Amazon Practice Questions, Discussions & Exam Topics by our Authors
A company wants to send notifications to customers to advertise a sale on the company=E2=80=99s products. The company needs to use Amazon Simple Notification Service (Amazon SNS) FIFO topics.
The company needs to examine the rate at which the topics send notifications and the latency w...
To meet the requirement of monitoring the rate and latency of Amazon SNS FIFO topics for sending notifications, we need a solution that can efficiently provide insights into both the performance of the service (rate of sending notifications) and any failures or delays (latency). Let's evaluate each option.
A) Use AWS X-Ray. Enable active tracing for Amazon SNS.
- Reason for rejection: While AWS X-Ray is excellent for tracing and debugging individual requests within services, Amazon SNS does not natively support detailed tracing via X-Ray. SNS is a messaging service, and X-Ray is typically used for application-level tracing of service calls (e.g., Lambda, EC2). It does not provide direct support for examining notification delivery metrics like rate or latency in SNS.
- Use case scenario: X-Ray would be useful for tracing requests in a serverless application or services like Lambda, but not for SNS.
B) Use the Amazon CloudWatch NumberOfNotificationsFailed metric.
- Reason for rejection: CloudWatch metrics can provide valuable insights into the performance of SNS topics, but the NumberOfNotificationsFailed metric only gives information about failed notifications, not the rate at which notifications are sent or the latency of their delivery. This does not fully meet the requirements of monitoring both the rate and latency.
- Use case scenario: This metric is useful for tracking failure rates but doesn’t provide a full view of SNS topic performance in terms of sending rates or latency.
C) Use AWS CloudTrail to log all Amazon SNS API calls.
- Reason for rejection: CloudTrail is u...
Author: Emma · Last updated Jul 14, 2026
A cloud-based video surveillance company is developing an application that analyzes video files. After the application analyzes the files, the company can discard the files.
The company stores the files in an Amazon S3 bucket. The files are 1 GB in size on average. No file is larger than 2 GB. An AWS Lambda function will run one time for each video file that is processed. The process...
To meet the performance requirements of the video surveillance application, the solution must optimize I/O performance when reading the video files multiple times. Let's evaluate each option based on how it addresses the application's need for performance and I/O efficiency.
A) Attach an Amazon Elastic Block Store (Amazon EBS) volume that is larger than 1 GB to the Lambda function. Copy the files from the S3 bucket to the EBS volume.
- Reason for rejection: While EBS volumes can provide persistent storage with high performance, Lambda functions do not support direct attachment of EBS volumes. Lambda functions use temporary ephemeral storage (the `/tmp` directory) for file operations, so attaching an EBS volume is not a valid option. Additionally, copying files from S3 to EBS would introduce unnecessary complexity and could reduce performance due to the additional steps involved.
- Use case scenario: This could be a good solution for EC2 instances but not for Lambda, which does not support EBS volume attachment.
B) Attach an Elastic Network Adapter (ENA) to the Lambda function. Use the ENA to read the video files from the S3 bucket.
- Reason for rejection: ENA is designed to enhance networking performance for EC2 instances, specifically for high-throughput networking. Lambda functions do not require ENA for accessing S3, as the AWS infrastructure automatically handles high-throughput network connections between Lambda and S3. This option would not provide any tangible performance benefit over the default configuration.
- Use case scenario: ENA is suitable for EC2 instances requiring high network throughput but not for Lambda functions accessing S3.
C) Increase the ephemeral storage size to 2 GB...
Author: Abigail · Last updated Jul 14, 2026
A company stores customer credit reports in an Amazon S3 bucket. An analytics service uses standard Amazon S3 GET requests to access the reports.
A developer must implement a solution to redact personally identifiable information (PII) from the reports before the rep...
The company needs to implement a solution that redacts Personally Identifiable Information (PII) from credit reports before they reach the analytics service. The solution should be operationally efficient and should avoid significant changes to the existing infrastructure or require complex rework. Let's evaluate each option:
A) Load the S3 objects into Amazon Redshift by using a COPY command. Implement dynamic data masking. Refactor the analytics service to read from Amazon Redshift.
- Reason for rejection: While Amazon Redshift offers capabilities for data manipulation and dynamic masking, this solution involves complex infrastructure changes. The reports would need to be loaded into Redshift, requiring extra ETL (Extract, Transform, Load) steps, which can be inefficient and operationally heavy, especially if there are frequent changes to the data. It would also require modifying the analytics service to interact with Redshift, which introduces significant overhead.
- Use case scenario: Redshift is useful for large-scale analytics and querying complex data, but it introduces unnecessary complexity for simply redacting PII from S3 objects before they are processed by the analytics service.
B) Set up an S3 Object Lambda function. Attach the function to an S3 Object Lambda Access Point. Program the function to call a PII redaction API.
- Reason for selection: This solution makes the most sense operationally. An S3 Object Lambda function allows you to process the data as it is retrieved from S3, modifying the content (such as redacting PII) before it is delivered to the analytics service. The S3 Object Lambda Access Point makes it easy to integrate this functionality with minimal changes to the analytics service. By using an S3 Object Lambda function, the company can programmatically modify the reports on-the-fly without requiring large-scale infrastructure changes or moving data to other services.
- Use c...
Author: GlowingTiger · Last updated Jul 14, 2026
A company is using the AWS Serverless Application Model (AWS SAM) to develop a social media application. A developer needs a quick way to test AWS Lambda functions locally by using test event payloads. The developer needs the structure of these test event payloads to match the a...
To address the developer’s need to test AWS Lambda functions locally using event payloads that match the structure of actual events, we should aim for a solution that minimizes development effort and streamlines testing. Let's evaluate each option based on this goal.
A) Create shareable test Lambda events. Use these test Lambda events for local testing.
- Reason for rejection: While creating shareable test events could work, it would involve manually designing and maintaining event payloads. This method would not automatically generate events that match the structure of actual AWS service events, leading to additional maintenance work and potential mismatches in event structure.
- Use case scenario: This approach could work if the events are relatively simple and don't need frequent updates, but it introduces overhead in ensuring the events remain accurate and up-to-date with actual AWS event structures.
B) Store manually created test event payloads locally. Use the sam local invoke command with the file path to the payloads.
- Reason for rejection: This approach also relies on manually creating test events. Although it allows for local testing with the `sam local invoke` command, the process of maintaining accurate test event payloads manually could lead to errors and mismatches with real AWS events. This requires additional work to keep the events up-to-date and to replicate the exact structure of actual AWS service events.
- Use case scenario: This could be useful if the events are simple and don't change frequently, but it still requires manual upkeep and lacks automation for gen...
Author: Olivia · Last updated Jul 14, 2026
A developer is building the authentication mechanism for a new mobile app. Users need to be able to sign up, sign in, and access secured backend...
To determine the best solution for user authentication and access to secured AWS resources in this mobile app scenario, let's evaluate each option:
Option A:
- AWS Identity and Access Management (IAM) Access Analyzer helps generate IAM policies, but it's typically more about identifying access and analyzing permissions for roles, not specifically about building the authentication mechanism itself.
- IAM Role Integration: While IAM roles are crucial for access control, using them directly for mobile app user authentication can be overly complex. The integration between IAM and identity providers is possible but not as seamless as other solutions tailored for mobile app sign-ins and managing user identities.
Why this is not ideal: IAM Access Analyzer and IAM roles are more suited for fine-grained access control and for managing permissions on resources, but they aren't designed for managing user authentication directly in mobile apps.
Option B:
- API Gateway Integration: This involves creating an IAM policy, associating it with a role, and then attaching this role to an API Gateway endpoint. This setup could allow secure access to backend services.
- API Gateway is more about managing and securing access to API endpoints, not directly handling user authentication for mobile apps.
Why this is not ideal: API Gateway can secure access to backend resources but doesn't directly manage user sign-up, sign-in, and authentication. This approach requires additional work to integrate authentication flows and identity management.
Option C:
- Amazon Cognito Identity Pool provides a mechanism to authenticate users (both authenticated and guest) and assign them specific IAM roles based on their authentication status.
- Integration with Identity Providers: T...
Author: Abigail · Last updated Jul 14, 2026
A developer is creating a new application that will give users the ability to upload documents to Amazon S3. The contents of the documents must not be accessible to ...
Let’s go over each option and analyze which one best meets the requirement for ensuring the contents of documents in Amazon S3 are not accessible by third parties:
Option A: Client-side encryption using the S3 Encryption Client with a Raw RSA wrapping key stored on the user's device
- Client-side encryption: In this case, the encryption is performed on the user's device before the data is uploaded to S3. The key is stored on the user's device.
- Why this is not ideal: While this option ensures that the data is encrypted before it leaves the device, it requires significant management on the user’s part, including handling the encryption keys. The key being stored on the user’s device could also lead to risks if the device is compromised.
Rejection reason: Although this approach ensures that the third-party (Amazon S3) cannot access the content, the responsibility for securely managing the encryption key lies with the user, which introduces security risks. Additionally, managing encryption at the client-side can be complex and error-prone.
Option B: Server-side encryption with S3-managed keys (SSE-S3)
- SSE-S3: This option uses Amazon S3’s built-in encryption features, where Amazon S3 manages the encryption and decryption of data. The keys are handled and rotated automatically by AWS.
- Why this is a good option: SSE-S3 is relatively simple to implement, and it provides at-rest encryption of the data in Amazon S3. However, the encryption keys are managed by AWS, meaning AWS could technically access them under certain circumstances (e.g., if required for law enforcement or compliance).
Rejection reason: Although SSE-S3 is simple and cost-effective, it does not offer the same level of control over encryption keys as other options, which might be a concern for sensitive data that should not be accessible by anyone, even AWS.
Option C: Server-side encryption with AWS KMS keys (SSE-KMS)
- SSE-KMS: With this option, AWS Key Management Service (KMS) manages the encryption keys. You have more control over the encryption process, and AWS KMS offers features like access policies and audit logging to...
Author: Deepak · Last updated Jul 14, 2026
An application includes an Amazon DynamoDB table that is named orders. The table has a primary partition key of id and a global secondary index (GSI) that is named an accountIndex. The GSI has a partition key of accountId and a sort key of orderDateTime.
A developer needs to create an AWS Lambda function...
In this scenario, the goal is to retrieve orders with the least read capacity used. Let's break down each option and its implications:
A) Define a DynamoDB API request for the GetItem action:
- GetItem is used to retrieve a single item from the table based on its primary key (the `id` in this case).
- Since `GetItem` works only with the partition key and doesn't support querying based on other attributes (like `accountId`), this action isn't useful for querying all orders with a specific `accountId`.
- Rejected: This option is rejected because we cannot query based on `accountId` directly. It’s meant for retrieving a single item, not filtering by a secondary index.
B) Define a DynamoDB API request for the BatchGetItem action:
- BatchGetItem retrieves multiple items by their primary key (again, `id` in this case). Similar to GetItem, this operation requires the keys to be known upfront, and it doesn’t allow you to query based on `accountId` directly.
- Rejected: This option is rejected because it also requires specifying the primary key (`id`), which doesn’t allow querying based on `accountId`. It doesn’t help when you want to retrieve multiple items based on a non-primary key.
C) Define a DynamoDB API request for the Scan action:
- Scan reads...
Author: Ella · Last updated Jul 14, 2026
A developer created several AWS Lambda functions that write data to a single Amazon S3 bucket. The developer configured all the Lambda functions to send logs and metrics to Amazon CloudWatch.
The developer receives reports that one of the Lambda functions writes data to the bucket very slowly. The developer...
To measure the latency between the Lambda function and the S3 bucket, we need to identify the option that can specifically track the interaction between the Lambda function and S3 in a clear and detailed manner. Let’s analyze each option:
Option A: Enable AWS X-Ray on the Lambda function. In the generated trace map, select the line between Lambda and Amazon S3.
- Advantages:
- AWS X-Ray provides detailed tracing capabilities that can track the entire flow of the Lambda function, including interactions with S3. This would allow for precise identification of where the latency occurs.
- The trace map would show the time spent in each step, including the Lambda function and S3 operations.
- Disadvantages:
- Requires additional setup to enable X-Ray on the Lambda function, but this is typically not complex and can provide granular insights.
- This is an effective option for measuring the specific latency between Lambda and S3.
Option B: Query the Lambda function's log file in Amazon CloudWatch Logs Insights. Return the average of the auto-discovered @duration field.
- Advantages:
- CloudWatch Logs Insights provides powerful querying capabilities for Lambda logs, which can give insights into execution duration.
- Disadvantages:
- Logs don't directly show the interaction time between Lambda and S3. The @duration field would only show the overall execution time of the Lambda function, not the specific latency between Lambda and S3. This won't help isolate where the latency is occurring in the interaction with the S3 bucket.
- The solution is more about general performance measurement rathe...
Author: Lina Zhang · Last updated Jul 14, 2026
A medical device company is building a machine learning (ML) model to predict the likelihood of device recall based on customer data that the company collects from a plain text survey. One of the survey questions asks which medications the customer is taking. The data for this field contains the names of medications that customers enter manually. Customers misspell some of the medication names. The column that contains t...
Key problem characteristics
Feature: medication names entered as free text
Issue: high cardinality + redundancy due to misspellings
Goal: convert into numeric feature for ML model
Constraint: must handle noisy categorical text (not clean categories)
This combination strongly suggests that simple categorical encodings (one-hot, ordinal) will fail, and we need a method that can handle semantic similarity + spelling variation.
---
Option analysis
A) Spell check + one-hot encoding
Why it is not effective:
One-hot encoding assumes a clean, finite set of categories
Even after spell-checking, medication names remain high-cardinality (thousands of drugs)
One-hot leads to:
very sparse vectors
high dimensionality explosion
poor generalization for unseen or rare medications
When it could be used:
Small number of clean categories (e.g., “Yes/No”, “Blood type”, “Country”)
After heavy standardization where category count is low
❌ Not suitable here due to high cardinality.
---
B) Char-RNN spelling correction + one-hot encoding
Why it is not ideal:
Char-RNN for spelling correction is:
complex
expensive
not typically used as preprocessing in AWS ML pipelines
Still ends with one-hot encoding, which suffers same issue as Option A
Also introduces unnecessary modeling step before encoding
When it could be used:
If building a full NLP pipeline specifically for text normalization or autocorrection systems
Research-heavy NLP systems, not standard AWS tabular ML workflows
❌ Overengineered and still ends in poor encoding choice.
---
C) Similarity enco...
Author: Noah · Last updated Jul 26, 2026
A developer is designing a game that stores data in an Amazon DynamoDB table. The partition key of the table is the country of the player. After a sudden increase in the number of players in a specific country, the developer notices Pr...
The error ProvisionedThroughputExceededException occurs when the number of read or write requests exceeds the provisioned throughput capacity of a DynamoDB table, which happens due to high traffic concentrated on certain partition keys (in this case, the country). Let's review the options and their effectiveness:
Option A: Use strongly consistent table reads.
- Advantages:
- Strongly consistent reads ensure that you get the most up-to-date data.
- Disadvantages:
- Strongly consistent reads consume more throughput capacity than eventually consistent reads. This could exacerbate the issue of exceeding provisioned throughput, especially if the partition key (country) is heavily used.
- This approach does not directly address the underlying issue of throughput exceeding capacity, and could actually increase the load on the table, making the problem worse.
Option B: Revise the primary key to use more unique identifiers.
- Advantages:
- Changing the primary key design to use more unique identifiers (such as combining a country with another unique identifier, like player ID) can help distribute traffic more evenly across different partitions. This reduces the risk of throttling because it prevents one partition from receiving too much traffic.
- This solution addresses the root cause of the throughput exceeded error, which is traffic concentration on a single partition.
- Disadvantages:
- This approach requires changing the primary key design, which could involve significant changes to the application’s data model and migration of data. However, this is a long-term solution that can scale and prevent similar issues in the future.
Option C: ...
Author: Ishaan · Last updated Jul 14, 2026
A manufacturing company produces 100 types of steel rods. The rod types have varying material grades and dimensions. The company has sales data for the steel rods for the past 50 years.
A data scientist needs to build a machine learning (ML) model to predict fut...
The correct answer is:
> ✅ A) Use the Amazon SageMaker DeepAR forecasting algorithm to build a single model for all the products.
Step 1: Identify the problem type
This is a time series forecasting problem.
Key clues:
Predict future sales
Past 50 years of historical sales
100 different products (steel rod types)
Wants the most operationally efficient solution
Whenever you see:
historical data over time
predicting future values
think forecasting, not standard regression.
---
Step 2: Key factors in the question
There are three important keywords.
Factor 1: 100 products
There are many related time series.
Instead of one product, there are 100 products.
---
Factor 2: Products are related
The rods differ only in:
material grade
dimensions
These products belong to the same business and likely exhibit similar sales patterns.
DeepAR is specifically designed to learn from multiple related time series simultaneously.
---
Factor 3: Operational efficiency
AWS exam questions often emphasize:
> "MOST operationally efficient"
Operational efficiency means:
fewer models
less maintenance
less retraining
easier deployment
lower cost
Building one model is almost always more operationally efficient than managing 100 models.
---
Why A is correct
Amazon SageMaker DeepAR
DeepAR is an AWS forecasting algorithm.
It is designed for:
multiple time series
seasonal data
demand forecasting
inventory forecasting
retail sales forecasting
Instead of learning one product at a time,
DeepAR learns patterns across all products.
Example:
Product A:
```
Jan 100
Feb 120
Mar 130
```
Product B:
```
Jan 60
Feb 75
Mar 80
```
Product C:
```
Jan 200
Feb 230
Mar 250
```
DeepAR learns:
yearly seasonality
monthly seasonality
trends
common demand behavior
The algorithm shares statistical strength across related series, improving forecasts, especially for products with less historical variation.
Advantages:
One model
Easy deployment
Easy retraining
Lower operational overhead
Better forecasting across similar products
This directly satisfies the requirement.
---
Why B is rejected
> Use DeepAR to build separate models for each product.
This means:
100 products
↓
100 DeepAR models
Problems:
100 training jobs
100 endpoints
100 retraining pipelines
Higher cost
Higher maintenance
Also,
DeepAR was created specifically to avoid building one model per time series.
You lose one of DeepAR's biggest advantages:
learning across multiple related series.
This is not operationally efficient.
---
Why C is rejected
> ...
Author: Deepak · Last updated Jul 26, 2026
A machine learning (ML) specialist is building a credit score model for a financial institution. The ML specialist has collected data for the previous 3 years of transactions and third-party metadata that is related to the transactions.
After the ML specialist builds the initial model, the ML specialist discovers that the model has low accuracy for both the...
The key clue in the question is:
> The model has low accuracy for both the training data and the test data.
This immediately tells us the model is underfitting (high bias).
Step 1: Identify the ML problem
| Training Accuracy | Test Accuracy | Problem |
| ----------------- | ------------- | ---------------------------- |
| Low | Low | Underfitting (High Bias) |
| High | Low | Overfitting (High Variance) |
Key factors
Training accuracy is low → Model cannot even learn the training data.
Test accuracy is also low → Poor generalization because the model itself is too simple.
Therefore we need to increase model capacity or provide better features.
Typical ways to reduce high bias:
Increase model complexity ✅
Engineer better features ✅
Reduce regularization ✅
Train longer (if not converged) ✅
Avoid:
Stronger regularization ❌
Simpler models ❌
Less training data ❌
---
Option A
Increase the number of passes on the existing training data. Perform more hyperparameter tuning.
Why it is correct
Increasing the number of passes (epochs) allows the model more opportunity to learn the existing data.
Hyperparameter tuning can discover:
better learning rate
tree depth
number of estimators
hidden layers
batch size
If the model hasn't reached its best performance, additional training and tuning can significantly improve accuracy.
Key reasoning
Useful when:
Model has not converged
Hyperparameters are not optimized
Initial model is weak
AWS likes this option because SageMaker automatically supports Hyperparameter Optimization (HPO).
Scenario
Suppose you're training XGBoost.
Current:
max_depth = 2
20 boosting rounds
HPO may find:
max_depth = 8
300 boosting rounds
Training accuracy increases.
✅ Correct
---
Option B
Increase the amount of regularization. Use fewer feature combinations.
Why rejected
Both actions make the model simpler.
Increasing regularization:
penalizes model complexity
reduces overfitting
Using fewer feature combinations:
removes useful information
lowers model capacity
But our problem is already underfitting.
This makes underfitting worse.
When this option is appropriate
When:
Training accuracy is high
Test accuracy is low
That's overfitting.
❌ Incorrect
---
Option C
Add new domain-specific features. Use more complex models.
Why correct
This is one of the best ways to reduce high bias.
Adding domain-s...
Author: Ava · Last updated Jul 26, 2026
A company supplies wholesale clothing to thousands of retail stores. A data scientist must create a model that predicts the daily sales volume for each item for each store. The data scientist discovers that more than half of the stores have been in business for less than 6 months. Sales data is highly consistent from week to week. Daily data from the database has been aggregated weekly, and weeks with no sales are omitted from the current dataset. Five years (100 MB) of sales...
The key to this question is identifying what prevents building an accurate daily forecasting model.
Step 1: Identify important facts in the question
| Key Factor | Why it matters |
| -------------------------------------------------------- | ----------------------------------------------------------------- |
| Predict daily sales for each item in each store | Model needs daily granularity. |
| More than half the stores are less than 6 months old | Limited history for many stores (cold start problem). |
| Sales are consistent week to week | Weekly patterns are stable; variance is not the issue. |
| Daily data has been aggregated weekly | Daily information has been lost. |
| Weeks with no sales are omitted | Missing zero-demand observations create biased training data. |
| Five years of data (100 MB) | Plenty of history for forecasting; dataset size is not a problem. |
---
Evaluate each option
A) Detecting seasonality for the majority of stores will be an issue. Request categorical data to relate new stores with similar stores that have more historical data.
Why this is correct
The important clue is:
> More than half the stores have been in business for less than 6 months.
Forecasting models often need enough historical data to learn:
yearly seasonality
holiday effects
store-specific demand
A store with only 6 months of history cannot learn annual seasonal patterns.
A common solution is:
use metadata (store type, region, size, demographics, climate, etc.)
borrow information from similar stores
cluster stores
hierarchical forecasting
This is exactly what the option suggests.
Key reasoning
Problem
→ New stores (cold-start problem)
Mitigation
→ Use categorical/store attributes to transfer knowledge from older stores.
When this option is generally used
Use whenever:
new stores
new products
little historical data
cold-start forecasting
---
B) The sales data does not have enough variance. Request external sales data from other industries to improve the model's ability to generalize.
Why this is wrong
The question says:
> Sales data is highly consistent from week to week.
Consistent data is not a problem.
Low variance does not mean the model cannot forecast.
Also,
External data from other industries usually has no relationship to clothing sales.
Generalization is not the issue.
Key reasoning
No indication that:
model is overfitting
variance is too low
more industries help
Reject.
When this option would be useful
External data helps when there are useful correlated variables such as:
weather
holidays
promotions
economic indicators
Not unrelated industries.
---
C) Sales data is aggregated by week. Request daily sales data from the source database to enable building a daily model.
Why this looks tempting
The task is:
> Predict daily sales.
But the available data is:
> aggregated weekly.
Normally this would absolutely be necessary.
However, notice the next statement:
> Daily data from the database has been aggregated weekly.
This means daily data exists in the source database, but this option only addresses aggregation.
The bigger data-quality issue tested by AWS is the omission of zero-sales weeks (Option D), which directly biases demand forecasting.
AWS exam writers expect you to focus on the data-quality issue rather than simply saying "get daily data back." In many versions of...
Author: Maya · Last updated Jul 26, 2026
A DevOps administrator is configuring a repository to store a company's container images. The administrator needs to configure a lifecycle rule that automatically deletes container images that have a specific tag and that are olde...
Let's analyze each option based on the requirements:
Store container images
Automatically delete container images with a specific tag
Delete images older than 15 days
Maximize operational efficiency
---
Option A) Amazon ECR with lifecycle policy
Pros:
Amazon ECR is designed specifically for storing container images.
Supports lifecycle policies natively that can filter by tag and age.
Lifecycle policies can automatically expire (delete) images based on tag and days since pushed.
Highly operationally efficient because this is a native feature, requires minimal manual intervention or scripting.
Fully managed service with security, scalability, and integration with AWS services.
When to use:
For container image storage and lifecycle management in AWS.
When you want built-in, automated lifecycle rules for container images.
---
Option B) AWS CodeArtifact repository policy
Cons:
AWS CodeArtifact is primarily designed for managing software packages (like Maven, npm, NuGet), not container images.
It does not natively support container images lifecycle management by tag or age.
Repository policies in CodeArtifact are for access control, not expiration or lifecycle management of assets.
Not suitable for container image lifecycle management.
When to use:
Managing software dependencies and packages, not container images.
---
Option C) Amazon S3 bucket with lifecycle policy
Cons:
S3 is an object storage service, not optimized for container images.
While lifecycle policies can delete obje...
Author: Amelia · Last updated Jul 20, 2026
A company hosts an application in its AWS account. The application uses an Amazon S3 bucket to store objects that contain sensitive information.
The company needs to capture object-level S3 API calls, including calls that are rejected because t...
To determine which solution best meets the requirements, let's break down the key requirements and analyze each option based on them.
---
Key Requirements:
1. Capture object-level Amazon S3 API calls.
2. Include rejected calls (e.g., invalid credentials).
3. Sensitive data is involved – audit-level logging is needed.
---
✅ A) Create an AWS CloudTrail trail in the account. Enable S3 data events logging. Configure the trail to log to Amazon CloudWatch.
Meets all requirements:
CloudTrail data events capture object-level API activity, such as `GetObject`, `PutObject`, `DeleteObject`.
CloudTrail captures both accepted and rejected API calls, including those with invalid credentials (if they reach the service endpoint).
Sending logs to CloudWatch enables real-time alerting, monitoring, and integration with security systems.
Use Case: Ideal for auditing and compliance, especially when fine-grained activity tracking is needed.
✅ This option meets all key requirements.
---
❌ B) Create a new S3 bucket. Configure access logging on the application's S3 bucket. Deliver the access logs to the new S3 bucket.
Why it's rejected:
S3 access logs only track requests to the bucket, and do not include:
Requests rejected due to invalid credentials.
Complete object-level API call information (e.g., API operation names).
...
Author: Victoria · Last updated Jul 20, 2026
A DevOps administrator is responsible for managing the security of a company's Amazon CloudWatch Logs log groups. The company's security policy states that employee IDs must not be visible in logs except by authorized personnel. Employee IDs follow the pattern of Emp-XXXXXX, where each X is a digit.
An audit discovered that employee IDs are found in a single log file. The log file is available to engineers, but the engineers are not authorized to view employee IDs. Engineers currently have an AWS IAM Identity Center permission that allows logs:* on all resource...
To determine the MOST operationally efficient solution for masking employee IDs in Amazon CloudWatch Logs, let's evaluate each option against key criteria:
---
✅ Key requirements:
1. Mask "Emp-XXXXXX" pattern (custom identifier).
2. Prevent unauthorized access to unmasked data (engineers shouldn’t see it).
3. Applies to new log entries only (not retroactive redaction).
4. Most operational efficiency (minimal manual effort, automation, scalability).
5. IAM-based access control, since engineers already have `logs:`.
---
🟢 Option A – Data Protection with Custom Identifier & Deny Unmask Permission
What it does:
Uses CloudWatch data protection policies with a custom data identifier (`Emp-\d{6}`).
Adds an IAM policy to deny `logs:Unmask`, so engineers can't view the raw unmasked logs.
Pros:
✅ Natively integrates with CloudWatch Logs (no external processing).
✅ Automatically masks in the console and API responses unless `logs:Unmask` is allowed.
✅ Most operationally efficient: no custom code, no data movement.
✅ Supports regex-based custom identifiers, matching the Emp-XXXXXX pattern.
Cons:
None significant. The configuration is straightforward and scalable.
Scenario fit:
Ideal when sensitive patterns (like employee IDs) must be masked for specific IAM users using CloudWatch’s native capabilities.
---
🔴 Option B – Use Managed Data Identifiers and Deny `NotAction:logs:Unmask`
What it does:
Uses managed identifiers (e.g., PII) in the data protection policy.
Uses a confusing and potentially incorrect IAM statement with `"NotAction": "logs:Unmask"`.
Cons:
❌ Managed identifiers don't match the custom pattern `Emp-\d{6}`.
❌ `"NotAction": "logs:Unmask"` is not valid ...
Author: Evelyn · Last updated Jul 20, 2026
A company uses an organization in AWS Organizations to manage many AWS accounts. The company has enabled all features for the organization. The company uses AWS CloudFormation StackSets to deploy configurations to the accounts. The company uses AWS Config to monitor an Amazon S3 bucket.
The company needs to ensure tha...
To determine the correct solution, let's evaluate each option based on security enforcement, monitoring capability, and deployment scope across accounts using AWS Organizations, given the goal: ensure all S3 object uploads use AWS KMS encryption.
---
✅ D) Create an SCP that includes a deny statement for the s3\:PutObject action and a condition where s3\:x-amz-server-side-encryption is not aws\:kms. Attach the SCP to the root of the organization.
Why it is correct:
Service Control Policies (SCPs) control what actions can be performed in member accounts, even by root users.
This SCP enforces a deny if someone tries to upload (`PutObject`) to S3 without using KMS encryption.
SCPs apply organization-wide when attached to the root, aligning with the requirement to manage many accounts.
It meets the requirement of preventing non-KMS encrypted uploads proactively (enforcement).
---
❌ A) Create an AWS Config conformance pack with the `s3-bucket-server-side-encryption-enabled` rule.
Why it's not selected:
This option is monitoring, not enforcement.
AWS Config rules can detect misconfigurations, but they do not prevent non-compliant uploads.
The SNS topic only notifies; it doesn't stop non-compliant actions.
Suitable in scenarios where you want visibility/compliance checks...
Author: Suresh · Last updated Jul 20, 2026
A company uses an Amazon Aurora PostgreSQL DB cluster and loads transactional data into the database every 5 hours. Data analysts use the Aurora PostgreSQL database to run short-running queries, create complex aggregated queries, and create simple reports that use the data. The data analysts also manually update the data, including deleting and inserting data.
The data analysts have reported performance issues. The database team recently identified a long-running idle transaction connection that affected performance by blocking other queries and preventing VACUUM operations. The team wants to be pr...
To determine the correct solution, we need to match the requirements with the capabilities of the services and eliminate incorrect or incomplete options.
---
✅ Key Requirements:
1. Proactive notifications about operational issues (like long-running idle transactions).
2. Recommended actions to fix the issues.
3. Aurora PostgreSQL is already being used.
4. DevOps Guru is enabled for the AWS account.
5. Notifications should go to the database team.
6. Performance Insights is needed for visibility into query performance and resource bottlenecks.
---
Option Analysis:
---
A) Turn on Performance Insights and DevOps Guru in the existing Aurora PostgreSQL DB cluster. Configure DevOps Guru to send notifications to the database team by using Amazon Simple Notification Service (Amazon SNS).
✅ Performance Insights helps analyze query-level performance bottlenecks.
✅ DevOps Guru uses AI/ML to detect operational issues (like blocking transactions, vacuum delays).
✅ DevOps Guru provides recommendations to resolve problems.
✅ SNS allows sending notifications to the database team (email, SMS, Lambda, etc.)
✅ Meets all requirements.
---
B) Turn on Performance Insights in the existing Aurora PostgreSQL DB cluster. Configure Amazon EventBridge to receive events from the existing Aurora PostgreSQL DB cluster. Configure the Aurora PostgreSQL DB cluster to send notifications to the database team by using Amazon Simple Notification Service (Amazon SNS).
✅ Performance Insights is useful.
❌ EventBridge by itself does not analyze or detect anomalies like DevOps Guru.
❌ No mention of DevOps Guru, so no automated insights or recommendations.
✅ SNS is correctly used for notifications.
❌ Lacks proactive issue detection and recommendations, so not sufficient.
---
C) Turn on Performance Insights and DevOps Guru in the existing Aurora PostgreSQL DB cluster. Configure the Aurora PostgreSQL DB cluster to send notifications to the dat...
Author: FlamePhoenix2025 · Last updated Jul 20, 2026
A DevOps engineer is implementing governance controls for a company that requires its infrastructure to be housed within the United States. The company has many AWS accounts in an organization in AWS Organizations that has all features enabled.
The engineer must restrict which AWS Regions the company can use. The engineer must also ensure that an alert is sent as soon as possible if any activity outside the govern...
To meet the requirements outlined, we need a strong governance control that restricts AWS Region usage to within the U.S. and an alerting mechanism that triggers immediately if there's any activity outside the allowed scope. The solution must also automatically apply to new Regions as they become available.
Let's evaluate each option carefully.
---
✅ A) Create an Organizations SCP deny policy...
✔ Selected
Why it's correct:
SCP (Service Control Policy) is the most effective way to enforce hard restrictions on what actions can be taken across accounts in an AWS Organization.
Using a deny policy based on `aws:RequestedRegion` ensures that no activity can be performed outside allowed Regions.
Including an exception for global services (like IAM or Route 53) is best practice to avoid breaking necessary functionality.
By attaching the policy at the organization root, it applies to all accounts — current and future.
This automatically covers new Regions, because any Region not explicitly allowed is denied.
Key Factors:
SCPs are evaluated before IAM policies.
Deny policies take precedence over allow policies.
Enforces preventative control, not just detection.
When to use:
To proactively block usage outside compliance boundaries.
To centrally manage Region access.
---
✅ B) Configure AWS CloudTrail to send logs to Amazon CloudWatch Logs...
✔ Selected
Why it's correct:
CloudTrail can track API calls in all Regions, including newly launched ones.
Enabling for all Regions ensures complete visibility.
CloudWatch Logs metric filters allow for real-time detection of activity in unauthorized Regions.
When activity occurs in a disallowed Region, a metric is generated, triggering a CloudWatch Alarm and alerting the security team.
Key Factors:
Provides real-time alerting.
C...
Author: Aria · Last updated Jul 20, 2026
A company runs applications on Amazon EC2 instances that are in an Amazon EC2 Auto Scaling group. The EC2 instances are behind an Application Load Balancer (ALB). Users recently began to experience errors when traffic was directed to some of the EC2 instances.
A DevOps engineer discovers that the Auto Scaling group reports the problematic instances are healthy despite the application errors. User experience returns to normal after the DevOps engineer resolves the application errors on the problematic instances.
The company wants to ensure that traffi...
To determine the correct solution, we need to assess:
Key Requirements:
1. Traffic must be routed only to healthy instances that are not experiencing application-level errors.
2. A support team must be notified if traffic routing configuration changes.
---
Option A Analysis:
> Use ELB health checks in the Auto Scaling group.
> Use AWS Config to detect configuration changes.
> SNS notification for config changes.
✅ Pros:
ELB health checks are application-aware, using the ALB target group health check which evaluates HTTP(S) responses — suitable for detecting application-level errors.
AWS Config can monitor whether ELB health checks are configured properly.
SNS ensures the support team is notified if configuration changes.
🔴 Cons:
While AWS Config tracks configuration drift, it doesn't actively detect application health issues in real-time.
No active monitoring (e.g., synthetic testing) of application behavior is included.
💡 When to use:
This is useful when you want config compliance and notifications on config drift, but not ideal for real-time application health monitoring.
---
Option B Analysis:
> Use EC2 health checks, AWS Config, and SNS.
🔴 Rejected Because:
EC2 health checks only monitor instance-level metrics (e.g., system status, instance status) — they do not detect application-level failures.
It suffers from the same AWS Config limitations as Option A.
Fails to meet the core requirement of routing traffic only to instances that are healthy from an application perspective.
---
Option C Analysis:
> Use EC2 health checks.
> Add CloudWatch synthetic canary and alarms.
✅ Pros:
CloudWatch Synthetics can simulate user behavior to detect application-level issues.
Alarm and SNS notify support team when failures are detected.
🔴 Cons:
Still relies on EC2 health checks, which cannot aut...
Author: Victoria · Last updated Jul 20, 2026
A DevOps engineer needs to troubleshoot a pipeline that uses a GitHub code repository. The pipeline contains a source stage, a build stage, and a deploy stage. The pipeline also has an AWS CodeStar connection to the GitHub code repository.
The build stage uses an AWS CodeBuild build project. The build project needs to perform a git clone of the repository as part of the build process.
The DevOps engineer ...
To determine why the build stage fails while the source stage works properly, we need to consider how AWS CodePipeline, CodeStar connections, and CodeBuild interact.
---
✅ Key context:
The source stage is already verified to be working properly, meaning:
The CodeStar connection is valid and authorized (eliminates invalid credential issues).
The CodePipeline service role likely has permissions to use the connection (because it can access the source).
The build stage uses CodeBuild, and CodeBuild tries to do a `git clone` of the repo.
By default, CodeBuild does not have access to the CodeStar connection unless configured with appropriate permissions.
---
🔍 Option Analysis:
A) The build stage within the pipeline needs to use the AWS CodeStar connection action.
❌ Incorrect.
Only source actions (like GitHub source) use CodeStar connections directly.
Build stages (e.g., CodeBuild) are not configured to use CodeStar connections directly as actions.
The source stage already does the GitHub checkout, and CodePipeline passes the source artifact to CodeBuild, so CodeBuild should not need to `git clone` again unless custom cloning is part of the buildspec.
Use-case where this applies:
Would be relevant if a source action were missing and trying to use CodeBuild to directly clone a repo, which is not the standard pattern in CodePipeline.
---
B) The AWS CodeStar connection to GitHub contains incorrect credentials.
...
Author: Mia · Last updated Jul 20, 2026
A company's DevOps team uses Node Package Manager (NPM) open source libraries to build applications. The DevOps team runs its application build process in an AWS CodeBuild project that downloads the NPM libraries from public NPM repositories.
The company wants to host the NPM libraries in private NPM repositories. The company also needs to be able to run checks...
The best solution must meet two primary requirements:
1. Host private NPM repositories – So the build process doesn’t directly rely on public NPM.
2. Run checks on new library versions before use – With the ability to prevent bad packages from being used in builds.
Additionally, the solution should require the least operational effort, so manual intervention, custom scripting, or over-engineering should be avoided.
---
Option A – ✅ Selected
Create an AWS CodeArtifact repository with an upstream repository named npm-store. Configure the application build process to use the CodeArtifact repository as the default source for NPM. Create an AWS CodePipeline pipeline to perform the required checks on package versions in the CodeArtifact repository. Set the package status to unlisted if a failure occurs.
Pros:
Low operational overhead: CodeArtifact natively integrates with NPM and supports upstream repositories. This allows developers to pull NPM packages into a private repository without manually cloning or maintaining them.
Centralized control: Packages are pulled from public NPM, stored in a private CodeArtifact repo, and can be reviewed and tested.
Access control & versioning: You can prevent the use of certain versions by unlisting or removing them.
Automation ready: Use CodePipeline to run validation checks automatically when new versions are pulled in.
Cons:
Slight learning curve with CodeArtifact if not already in use, but this is outweighed by the automation benefits.
Best used when: You want a managed, integrated solution with minimal manual intervention and tight integration with AWS build and release services.
---
Option B – ❌ Rejected
Enable Amazon S3 caching in the CodeBuild project configuration. Add a step in the buildspec.yaml config file to perform the required checks on the package versions in the cache.
Pros:
Easy to enable.
Cons:
S3 cache is not a repository. It’s only a cache to speed up builds; it doesn’t offer versioning, validation, access control, or unlisting.
You cannot manage or cura...
Author: Kunal · Last updated Jul 20, 2026
A company has a search application that has a web interface. The company uses Amazon CloudFront, Application Load Balancers (ALBs), and Amazon EC2 instances in an Auto Scaling group with a desired capacity of 3. The company uses prebaked AMIs. The application starts in 1 minute. The application queries an Amazon OpenSearch Service cluster.
The application is deployed to multiple Availability Zones. Because of compliance requirements, the application needs to have a disaster recovery (DR) environment in a separate AWS...
To choose the best disaster recovery (DR) solution, we need to align the architecture with key requirements:
---
✅ Key Requirements Recap
Disaster Recovery (DR) in a different Region
RTO (Recovery Time Objective) < 30 minutes
RPO (Recovery Point Objective) < 30 minutes
Minimize ongoing cost
Application starts in 1 minute (fast)
Prebaked AMIs available
CloudFront + ALB + EC2 Auto Scaling
Uses OpenSearch Service
---
Let's analyze each option:
---
Option A
> Add the new ALB as an origin in CloudFront. Configure origin failover. AMI copied. Auto Scaling group with desired capacity of 0 in DR. New OpenSearch cluster with cross-cluster replication.
✅ Meets DR Region requirement
✅ Low cost: desired capacity = 0 — only spins up instances when needed
✅ RTO < 30 minutes: With Auto Scaling, EC2 instances can spin up within minutes
✅ RPO < 30 minutes: OpenSearch cross-cluster replication supports this
✅ CloudFront origin failover enables automatic traffic shift
✅ App starts in 1 minute — works well with on-demand instance launch
🔄 Suitable when you want low-cost pilot-light DR that only activates on failure
✅ Good fit for the company’s RTO/RPO, cost sensitivity, and compliance
---
Option B
> New CloudFront distribution in DR. Use Route 53 for Regional failover. Auto Scaling group with desired capacity = 0. OpenSearch set up as Multi-AZ with Standby, with standby in DR Region.
❌ OpenSearch Multi-AZ Standby is within one region only – it does not support standby nodes in a separate Region
❌ Violates requirement for DR in another Region
✅ Route 53 regional failover works but CloudFront setup duplicates infra unnecessarily
🟥 Invalid due to incorrect OpenSearch configuration across Regions
---
Option C
> Like B, but with Auto Scaling desired capa...
Author: Deepak · Last updated Jul 20, 2026
A DevOps engineer uses AWS WAF to manage web ACLs across an AWS account. The DevOps engineer must ensure that AWS WAF is enabled for all Application Load Balancers (ALBs) in the account. The DevOps engineer uses an AWS CloudFormation template to deploy an individual ALB and AWS WAF as part of each application stack's deployment process. If AWS WAF is removed from the ALB...
Let's analyze each option based on the requirements:
Requirements Recap:
AWS WAF must be enabled for all ALBs in the account.
If AWS WAF is removed from an ALB after deployment, it must be automatically re-added.
The solution should be operationally efficient (minimal manual intervention, automated correction).
The ALBs and WAF are deployed via CloudFormation templates as part of app stacks.
---
Option A) AWS Config + alb-waf-enabled managed rule + Systems Manager Automation for remediation
Pros:
AWS Config has a managed rule alb-waf-enabled that detects ALBs without WAF.
AWS Config supports automatic remediation via Systems Manager Automation documents.
You can create an Automation document to re-associate WAF to the ALB.
This solution uses native AWS services with built-in integrations, minimizing custom code.
Continuous compliance monitoring and automated fixes.
Operationally efficient and scalable across accounts and regions.
When to use:
You want ongoing compliance enforcement with minimal maintenance.
You want AWS-native remediation for resource configuration drift.
---
Option B) AWS Config + alb-waf-enabled managed rule + EventBridge + Lambda calling start-resource-evaluation in detective mode
Cons:
The alb-waf-enabled rule already detects compliance. Calling `start-resource-evaluation` in detective mode is for evaluating resource changes but doesn’t fix noncompliance automatically.
Using EventBridge and Lambda to re-trigger evaluations adds complexity but does not provide automatic remediation.
Additional Lambda functions add operational overhead.
Requires more custom implementation for remediation.
When to use:
When you want to trigger evaluations on-demand or for complex multi-account setups, but without automatic remediation.
---
Option C) EventBridge periodically triggers Lambda that calls detect-stack-drift API, then modifies ALB attribute waf.fail\_open.enabled to true if drift detected o...
Author: Krishna · Last updated Jul 20, 2026
A company has an infernal web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto
Scaling group in a single Availability Zone. A SysOps administrator must make the app...
To make the application highly available, the key factor is to distribute the application across multiple Availability Zones (AZs) to ensure that if one AZ experiences a failure, the application can still be served by instances in another AZ. Here's an analysis of the options:
Option A: Increase the maximum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
- Rejected: Increasing the maximum number of instances in the Auto Scaling group may help handle higher traffic during peak usage, but it does not address the issue of high availability. The instances will still be located within a single Availability Zone, meaning that the application will still be vulnerable to the failure of that AZ.
Option B: Increase the minimum number of instances in the Auto Scaling group to meet the capacity that is required at peak usage.
- Rejected: Similar to Option A, increasing the minimum number of instances ensures that the Auto Scaling group will always have a minimum number of instances running. However, this does not address high availability because it still keeps all instances in a single Availability Zone. In the event of an AZ failure, the application would still be down.
Option C: Update the Auto Scaling group to launch new instances in a second Availability Zone in the same AWS Region.
- Selected: This option addresses high availability by distributing the EC2 instances across mult...
Author: Julian · Last updated Jul 17, 2026
A company hosts a website on multiple Amazon EC2 instances that run in an Auto Scaling group. Users are reporting slow responses during peak times between
6 PM and 11 PM every weekend. A SysOps administrator must implement a solution to improve performa...
To improve performance during peak times, the solution must efficiently scale the EC2 instances based on the demand, especially during the known peak times (6 PM to 11 PM on weekends). Here’s a detailed analysis of the options:
Option A: Create a scheduled Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function to increase the desired capacity before peak times.
- Rejected: While this approach can schedule capacity adjustments, it involves creating a custom AWS Lambda function, which adds complexity and requires additional operational effort. It’s not as operationally efficient as other solutions, as you need to manage Lambda function logic and monitor it. Additionally, using Lambda for this task may require unnecessary overhead if there are more streamlined solutions available.
Option B: Configure a scheduled scaling action with a recurrence option to change the desired capacity before and after peak times.
- Selected: This is the most operationally efficient solution. Using a scheduled scaling action allows you to automatically adjust the desired capacity at specific times (6 PM to 11 PM) without requiring manual intervention or complex configurations. The scaling action is based on a predictable time schedule, ensuring the Auto Scaling group has sufficient capacity during peak times. This is simple, efficient, and doesn’t involve custom code or complex management overhead.
Option C: Create a target tracking scaling policy to add more instances when memory utilization is above 70%.
- Rejected: This o...
Author: William · Last updated Jul 17, 2026
A company is running a website on Amazon EC2 instances behind an Application Load Balancer (ALB). The company configured an Amazon CloudFront distribution and set the ALB as the origin. The company created an Amazon Route 53 CNAME record to send all traffic through the CloudFront distribution. As an unintended side effect, m...
The issue of mobile users being served the desktop version of the website is likely due to CloudFront not forwarding the `User-Agent` header to the backend servers (in this case, the Application Load Balancer), causing the website to serve the same content regardless of whether the user is on a mobile or desktop device. The key factor here is ensuring that the `User-Agent` header is forwarded so that the EC2 instances can properly detect the device type and serve the appropriate content.
Option A: Configure the CloudFront distribution behavior to forward the User-Agent header.
- Selected: This is the best solution. By configuring CloudFront to forward the `User-Agent` header, the backend (ALB and EC2 instances) will be able to detect the device type (mobile vs. desktop) and serve the appropriate version of the website. This action ensures that CloudFront passes relevant device information to the origin, allowing the website to display differently for mobile and desktop users. This solution is simple, effective, and directly addresses the issue.
Option B: Configure the CloudFront distribution origin settings. Add a User-Agent header to the list of origin custom headers.
- Rejected: This option would require manually adding the `User-Agent` header as a custom header in the CloudFront distribution settings. While this might work in some scenarios, forwarding the `User-Agent` header via the standard `Forward Headers` setting in CloudFront (as described in Option A) is a more straightforward and native solution. Custom headers generally add complexity and are unnecessary when y...
Author: Aditya · Last updated Jul 17, 2026
A SysOps administrator has enabled AWS CloudTrail in an AWS account. If CloudTrail is disabled, it must be re-enabled immediately.
What should the SysOps adm...
The requirement is to ensure that if CloudTrail is disabled, it is automatically re-enabled immediately, without writing custom code. Let's analyze the options:
Option A: Add the AWS account to AWS Organizations. Enable CloudTrail in the management account.
- Rejected: While enabling CloudTrail at the management account level in AWS Organizations would ensure that CloudTrail is enabled for all accounts within the organization, it does not meet the requirement of re-enabling CloudTrail immediately if it gets disabled. This option requires initial setup but doesn’t address the immediate re-enabling of CloudTrail if it’s turned off.
Option B: Create an AWS Config rule that is invoked when CloudTrail configuration changes. Apply the AWS-ConfigureCloudTrailLogging automatic remediation action.
- Selected: This is the best option. By creating an AWS Config rule that monitors CloudTrail configuration, you can detect when CloudTrail is disabled. AWS Config has a built-in automatic remediation action (`AWS-ConfigureCloudTrailLogging`) that can automatically re-enable CloudTrail without the need for custom code. This solution is operationally efficient and directly addresses the requirement, ensuring CloudTrail is always enabled.
Option C: Create an AWS Config rule that is invoked when CloudTrail configuration changes. Configure the rule to invoke an AWS ...
Author: Aria · Last updated Jul 17, 2026
A company hosts its website on Amazon EC2 instances behind an Application Load Balancer. The company manages its DNS with Amazon Route 53, and wants to point its domain's zone apex t...
To point the domain's zone apex to the website hosted behind the Application Load Balancer (ALB) on Amazon EC2, it’s important to consider how DNS works with Route 53 and the limitations of certain record types.
Option A: An AAAA record for the domain's zone apex
- Rejected: An AAAA record maps a domain to an IPv6 address. While this could technically be used for IPv6 traffic, it doesn't help when you need to direct traffic to an Application Load Balancer, which typically resolves to an alias or IP address for the load balancer's DNS name. AAAA records are specific to IPv6, and are generally not used to route traffic to ALBs.
Option B: An A record for the domain's zone apex
- Rejected: While an A record can map a domain to an IPv4 address, it does not work directly with the ALB DNS name (which is not a fixed IP address but a CNAME). You cannot point the apex of a domain (e.g., `example.com`) to an ALB using an A record unless you resolve to an IP address, which in this case, ALBs use dynamic IPs that cannot be directly referenced via an A record.
Option C: A CNAME record for the domain's zone apex
- Rejected: A CNAME record cannot be used at the zone apex (the root domain), as per DNS standards. CNAME records can only be used for subdomai...
Author: Liam · Last updated Jul 17, 2026
A company must ensure that any objects uploaded to an S3 bucket are encrypted.
Which of the following act...
To ensure that any objects uploaded to an S3 bucket are encrypted, the key focus is on controlling the encryption of objects either through configuration or policies at the S3 bucket level. Let's evaluate each option and its feasibility:
A) Implement AWS Shield to protect against unencrypted objects stored in S3 buckets.
- Why it's not selected: AWS Shield is primarily designed to protect against Distributed Denial of Service (DDoS) attacks. It doesn't have anything to do with enforcing encryption of objects stored in S3. Therefore, it is not applicable in this context.
B) Implement Object access control list (ACL) to deny unencrypted objects from being uploaded to the S3 bucket.
- Why it's not selected: ACLs (Access Control Lists) manage access permissions to S3 objects and buckets but do not enforce encryption requirements. ACLs cannot directly prevent unencrypted objects from being uploaded, making it unsuitable for this use case.
C) Implement Amazon S3 default encryption to make sure that any object being uploaded is encrypted before it is stored.
- Why it's selected: S3 default encryption automatically ensures that all objects uploaded to the S3 bucket are encrypted. This can be configured to use either server-side encryption with AWS-managed keys (S...
Author: Lucas Carter · Last updated Jul 17, 2026
A company has a stateful web application that is hosted on Amazon EC2 instances in an Auto Scaling group. The instances run behind an Application Load
Balancer (ALB) that has a single target group. The ALB is configured as the origin in an Amazon CloudFront distribution. Users are reporting random logou...
Problem Overview:
The issue described is random logouts from a stateful web application hosted on EC2 instances behind an Application Load Balancer (ALB). The ALB is the origin in a CloudFront distribution. This typically happens when users are routed to different backend instances across sessions, and the session state isn't preserved correctly, leading to random logouts. The solution should focus on ensuring that users are consistently routed to the same EC2 instance that holds their session state.
Evaluation of Options:
A) Change to the least outstanding requests algorithm on the ALB target group.
- Why it's not selected: The "least outstanding requests" algorithm in the ALB is used to distribute traffic more evenly by routing traffic to the instance with the least number of outstanding requests. However, this doesn't directly address the issue of session stickiness or ensuring that a user is consistently routed to the same EC2 instance for session persistence. The random logouts are likely due to the user being routed to different instances that do not have the session data.
B) Configure cookie forwarding in the CloudFront distribution cache behavior.
- Why it's selected: When using stateful applications with session cookies, it’s critical that CloudFront forwards cookies to the ALB so that the session information is included in requests. By configuring cookie forwarding in CloudFront, the session information will be passed from the client to the ALB, ensuring the correct instance processes the request and maintains the user’s session. This is essential for resolving the random logouts caused by users being routed to different instances without proper session persistence.
C) Configure header forwarding in the CloudFront distr...
Author: James · Last updated Jul 17, 2026
A company is running a serverless application on AWS Lambda. The application stores data in an Amazon RDS for MySQL DB instance. Usage has steadily increased, and recently there have been numerous "too many connections" errors when the Lambda function attempts to connect to the database. The company already has configur...
Problem Overview:
The issue here is that the Lambda function is encountering "too many connections" errors when trying to connect to the Amazon RDS for MySQL instance. This suggests that the database is hitting its maximum number of allowed connections, and this is causing issues as more Lambda invocations occur. The company has already set the maximum `max_connections` value, but it’s still encountering issues as usage grows.
Evaluation of Options:
A) Create a read replica of the database. Use Amazon Route 53 to create a weighted DNS record that contains both databases.
- Why it's not selected: While creating a read replica can help with read-heavy workloads by offloading some of the read traffic to the replica, it does not directly address the issue of "too many connections" for write operations, which is likely the root cause here. Additionally, using weighted DNS records can lead to complications in managing writes (since read replicas are not suitable for writes). This approach doesn't provide a direct and effective solution to connection limitations.
B) Use Amazon RDS Proxy to create a proxy. Update the connection string in the Lambda function.
- Why it's selected: Amazon RDS Proxy is a service designed to manage database connections more efficiently between applications (like Lambda) and the RDS database. It helps reduce the overhead of managing a large number of database connections by pooling connections and reusing them, which prevents the "too many connections" error. RDS Proxy can handle a larger number of concurrent connections and ensure that the Lambda function doesn’t exhaust the max_connections limit of the R...
Author: ShadowWolf101 · Last updated Jul 17, 2026
A SysOps administrator is deploying an application on 10 Amazon EC2 instances. The application must be highly available. The instances must be placed on distinct underlying ha...
Problem Overview:
The goal is to deploy an application on 10 Amazon EC2 instances, ensuring the application is highly available and that the instances are placed on distinct underlying hardware to avoid a single point of failure. This means we need a strategy that distributes instances across different physical hardware within a region, while maintaining high availability.
Evaluation of Options:
A) Launch the instances into a cluster placement group in a single AWS Region.
- Why it's not selected: A cluster placement group is designed to group EC2 instances within a single AZ to provide high performance and low latency. However, this would place the instances on the same underlying hardware or within the same set of hardware resources, meaning they may not be spread across distinct underlying hardware. This does not meet the requirement for high availability, as all instances could fail if the underlying hardware or AZ experiences issues. So, this option is not ideal for high availability when distinct hardware is required.
B) Launch the instances into a partition placement group in multiple AWS Regions.
- Why it's not selected: A partition placement group is designed to distribute instances across multiple partitions within a single AWS Region, but it cannot span multiple regions. Launching instances across multiple regions would involve different regions entirely, which introduces complexity for maintaining the application across regions and managing high availability. In addition, this would result in higher latency between instances and more complex networking, which is not necessary for most appli...
Author: Lucas Carter · Last updated Jul 17, 2026
A SysOps administrator is troubleshooting an AWS CloudFormation template whereby multiple Amazon EC2 instances are being created. The template is working in us-east-1, but it is failing in us-west-2 with the error code:
AMI [ami-12345678] does not ...
Problem Overview:
The issue is that an AWS CloudFormation template works in one region (us-east-1) but fails in another (us-west-2) because the specified Amazon Machine Image (AMI) ID does not exist in the destination region. This happens because AMI IDs are region-specific and vary across different regions.
Evaluation of Options:
A) Copy the source region's Amazon Machine Image (AMI) to the destination region and assign it the same ID.
- Why it's not selected: While copying the AMI from us-east-1 to us-west-2 is a possible solution, the problem is that AMI IDs are region-specific, and you cannot guarantee the same AMI ID across different regions. This means the AMI ID in us-east-1 (ami-12345678) will not be the same in us-west-2, even if the AMI is copied. Therefore, this approach does not solve the root cause of the issue, as it requires manual management and does not automate the process in CloudFormation.
B) Edit the AWS CloudFormation template to specify the region code as part of the fully qualified AMI ID.
- Why it's not selected: CloudFormation templates do not support including region codes directly in the AMI ID. The AMI ID is specific to each region and needs to be specified dynamically based on the region the stack is being deployed to. This approach would not work as CloudFormation does not handle region-specific information within the AMI ID directly like this.
C) Edit the AWS CloudFormation template to offer a drop-down list of all AMIs to the user by using the AWS::EC2...
Author: Noah · Last updated Jul 17, 2026
A SysOps administrator is provisioning an Amazon Elastic File System (Amazon EFS) file system to provide shared storage across multiple Amazon EC2 instances. The instances all exist in the same VPC across multiple Availability Zones. There are two instances in each Availability Zone. The SysOps administrator ...
To determine the best solution for making the Amazon Elastic File System (Amazon EFS) accessible with the lowest possible latency to multiple EC2 instances spread across multiple Availability Zones (AZs), let's evaluate the options:
Option A: Create a mount target for the EFS file system in the VPC. Use the mount target to mount the file system on each of the instances.
- Analysis: This option suggests creating only one mount target for the EFS file system in the VPC and mounting it on all instances. However, this would not provide low latency since the instances are distributed across multiple AZs. With only one mount target, instances in different AZs would have to route traffic through potentially distant resources, introducing network latency.
- Rejected: This option does not optimize for low-latency access because it doesn't account for multiple AZs and could result in suboptimal routing between AZs.
Option B: Create a mount target for the EFS file system in one Availability Zone of the VPC. Use the mount target to mount the file system on the instances in that Availability Zone. Share the directory with the other instances.
- Analysis: This option creates only one mount target in a single AZ, and the instances in other AZs would share the directory. While this might seem feasible for file sharing, it does not offer low-latency access to instances in other AZs. There will still be inter-AZ traffic when accessing the file system, which introduces unnecessary latency.
- Rejected: Although it offers shared access, it is not the best for low latency across multiple AZs because it doesn't provide direct access from each AZ to the...
Author: Victoria · Last updated Jul 17, 2026
A SysOps administrator has successfully deployed a VPC with an AWS CloudFormation template. The SysOps administrator wants to deploy the same template across multiple accounts that are managed through AWS Orga...
Let's evaluate the options for deploying the same AWS CloudFormation template across multiple accounts in an AWS Organization, focusing on operational overhead:
Option A: Assume the OrganizationAccountAccessRole IAM role from the management account. Deploy the template in each of the accounts.
- Analysis: This option requires manually assuming a role (OrganizationAccountAccessRole) in each account to deploy the CloudFormation template. While it can work, it requires manual intervention or automation through scripts for each account. This could be operationally expensive, as it necessitates managing multiple steps and access in each account.
- Rejected: Although it can technically meet the requirement, it involves more manual work and operational overhead compared to the alternatives.
Option B: Create an AWS Lambda function to assume a role in each account. Deploy the template by using the AWS CloudFormation CreateStack API call.
- Analysis: This option would involve creating an AWS Lambda function that assumes a role in each account and then deploys the template via the CloudFormation CreateStack API. While this could automate deployment, managing Lambda functions, assuming roles, and invoking API calls introduces complexity and operational overhead, especially as the number of accounts grows.
- Rejected: Although it automates the process, it adds unnecessary complexity by introducing Lambda functions and multiple steps for each account, which can increase operational overhead.
Option C: Create an AWS Lambda ...
Author: Ethan Smith · Last updated Jul 17, 2026
A company is running distributed computing software to manage a fleet of 20 Amazon EC2 instances for calculations. The fleet includes 2 control nodes and 18 task nodes to run the calculations. Control nodes can automatically start the task nodes.
Currently, all the nodes run on demand. The control nodes must be available 24 hours a day, 7 days a week. The task nodes run f...
To optimize the cost of the solution, we need to focus on how to reduce the cost of EC2 instances based on their usage patterns. Let's evaluate the options:
Option A: Purchase EC2 Instance Savings Plans for the control nodes.
- Analysis: EC2 Instance Savings Plans provide a discount (compared to On-Demand prices) in exchange for a one- or three-year commitment to using a specific instance family, region, or operating system. Since the control nodes need to be available 24/7, they are a good candidate for this option. By committing to long-term usage, the company can save significantly on the cost of running the control nodes.
- Selected: This is a great option to reduce the cost for the control nodes because they are always running, and a Savings Plan offers a substantial discount for long-term usage.
Option B: Use Dedicated Hosts for the control nodes.
- Analysis: Dedicated Hosts are physical servers with EC2 instances running on them, which offer the benefit of having full control over instance placement. However, they are typically more expensive than On-Demand instances and Savings Plans. Dedicated Hosts are mainly useful for compliance or licensing reasons, not for cost optimization.
- Rejected: This option is generally more expensive and doesn't directly contribute to cost savings in the context of the control nodes, which would benefit more from Savings Plans.
Option C: Use Reserved Instances for the task nodes.
- Analysis: Reserved Instances (RIs) provide a discounted rate for instances in exchange for a one- or three-year commitment. However, the task nodes only run for 4 hours a day. The infrequent and short duration of their usage makes RIs less suitable, as they require consistent, lon...
Author: Evelyn · Last updated Jul 17, 2026
A company is supposed to receive a data file every hour in an Amazon S3 bucket. An S3 event notification invokes an AWS Lambda function each time a file arrives. The function processes the data for use by an application.
The application team notices that sometimes the file does not arrive. The application team wants to ...
To solve the problem efficiently, we need to determine a solution that reliably alerts the application team if a file doesn't arrive within an hour, considering the constraints of S3, Lambda, and CloudWatch integration.
Let’s break down each option:
Option A: Add an S3 Lifecycle rule on the S3 bucket with a scope that is limited to objects created in the last hour. Configure another S3 event notification to be invoked by the lifecycle transition when the number of objects transitioned is zero. Publish a message to an SNS topic to notify the application team.
- Issues: This option uses S3 Lifecycle rules, which are designed to manage objects based on their age (transitioning to a different storage class, for instance). However, the task is to detect the absence of a file in the bucket, not to transition files. S3 event notifications are not typically triggered by lifecycle transitions. This method would be difficult to configure correctly and is not a suitable mechanism for detecting missing files.
- Rejected because: Lifecycle rules and event notifications on transitions are not optimal for detecting missing files and require complex setup.
Option B: Configure another S3 event notification to invoke a Lambda function that posts a message to an SQS queue. Create a CloudWatch alarm to publish a message to SNS when the ApproximateAgeOfOldestMessage metric of the queue is greater than 1 hour.
- Issues: While this option introduces the idea of using CloudWatch and SQS, it would be over-complicated. Each time a file arrives, a Lambda function triggers an event notification and posts the event to an SQS queue. The real-time check would then depend on monitoring the age of the oldest message in the queue. This solution introduces additional services (SQS) and adds unnecessary complexity to monitor a file arrival within an hour.
- Rejected because: The solution involves unnecessary complexity with SQS...
Author: Siddharth · Last updated Jul 17, 2026
A company recently acquired another corporation and all of that corporation's AWS accounts. A financial analyst needs the cost data from these accounts. A
SysOps administrator uses Cost Explorer to generate cost and usage reports. The SysOps administrator notices that "No ...
To address the problem of untagged resources, we need a solution that efficiently identifies and tags resources without unnecessarily complex configurations. Let's evaluate the options:
Option A: Add the accounts to AWS Organizations. Use a service control policy (SCP) to tag all the untagged resources.
- Issues: While adding the accounts to AWS Organizations and using an SCP might help with central governance and policy enforcement, SCPs are primarily used to restrict actions rather than to tag resources. They cannot automatically enforce resource tagging. Therefore, this approach would not directly solve the issue of tagging untagged resources.
- Rejected because: SCPs cannot be used to tag resources; they are for controlling permissions, not resource management.
Option B: Use an AWS Config rule to find the untagged resources. Set the remediation action to terminate the resources.
- Issues: AWS Config rules can track resources and enforce compliance based on configurations. However, automatically terminating untagged resources could lead to serious disruptions and data loss. This is a very aggressive remediation approach and may not be acceptable in a production environment where resources may be untagged for various reasons.
- Rejected because: Terminating untagged...
Author: Daniel · Last updated Jul 17, 2026
While setting up an AWS managed VPN connection, a SysOps administrator creates a customer gateway resource in AWS. The customer gateway device resides in a data center with a NAT gateway in ...
When setting up an AWS managed VPN connection, the key is to identify the correct address to use for the customer gateway resource, as this is how AWS establishes the connection to the customer’s VPN device. Let’s analyze each option:
Option A: The private IP address of the customer gateway device
- The private IP address of the customer gateway device would be used if the customer gateway device is directly connected to AWS without any NAT device in between. However, since there is a NAT gateway in front of the customer gateway device, the private IP address would not be correct in this scenario because AWS needs to establish the connection over the public internet. Hence, this option is rejected.
Option B: The MAC address of the NAT device in front of the customer gateway device
- The MAC address of the NAT device is not relevant for establishing a VPN connection. The MAC address is a hardware address used for local network communication and not for IP-based communication over the internet, which AWS uses for the VPN. Thus, this option is rejected.
Option C: The public IP address of the customer gateway d...
Author: Julian · Last updated Jul 17, 2026
A company has a web application that is experiencing performance problems many times each night. A root cause analysis reveals sudden increases in CPU utilization that last 5 minutes on an Amazon EC2 Linux instance. A SysOps administrator must find the process ID (PID) of the service or process that is consum...
When troubleshooting performance issues on an EC2 instance, the goal is to determine the specific process or service consuming excessive CPU, while minimizing effort and ensuring a streamlined, automated approach. Let's evaluate each option:
Option A: Configure the Amazon CloudWatch agent procstat plugin to capture CPU process metrics
- The CloudWatch agent procstat plugin can be used to collect detailed process-level metrics, including CPU utilization by process, for an EC2 instance. By configuring this plugin, you can send detailed metrics such as process IDs (PIDs) and CPU usage to Amazon CloudWatch, which can then be monitored and analyzed over time. This option provides an automated, efficient solution that allows for continuous monitoring of process performance with minimal manual intervention. This option is optimal because it directly addresses the problem (capturing CPU utilization at the process level) and automates the data collection.
Option B: Configure an AWS Lambda function to run every minute to capture the PID and send a notification
- Using AWS Lambda to run every minute and capture the PID involves additional complexity, including setting up Lambda functions, permissions, and handling the captured data. While this approach would work, it is more cumbersome and involves significant setup and maintenance effort compared to the simpler CloudWatch agent solution in Option A. Furthermore, Lambda functions would need to actively collect and report data every minute, leading to potential resource consumption, especially if the issue is not occurring consistently. This option is rejected due to its complexity ...
Author: Lucas · Last updated Jul 17, 2026
A SysOps administrator configured AWS Backup to capture snapshots from a single Amazon EC2 instance that has one Amazon Elastic Block Store (Amazon
EBS) volume attached. On the first snapshot, the EBS volume has 10 GiB of data. On the second snapshot, the EBS volume still contains 10 GiB of data, but 4
GiB have changed. On the th...
When considering AWS Backup and EBS snapshots, it’s important to understand how snapshots are managed and how storage is calculated. Let's evaluate each option based on the information provided:
Snapshot Mechanics:
- Incremental Snapshots: AWS EBS snapshots are incremental, meaning only the data that has changed between snapshots is stored. The first snapshot contains the entire volume, and subsequent snapshots only store the changes (deltas) between the snapshots.
- Storage Calculation:
- First Snapshot: This snapshot will store the entire volume data, which is 10 GiB in size.
- Second Snapshot: The second snapshot only captures the 4 GiB of changed data from the first snapshot (since the first snapshot already contains the original 10 GiB, and 4 GiB of it changed).
- Third Snapshot: The third snapshot contains the 2 GiB of added data (since 2 GiB of new data has been added to the volume, making the total size of the volume now 12 GiB).
Now, let’s calculate the total storage required for these snapshots:
- Snap...
Author: Ahmed · Last updated Jul 17, 2026
A team is managing an AWS account that is a member of an organization in AWS Organizations. The organization has consolidated billing features enabled. The account hosts several applications.
A SysOps administrator has applied tags to resources within the account to reflect the environment. The t...
To meet the requirement of generating a report that breaks down charges by environment, the SysOps administrator needs to make sure that AWS can categorize and report costs based on the applied tags. Here's an analysis of each option:
Option A: Filter, map, and categorize resource groups in Tag Editor
- The Tag Editor allows the administrator to filter and categorize resources based on tags, but it does not directly assist with cost allocation. It helps in organizing and managing tags, but it doesn’t specifically generate cost breakdown reports. This option is rejected because it does not address the need to generate a report of charges by environment.
Option B: Ensure that the organization's service control policies (SCPs) allow access to cost allocation tags
- Service Control Policies (SCPs) in AWS Organizations are used to manage permissions at the organizational level. While they can restrict or grant access to resources, they are not directly related to generating cost allocation reports. Ensuring that SCPs allow access to cost allocation tags would not solve the requirement of generating a cost breakdown report by environment. This option is rejected because it doesn't directly contribute to generating cost reports.
Option C: Ensure that the IAM credentials that are used to access Cost Explorer have permissions to group cost by tags
- To generate cost breakdown reports using Cost Explorer, IAM credentials need the appropriate permissions t...
Author: Isabella · Last updated Jul 17, 2026
A company uses an AWS CloudFormation template to provision an Amazon EC2 instance and an Amazon RDS DB instance. A SysOps administrator must update the template to ensure that the DB instance is created before the ...
To ensure that the RDS DB instance is created before the EC2 instance in an AWS CloudFormation stack, the SysOps administrator must manage the creation order between the two resources. Let's evaluate each option based on the specific requirement:
Option A: Add a wait condition to the template. Update the EC2 instance user data script to send a signal after the EC2 instance is started.
- A wait condition allows you to pause the creation of resources until a signal is received. While this can be used to wait for specific events to occur before proceeding, it's more useful for complex workflows that require manual signaling. It doesn't specifically guarantee that the RDS instance is created before the EC2 instance. Also, using a wait condition might introduce unnecessary complexity, especially if the goal is simply to ensure the creation order. This option is rejected because it adds unnecessary complexity for the task at hand.
Option B: Add the DependsOn attribute to the EC2 instance resource, and provide the logical name of the RDS resource.
- The DependsOn attribute explicitly defines the order in which AWS CloudFormation creates resources. In this case, adding a DependsOn attribute to the EC2 instance resource ensures that CloudFormation will wait for the RDS instance to be created first before launching the EC2 instance. This solution is simple and directly meets the requirement of ensuring the correct creation order. This is the correct option because it precisely addresses the requirement with minimal effort.
...
Author: Noah · Last updated Jul 17, 2026
A company hosts a static website on Amazon S3. The website is served by an Amazon CloudFront distribution with a default TTL of 86,400 seconds.
The company recently uploaded an updated version of the website to Amazon S3. However, users still see the old content when they refresh the site. A SysOps adm...
The issue described is that users are still seeing the old content on the website, despite the updated version being uploaded to Amazon S3. This suggests that the CloudFront cache is serving the old content due to the default TTL setting of 86,400 seconds (24 hours). In order to make the updated content visible as soon as possible, the SysOps administrator needs to force CloudFront to fetch the new content from the S3 bucket immediately.
Let’s analyze each option:
A) Adjust the TTL value for the DNS CNAME record that is pointing to the CloudFront distribution.
- Analysis: The TTL value for the DNS CNAME record affects how long DNS records are cached by DNS resolvers, not how long CloudFront caches the website content. Adjusting the TTL for DNS records would not directly impact the CloudFront cache, so this option would not solve the problem of serving updated content.
- Rejected: It doesn’t address CloudFront’s caching of content, which is the root issue.
B) Create an invalidation on the CloudFront distribution for the old S3 objects.
- Analysis: An invalidation request in CloudFront forces the distribution to remove cached objects. After invalidation, CloudFront will fetch the updated content from the S3 bucket. This option directly solves the problem by ensuring that CloudFront serves the latest version of the website.
- Selected: This is the correct solution becau...
Author: Leo · Last updated Jul 17, 2026
A SysOps administrator is responsible for managing a company's cloud infrastructure with AWS CloudFormation. The SysOps administrator needs to create a single resource that consists of multiple AWS services. The resource must support creation and deletion through the CloudFo...
In this scenario, the SysOps administrator needs to create a single resource that consists of multiple AWS services and supports creation and deletion through the CloudFormation console.
Let's evaluate each option in detail:
A) AWS::EC2::Instance with a cfn-init helper script
- Analysis: The `AWS::EC2::Instance` resource is used to create an EC2 instance, and the `cfn-init` helper script is used for initialization tasks on the EC2 instance. However, this option creates a single EC2 instance, which might not encompass multiple AWS services. Additionally, while `cfn-init` can initialize software on the instance, it does not provide a way to directly create and manage multiple AWS services through CloudFormation.
- Rejected: This option does not fulfill the requirement of creating a single resource consisting of multiple AWS services.
B) AWS::OpsWorks::Instance
- Analysis: The `AWS::OpsWorks::Instance` resource creates an instance within AWS OpsWorks, a configuration management service. OpsWorks can manage multiple resources (such as EC2 instances and other configurations) but is primarily used for managing EC2 instances with a more focused, application-centric approach. It does not allow creating arbitrary combinations of multiple services as needed here.
- Rejected: This resource is specific to OpsWorks and does not provide flexibility to create a general resource consisting of multiple services from various AWS resources.
C) AWS::SSM::Document
...
Author: Ming88 · Last updated Jul 17, 2026
A new website will run on Amazon EC2 instances behind an Application Load Balancer. Amazon Route 53 will be used to manage DNS records.
What type of record should be set in Route 53 to point the web...
To point the website's apex domain (e.g., `company.com`) to the Application Load Balancer (ALB), the appropriate DNS record type needs to be selected in Route 53. Let’s analyze each option:
A) CNAME
- Analysis: A `CNAME` record maps one domain name to another domain name (e.g., `www.example.com` to `example.com`). However, `CNAME` records cannot be used for apex domain names (the root domain, such as `company.com`). DNS standards prohibit using `CNAME` at the apex because it would conflict with other required records, such as `NS` and `SOA`.
- Rejected: This option is not valid for apex domain names.
B) SOA
- Analysis: The `SOA` (Start of Authority) record is a mandatory DNS record that defines the authoritative DNS server for the domain. It provides metadata about the zone but does not point a domain name to an endpoint, such as an ALB.
- Rejected: This record is not suitable for directing traffic to the ALB.
C) TXT
- Analysis: A `TXT` record allows for storing ar...
Author: Ahmed · Last updated Jul 17, 2026
A company is implementing security and compliance by using AWS Trusted Advisor. The company's SysOps team is validating the list of Trusted Advisor checks that it can access.
...
When using AWS Trusted Advisor, the number and types of checks available are influenced by specific factors. Let's evaluate the given options to determine which one affects the number of available Trusted Advisor checks:
A) Whether at least one Amazon EC2 instance is in the running state
- Analysis: The number of Trusted Advisor checks is not dependent on the state of individual EC2 instances. Trusted Advisor checks focus on overall best practices for your AWS environment, rather than the operational status of EC2 instances.
- Rejected: This factor does not influence the number of available Trusted Advisor checks.
B) The AWS Support plan
- Analysis: The quantity and types of Trusted Advisor checks available depend heavily on the AWS Support plan.
- Basic and Developer Support plans provide access to a limited set of checks (i.e., 7 checks).
- Business and Enterprise Support plans provide access to the full set of checks, which includes over 50 checks, covering a wide range of AWS services and security best practices.
Therefore, the AWS Support plan directly affects the number of Trusted Advisor checks available to an account.
- Selected: This is the correct option because the AWS Support plan determines how many Trusted Advisor checks an account has access to, with...
Author: Liam · Last updated Jul 17, 2026
A SysOps administrator is investigating issues on an Amazon RDS for MariaDB DB instance. The SysOps administrator wants to display the database load categorized by deta...
To investigate database load categorized by detailed wait events for an Amazon RDS for MariaDB DB instance, the SysOps administrator needs to focus on gathering specific performance metrics related to wait events.
Let’s analyze each option:
A) Create an Amazon CloudWatch dashboard
- Analysis: A CloudWatch dashboard provides a visual representation of CloudWatch metrics, including RDS metrics. However, it does not inherently categorize or provide detailed information about database wait events. While it can display metrics related to the RDS instance (such as CPU utilization, IOPS, etc.), it does not provide the detailed database-level wait event categorization necessary for understanding DB performance.
- Rejected: This option would help monitor general metrics but not detailed wait event information.
B) Enable Amazon RDS Performance Insights
- Analysis: Amazon RDS Performance Insights is designed specifically to help users monitor and analyze database performance. It categorizes database load by wait events, showing which specific operations are consuming the most resources. This makes it ideal for the SysOps administrator to understand the detailed database load, including wait events, which is exactly what the administrator is looking for.
- Selected: This is the correct option because Performance Insights provides detailed analysis of wait events and database load, which d...
Author: Ishaan · Last updated Jul 17, 2026
A company is planning to host an application on a set of Amazon EC2 instances that are distributed across multiple Availability Zones. The application must be able to scale to millions of requests each second.
A SysOps administrator must design a solution to distribute the traffic to the EC2 instances. The solution must be optimized to handle ...
To address the requirements of the application, let's evaluate the different options based on the scenario's needs:
Key Requirements:
1. Distribute traffic across multiple Availability Zones: Traffic should be able to scale and be distributed effectively across different zones.
2. Scalability to handle millions of requests per second: The system should efficiently handle very high volumes of traffic.
3. Ability to manage sudden and volatile traffic patterns: The solution must be able to handle surges in traffic without performance degradation.
4. Single static IP address per Availability Zone: Each Availability Zone should have a unique static IP address for routing traffic.
A) Amazon Simple Queue Service (Amazon SQS)
- Analysis: Amazon SQS is a message queue service used for decoupling applications and enabling asynchronous communication. It’s not designed for traffic distribution across EC2 instances for high-volume, real-time traffic. SQS is suitable for scenarios where backend services need to process messages at a pace they can handle but not for distributing web traffic to EC2 instances.
- Rejection: It does not support distributing HTTP/HTTPS traffic to EC2 instances in a way that would meet the high-volume, real-time scaling requirements.
B) Application Load Balancer (ALB)
- Analysis: An Application Load Balancer operates at the application layer (Layer 7) and is designed to route HTTP and HTTPS traffic. It can distribute traffic across multiple EC2 instances in different Availability Zones. However, it does not provide static IP addresses per Availability Zone and is primarily intended for application-level traffic.
- Rejection: While ALB is excellent for HTTP/HTTPS traffic distribution, it does not offer the ability to provide a single static IP per Availability Zone, which is one of the key requirements.
C) AWS Global Accelerator
- A...
