Question 1

A company runs a workload on Amazon EC2 instances. The company needs a control that requires the use of Instance Metadata Service Version 2 (IMDSv2) on all EC2 instances in the AWS account. If an EC2 instance does not prevent the use of Instance Metadata Service Version 1 (IMDSv1), the EC2 instance must be terminated. Which solution will meet these requirements?

Options :

A :

Set up AWS Config in the account. Use a managed rule to check EC2 instances. Configure the rule to remediate the findings by using AWS Systems Manager Automation to terminate the instance.

B :

Create a permissions boundary that prevents the ec2:Runlnstance action if the ec2:MetadataHttpTokens condition key is not set to a value of required. Attach the permissions boundary to the IAM role that was used to launch the instance.

C :

Set up Amazon Inspector in the account. Configure Amazon Inspector to activate deep inspection for EC2 instances. Create an Amazon EventBridge rule for an Inspector2 finding. Set an AWS Lambda function as the target to terminate the instance.

D :

Create an Amazon EventBridge rule for the EC2 instance launch successful event. Send the event to an AWS Lambda function to inspect the EC2 metadata and to terminate the instance.

Answer: B

Question 2

A DevOps engineer needs to back up sensitive Amazon S3 objects that are stored within an S3 bucket with a private bucket policy using S3 cross-Region replication functionality. The objects need to be copied to a target bucket in a different AWS Region and account.

Which combination of actions should be performed to enable this replication? (Choose three.)

Options :

A : Create a replication IAM role in the source account

B : Create a replication I AM role in the target account.

C : Add statements to the source bucket policy allowing the replication IAM role to replicate objects.

D : Add statements to the target bucket policy allowing the replication IAM role to replicate objects.

E : Create a replication rule in the source bucket to enable the replication.

F : Create a replication rule in the target bucket to enable the replication.

Answer: A,D

Question 3

A PHP web application is uploaded to the AWS Elastic Beanstalk of the company's development account to automatically handle the deployment, capacity provisioning, load balancing, auto-scaling, and application health monitoring. Amazon RDS is used as the database, and it is tightly coupled to the Elastic Beanstalk environment. A DevOps Engineer noticed that if you terminate the environment, its database goes down as well. This issue prevents you from performing seamless updates with blue-green deployments. Moreover, this poses a critical security risk if the company decides to deploy the application in its production environment.

How can the DevOps Engineer decouple the database instance from the environment with the LEAST amount of data loss?

Options :

A : Decouple the Amazon RDS instance from your Elastic Beanstalk environment using a blue/green deployment strategy. Enable deletion protection and take an RDS DB snapshot of the database. Set up a new Elastic Beanstalk environment with the necessary information to connect to the Amazon RDS instance and delete the old environment.

B : Decouple the Amazon RDS instance from your Elastic Beanstalk environment using the blue/green deployment strategy to decouple. Take an RDS DB snapshot of the database and enable deletion protection. Set up a new Elastic Beanstalk environment with the necessary information to connect to the Amazon RDS instance. Before terminating the old Elastic Beanstalk environment, remove its security group rule first before proceeding.

C : Decouple the Amazon RDS instance from your Elastic Beanstalk environment using the Canary deployment strategy. Take an RDS DB snapshot of the database and enable deletion protection. Set up a new Elastic Beanstalk environment with the necessary information to connect to the Amazon RDS instance and delete the old environment.

D : Decouple the Amazon RDS instance from your Elastic Beanstalk environment using the Canary deployment strategy. Take an RDS DB snapshot of the database and then set up a new Elastic Beanstalk environment with the necessary information to connect to the Amazon RDS instance.

Answer: B

Question 4

A company has an application that runs on AWS Lambda and sends logs to Amazon CloudWatch Logs. An Amazon Kinesis data stream is subscribed to the log groups in CloudWatch Logs. A single consumer Lambda function processes the logs from the data stream and stores the logs in an Amazon S3 bucket. The company's DevOps team has noticed high latency during the processing and ingestion of some logs. Which combination of steps will reduce the latency? (Select THREE.)

Options :

A :

Create a data stream consumer with enhanced fan-out. Set the Lambda function that processes the logs as the consumer.

B : Increase the ParallelizationFactor setting in the Lambda event source mapping.

C : Configure reserved concurrency for the Lambda function that processes the logs.

D : Turn off the ReportBatchltemFailures setting in the Lambda event source mapping.

E : Increase the number of shards in the Kinesis data stream.

Answer: A,B,C

Question 5

A government-sponsored health service is running their web application containing information about the clinics, hospitals, medical specialists and other medical services in the country. They also have a set of public web services which enable third-party companies to search medical data for their respective applications and clients. Lambda functions are used for the public APIs. For its database-tier, an Amazon DynamoDB table stores all of the data with an Amazon ES domain which supports the search feature and stores the indexes. A DevOps engineer has been instructed to ensure that in the event of a failed deployment, there should be no downtime and a system should be in place to prevent subsequent deployments. The service must strictly maintain full capacity during API deployment without any reduced capacity to avoid degradation of service.

How can the engineer meet the above requirements in the MOST efficient way?

Options :

A : Deploy the DynamoDB tables, Lambda functions, and Amazon ES domain using AWS CloudFormation. Deploy changes with an AWS CodeDeploy blue/green deployment. Host the web application in AWS Elastic Beanstalk and set the deployment policy to All at Once.

B : Deploy the DynamoDB tables, Lambda functions, and Amazon ES domain using AWS CloudFormation. Deploy changes with an AWS CodeDeploy in-place deployment. Host the web application in AWS Elastic Beanstalk and set the deployment policy to Rolling.

C : Deploy the DynamoDB tables, Lambda functions, and Amazon ES domain using AWS CloudFormation. Deploy changes with an AWS CodeDeploy blue/green deployment. Host the web application in AWS Elastic Beanstalk and set the deployment policy to Immutable.

D : Deploy the DynamoDB tables, Lambda functions, and Amazon ES domain using AWS CloudFormation. Deploy changes with an AWS CodeDeploy blue/green deployment. Host the web application in Amazon S3 and enable cross-region replication.

Answer: C