Question 1

A company is planning to host their enterprise web application in an Amazon ECS Cluster which uses the Fargate launch type. The database credentials, API keys, and other sensitive parameters should be provided to the application image by using environment variables. A DevOps engineer was instructed to ensure that the sensitive parameters are highly secured when passed to the image and must be kept in a dedicated storage with lifecycle management. The size of some parameters can exceed up to 12 Kb in size and must be rotated automatically.

Which of the following is the MOST suitable solution that the DevOps engineer should implement?

Options :

A : Store the API Keys and other credentials in AWS Key Management Service (AWS KMS) and enable automatic key rotation. Set up an IAM role to the ECS task definition script that allows access to AWS KMS to retrieve the necessary parameters when calling the register-task-definition action in Amazon ECS.

B : Keep the credentials using the AWS Secrets Manager and then encrypt them using AWS KMS. Set up an IAM Role for your Amazon ECS task execution role and reference it with your task definition which allows access to both KMS and AWS Secrets Manager. Within your container definition, specify secrets with the name of the environment variable to set in the container and the full ARN of the Secrets Manager secret which contains the sensitive data, to present to the container. Enable the built-in automatic key rotation for the credentials.

C : Keep the credentials using the AWS Systems Manager Parameter Store and then encrypt them using AWS KMS. Set up an IAM Role for your Amazon ECS task execution role and reference it with your task definition, which allows access to both KMS and the Parameter Store. Within your container definition, specify secrets with the name of the environment variable to set in the container and the full ARN of the Systems Manager Parameter Store parameter containing the sensitive data to present to the container. Enable the built-in automatic key rotation for the parameters.

D : Store the credentials using AWS Storage Gateway in the ECS task definition file of the ECS Cluster in order to centrally manage these sensitive data and securely transmit these only to those containers that need access to them. Ensure that the secrets are encrypted and can only be accessed to those services which have been granted explicit access to it via IAM Role, and only while those service tasks are running. Launch a custom rotation function in AWS Lambda and automatically rotate the credentials using Amazon EventBridge.

Answer: B

Question 2

A company has configured an Amazon S3 event source on an AWS Lambda function The company needs the Lambda function to run when a new object is created or an existing object IS modified In a particular S3 bucket The Lambda function will use the S3 bucket name and the S3 object key of the incoming event to read the contents of the created or modified S3 object The Lambda function will parse the contents and save the parsed contents to an Amazon DynamoDB table. The Lambda function's execution role has permissions to read from the S3 bucket and to write to the DynamoDB table, During testing, a DevOps engineer discovers that the Lambda function does not run when objects are added to the S3 bucket or when existing objects are modified. Which solution will resolve this problem?

Options :

A :

Increase the memory of the Lambda function to give the function the ability to process large files from the S3 bucket.

B :

Create a resource policy on the Lambda function to grant Amazon S3 the permission to invoke the Lambda function for the S3 bucket

C :

Configure an Amazon Simple Queue Service (Amazon SQS) queue as an OnFailure destination for the Lambda function

D :

Provision space in the /tmp folder of the Lambda function to give the function the ability to process large files from the S3 bucket

Answer: B

Question 3

A company's application uses a fleet of Amazon EC2 On-Demand Instances to analyze and process data. The EC2 instances are in an Auto Scaling group. The Auto Scaling group is a target group for an Application Load Balancer (ALB). The application analyzes critical data that cannot tolerate interruption. The application also analyzes noncritical data that can withstand interruption. The critical data analysis requires quick scalability in response to real-time application demand. The noncritical data analysis involves memory consumption. A DevOps engineer must implement a solution that reduces scale-out latency for the critical data. The solution also must process the noncritical data. Which combination of steps will meet these requirements? (Select TWO.)

Options :

A :

For the critical data, modify the existing Auto Scaling group. Create a warm pool instance in the stopped state. Define the warm pool size. Create a new version of the launch template that has detailed monitoring enabled. use Spot Instances.

B :

For the critical data, modify the existing Auto Scaling group. Create a warm pool instance in the stopped state. Define the warm pool size. Create a new version of the launch template that has detailed monitoring enabled. Use On-Demand Instances.

C :

For the critical data. modify the existing Auto Scaling group. Create a lifecycle hook to ensure that bootstrap scripts are completed successfully. Ensure that the application on the instances is ready to accept traffic before the instances are registered. Create a new version of the launch template that has detailed monitoring enabled.

D :

For the noncritical data, create a second Auto Scaling group that uses a launch template. Configure the launch template to install the unified Amazon CloudWatch agent and to configure the CloudWatch agent with a custom memory utilization metric. Use Spot Instances. Add the new Auto Scaling group as the target group for the ALB. Modify the application to use two target groups for critical data and noncritical data.

E :

For the noncritical data, create a second Auto Scaling group. Choose the predefined memory utilization metric type for the target tracking scaling policy. Use Spot Instances. Add the new Auto Scaling group as the target group for the ALB. Modify the application to use two target groups for critical data and noncritical data.

Answer: B,D

Question 4

A company has migrated its container-based applications to Amazon EKS and want to establish automated email notifications. The notifications sent to each email address are for specific activities related to EKS components. The solution will include Amazon SNS topics and an AWS Lambda function to evaluate incoming log events and publish messages to the correct SNS topic.

Which logging solution will support these requirements?

Options :

A : Enable Amazon CloudWatch Logs to log the EKS components. Create a CloudWatch subscription filter for each component with Lambda as the subscription feed destination.

B : Enable Amazon CloudWatch Logs to log the EKS components. Create CloudWatch Logs Insights queries linked to Amazon EventBridge events that invoke Lambda.

C : Enable Amazon S3 logging for the EKS components. Configure an Amazon CloudWatch subscription filter for each component with Lambda as the subscription feed destination.

D : Enable Amazon S3 logging for the EKS components. Configure S3 PUT Object event notifications with AWS Lambda as the destination.

Answer: A

Question 5

A multinational insurance firm has recently consolidated its multiple AWS accounts using AWS Organizations with several Organizational units (OUs) that group each department of the firm. Their IT division consists of two teams: the DevOps team and the Release & Deployment team. The first one is responsible for protecting its cloud infrastructure and ensuring that all of its AWS resources are compliant, while the latter is responsible for deploying new applications to AWS Cloud. The DevOps team has been instructed to set up a system that regularly checks if all of the running EC2 instances are using an approved AMI. However, the solution should not stop the Release & Deployment team from deploying an EC2 instance running on a non-approved AMI for their release process. The DevOps team must build a notification system that sends the compliance state of the AWS resources to improve and maintain the security of their cloud resources.

Which of the following is the MOST suitable solution that the DevOps team should implement?

Options :

A : Set up an AWS Config Managed Rule and specify a list of approved AMI IDs. Modify the rule to check whether the running Amazon EC2 instances are using specified AMIs. Configure AWS Config to stream configuration changes and notifications to an Amazon SNS topic which will send a notification to both teams for non-compliant instances.

B : Verify whether the running EC2 instances in your VPCs are using approved AMIs using Trusted Advisor checks. Set up a CloudWatch alarm and integrate it with the Trusted Advisor metrics that will check all of the AMIs being used by your Amazon EC2 instances and that will send a notification to both teams if there is a running instance which uses an unapproved AMI.

C : Automatically check all of the AMIs that are being used by your EC2 instances using the Amazon Inspector service. Use an SNS topic that will send a notification to both the DevOps and Release & Deployment teams if there is a non-compliant EC2 instance running in their VPCs.

D : Assign a Service Control Policy and an IAM policy that restricts the AWS accounts and the development team from launching an EC2 instance using an unapproved AMI. Set up a CloudWatch alarm that will automatically notify the DevOps team if there are non-compliant EC2 instances running in their VPCs.

Answer: A