Question 1

An AWS CodePipeline pipeline has implemented a code release process. The pipeline is integrated with AWS CodeDeploy to deploy versions of an application to multiple Amazon EC2 instances for each CodePipeline stage.

During a recent deployment, the pipeline failed due to a CodeDeploy issue. The DevOps team wants to improve monitoring and notifications during deployment to decrease resolution times.

What should the DevOps engineer do to create notifications when issues are discovered?

Options :

A : Implement Amazon CloudWatch Logs for CodePipeline and CodeDeploy, create an AWS Config rule to evaluate code deployment issues, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.

B : Implement Amazon EventBridge for CodePipeline and CodeDeploy, create an AWS Lambda function to evaluate code deployment issues, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.

C : Implement AWS CloudTrail to record CodePipeline and CodeDeploy API call information, create an AWS Lambda function to evaluate code deployment issues, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.

D : Implement Amazon EventBridge for CodePipeline and CodeDeploy, create an Amazon Inspector assessment target to evaluate code deployment issues, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.

Answer: B

Question 2

A leading software development company is using AWS CodeCommit as the source control repository of one of its cloud-based applications. There is a new requirement to automate its continuous integration and continuous deployment pipeline on its development, testing, and production environments. A security code review must be done to ensure that there is no leaked Personally Identifiable Information (PII) or other sensitive data. Each change should go through both unit testing as well as functional testing. Any code push to CodeCommit should automatically trigger the CI/CD pipeline, and an email notification to [email protected] should be sent in the event of build or deployment failures. In addition, an approval to stage the assets to Amazon S3 after tests should also be performed. The solution must strictly follow the CI/CD best practices.

Which among the following options should a DevOps Engineer implement to satisfy all of the requirements above?

Options :

A : Configure AWS CodePipeline to have a trigger to start off the pipeline when a new code change is committed on a certain branch. Add the required stages in the pipeline for security review, unit tests, functional tests, and manual approval. Use CloudWatch Events to detect changes in pipeline stages. Send an email notification to [email protected] using Amazon SES.

B : Configure the AWS CodePipeline to have a trigger to start off the pipeline when a new code change is committed on the master branch. In the pipeline, set up the required stages for security review, unit tests, functional tests, and manual approval. Use CloudTrail to detect changes in pipeline stages. Send an email notification to [email protected] using Amazon SNS.

C : Configure AWS CodePipeline to have a trigger to start off the pipeline when a new code change is committed on the master branch. Add the required stages in the pipeline for security review, unit tests, functional tests, and manual approval. Use CloudWatch Logs to detect changes in pipeline stages. Send an email notification to [email protected] using Amazon SES.

D : Configure the AWS CodePipeline to have a trigger to start off the pipeline when a new code change is committed on a certain code branch. In the pipeline, set up the required stages for security review, unit tests, functional tests, and manual approval. Use Amazon CloudWatch Events to detect changes in pipeline stages. Send an email notification to [email protected] using Amazon SNS.

Answer: D

Question 3

A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet regulatory compliance requirements. The security team wants to be notified when any keys have not been rotated after 90 days.

Which solution will accomplish this?

Options :

A : Configure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.

B : Configure an Amazon EventBridge event to launch an AWS Lambda function to call the AWS Trusted Advisor API and publish to an Amazon Simple Notification Service (Amazon SNS) topic.

C : Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.

D : Configure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.

Answer: C

Question 4

A DevOps engineer is implementing governance controls for a company that requires its infrastructure to be

housed within the United States. The engineer must restrict which AWS Regions can be used, and ensure an

alert is sent as soon as possible if any activity outside the governance policy takes place. The controls should

be automatically enabled on any new Region outside the United States (US).

Which combination of actions will meet these requirements? (Select TWO.)

Options :

A :

Create an AWS Organizations SCP that denies access to all non-global services in non-US Regions. Attach the policy to the root of the organization.

B :

Configure AWS CloudTrail to send logs to Amazon CloudWatch Logs and enable it for all Regions. Use a CloudWatch Logs metric filter to send an alert on any service activity in non-US Regions.

C :

Use an AWS Lambda function that checks for AWS service activity and deploy it to all Regions. Write an Amazon EventBridge rule that runs the Lambda function every hour, sending an alert if activity is found in a non-US Region.

D :

Use an AWS Lambda function to query Amazon Inspector to look for service activity in non-US Regions and send alerts if any activity is found.

E :

Write an SCP using the aws: RequestedRegion condition key limiting access to US Regions. Apply the policy to all users, groups, and roles

Answer: A,B

Question 5

A company uses Amazon RDS for all databases in its AWS accounts. The company uses AWS Control Tower to build a landing zone that has an audit and logging account. All databases must be encrypted at rest for compliance reasons. The company's security engineer needs to receive notification about any noncompliant databases that are in the company’s accounts.

Which solution will meet these requirements with the MOST operational efficiency?

Options :

A : Use AWS Control Tower to activate the optional detective control (guardrail) to determine whether the RDS storage is encrypted. Create an Amazon Simple Notification Service (Amazon SNS) topic in the company-s audit account. Create an Amazon EventBridge rule to filter noncompliant events from the AWS Control Tower control (guardrail) to notify the SNS topic. Subscribe the security engineer-s email address to the SNS topic.

B : Use AWS CloudFormation StackSets to deploy AWS Lambda functions to every account. Write the Lambda function code to determine whether the RDS storage is encrypted in the account the function is deployed to. Send the findings as an Amazon CloudWatch metric to the management account. Create an Amazon Simple Notification Service (Amazon SNS) topic. Create a CloudWatch alarm that notifies the SNS topic when metric thresholds are met. Subscribe the security engineer-s email address to the SNS topic.

C : Create a custom AWS Config rule in every account to determine whether the RDS storage is encrypted. Create an Amazon Simple Notification Service (Amazon SNS) topic in the audit account. Create an Amazon EventBidge rule to filter noncompliant events from the AWS Control Tower control (guardrail) to notify the SNS topic. Subscribe the security engineer-s email address to the SNS topic.

D : Launch an Amazon C2 instance. Run an hourly cron job by using the AWS CLI to determine whether the RDS storage is encrypted in each AWS account. Store the results in an RDS database. Notify the security engineer by sending email messages from the EC2 instance when noncompliance is detected

Answer: A