌ Incorrect
The `Parameters` section is also optional.
Purpose of Parameters:
Allows users to provide input values during stack creation.
Helps reuse templates for different environments.
Examples:
Choos...
Author: Maya · Last updated Jul 11, 2026
A company uses Amazon Route 53 with latency-based routing across multiple AWS Regions to provide resiliency. The company uses Route 53 with latency-based routing to direct traffic to the nearest Region. Within each Region, weighted A records distribute traffic across multiple Availability Zones.
During a recent update, some Availability Zone endpoints became unhealthy. Route 53 ...
Key requirement analysis
The issue is:
The company uses Route 53 latency-based routing to choose the AWS Region closest to users.
Inside each Region, weighted A records distribute traffic across Availability Zones.
During an update, some Availability Zone endpoints became unhealthy.
Route 53 continued sending traffic to those unhealthy endpoints.
The missing capability is health evaluation at the endpoint level. Route 53 routing policies do not automatically know whether an endpoint is unhealthy unless health checks are configured and associated with records.
Important AWS exam factor
Routing policy decides where traffic goes; health checks decide whether a destination is eligible to receive traffic.
Latency-based routing → chooses the lowest-latency Region.
Weighted routing → distributes traffic according to weights.
Health checks → remove unhealthy endpoints from DNS responses.
Therefore, to prevent future traffic being sent to unhealthy Availability Zone endpoints, the weighted records need health checks.
---
Option analysis
A) Add a Route 53 health check for each of the weighted records that received traffic during the recent update. ✅
Why it is correct:
Each weighted record represents an endpoint (for example, an Availability Zone endpoint).
Associating a Route 53 health check with each weighted record allows Route 53 to determine whether that endpoint is healthy.
If an endpoint fails the health check, Route 53 stops returning that record in DNS responses.
Traffic is automatically shifted to other healthy weighted endpoints.
Scenario where this option is used:
Use this when:
Multiple endpoints share traffic using weighted routing.
Some endpoints can fail independently.
You need automatic DNS failover away from unhealthy resources.
Example:
```
Region A
├── AZ-1 endpoint (Weight 50, Health Check: Healthy)
├── AZ-2 endpoint (Weight 50, Health Check: Failed)
Route 53 removes AZ-2 from responses and sends traffic only to AZ-1.
```
This directly addresses the problem.
---
B) Increase the weight of Route 53 records in the Region where traffic must go during updates. ❌
Why it is rejected:
Weight only controls traffic distribution percentage.
It does not check endpoint health.
An unhealthy endpoint with a higher weight can still receive traffic.
Example:
```
Endpoint A: Weight 80 (Unhealth...
Author: Layla · Last updated Jul 11, 2026
A company runs a business application on more than 300 Linux-based instances. Each instance has the AWS Systems Manager Agent (SSM Agent) installed. The company expects the number of instances to grow in the future. All business application instances have the same user-defined tag.
A CloudOps engineer wants to run a command on all the business application instances to download and install a package from a private repository. To avoid overwhel...
Key requirement analysis
The company needs to:
1. Run a command on all business application instances.
2. The instances are identified by a common user-defined tag.
3. The number of instances can increase in the future.
4. The package repository must not be overwhelmed.
5. No more than 30 downloads should happen at the same time.
6. The solution should be operationally efficient.
The important AWS feature here is AWS Systems Manager Run Command rate control.
---
Option analysis
A) Create 10 batches of 30 instances using a secondary tag and run each batch separately
Why it is not the best choice:
This requires manually creating and maintaining additional tags.
If the number of instances grows (for example, 500 or 1,000 instances), the engineer must create new batches and manage them.
It introduces operational overhead and does not dynamically handle scaling.
When this option can be used:
When you need strict manual grouping of servers, such as:
Production servers in waves.
Application migration phases.
Testing specific groups of instances.
However, it is not efficient for a growing fleet.
---
B) Use Lambda to run Run Command and set Lambda reserved concurrency to 30
Why it is rejected:
Lambda concurrency controls how many Lambda executions run simultaneously.
It does not control how many SSM commands execute concurrently on managed instances.
The Lambda function would still need custom logic to:
Retrieve instance IDs.
Split them into groups.
Handle failures and retries.
Manage execution timing.
This creates unnecessary complexity.
When this option can be used:
When you need custom automation logic before or after SSM execution.
Example:
Query a database.
Perform validation.
Trigger SSM commands conditionally.
But it is unnecessary for simple fleet-wide commands.
---
C) Use Systems Manager Run Command with rate control concurrency set to 30 and target instances by tag
✅ Correct answer
Systems Manager Run Command has built-in rate controls:
Concurrency controls how many instances execute the command at the same time.
Setting concurrency to 30 ensures that only 30 instances download the package simultaneously.
The target can be specified using the existi...
Author: Rohan · Last updated Jul 11, 2026
A company uses AWS Organizations to manage a set of AWS accounts. The company has set up organizational units (OUs) in the organization. An application OU supports various applications.
A CloudOps engineer must prevent users from launching Amazon EC2 instances that do not have a CostCenter-Project tag into any accoun...
Key factors to identify
1. The restriction must apply to multiple AWS accounts
The company uses AWS Organizations and wants the rule to apply to all accounts inside the application OU.
This points toward using an AWS Organizations Service Control Policy (SCP), because SCPs centrally control permissions across accounts.
2. The restriction must apply only to the application OU
The policy should not affect other OUs or accounts.
Therefore, the SCP should be attached at the application OU level, not the organization root.
3. The requirement is to prevent launching non-compliant resources
The company must prevent EC2 instances without the `CostCenter-Project` tag.
A deny-based SCP is appropriate because SCPs set permission guardrails and can override any IAM permissions within member accounts.
---
Option analysis
A) Create an IAM group that has a policy that allows the `ec2:RunInstances` action when the CostCenter-Project tag is present. Place all IAM users who need access to the application accounts in the IAM group.
❌ Rejected
Why:
IAM policies only apply to users, groups, or roles in a single AWS account.
AWS Organizations may contain many accounts, and managing IAM groups across every account is not a centralized solution.
This policy only allows tagged launches; it does not guarantee prevention because users may have other permissions that allow launching instances.
When this option is useful:
When controlling permissions for users inside one AWS account.
Example: Allow developers in one account to launch only tagged EC2 instances.
---
B) Create a service control policy (SCP) that denies the `ec2:RunInstances` action when the CostCenter-Project tag is missing. Attach the SCP to the application OU.
✅ Selected
Why:
SCPs are designed for AWS Organizations and apply across multiple accounts.
Attaching the SCP to the application OU ensures only accounts in that OU receive the restriction.
A deny SCP is effective because explic...
Author: Emily · Last updated Jul 11, 2026
A CloudOps engineer is troubleshooting an AWS CloudFormation stack creation that failed. Before the CloudOps engineer can identify the problem, the stack and its resources are deleted. For future deployments, the CloudOps engineer must preserve any resou...
Requirement:
The CloudOps engineer wants CloudFormation to keep any resources that were successfully created even when stack creation fails, so the engineer can inspect them and troubleshoot the failure.
The key concept is what CloudFormation does when stack creation fails:
By default, CloudFormation rolls back a failed stack creation.
During rollback, CloudFormation deletes the resources that were successfully created.
To preserve successfully created resources, the stack creation failure behavior must be changed to do nothing.
---
Option analysis
✅ B) Set the value of the `OnFailure` parameter to `DO_NOTHING` during stack creation.
Correct option.
Why?
The `OnFailure` parameter controls what CloudFormation does when stack creation fails.
Possible values:
ROLLBACK (default)
Deletes all resources created during the failed stack creation.
Used when you want automatic cleanup.
DELETE
Deletes the stack and its resources after failure.
DO_NOTHING
Leaves the failed stack and any successfully created resources in place.
Allows engineers to investigate the failure and fix the issue manually.
In this scenario:
> "The stack and its resources are deleted before the CloudOps engineer can identify the problem."
This indicates that rollback behavior is removing the evidence. Setting:
```
OnFailure = DO_NOTHING
```
prevents automatic cleanup and preserves created resources.
When to use this option:
Troubleshooting failed stack creations.
Development/testing environments.
When engineers need to inspect failed resources, logs, events, or configurations.
---
Why other options are rejected
❌ A) Set the value of the `DisableRollback` parameter to False during stack creation.
`DisableRollback` controls whether CloudFormation performs rollback after stack creation failure.
`DisableRollback = False` means rollback is enabled.
CloudFormation will delete successfully created resources after failure.
This produces the opposite behavior required.
Example:
```
DisableRollback = False
```
Failure...
Author: CrystalWolfX · Last updated Jul 11, 2026
A company is using an Amazon Aurora MySQL DB cluster that has point-in-time recovery, backtracking, and automatic backup enabled. A CloudOps engineer needs to be able to roll back the DB cluster to a specific recovery point within the previous 72 hours...
Correct Answer: C) Use backtracking to rewind the existing DB cluster to the desired recovery point.
Key factors in the scenario
Let's identify the important requirements:
| Requirement | Important clue |
| ------------------ | --------------------------------------------------------------- |
| Database engine | Amazon Aurora MySQL |
| Recovery window | Within the previous 72 hours |
| Restore location | Must be completed in the same production DB cluster |
| Available features | Point-in-time recovery, backtracking, automatic backups enabled |
The key phrase is:
> "Restores must be completed in the same production DB cluster."
This immediately points toward Aurora Backtracking, because it allows an Aurora MySQL cluster to be rewound to a previous state without creating a new cluster.
---
Option C — Use backtracking to rewind the existing DB cluster to the desired recovery point. ✅
Why this is correct
Aurora Backtracking allows an Aurora MySQL DB cluster to be moved backward to a specific point in time within the configured backtrack window.
Important exam factors:
Works on the existing Aurora DB cluster.
Does not create a new DB cluster.
Allows fast rollback after accidental changes, such as:
Incorrect data updates.
Accidental table deletion.
Application deployment errors.
Supports recovery within a configured window (maximum 72 hours for Aurora MySQL).
Example scenario:
> A developer accidentally runs an UPDATE statement that corrupts customer records at 10:00 AM. The CloudOps engineer wants the production Aurora cluster to return to 9:55 AM.
Backtracking can rewind the existing cluster to 9:55 AM.
Therefore, it satisfies both:
1. Recovery within 72 hours.
2. Restore into the same production cluster.
---
Why the other options are rejected
Option A — Create an Aurora Replica. Promote the replica to replace the primary DB instance. ❌
Why it is incorrect
An Aurora Replica is designed for:
Read scaling.
High availability.
Failover protection.
Promoting a replica:
Does not provide point-in-time rollback.
Only promotes the replica's current database state.
Does not rewind data to a previous time.
Example scenario where this option is useful:
> The primary Aurora instance fails because of a hardware issue. Promote an Aurora Replica to quickly restore database availability.
However, it cannot rec...
Author: Henry · Last updated Jul 11, 2026
A company is migrating a legacy application to AWS. The company manually installs and configures the legacy application on Amazon EC2 instances across multiple Availability Zones. The company sets up an Application Load Balancer (ALB) for the application. The company sets the target group routing algorithm to weighted random. The application requires session affinity.
After the company deploys the application, users report random application errors that were no...
Correct answer: A) Set the routing algorithm of the target group to least outstanding requests.
Key factors in the scenario
Let's identify the important clues:
1. Legacy application requires session affinity
Session affinity means a user's requests must consistently go to the same backend instance.
Legacy applications often store user session data locally on the server (for example, in memory) instead of using a shared session store like Amazon ElastiCache or a database.
2. ALB target group routing algorithm is set to weighted random
Weighted random routing distributes requests randomly among targets based on weights.
Random distribution can break session affinity because a user's requests may be sent to different EC2 instances.
If the application expects the user's session data to exist on one specific server, requests routed to another server can cause application errors.
3. Health checks show no failures
This indicates the EC2 instances and application endpoints are healthy.
The problem is not infrastructure availability; it is request routing behavior.
The solution should improve request consistency and reduce the chance of users being sent between instances.
---
Option analysis
A) Set the routing algorithm of the target group to least outstanding requests. ✅ Correct
Why this works:
The least outstanding requests algorithm routes new requests to the target with the fewest active requests.
Compared with weighted random, it provides more predictable distribution and avoids unnecessary random switching between targets.
It is better suited for applications where request processing time varies and where maintaining more consistent backend usage is important.
When to use this option:
Applications have uneven request processing times.
Some targets become overloaded while others are idle.
You need better request distribution than random routing.
Legacy applications may behave poorly when requests are spread unpredictably.
For session affinity, the application should ideally use ALB sticky sessions or an external session store. However, among the provided choices, changing from weighted random to least outstanding requests is the best available solution because it avoids random request distribution behavior.
---
B) Turn on anomaly mitigation for the target group. ❌ Incorrect
Why it is rejected:
Anomaly mitigation is designed to help with Automatic Target Weights (ATW) by detecting abnormal target behavior and reducing traffic to unhealthy-performin...
Author: ShadowWolf101 · Last updated Jul 11, 2026
A company's CloudOps engineer is troubleshooting communication between the components of an application. The company configured VPC flow logs to be published to Amazon CloudWatch Logs However, there are no logs in Cloud...
Correct answer: A) The IAM policy that is attached to the IAM role for the flow log is missing the `logs:CreateLogGroup` permission.
Reasoning (AWS exam approach)
The key clue is:
VPC Flow Logs are configured to publish to Amazon CloudWatch Logs
No logs appear in CloudWatch Logs
When VPC Flow Logs publish to CloudWatch Logs, AWS uses an IAM role to deliver the logs. That role must have permissions to create the required CloudWatch Logs resources and write log events.
The permissions typically required include:
`logs:CreateLogGroup`
`logs:CreateLogStream`
`logs:PutLogEvents`
If the role cannot create the log group (when it does not already exist), VPC Flow Logs cannot publish data, resulting in no logs appearing.
Why option A is correct
A) Missing `logs:CreateLogGroup` permission
✅ Correct.
When VPC Flow Logs are delivered to CloudWatch Logs, the service needs permissions to create and write to CloudWatch Logs resources. If the IAM role lacks `logs:CreateLogGroup`, the flow log delivery process can fail before logs are stored.
Key exam factor:
VPC Flow Logs → CloudWatch Logs requires IAM permissions.
Missing CloudWatch Logs permissions → no log delivery.
---
Why the other options are incorrect
B) Missing `logs:CreateExportTask` permission
❌ Incorrect.
`logs:CreateExportTask` is used for exporting existing CloudWatch Logs data to Amazon S3.
Example scenario:
You have application logs already stored in CloudWatch Logs.
You want to export them to S3 for long-term retention or analysis.
You use `CreateExportTask`.
It is not involved in publishing VPC Flow Logs to CloudWatch Logs.
Key exam factor:
Exporting logs out of CloudWatch → `CreateExportTask`
Sending logs into CloudWatch → `CreateLogGroup`, `CreateLogStream`, `PutLogEv...
Author: Kai · Last updated Jul 11, 2026
A company is storing backups in an Amazon S3 bucket. The backups must not be deleted for at least 3 months after the backups are created.
...
Requirement
Backups stored in an Amazon S3 bucket must not be deleted for at least 3 months after creation.
The key requirement is data immutability: even users with permissions should not be able to delete or modify the backups during the retention period.
AWS services/features related to this requirement:
S3 Object Lock → Provides Write Once Read Many (WORM) protection. Prevents deletion or modification for a defined retention period.
Compliance mode → No user, including the AWS account root user, can delete or shorten the retention period until it expires.
Governance mode → Protects objects from deletion, but users with special permissions (`s3:BypassGovernanceRetention`) can override the lock.
---
Option Analysis
A) Configure an IAM policy that denies the `s3:DeleteObject` action for all users. Three months after an object is written, remove the policy.
❌ Rejected
Why?
An IAM deny policy can prevent normal users from deleting objects, but it is not designed for long-term immutable backup protection.
Problems:
The policy must be manually removed after 3 months.
IAM policies control permissions, but they do not provide a true WORM retention mechanism.
Administrators with sufficient permissions could modify IAM policies and potentially delete objects.
It does not protect against accidental or intentional changes to the access control configuration.
When would this option be used?
Temporary restriction of delete permissions.
Preventing users from deleting resources during a migration or operational period.
Not suitable for compliance backup retention requirements.
---
B) Enable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3 bucket with a retention period of 3 months.
✅ Accepted
Why?
This exactly matches the requirement.
Key factors:
S3 Object Lock provides immutable storage.
Compliance mode ensures nobody can delete the object before the retention period expires.
The retention period can be set to 3 months when objects are created.
Even the AWS account root user cannot bypass compliance mode.
Commonly used for regulatory, legal, audit, and backup retention requirements.
Example scenario:
A company must retain financial records for a fixed period.
Backups must be protected from ransomware deletion.
Security teams require guaranteed immutability.
Important exam clue:
> "Must not be deleted for at least X months" → Think S3 Object Lock + Compliance mode.
---
...
Author: Amelia · Last updated Jul 11, 2026
An environment consists of 100 Amazon EC2 Windows instances. The Amazon CloudWatch agent is deployed and running on all EC2 instances with a baseline configuration file to capture log files. There is a new requirement to capture the DHCP log files th...
Question Summary
You have:
100 Amazon EC2 Windows instances
CloudWatch agent already installed and running
A baseline configuration file is already collecting logs
New requirement: Collect DHCP log files from only 50 instances
Need the MOST operationally efficient solution
The key requirement is to add extra log collection without disrupting the existing configuration and avoid manual changes on many instances.
---
Option Analysis
✅ A) Create an additional CloudWatch agent configuration file to capture the DHCP logs. Use AWS Systems Manager Run Command to restart the CloudWatch agent on each EC2 instance with the append-config option to apply the additional configuration file.
Why this is correct:
This is the most operationally efficient approach because:
1. Existing configuration is preserved
The EC2 instances already have a baseline CloudWatch agent configuration.
The `append-config` option allows adding new log collection settings without replacing the existing configuration.
2. Uses AWS Systems Manager Run Command
No need to manually log in to 50 Windows instances.
A single Systems Manager command can execute the configuration update remotely.
3. Targets only required instances
The DHCP logs exist on only 50 instances.
Systems Manager can target instances using tags, instance IDs, or resource groups.
4. Scalable and repeatable
This method works efficiently whether there are 50, 500, or more instances.
When to use this approach:
Use this when:
The CloudWatch agent is already deployed.
You need to add or modify monitoring/log collection settings.
You want to avoid replacing existing agent configurations.
You need centralized management across many EC2 instances.
---
Why Other Options Are Rejected
---
❌ B) Log in to each EC2 instance with administrator rights. Create a PowerShell script to push the needed baseline log files and DHCP log files to CloudWatch.
Why incorrect:
Requires manual access to each instance.
Does not use the existing CloudWatch agent deployment.
Creates operational overhead and increases the chance of configuration drift.
Managing scripts individually across 50 instances is inefficient.
When this approach could be used:
A small number...
Author: Leah Davis · Last updated Jul 11, 2026
A company is implementing Cross-Region Replication (CRR) for the company's Amazon S3 buckets. The S3 buckets are in the us-east-1 Region. The company uses server-side encryption with Amazon S3 managed keys (SSE-S3) to secure the data in the buckets.
A CloudOps engineer creates a new AWS account to store backups in S3 buckets. All backup buckets are in the us-west-2 Region. The CloudOps engineer enables versioning on the source buckets and the destination buckets. The CloudOps engineer creates an IAM role in the source account for s3.amazonaws.com. The CloudOps engineer grants the IAM role permissions to perform read actions in the source buckets, replicate actions in the destination buckets, and encrypt acti...
For this AWS exam question, the key factors are:
The source S3 buckets use SSE-S3 (Amazon S3 managed keys).
The replication is Cross-Region Replication (CRR) and the destination buckets are in a different AWS account.
The replication IAM role is granted permissions for:
Reading from the source bucket
Replicating to the destination bucket
Encrypting with the destination bucket’s key
The issue is related to encryption configuration during replication.
Option analysis
A) The IAM role and bucket policies must have the `ObjectOwnerOverrideToBucketOwner` permission.
Rejected.
`ObjectOwnerOverrideToBucketOwner` is not an IAM permission. It is a replication configuration setting used to make the destination bucket owner the owner of replicated objects.
This is useful in older cross-account replication scenarios where object ownership needs to be changed. However, it is not required for replication to work, and its absence would not prevent replication in this scenario.
Use this when:
You need the destination account to own replicated objects.
You are dealing with object ownership issues after replication.
---
B) The objects in the source buckets and destination buckets must be encrypted by multi-Region keys.
Rejected.
Multi-Region AWS KMS keys are not required for S3 CRR.
S3 replication supports:
SSE-S3
SSE-KMS
The source objects are encrypted using SSE-S3, which is supported. Multi-Region KMS keys are useful when applications need the same KMS key material available in multiple Regions, but they are not a requirement for S3 replication.
Use this when:
Applications need cross-Region KMS key consistency.
You are replicating KMS-encrypted data and want simplified key management.
---
C) Gateway VPC endpoints for Amazon S3 must be created in the source accou...
Author: David · Last updated Jul 11, 2026
An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The application takes up to 2 minutes to populate a local cache after the application is started. The application reports as healthy in the target group health check a few seconds after starting.
A CloudOps engineer observes that after some of the instances are rebooted, the instances receive an equal share of the traffic immediately after each ins...
Scenario Summary
Application runs on EC2 instances behind an Application Load Balancer (ALB).
When an instance starts, the application needs up to 2 minutes to populate a local cache.
The application reports healthy within a few seconds, even though the cache is not ready.
ALB immediately sends an equal share of traffic to newly healthy instances.
Requirement: Gradually increase traffic to newly started instances while the cache warms up.
The key AWS feature to recognize here is:
> ALB Target Group Slow Start Mode gradually increases the amount of traffic sent to newly registered targets.
---
Option A: Change `slow_start.duration_seconds` to 120 seconds and deregister/register instances
✅ Correct
Why this works
The ALB target group attribute:
```
slow_start.duration_seconds
```
enables slow start mode.
When a new target becomes healthy:
ALB does not immediately send the normal traffic share.
Instead, ALB gradually increases traffic sent to that target over the configured duration.
After the slow start period ends, the target receives its normal traffic distribution.
Setting:
```
slow_start.duration_seconds = 120
```
matches the application's cache warm-up time.
The required workflow:
1. Deregister instances before rebooting.
Prevents traffic being sent while they restart.
2. Reboot instances.
3. Register them again.
ALB treats them as new targets.
4. Slow start begins.
Traffic gradually increases during the 120 seconds while cache populates.
When to use ALB Slow Start
Use slow start when:
Applications need warm-up time.
Instances need to load:
local caches
application data
runtime optimizations
connection pools
You want to avoid overwhelming newly launched instances.
Example:
A Java application needs several minutes for JVM optimization.
A web application builds an in-memory cache after startup.
---
Option B: Change `HealthCheckTimeoutSeconds` to 120 seconds
❌ Incorrect
Why it is rejected
`HealthCheckTimeoutSeconds` controls:
How long ALB waits for a health check response before considering it failed.
It does not control:
Traffic distribution.
How quickly traffic increases.
Application warm-up time.
Increasing it to 120 seconds means:
> "Wait longer for a health check response."
It does not mean:
> "Wait 120 seconds before sending full traffic."
When to use health check timeout
Use this setting when:
The health endpoint itself is slow.
The application needs more time to respond to the health probe.
Example:
A `/health` endpoint takes 20 seconds because it checks dependencies.
It does not help with cache initialization.
---
Option C: CloudWatch alarm ...
Author: Daniel · Last updated Jul 11, 2026
A developer enables versioning on an Amazon S3 bucket. When the developer attempts to perform a write operation on the bucket, the developer encounters an HTTP 404 NoSuchKey error.
A Cloud...
Correct Answer: C) Wait at least 15 minutes after enabling versioning, and then perform the write operation.
Key AWS Concept: S3 Versioning Enablement Propagation Delay
When versioning is enabled on an Amazon S3 bucket, the change is not always immediately available across all S3 systems. There can be a short propagation delay (up to 15 minutes) before write operations behave normally.
During this period, attempts to write objects can fail with errors such as:
HTTP 404 NoSuchKey
Requests behaving as if the object/versioning state is not yet available
The recommended solution is to wait until the versioning configuration has fully propagated, then retry the write operation.
---
Option Analysis
✅ C) Wait at least 15 minutes after enabling versioning, and then perform the write operation.
Why this is correct:
Enabling S3 Versioning is an asynchronous operation internally.
S3 needs time to propagate the versioning state across the service.
Waiting allows the bucket to reach a consistent state before performing object writes.
This directly addresses the timing issue causing the `NoSuchKey` error.
When this option is used:
A bucket has just had versioning enabled.
Immediate write operations fail unexpectedly.
The error is related to S3 configuration propagation rather than permissions or networking.
---
Why Other Options Are Incorrect
❌ A) Disable versioning on the S3 bucket and retry the write operation.
Why it is rejected:
Disabling versioning does not fix the underlying issue.
The error is not caused by versioning itself being incompatible with writes.
S3 supports normal write operations on versioned buckets.
When disabling versioning is used:
When an application does not require object version history.
When reducing storage costs from retained object versions.
When a bucket lifecycle strategy requires versioning to be removed.
It is not a tr...
Author: Carlos Garcia · Last updated Jul 11, 2026
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company needs to send specific events from all the accounts in the organization to a new receiver account so an AWS Lambda function can process the events.
A CloudOps engineer needs to configure Amazon EventBridge to route the events to a target event bus in the us-west-2 Region in the new receiver account. The CloudOps engineer creates rules in the sender accounts and the receiver account that match the specified events. The rules do not specify an account parameter in the event pattern. The CloudOps engineer creates IAM roles in...
Key factors in the scenario
The company is using AWS Organizations with multiple AWS accounts.
Events originate from sender accounts and must be sent to a receiver account.
The target is an EventBridge event bus in the receiver account (`us-west-2`).
The sender accounts already have IAM roles that allow `events:PutEvents` to the target event bus.
The receiving account has rules that match the events.
The first test events originate from `us-east-1` and are not reaching Lambda.
The important EventBridge concepts for this question are:
1. Cross-account event bus delivery requires permissions on the target event bus.
2. EventBridge supports cross-Region event routing.
3. Rules on the receiving event bus do not need to specify the sender account unless filtering is required.
---
Option A: Interface VPC endpoints for EventBridge are required in the sender accounts and receiver accounts.
Rejected
Interface VPC endpoints are used when you need private connectivity from a VPC to AWS services without using public endpoints.
They are not required for EventBridge cross-account event delivery. EventBridge communicates through AWS service infrastructure, and cross-account routing does not depend on VPC endpoints.
When this option would apply:
A company requires private network access from resources inside a VPC to EventBridge APIs.
The environment has strict network controls preventing public AWS service endpoints.
It does not apply to this scenario because the issue is event bus authorization.
---
Option B: The target Lambda function is in a different AWS Region, which is not supported by EventBridge.
Rejected
EventBridge supports cross-Region event routing. A rule can send events to an event bus in another AWS Region.
The event flow can be:
```
Sender Account (us-east-1)
|
| PutEvents
↓
Receiver Account Event Bus (us-west-2)
|
| Rule target
↓
Lambda Function
```
The Region difference is not the cause.
When this option would apply:
If using a service that does not support cross-Region operation.
If the destination service specifically requires same-Region deployment.
EventBridge does not have this limitation.
---
Option C: The resource-based policy on the target event bus must be modified to allow PutEvents API calls from ...
Author: Maya · Last updated Jul 11, 2026
A company generates hundreds of images and uploads the images to an Amazon S3 bucket. The company manually copies the images to an always-on Amazon EC2 instance for processing. It usually takes between 30 seconds and 120 seconds to process each image.
A CloudOps engineer wants to automate the image processing solu...
Question Analysis
Requirements / key factors:
Images are uploaded to an Amazon S3 bucket.
Processing should start as soon as images arrive → event-driven architecture is preferred.
Processing time per image is 30–120 seconds.
The current EC2 instance is always running, but this is costly because processing is not continuous.
Need the most cost-effective solution.
Workload is short-lived, independent image processing tasks.
The best AWS service choice should:
1. Automatically trigger when an object is uploaded.
2. Avoid paying for idle compute.
3. Scale automatically with the number of images.
4. Be suitable for processing tasks lasting up to a few minutes.
---
Option A: S3 Event Notifications → Invoke EC2 instance
Why it might seem correct:
S3 can send event notifications when an image is uploaded.
The EC2 instance can process the image immediately.
Why it is rejected:
The EC2 instance must remain running all the time.
The company already has an always-on EC2 instance, which causes unnecessary costs when no images are being processed.
EC2 does not automatically scale based on image upload volume unless additional architecture is added (Auto Scaling, queues, etc.).
When this option is useful:
When processing requires:
A long-running application.
Custom software installed on the server.
Persistent state.
Specialized hardware (for example, GPU workloads).
Example: A video rendering server that continuously runs a custom application.
---
Option B: S3 Event Notifications → EventBridge → AWS Glue ETL job
Why it might seem correct:
EventBridge can react to S3 events.
AWS Glue can perform data processing.
Why it is rejected:
AWS Glue is designed for large-scale data transformation and ETL workloads, such as:
Data lake processing.
Data cleaning.
Batch analytics.
Transforming large datasets.
Processing individual images that take only 30–120 seconds is not a good fit.
Glue startup time and pricing make it inefficient for simple image processing.
When this option is useful:
When processing large amounts of structured/semi-structured data.
Example:
Reading CSV files from S3.
Transforming data.
Loading results into a data warehouse.
---
Option C: S3 Event Notifications → AWS Lambda → Image processing logic
Why it is correct:
S3 can directly trigger Lambda when a new object is uploaded.
Lambda runs only when processing is required.
No server n...
Author: Ava · Last updated Jul 11, 2026
A CloudOps engineer is using AWS Compute Optimizer to generate recommendations for a fleet of Amazon EC2 instances. Some of the instances use newly released instance types, while other instances use older instance types.
After the analysis is complete, the CloudOps engineer notices ...
Correct answer: A) The missing instances have insufficient historical Amazon CloudWatch metric data for analysis.
Key reasoning
AWS Compute Optimizer generates EC2 recommendations by analyzing historical utilization metrics from Amazon CloudWatch, such as:
CPU utilization
Network utilization
Disk I/O (where applicable)
Memory utilization (if the CloudWatch agent is configured)
For an EC2 instance to appear in Compute Optimizer recommendations, AWS needs enough historical performance data. If an instance is newly launched, recently resized, or does not have enough collected metrics, Compute Optimizer cannot evaluate it and therefore does not display recommendations for that instance.
In this scenario:
Some instances use newly released instance types.
Some instances use older instance types.
Some instances are missing from the dashboard.
The important clue is that the missing instances are not necessarily unsupported. The issue is most likely that Compute Optimizer does not have enough historical CloudWatch data to generate a recommendation.
---
Why the other options are rejected
B) Compute Optimizer does not support the instance types of the missing instances.
❌ Incorrect
Compute Optimizer supports a broad range of Amazon EC2 instance types. Newly released instance types may not immediately have optimization recommendations available, but the exam focus here is usually on data requirements, not instance age.
When this option would be correct:
The EC2 instance family is explicitly listed as unsupported by Compute Optimizer.
The workload uses a specialized or unsupported configuration.
Example:
An instance type outside Compute Optimizer's supported EC2 scope would not receive recommendations.
Why it does not fit:
The questi...
Author: Julian · Last updated Jul 11, 2026
A company uses hundreds of Amazon EC2 On-Demand Instances and Spot Instances to run production and non-production workloads. The company installs and configures the AWS Systems Manager Agent (SSM Agent) on the EC2 instances.
During a recent instance patch operation, some instances were not patched because the instances were either busy or down. The company needs to ...
Requirement analysis
The company needs to:
Get the current patch version of all EC2 instances.
Include instances that may have been:
Busy during the patch operation.
Offline/down during the patch operation.
Generate a report in an operationally efficient way.
The instances already have SSM Agent installed and configured.
The key AWS exam clue is: "current patch version of all instances" rather than "which instances failed patching." This points toward Systems Manager Inventory, which continuously collects instance metadata, including installed applications and patch information.
---
Option A — Use Systems Manager Inventory to collect patch versions. Generate a report of all instances.
✅ Correct option
Why this works
AWS Systems Manager Inventory collects metadata from managed instances through the SSM Agent. It can collect:
Installed applications.
OS information.
Network configuration.
Windows updates.
Patch details.
The inventory data is stored centrally and can be queried to generate reports.
Why it is operationally efficient
No need to manually run commands on hundreds of instances.
Works across:
EC2 On-Demand Instances.
EC2 Spot Instances.
Production and non-production environments.
Provides a historical and current view of instance state.
Does not require instances to be actively running at the time of report generation if inventory data was previously collected.
When to use Systems Manager Inventory
Use Inventory when you need:
A fleet-wide view of instance configuration.
Installed software versions.
OS details.
Patch versions.
Compliance reporting based on collected metadata.
Example:
> "List the current OS patch level of 10,000 EC2 instances."
Systems Manager Inventory is designed for this.
---
Option B — Use Systems Manager Run Command to remotely collect patch version information. Generate a report of all instances.
❌ Incorrect
Why it is rejected
Run Command executes commands on managed instances at a specific point in time.
For example:
Run `rpm -qa` on Linux.
Run PowerShell commands to list Windows patches.
However, this has operational limitations:
Requires contacting every instance individually.
Instances that are:
Stopped.
Unavailable.
Busy.
may fail to return results.
The question specifically states:
> Some instances were not patched because they were either busy or down.
This hints that the company needs a solution that does not depend on executing commands immediately against every instance.
When to use Run Command
Use Run Command when you need:...
Author: Sara · Last updated Jul 11, 2026
A multinational company uses an organization in AWS Organizations to manage over 200 member accounts across multiple AWS Regions. The company must ensure that all AWS resources meet specific security requirements.
The company must not deploy any EC2 instances in the ap-southeast-2 Region. The company must completely block root user actions in all member accounts. The company must prevent any user from deleting AWS CloudTrail logs, including a...
Correct answer: C) Use AWS Control Tower for account governance. Configure Region deny controls. Use service control policies (SCPs) to restrict root user access.
Key factors in the question
This scenario has three important requirements:
1. Centrally manage security across 200+ AWS accounts
The solution must apply automatically to existing and future accounts.
This points toward AWS Organizations features, especially Service Control Policies (SCPs) and AWS Control Tower.
2. Prevent EC2 deployments in one Region (`ap-southeast-2`)
This is an organization-level restriction.
The correct AWS feature is a Region deny control (implemented through SCPs).
3. Completely block root user actions in member accounts
IAM policies and permissions boundaries cannot restrict the AWS account root user.
SCPs can restrict root user actions because SCPs apply to the entire account, including the root user.
4. Prevent deletion of CloudTrail logs, even by administrators
Administrators have IAM permissions, but SCPs can create a higher-level organization guardrail that prevents actions such as deleting CloudTrail trails or modifying log storage protections.
---
Why option C is correct
AWS Control Tower
AWS Control Tower provides centralized governance for multi-account environments.
It can:
Automatically apply governance controls to existing accounts.
Automatically apply controls to newly created accounts.
Use preventive guardrails based on SCPs.
Provide a standardized landing zone for large AWS Organizations environments.
For a company managing 200+ accounts, Control Tower is designed exactly for this type of centralized governance.
Region deny controls
A Region deny control prevents AWS services from being used in unwanted Regions.
Example:
Block all actions in `ap-southeast-2`.
Allow workloads only in approved Regions.
This is much stronger than detecting deployments after they happen.
SCPs for root user restrictions
SCPs can deny sensitive actions regardless of:
IAM administrator permissions.
IAM policies.
Permissions granted to users or roles.
Example:
Deny CloudTrail deletion.
Deny disabling security services.
Deny modifying logging configurations.
This satisfies the requirement that even administrators cannot delete CloudTrail logs.
---
Why the other options are rejected
---
A) Create AWS Config rules with remediation actions in each account. Implement IAM permissions boundaries for account root users.
Why it is incorrect
AWS Config is detective, not preventive
AWS Config rules:
Detect compliance issues.
Can trigger remediation.
Do not prevent a user from performing an action initially.
Example:
A user creates an EC2 instance in `ap-southeast-2`.
AWS Config detects it later.
Remediation deletes or modifies it.
The requirement says:
> "The company must not deploy any EC2 instances in the ap-southeast-2 Region."
This requires prevention, not detection.
Permissions boundaries cannot apply to root users
AWS account root users:
Are not IAM users.
Cannot have permissions boundaries at...
Author: RadiantJaguar56 · Last updated Jul 11, 2026
A company uses memory-optimized Amazon EC2 instances behind a Network Load Balancer (NLB) to run an application. The company launched the EC2 instances from an AWS provided Red Hat Enterprise Linux (RHEL) Amazon Machine Image (AMI).
A CloudOps engineer must monitor RAM utilization in 5-minute intervals. The CloudOps engin...
Key requirements from the question
1. Monitor RAM utilization
EC2 default monitoring does not provide memory utilization metrics.
Amazon CloudWatch provides default EC2 metrics such as:
CPU utilization
Network traffic
Disk activity (limited)
RAM utilization requires the CloudWatch Agent installed inside the instance.
2. Monitor every 5 minutes
Basic EC2 monitoring provides metrics at 5-minute intervals.
Detailed monitoring provides metrics at 1-minute intervals.
Since the requirement is only 5-minute intervals, basic monitoring is sufficient.
3. Auto Scaling based on RAM utilization
EC2 Auto Scaling policies can use CloudWatch metrics.
The memory metric must first be published by the CloudWatch Agent.
The CloudWatch Agent requires an IAM role/instance profile with permissions to send metrics to CloudWatch.
4. Instances are launched from AWS-provided RHEL AMI
The CloudWatch Agent is not automatically installed or configured.
It must be installed and configured manually.
---
Option analysis
A) Configure detailed monitoring. Configure CloudWatch agent. Create Auto Scaling policy based on mem_active.
❌ Rejected
Why:
Detailed monitoring is unnecessary because the requirement is only 5-minute intervals. Basic monitoring already meets this.
`mem_active` is not the typical metric used for scaling based on RAM percentage.
Scaling should normally use a percentage-based metric such as `mem_used_percent`.
When this option could be used:
Detailed monitoring is useful when:
You need EC2 metrics every 1 minute.
You need faster scaling response.
`mem_active` may be useful for memory analysis, but it is not the best metric for capacity-based scaling.
---
B) Configure detailed monitoring. Use the mem_used_percent metric that detailed monitoring provides. Create IAM role for CloudWatch agent.
❌ Rejected
Why:
The assumption is incorrect: EC2 detailed monitoring does not provide memory metrics.
Detailed monitoring only changes the frequency of EC2-provided metrics.
Memory metrics are not available unless the CloudWatch Agent collects and publishes them.
Key exam point:
> EC2 detailed monitoring ≠ memory monitoring.
Detailed monitoring provides more frequent versions of ex...
Author: Ming88 · Last updated Jul 11, 2026
A financial services company stores customer images in an Amazon S3 bucket in the us-east-1 Region. To comply with regulations, the company must ensure that all existing objects are replicated to an S3 bucket in a second AWS Region. If an object replication fai...
Key requirement analysis
The company needs to:
1. Replicate all existing objects in an S3 bucket to another AWS Region.
2. Retry replication for objects that failed replication.
The important AWS exam keywords are:
Existing objects → Standard S3 Cross-Region Replication (CRR) only replicates new objects after replication is enabled. For existing objects, use S3 Batch Replication.
Retry failed replication → S3 Batch Replication can be run again to retry replication of specific objects or failed objects.
---
Option analysis
A) Configure Amazon S3 Cross-Region Replication (CRR). Use Amazon S3 live replication to replicate existing objects.
❌ Rejected
Why:
S3 live replication (normal CRR behavior) replicates new objects and updates after the replication configuration is enabled.
It does not replicate objects that already existed in the source bucket before CRR was configured.
It also does not provide a mechanism to reprocess existing failed objects.
When this option is used:
When the requirement is to continuously replicate new objects from one Region to another.
Example: A company uploads new customer documents to S3 and wants automatic replication going forward.
---
B) Configure Amazon S3 Cross-Region Replication (CRR). Use S3 Batch Replication to replicate existing objects.
✅ Accepted
Why:
S3 CRR provides the replication configuration between the source and destination buckets in different AWS Regions.
S3 Batch Replication is designed specifically to replicate existing objects that were created before replication was enabled.
It can also be used to retry replication for objects that previously failed replication.
It works with S3 Batch Operations and allows administrators to select objects through:
S3 Inventory reports
Object lists
Other object selection methods
When this option is used:
Migrating existing S3 data to another Region.
Meeting compliance requirements that require all historical objects to exist in another Region.
Reprocessing failed replication attempts.
...
Author: ThunderBear · Last updated Jul 11, 2026
A CloudOps engineer has an AWS CloudFormation template of the company's existing infrastructure in us-west-2. The CloudOps engineer attempts to use the template to launch a new stack in eu-west-1, but the stack only partially deploys, ...
Correct options: B and C
Reasoning key factors
When moving an AWS CloudFormation template from one AWS Region to another, remember:
1. CloudFormation templates are Region-specific when they reference regional resources.
2. The resources created by CloudFormation must exist and be available in the target Region.
3. The IAM identity executing CloudFormation must have permissions to create all requested resources.
The stack partially deployed and then rolled back, which usually indicates CloudFormation successfully created some resources but failed when it reached a resource that could not be created.
---
✅ B) The template referenced an Amazon Machine Image (AMI) that is not available in eu-west-1.
Selected
Why this is correct:
AMI IDs are Region-specific.
Example:
An AMI ID from us-west-2:
`ami-0123456789abcdef0`
The same AMI ID does not automatically exist in eu-west-1.
If the template contains an EC2 instance resource like:
```yaml
ImageId: ami-xxxxxxxx
```
that AMI must exist in the target Region.
When CloudFormation tries to launch the EC2 instance in eu-west-1, it cannot find the AMI, causing deployment failure and rollback.
Key exam clue:
"Using an existing CloudFormation template in another Region" + "EC2 resources" → check AMI availability.
When this option applies:
Migrating EC2 infrastructure between Regions.
Using hardcoded AMI IDs in templates.
Deploying templates containing EC2, Auto Scaling launch templates, or launch configurations.
---
✅ C) The template did not have the proper level of permissions to deploy the resources.
Selected
Why this is correct:
CloudFormation uses the permissions of the user/role that creates the stack (unless a service role is specified).
Example:
A template creates:
EC2 instances
VPCs
IAM roles
S3 buckets
but the CloudOps engineer's IAM role lacks:
`ec2:RunInstances`
`iam:CreateRole`
`s3:CreateBucket`
CloudFormation can create some resources, then fail when it reaches a resource requiring missing permissions. The stack enters a failed state and rolls back.
Key exam clue:
"Partially deploys, then rolls back" often indicates a permissions issue.
When this option applies:
The deployment user has insufficient IAM permissions.
A CloudFormation service role i...
Author: Ravi Patel · Last updated Jul 11, 2026
A CloudOps engineer needs to build an event infrastructure for a set of custom application-specific events. The events must be sent to an AWS Lambda function for processing. The CloudOps engineer must record the even...
Requirement analysis (AWS exam reasoning)
The key requirements are:
1. Custom application-specific events
The application is generating its own events (not AWS service events).
Amazon EventBridge supports custom events through a custom event bus.
2. Send events to AWS Lambda for processing
EventBridge rules can match events and invoke Lambda targets.
3. Record events for future replay
EventBridge provides event archives.
Archives allow storing events and replaying them later.
Replay can be filtered by:
Event type / event pattern
Time range
The solution should therefore use:
Custom event bus → receives custom events
Archive → stores events for replay
Rule → routes events to Lambda
---
Option A
Create an Amazon EventBridge custom event bus. Create an archive on the custom event bus. Create a rule to send the custom events to the Lambda function.
Why this is correct
A custom application publishes events to EventBridge using a custom event bus.
Architecture:
```
Application
|
v
EventBridge Custom Event Bus
|
+--> Archive (store events for replay)
|
+--> Rule
|
v
Lambda
```
Key factors:
Custom event bus is designed for application-generated events.
EventBridge archives store events from an event bus.
Archived events can later be replayed:
By event pattern (for example, event type)
By time window
EventBridge rules can invoke Lambda.
This exactly satisfies all requirements.
---
Option B
Create an archive on the Amazon EventBridge default event bus. Use pattern matching to record the custom events. Create a rule to send the custom events to the Lambda function.
Why this is rejected
The default event bus is primarily intended for:
AWS service events
Events from AWS accounts
Example:
```
EC2 state change
CloudTrail event
Auto Scaling event
```
Although custom events can technically be sent to the default event bus, it is not the recommended architecture when building infrastructure for application-specific events.
The issue is the wording:
> "custom application-specific events"
AWS exam questions usually expect a custom event bus for application events because it provides:
Separation between application events and AWS service events
Better event organization
Easier access control
Cleaner event routing
Also, an archive does not need pattern matching to record events. EventBridge archives already support event pattern filtering during archive creation.
When the default event bus is appropriate:
An application wants to consume AWS generated events.
Example: Trigger Lambda when an EC2 instance...
Author: Rohan · Last updated Jul 11, 2026
A CloudOps engineer creates a new VPC that includes a public subnet and a private subnet. The CloudOps engineer successfully launches 11 Amazon EC2 instances in the private subnet The CloudOps engineer attempts to launch one more EC2 instance in the same subnet. However, the CloudOps engineer receives an error ...
Correct answer: D) Create a new private subnet to hold the required EC2 instances.
Key factors in reasoning
The error message says:
> "Not enough free IP addresses are available"
This indicates an IP address exhaustion problem inside the subnet.
In AWS, every subnet is associated with a CIDR block that determines the number of available private IP addresses. AWS reserves 5 IP addresses in every subnet:
1. Network address
2. VPC router address
3. DNS address
4. Future AWS use
5. Broadcast address (not used, but reserved)
So a subnet does not provide the full CIDR range for EC2 instances.
Example:
A /28 subnet has 16 total IP addresses.
AWS reserves 5.
Available for EC2 = 11 IP addresses.
The CloudOps engineer launched 11 EC2 instances successfully, then the 12th instance failed. This strongly indicates that the subnet has exhausted all available IP addresses.
The solution is to provide more subnet IP capacity.
---
Option analysis
A) Edit the private subnet to change the CIDR block to /27. ❌ Incorrect
Why rejected:
AWS does not allow you to change the CIDR block size of an existing subnet after creation.
A subnet CIDR cannot be expanded from something like `/28` to `/27`.
Example:
Existing subnet: `10.0.1.0/28`
Desired change: `10.0.1.0/27`
This is not supported.
When would a larger CIDR help?
When creating a new subnet, selecting a larger CIDR block provides more available IP addresses.
Example:
`/24` → 251 usable IP addresses
`/27` → 27 usable IP addresses
But you cannot resize the existing subnet.
---
B) Edit the private subnet to extend across a second Availability Zone. ❌ Incorrect
Why rejected:
A subnet exists in one Availability Zone only.
You cannot extend an existing subnet across multiple Availability Zones.
AWS networking design:
VPC → spans multiple AZs
Subnet → belongs to one AZ
If you need resources in another AZ, you create another subnet in that AZ.
When is this option useful...
Author: Victoria · Last updated Jul 11, 2026
A company runs an application on Amazon EC2 instances that are in an Amazon EC2 Auto Scaling group. Scale-out actions take a long time to become complete because of long-running boot scripts. A CloudOps engineer must implement a solution to reduce the required time f...
Correct answer: D) Add a warm pool to the Auto Scaling group
Key requirement analysis
The important clues in the question are:
1. EC2 Auto Scaling group
2. Scale-out actions take a long time
3. The delay is caused by long-running boot scripts
4. Need to reduce scale-out completion time
5. Must avoid overprovisioning
The bottleneck is not instance capacity; it is the time required to launch and configure new instances. When Auto Scaling launches a new EC2 instance, it must wait for:
Instance provisioning
Operating system initialization
Application installation/configuration
Boot scripts/user data execution
Application readiness
A solution is needed that keeps instances partially or fully initialized so they can be added quickly during scale-out.
---
Option analysis
A) Change the launch configuration to use a larger instance size ❌
Why it is rejected:
Increasing instance size (for example, moving from `t3.medium` to `m7i.large`) provides:
More CPU
More memory
Higher instance capacity
However, it does not reduce the boot time.
The instance still has to:
Launch
Run boot scripts
Install/configure applications
Become healthy
This option solves performance bottlenecks after launch, not slow scale-out provisioning.
When this option is useful:
Use larger instances when:
Existing instances are CPU/memory constrained
Applications need more resources per instance
Scaling out many small instances is inefficient
Example:
> A database application is running out of memory on existing EC2 instances. Increasing instance size is appropriate.
---
B) Increase the minimum number of instances in the Auto Scaling group ❌
Why it is rejected:
Increasing the minimum capacity keeps more instances running permanently.
Example:
Current:
```
Min: 2
Desired: 2
Max: 20
```
Change to:
```
Min: 10
Desired: 10
Max: 20
```
This reduces the chance of needing scale-out because more instances already exist, but it causes:
Higher EC2 costs
Resource wastage during low traffic periods
Overprovisioning
The requirement explicitly says:
> "without overprovisioning the Auto Scaling group"
Therefore, this option is not suitable.
When this option is useful:
Use a higher minimum capacity when:
The application always requires a baseline number of instances
Traffic never drops below a certain level
Cost is less important than guaranteed availability
Example:
> A banking application must always run at least 20 application servers.
---
C) Add a predictive scaling policy to the Auto Scaling group ❌
Why it is rejected:
Predictive scaling uses historical traffic patterns to forecast future demand and la...
Author: Ethan · Last updated Jul 11, 2026
A CloudOps engineer wants to provide access to AWS services by attaching an IAM policy to multiple IAM users The CloudOps engineer also wants to be able to change the policy and create new v...
Question Summary
A CloudOps engineer needs to:
1. Provide access to AWS services for multiple IAM users.
2. Be able to change the policy.
3. Be able to create new policy versions.
We need to choose two actions.
---
Key AWS IAM Concepts
1. Policies for multiple users
If the same permissions must be assigned to multiple IAM users, the best practice is to avoid attaching policies individually. Instead:
Put users into an IAM user group.
Attach a policy to the group.
This provides centralized permission management.
2. Policy modification and versions
Only managed policies support policy versioning.
Managed policies can be:
AWS managed policies → Created and maintained by AWS. You cannot edit them or create custom versions.
Customer managed policies → Created and controlled by your organization. You can edit them and create new versions.
Inline policies do not support versioning.
---
Option Analysis
A) Add the users to an IAM service-linked role. Attach the policy to the role.
❌ Rejected
Why?
A service-linked role is a special IAM role created for AWS services to perform actions on your behalf.
Example use cases:
Amazon EC2 Auto Scaling service using a service-linked role.
AWS Config using a service-linked role.
It is not designed for granting permissions to IAM users.
When would this option be used?
Use service-linked roles when:
An AWS service requires permissions to operate resources automatically.
AWS creates and manages the role.
Example:
> Allowing Amazon ECS to manage load balancers using its service-linked role.
---
B) Add the users to an IAM user group. Attach the policy to the group.
✅ Selected
Why?
IAM groups allow you to manage permissions for multiple users together.
Example:
```
IAM Group: CloudOps-Team
Users:
- Alice
- Bob
- Charlie
Attached Policy:
- Permissions to manage AWS services
```
Any user added to the group automatically receives the permissions.
Key factor:
Best practice for multiple users.
Centralized access management.
Easier auditing and permission changes.
When would this option be used?
Use IAM groups when:
Several IAM users require the same permissions.
Administrators want to manage permissions collectively.
Example:
> All developers need read access to S3 and CloudWatch.
---
C) Create an AWS managed policy.
❌ ...
Author: IronLion88 · Last updated Jul 11, 2026
An errant process is known to use an entire processor and run at 100%. A CloudOps engineer wants to automate restarting an Amazon EC2 instance when the pro...
Key requirement analysis
The requirement is:
A process on an Amazon EC2 instance consumes 100% CPU.
The restart should happen automatically.
It should happen only when the problem persists for more than 2 minutes.
The solution should use AWS native monitoring and remediation.
The key factors are:
1. CPU utilization must be monitored.
2. The monitoring must detect sustained high CPU usage for a specific period (2 minutes).
3. The action must restart the EC2 instance automatically.
4. The solution should be event-driven, not based on fixed schedules.
---
Option A: Create an Amazon CloudWatch alarm with basic monitoring and add an action to restart the instance.
Why this is a possible consideration:
Amazon CloudWatch can monitor EC2 CPU utilization and trigger EC2 actions such as:
Stop instance
Terminate instance
Recover instance (for certain failures)
However, basic monitoring is collected at 5-minute intervals.
Why it is rejected:
The requirement is to restart the instance when CPU usage remains at 100% for more than 2 minutes.
With basic monitoring:
Metrics arrive every 5 minutes.
CloudWatch cannot reliably evaluate a 2-minute condition.
The alarm may detect the problem too late.
When basic monitoring is used:
Basic monitoring is suitable when:
Cost optimization is important.
Five-minute granularity is acceptable.
The application does not require fast detection.
Example:
Monitoring a development server where occasional delays are acceptable.
---
Option B: Create an Amazon CloudWatch alarm with detailed monitoring and add an action to restart the instance.
Why this is correct:
Detailed monitoring provides EC2 metrics at 1-minute intervals.
This allows CloudWatch to:
1. Collect CPU utilization every minute.
2. Evaluate whether CPU remains above a threshold.
3. Trigger an alarm after the configured duration (for example, 2 consecutive minutes).
4. Execute the EC2 restart action automatically.
Example configuration:
Metric: `CPUUtilization`
Threshold: `>= 100%` (or a suitable high CPU threshold)
Period: 1 minute
Evaluation periods: 2
Alarm action: Restart EC2 instance
Why this matches the requirement:
Uses CloudWatch for monitoring.
Detects sustained CPU problems.
Does not require custom code.
Provides automatic remediation.
When detailed monitoring is used:
Detailed monitoring is appropriate when:
Faster detection is required.
Auto scaling or remediation decisions depend on recent metrics.
Production workloads require quicker response.
Example:
Web servers where high CPU must be handled quickly.
---
Option C: Create an AWS Lam...
Author: Joseph · Last updated Jul 11, 2026
A CloudOps engineer is maintaining a web application using an Amazon CloudFront web distribution, an Application Load Balancer (ALB), Amazon RDS, and Amazon EC2 in a VPC. All services have logging enabled. The CloudOps engineer needs to investigate HT...
Question focus: HTTP Layer 7 status codes
The key phrase is "HTTP Layer 7 status codes".
Layer 7 status codes are application-level HTTP responses such as:
200 OK
301 Redirect
403 Forbidden
404 Not Found
500 Internal Server Error
The logs must be from services that process HTTP requests and responses. Network-level logs or infrastructure audit logs will not contain HTTP response codes.
---
Option analysis
A) VPC Flow Logs ❌ Reject
Why rejected:
VPC Flow Logs operate at Layer 3/Layer 4 (network layer).
They record information such as:
Source IP
Destination IP
Source/destination ports
Protocol
ACCEPT/REJECT action
Bytes and packets transferred
They do not inspect HTTP traffic and cannot see HTTP status codes like 200 or 404.
When to use VPC Flow Logs:
Troubleshooting network connectivity issues.
Investigating security group or NACL problems.
Finding rejected traffic between resources.
Example:
"Why can't my EC2 instance connect to RDS on port 3306?"
VPC Flow Logs can show rejected TCP traffic.
---
B) AWS CloudTrail logs ❌ Reject
Why rejected:
CloudTrail records AWS API activity, not application traffic.
It logs actions such as:
Creating an EC2 instance
Modifying a security group
Updating an RDS configuration
Creating a CloudFront distribution
It does not log user HTTP requests to the application or HTTP response codes.
When to use CloudTrail:
Auditing who changed an AWS resource.
Tracking administrative actions.
Investigating unauthorized AWS API activity.
Example:
"Who deleted this security group?"
CloudTrail provides the answer.
---
C) ALB access logs ✅ Select
Why selected:
An Application Load Balancer operates at Layer 7.
ALB access logs capture HTTP/HTTPS request details, including:
Request URL
Client IP
Target response code
Load balancer response code
Processing time
Request method
Examples of captured status codes:
200 → Successful request
404 → Resource not found
502 → Bad gateway from target
When to use ALB access logs:
Investigating application errors behind an ALB.
Finding unhealthy targets.
Analyzing HTTP request patterns.
Example:
"Users are receiving 502 errors. Is the ALB or EC2 instance returning ...
Author: Ming88 · Last updated Jul 11, 2026
A company's security policy requires incoming SSH traffic to be restricted to a defined set of addresses. The company is using an AWS Config rule to check whether security groups allow unrestricted incoming SSH traffic.
A CloudOps engineer discovers a noncompliant resource and fixes the security group manually. The CloudOps engineer wa...
Question Summary
The company already uses AWS Config to detect security groups that allow unrestricted inbound SSH access (0.0.0.0/0 on port 22). A CloudOps engineer manually fixed one violation and now wants to automate remediation for future noncompliant resources.
The requirement is:
Automatically remediate AWS Config violations.
Use the most operationally efficient AWS-native solution.
Avoid unnecessary custom code and maintenance.
---
Key AWS Concepts
AWS Config Rules
AWS Config evaluates resources against compliance rules.
When a resource becomes noncompliant, AWS Config can trigger automatic remediation actions.
AWS provides managed remediation actions for common security issues.
AWS Config Automatic Remediation
Allows AWS Config to automatically run an action when a rule reports NON_COMPLIANT.
Can use:
AWS Systems Manager Automation documents (including AWS managed ones).
Custom remediation documents.
For this scenario, AWS already provides a managed remediation action:
`AWS-DisableIncomingSSHOnPort22`
It removes unrestricted SSH access from a security group.
---
Option Analysis
A) Create a CloudWatch alarm for the AWS Config rule status metric. Create a Lambda function to remove the noncompliant rule. Configure the alarm action to invoke Lambda.
Why it is not the best choice
This approach works technically, but it is inefficient.
Problems:
AWS Config already knows when a resource is noncompliant.
Creating CloudWatch alarms adds unnecessary components.
Requires custom Lambda code.
Requires maintaining Lambda permissions, code, and error handling.
When this approach can be used
Use this pattern when:
No AWS Config remediation action exists.
A custom remediation workflow is required.
Multiple services need to be coordinated after a compliance event.
Example:
A violation requires updating a ticket system, notifying teams, and modifying several resources.
Rejected because AWS Config has a built-in remediation option.
---
B) Configure an automatic remediation action on the AWS Config rule. Specify `AWS-DisableIncomingSSHOnPort22`.
Why this is correct
This is the most operationally efficient solution.
Advantages:
Native AWS Config capability.
No custom Lambda code.
No additional monitoring infrastructure.
Automatically runs whenever the Config rule detects a violation.
Uses an AWS-managed Systems Manager Automation document.
Reduces operational overhead.
The workflow becomes:
1. AWS Config evaluates the security group.
2. Rule detects unrestricted SSH access.
3. Resource becomes NON_COMPLIANT.
4. AWS Config automatically executes:
`AWS-DisableIncomingSSHOnPort22`
5. The inbound SSH rule is removed.
When this option should be used
...
Author: RadiantPhoenixX · Last updated Jul 11, 2026
A company deploys AWS infrastructure in a VPC that has an internet gateway. The VPC has public subnets and private subnets. An Amazon RDS for MySQL DB instance is deployed in a private subnet. An AWS Lambda function uses the same private subnet and connects to the DB instance to query data.
A developer modifies the Lambda function to require the function to publish messages to an Amazon Simple Queue Service (...
Key concept tested: Lambda in a private subnet accessing AWS services
The Lambda function is deployed inside a private subnet because it needs to access the RDS MySQL database. When a Lambda function is connected to a VPC, it no longer has automatic internet access.
The Lambda function can still access resources inside the VPC (such as RDS), but when it tries to send messages to Amazon SQS, it needs a network path to the SQS service.
There are two common solutions:
1. Give the private subnet outbound internet access through a NAT Gateway.
2. Use a VPC endpoint to privately access AWS services without internet.
---
Option C: Deploy a NAT gateway. Update the private subnet's route table to route all traffic to the NAT gateway. ✅ Selected
Why it works:
A Lambda function inside a private subnet cannot directly reach public AWS service endpoints.
A NAT Gateway allows resources in private subnets to initiate outbound connections to AWS public endpoints, including SQS.
The route table of the private subnet must send internet-bound traffic (`0.0.0.0/0`) to the NAT Gateway.
The NAT Gateway itself must be deployed in a public subnet with a route to the Internet Gateway.
Scenario where this option is used:
Use a NAT Gateway when:
A private subnet resource needs access to:
Public AWS service endpoints
External APIs
Software repositories
Internet resources
You need general outbound internet connectivity.
Example:
```
Lambda (Private Subnet)
|
v
NAT Gateway
|
v
Internet Gateway
|
v
SQS Public Endpoint
```
Why this is a good exam answer:
The Lambda already needs to remain in the VPC for RDS access. NAT Gateway provides connectivity to SQS without changing the Lambda placement.
---
Option D: Create an interface endpoint for Amazon SQS in the VPC. ✅ Selected
Why it works:
AWS PrivateLink interface endpoints allow private communication between a VPC and AWS services.
An SQS interface endpoint creates private network interfaces inside the VPC.
Lambda can send messages to SQS without requiring internet access or a NAT Gateway.
Scenario where this option is used:
Use an interface endpoint when:
You want private connectivity to AWS services.
You want to avoid NAT Gateway costs.
You require traffic to stay within the AWS network.
Example:
```
Lambda (Private Subnet)
|
v
SQS Interface Endpoint
|
v
Amazon SQS
```
Why it is especially relevant:
The question specifically mentions the Lambda function is in a private subnet and timing out when calling SQS. A VPC endpoint is a direct solution.
---
Why other options are rejected
---
Opt...
Author: Matthew · Last updated Jul 11, 2026
A CloudOps engineer is troubleshooting an implementation of Amazon CloudWatch Synthetics. The CloudWatch Synthetics results must be sent to an Amazon S3 bucket.
The CloudOps engineer has copied the configuration of an existing canary that runs on a VPC that has an internet gateway attached. However, the CloudOps engineer cannot get the canary to su...
Problem Summary
A CloudOps engineer has an Amazon CloudWatch Synthetics canary that works in a VPC with an Internet Gateway (IGW), but the same configuration fails in a private VPC with no internet access.
The canary results must be delivered to an Amazon S3 bucket.
The key challenge:
A CloudWatch Synthetics canary running inside a private VPC cannot reach AWS services through the public internet.
It needs private connectivity to AWS services.
The canary needs access to:
1. Amazon S3 → to upload canary artifacts/results.
2. CloudWatch/Synthetics service endpoints → for communication with the AWS service.
---
Key AWS Exam Reasoning Factors
Factor 1: Private VPC without internet access
A private subnet has no route through an Internet Gateway. Therefore:
Public AWS endpoints cannot be reached.
NAT Gateway could provide internet access, but none is mentioned.
VPC endpoints are the AWS-native solution for private connectivity.
---
Factor 2: DNS resolution and DNS hostnames must be enabled
When using VPC endpoints, AWS services rely on DNS names such as:
```
s3.amazonaws.com
monitoring.amazonaws.com
synthetics.amazonaws.com
```
For private DNS resolution to work:
enableDnsSupport = true
enableDnsHostnames = true
A private VPC using AWS services normally requires these settings.
---
Factor 3: S3 uses Gateway VPC Endpoints
Amazon S3 supports:
Gateway VPC Endpoint ✅
Interface VPC Endpoint (PrivateLink) ✅ (available, but not the typical exam answer for S3)
For Synthetics results stored in S3, the standard AWS exam solution is:
```
Private subnet
|
|
Gateway VPC Endpoint
|
|
Amazon S3
```
No NAT Gateway or internet access is required.
---
Factor 4: CloudWatch/Synthetics communication
CloudWatch services require private connectivity when the workload has no internet access.
An Interface VPC Endpoint (AWS PrivateLink) is used for AWS services such as:
CloudWatch
CloudWatch Logs
Synthetics API
---
Option Analysis
---
A) Enable DNS resolution and DNS hostnames. Add synthetics:GetCanaryRuns permission to the VPC. Add IgnorePublicAcls permission to S3 bucket.
Why it looks correct:
DNS settings are correct.
Why it is rejected:
IAM permissions are not the network solution.
A VPC does not have IAM permissions such as `synthetics:GetCanaryRuns`.
`IgnorePublicAcls` is an S3 Object Ownership/security setting and does not provide connectivity.
This option confuses permissions with network access.
❌ Reject.
---
B) Turn DNS resolution and DNS hostnames off. Create a gateway VPC endpoint for S3. Add permissions for Synthetics to use S3 endpoint.
Why it looks partially correct:
S3 Gateway Endpoint is required.
Why it is rejected:
Turning DNS resolution and hostnames o...
Author: Kunal · Last updated Jul 11, 2026
A company runs several workloads on AWS. The company identifies five AWS Trusted Advisor service quota metrics to monitor in a specific AWS Region. The company wants to receive email notification each time resource ...
Question Summary
The company needs to:
Monitor five AWS Trusted Advisor service quota metrics.
Detect when resource usage exceeds 60% of the quota.
Send an email notification every time the threshold is crossed.
Apply this monitoring to a specific AWS Region.
The key requirements are:
1. Metric-based monitoring → Need a service that can monitor numeric values and trigger thresholds.
2. Threshold alerting (60%) → Need alarms based on metrics.
3. Email notification → Best fit is Amazon SNS because it can directly send email notifications.
---
Key AWS Concepts
AWS Trusted Advisor Service Quota Metrics
Trusted Advisor provides checks and recommendations, including service quota usage information.
For automated monitoring of quota usage, these metrics can be monitored through Amazon CloudWatch.
Amazon CloudWatch Alarms
CloudWatch alarms:
Monitor metrics.
Compare metric values against thresholds.
Trigger actions when thresholds are breached.
Example:
```
EC2 service quota usage > 60%
↓
CloudWatch Alarm triggers
↓
SNS notification
↓
Email sent
```
Amazon SNS vs Amazon SQS
| Service | Purpose | Suitable for email notification? |
| ---------- | ------------------------------------------------------------------ | -------------------------------- |
| Amazon SNS | Push notifications to subscribers (email, SMS, Lambda, HTTP, etc.) | ✅ Yes |
| Amazon SQS | Message queue for applications to process asynchronously | ❌ No direct email notification |
---
Option Analysis
A) Create five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon SNS topic for email notification each time usage exceeds 60%.
Why this is correct
This option matches all requirements:
✅ CloudWatch alarms monitor the quota metrics.
✅ Five alarms can be created because there are five metrics.
✅ Alarm threshold can be configured at 60% usage.
✅ SNS can send email notifications when alarms enter the ALARM state.
Example:
```
Trusted Advisor quota metric
↓
CloudWatch Alarm (>60%)
↓
SNS Topic
↓
Email notification
```
When to use this approach
Use:
CloudWatch alarms for metric-based monitoring.
SNS when humans need immediate notifications through email, SMS, or other endpoints.
---
B) Create five Amazon CloudWatch alarms, one for each Trusted Advisor service quota metric. Configure an Amazon SQS queue for email notification.
Why this is incorrect
CloudWatch alarms are appropriate, but SQS is not designed for email notifications.
SQS:
Stores messages.
Allows applications or services to poll and process messages.
Does not directly send emails.
The architecture would re...
Author: StarryEagle42 · Last updated Jul 11, 2026
A company uses Amazon ElastiCache (Redis OSS) to cache application data. A CloudOps engineer must implement a solution to increase the resilience of the cache. The solution also must minimiz...
Question Summary
A company uses Amazon ElastiCache for Redis OSS as a cache layer. The CloudOps engineer needs to:
1. Increase cache resilience (ability to survive failures)
2. Minimize Recovery Time Objective (RTO) (recover service as quickly as possible)
The key requirement is fast recovery from failures, not just the ability to restore data.
---
Key AWS Exam Factors
ElastiCache Redis OSS Resilience Features
For Redis OSS, AWS provides:
| Feature | Purpose | RTO Impact |
| -------------------------------- | ----------------------------------------------------------------- | ---------------------------------------------- |
| Multi-AZ with automatic failover | Automatically promotes a replica in another AZ when primary fails | Very low RTO |
| Read replicas | Provide redundancy and read scaling | Helps availability when combined with failover |
| Automatic backups | Point-in-time recovery | Higher RTO because restore is required |
| Manual/EventBridge backups | Scheduled backups | Higher RTO because restore is required |
| Memcached | Distributed cache without persistence/replication | Not suitable for high resilience |
The requirement is minimum RTO, so the preferred solution is automatic failover rather than backup restoration.
---
Option Analysis
A) Replace ElastiCache (Redis OSS) with ElastiCache (Memcached)
Why it is rejected
Memcached is a simple distributed caching service.
Characteristics:
No replication
No automatic failover
No persistence
No backup and restore capability
If a Memcached node fails:
Cached data is lost
Application must repopulate the cache
Recovery depends on application behavior
Although Memcached can be used when:
Data loss is acceptable
The cache is only a performance optimization
The application can easily rebuild cached data
It does not meet the requirement for increased resilience and low RTO.
❌ Rejected: No high availability or automatic recovery.
---
B) Create an Amazon EventBridge rule to initiate a backup every hour. Restore the backup when necessary.
Why it is rejected
This solution creates scheduled backups.
Flow:
1. EventBridge triggers backup every hour
2. Backup is stored
3. Failure occurs
4. Restore Redis from backup
Problems:
Recovery requires manual restore
Restore operation takes time
Last hour of cache changes may be missing
Does not provide automatic failover
Example:
If Redis f...
Author: James · Last updated Jul 11, 2026
A company's application is hosted by an internet provider at app.example.com. The company wants to access the application by using www.company.com, which the company owns and manages ...
Correct answer: B) Alias record
Scenario:
The application is hosted by an internet provider at:
`app.example.com`
The company owns and manages:
`www.company.com` using Amazon Route 53
The company wants users to access the application using:
`www.company.com`
The key requirement is: Route 53 must point the company's domain name to another hostname (app.example.com) without requiring users to know the original provider URL.
---
Option analysis
A) A record ❌ Rejected
What it does:
An A record maps a domain name to an IPv4 address.
Example:
```
www.company.com → 203.0.113.10
```
Why it is rejected:
The application is hosted at `app.example.com`, which is a DNS name, not an IP address.
The company does not control the internet provider's IP address.
If the provider changes the application's IP address, the A record would become incorrect.
When to use an A record:
When you know and manage the fixed IPv4 address of the resource.
Example:
EC2 instance with an Elastic IP
On-premises server with a static public IP
---
B) Alias record ✅ Correct
What it does:
An Alias record is an AWS Route 53 feature that allows a domain name to point directly to another AWS resource or supported DNS target.
It behaves similarly to a CNAME but is managed within Route 53.
Example:
```
www.company.com → app.example.com
```
Why it is selected:
The company is using Amazon Route 53 to manage DNS.
The requirement is to map one domain name to another hostname.
Alias records allow Route 53 to route traffic to supported targets without requiring an IP address.
Key exam factors:
Route 53 managed domain → consider Alias record.
Need to point a domain to another AWS resource → use Alias.
Works at the DNS level without requiring a fixed IP.
When to use an Alias record:
Pointing a Route 53 domain to:
Application Load Balancer
Network Load Balancer
CloudFront distribution
API Gateway
S3 website endpoint
Another Route 53 record
Example:
```
www.company.com
|
↓
ALB-123456.us-east-1.elb.amazonaws.com
```
---
C) CNAME record ❌ Rejected
W...
Author: Zain · Last updated Jul 11, 2026
A CloudOps engineer has successfully deployed a VPC with an AWS CloudFormation template The CloudOps engineer wants to deploy the same template across multiple accounts that are managed through AWS Organi...
Question analysis
Requirement:
A CloudOps engineer has already created a VPC using an AWS CloudFormation template and now wants to deploy the same template across multiple AWS accounts that are managed through AWS Organizations.
Key factors:
The accounts are part of AWS Organizations.
The goal is to deploy the same CloudFormation template repeatedly.
The solution should have the least operational overhead.
AWS provides a native service specifically for deploying CloudFormation stacks across multiple accounts and regions.
The best fit is AWS CloudFormation StackSets.
---
Option analysis
A) Assume the OrganizationAccountAccessRole IAM role from the management account. Deploy the template in each of the accounts.
Why it is rejected:
The `OrganizationAccountAccessRole` allows the management account to access member accounts, but the engineer must:
Assume the role manually or automate the process.
Deploy the stack individually in every account.
Manage failures and updates separately.
This creates high operational overhead as the number of accounts grows.
When this option can be used:
Small environments with only a few AWS accounts.
One-time administrative tasks where centralized deployment is not required.
---
B) Create an AWS Lambda function to assume a role in each account. Deploy the template by using the AWS CloudFormation CreateStack API call.
Why it is rejected:
This requires custom automation:
Writing and maintaining Lambda code.
Managing IAM permissions.
Handling account discovery, failures, retries, and deployment status.
AWS already provides a managed solution for this use case.
When this option can be used:
When deployment logic requires custom workflows that StackSets cannot support.
For highly customized automation processes.
---
C) Create an AWS Lambda function to query for a list of accounts. Deploy the template by using the AWS CloudFormation CreateStack API call.
Why it is rejec...
Author: Benjamin · Last updated Jul 11, 2026
A company has an application that collects notifications from thousands of alarm systems. The notifications include alarm notifications and information notifications. The information notifications include the system arming processes, disarming processes, and sensor status.
All notifications are kept as messages in an Amazon Simple Queue Service (Amazon SQS) queue. Amazon EC2 instances that are in an Auto Scaling group pro...
Question focus
The requirement is message prioritization: alarm notifications must be processed before information notifications.
The current design has:
Thousands of alarm systems sending notifications.
All messages stored in one Amazon SQS queue.
EC2 instances in an Auto Scaling group consume messages.
Need to ensure alarm messages get higher priority than informational messages.
The key AWS design principle is:
> Amazon SQS standard queues do not provide message priority ordering.
> If different priorities are required, use separate queues and process the higher-priority queue first.
---
Option analysis
A) Adjust the Auto Scaling group to scale faster when a high number of messages is in the queue.
Why it is rejected:
Auto Scaling can increase the number of EC2 instances when the SQS queue has a large backlog (using metrics such as `ApproximateNumberOfMessagesVisible`).
However:
It only increases processing capacity.
It does not distinguish between alarm notifications and information notifications.
EC2 instances may still process informational messages before alarm messages.
When this option is useful:
Use this when the problem is slow processing or queue backlog, not message prioritization.
Example:
A large number of messages are waiting.
All messages have the same importance.
Need more workers to clear the queue faster.
---
B) Use the Amazon SNS fanout feature with Amazon SQS to send the notifications in parallel to all the EC2 instances.
Why it is rejected:
SNS fanout is used for one-to-many message delivery.
Example:
```
Publisher
|
Amazon SNS Topic
|
---------------------
| | |
SQS1 SQS2 Lambda
```
It allows multiple subscribers to receive copies of messages.
However:
SNS does not provide message priority.
Sending messages in parallel does not guarantee alarm notifications are processed first.
It increases distribution capability, not prioritization.
When this option is useful:
Use SNS fanout when multiple systems need the same notification.
Example:
A new customer signup event needs to notify:
Billing system
Analytics system
Email service
---
C) Add an Amazon DynamoDB stream to accelerate the message processing.
Why it is rejected:...
Author: RadiantJaguar56 · Last updated Jul 11, 2026
A company wants to use AWS Systems Manager to manage a large fleet of Amazon EC2 instances. The company hosts the instances in private subnets. The company follows the principle of least privilege to assign access permissions. All private subnets have internet connectivity through a NAT gateway.
A CloudOps engineer installs the latest version of the Systems Manager Agent (SSM Agent)....
Key problem factors
The EC2 instances are in private subnets.
The instances have NAT gateway internet access, so they can potentially reach AWS public endpoints.
The latest SSM Agent is installed, so the agent software itself is not the issue.
The instances do not appear in Systems Manager Fleet Manager, which means the SSM Agent is not successfully registering with AWS Systems Manager.
AWS Systems Manager requires:
1. SSM Agent installed and running
2. Network connectivity to Systems Manager endpoints
3. An IAM instance profile with the required permissions
The most common missing requirement in this scenario is the IAM permissions for the EC2 instance.
---
Option analysis
A) Replace the NAT gateway with a NAT instance that is deployed in the public subnet. Update the private subnet's route table to use the NAT instance.
❌ Rejected
Why?
A NAT gateway already provides outbound internet connectivity from private subnets. Replacing it with a NAT instance does not solve the Systems Manager registration issue.
SSM Agent only needs outbound connectivity to AWS Systems Manager endpoints. Both NAT gateway and NAT instance can provide this.
When would this option be used?
A NAT instance might be used when:
A company needs custom NAT functionality.
The organization wants more control over NAT behavior.
Cost optimization is required for very small workloads.
It is not required for SSM Agent connectivity.
---
B) Create a VPC endpoint for Systems Manager. Remove routes to the internet through the NAT gateway from the private subnet's route table.
❌ Rejected
Why?
A VPC endpoint for Systems Manager allows private communication between EC2 instances and Systems Manager without requiring internet access.
However, the question states:
Private subnets already have internet connectivity through a NAT gateway.
The issue occurs after installing SSM Agent.
The missing requirement is more likely the instance permissions, not network connectivity.
When would this option be used?
Use Systems Manager VPC endpoints when:
Instances are in fully isolated private subnets.
The organization does not allow internet-bound traffic.
Security requirements require AWS service access through private AWS networking.
Example endpoints commonly required:
`ssm`
`ssmmessages`
`ec2messages` (depending on Region and SSM Agent version)
---
C) Attach the AmazonSSMManagedInstanceCore AWS managed policy to the E...
Author: Olivia · Last updated Jul 11, 2026
A CloudOps engineer is creating a simple, public-facing website running on Amazon EC2. The CloudOps engineer created the EC2 instance in an existing public subnet and assigned an Elastic IP address to the instance. Next, the CloudOps engineer created and applied a new security group to the instance to allow incoming HTTP traffic from 0.0.0.0/0. Finally, the CloudOps engineer created a new network...
Key AWS networking factors to reason about
When troubleshooting an EC2 instance that is publicly unreachable, check the traffic path:
Internet → Internet Gateway → Route Table → Network ACL → Security Group → EC2 instance
For a public EC2 web server:
1. EC2 must be in a public subnet
The subnet route table must have a route to an Internet Gateway.
The instance needs a public IPv4 address or Elastic IP.
2. Security Group (SG) behavior
Security groups are stateful.
If inbound HTTP (TCP port 80) is allowed, the return traffic is automatically allowed.
You do not need outbound rules for response traffic.
3. Network ACL (NACL) behavior
Network ACLs are stateless.
Both inbound and outbound rules must be explicitly allowed.
For HTTP access:
Inbound rule: allow TCP port 80 from the internet.
Outbound rule: allow ephemeral ports (1024–65535) back to clients because return traffic uses random high-numbered ports.
---
Option analysis
A) The CloudOps engineer did not create an outbound rule that allows ephemeral port return traffic in the new network ACL
✅ Correct
The engineer created a new network ACL and only allowed inbound HTTP traffic from `0.0.0.0/0`.
A NACL is stateless, meaning it does not automatically allow response traffic. When a user accesses the website:
1. Client sends:
Source: client IP + random source port
Destination: EC2 public IP + TCP port 80
2. NACL inbound rule allows TCP port 80 → request reaches EC2.
3. EC2 sends the HTTP response back:
Source: EC2 port 80
Destination: client's ephemeral port (for example, TCP 55000)
4. The outbound NACL must allow this return traffic.
If the outbound NACL rule is missing, the response is blocked, and the website appears unreachable.
When this option applies:
A custom NACL was created.
Only inbound rules were configured.
The application receives requests but clients cannot complete connections.
Common with public web servers behind custom NACLs.
---
B) The CloudOps engineer did not create an outbound rule in the security group that allows HTTP traffic from port 80
❌ Incorrect
Security groups are stateful.
If the ...
