Amazon Practice Questions, Discussions & Exam Topics by our Authors
A data engineer develops an AWS Glue Apache Spark ETL job to perform transformations on a dataset. When the data engineer runs the job, the job returns an error that reads, 'No space left on device.'
The data engineer needs to identify the source of the error and...
The error “No space left on device” in an AWS Glue Apache Spark job typically indicates that the local disk on the Spark executors is running out of space, most commonly due to:
Large shuffle operations spilling to disk
Data skew causing a few executors to handle disproportionate data
Insufficient disk capacity in worker nodes
So the requirement has two parts:
1. Identify the root cause (diagnostics)
2. Apply a cost-effective fix
---
✅ Correct Options
B) Use the Spark UI and AWS Glue metrics to monitor data skew in the Spark executors
This is correct for identification.
Spark UI shows:
Stage-level skew (some tasks taking much longer)
Shuffle spill metrics (disk vs memory spill)
Executor storage usage
AWS Glue metrics help confirm:
Worker disk utilization spikes
Executor failures due to storage pressure
Why this is needed:
Before fixing, you must confirm whether the issue is data skew vs general undersizing vs bad partitioning.
👉 Best used for root cause analysis and performance debugging
---
D) Enable the `--write-shuffle-files-to-s3` job parameter. Use the salting technique.
This is correct for resolution.
`--write-shuffle-files-to-s3`:
Moves shuffle spill from local disk → Amazon S3
Directly prevents “No space left on device”
Very cost-effective vs scaling up workers
Salting technique:
...
Author: Sam · Last updated Jun 25, 2026
A company built a data lake and a data warehouse on AWS. The company wants to implement a data catalog to enhance the current data storage solutions. The company wants to have the capability to add business metadata and glossary information to the data...
The requirement is to build a data catalog with business metadata and glossary support for every data asset, with minimum operational overhead. The key is choosing a fully managed service that natively supports governance, cataloging, and business semantics without needing custom applications or self-managed infrastructure.
Key evaluation factors
Native data catalog + governance support
Built-in business glossary capability
Low operational overhead (managed service preferred)
No need for custom applications or manual metadata management
Integration with AWS data lake + warehouse
---
✅ Correct Option: C — Use Amazon DataZone
Amazon DataZone is designed specifically for this use case. It provides:
A centralized data catalog
Built-in business glossary management
Metadata forms to attach business context to assets
A self-service data portal for discovery and access
Governance workflows with minimal setup effort
Why this is best (least operational overhead)
Fully managed AWS service
No need to build or maintain custom UI or APIs
Native support for business metadata + glossary per asset
Designed for data lake + data warehouse governance together
Provides an out-of-the-box data portal
---
❌ Why other options are rejected
A — AWS Glue Data Catalog
Provides technical metadata (schemas, partitions, tables)
❌ Doe...
Author: Zara1234 · Last updated Jun 25, 2026
A data engineer uses AWS Lake Formation to manage access to data that is stored in an Amazon S3 bucket. The data engineer configures an AWS Glue crawler to discover data at a specific file location in the bucket, s3://examplepath. The crawler execution fails with the following error: 'The S3 location: ...
The error “The S3 location is not registered” is specific to AWS Lake Formation governance, not IAM or Glue catalog configuration.
Correct answer: B) Register the S3 location in Lake Formation to allow the crawler to access the data.
---
Why option B is correct
In AWS Lake Formation, any S3 path used as part of a governed data lake must be explicitly registered as a data lake location.
Key factors:
Lake Formation controls access at the data location level (S3 buckets/prefixes).
Before services like AWS Glue crawlers, Athena, or Redshift Spectrum can access S3 data under Lake Formation governance, the S3 path must be:
Registered in Lake Formation
Associated with an IAM role that grants access
If not registered, Lake Formation blocks access even if IAM permissions are correct → hence the error.
When this option is used:
First-time onboarding of an S3 bucket into a Lake Formation–governed data lake
Fixing errors like:
“S3 location is not registered”
“Insufficient Lake Formation permissions”
---
Why other options are incorrect
A) Attach IAM policy to Glue crawler role
IAM permissions only control S3 access at AWS IAM level
In Lake Formation, IAM alone is not sufficient
...
Author: Rohan · Last updated Jun 25, 2026
A company stores sensitive data in an Amazon Redshift table. The company needs to give specific users the ability to access the sensitive data. The company must not create duplication in the data.
Customer support users must be able to see the last four characters of the sensitive data. Audit users must be able to see the full valu...
The correct answer is A) Create a dynamic data masking policy to allow access based on each user role. Create IAM roles that have specific access permissions. Attach the masking policy to the column that contains sensitive data.
Why Option A is correct
Amazon Redshift dynamic data masking is designed specifically for this kind of requirement:
It allows different users to see different representations of the same column data without creating duplicate tables.
You can define policies such as:
Customer support users → see only the last 4 characters (masked view)
Audit users → see the full unmasked value
Other users → no access or fully masked output
Key reasoning factors
No data duplication required → masking happens at query time, not via new tables
Column-level control → exactly matches requirement (partial exposure of sensitive field)
Role-based access control (IAM/Redshift roles) → ensures only authorized users get appropriate visibility
Least privilege enforcement → default users can be denied or fully masked
Why other options are incorrect
B) Metadata security
Metadata security on...
Author: Abigail · Last updated Jun 25, 2026
A company wants to build a dimension table in an Amazon S3 bucket. The bucket contains historical data that includes 10 million records. The historical data is 1 TB in size.
A data engineer needs a solution to update changes for up to 10,000 ...
We need the lowest runtime solution for updating a large S3-based dimension table (1 TB, 10 million records) with small daily changes (~10,000 records).
Key observation
The workload is a classic data lake upsert pattern:
Very large base dataset (1 TB) → should NOT be reprocessed daily
Small incremental updates (10K records/day)
Goal: avoid full table rewrite and full scan
---
Option A: EMR Spark (read full + update via Spark)
Reads entire 1 TB historical dataset + daily changes
Performs update logic in Spark and rewrites dataset
Why it's not optimal
Full dataset scan every day → very high runtime
Expensive shuffle and write back to S3
No incremental optimization
When used
Batch ETL where full refresh is acceptable
No need for incremental updates
---
Option B: AWS Glue + Pandas DataFrames
Loads data into Pandas DataFrames
Why it's incorrect
Pandas is single-node, memory-bound
Cannot handle 1 TB dataset
Will fail or be extremely slow
When used
Small datasets (MBs to a few GBs max)
Prototyping or local transformations
---
Option C: AWS Glue Spark job (full read + upd...
Author: Aarav · Last updated Jun 25, 2026
A company receives marketing campaign data from a vendor. The company ingests the data into an Amazon S3 bucket every 40 to 60 minutes. The data is in CSV format. File sizes are between 100 KB and 300 KB.
A data engineer needs to set-up an extract, transform, and load (ETL) pipeline to upload ...
✅ Correct Answer: A
---
Why Option A is correct
A) Create an AWS Lambda function that connects to Amazon Redshift and runs a COPY command. Use Amazon EventBridge to invoke the Lambda function based on an Amazon S3 upload trigger.
This is the best fit because:
Event-driven architecture: S3 upload triggers processing automatically (near real-time ingestion every 40–60 minutes fits well).
Minimal infrastructure management: Both Lambda and EventBridge are fully managed services.
Efficient loading into Redshift: The COPY command is the recommended high-performance way to load data from S3 into Amazon Redshift.
Simple ETL logic: CSV files can be directly ingested with minimal transformation.
Good for small-to-medium files: 100–300 KB files are lightweight and suitable for per-file ingestion.
💡 When to use this pattern:
Use Lambda + COPY + S3 triggers when:
Files land intermittently in S3
Data volumes are small to moderate
You want near real-time ingestion into Redshift
You want serverless orchestration without Glue or streaming systems
---
❌ Why other options are incorrect
B) Amazon Data Firehose with Lambda source pulling from S3
Incorrect architecture
Kinesis Data Firehose does NOT support Lambda as a s...
Author: Carlos Garcia · Last updated Jun 25, 2026
A data engineer created a table named cloudtrail_logs in Amazon Athena to query AWS CloudTrail logs and prepare data for audits. The data engineer needs to write a query to display errors with error codes that have occurred since the beginnin...
What the question is actually asking
You need raw error events from AWS CloudTrail, not aggregated statistics.
Key requirements:
Only error events → `errorcode IS NOT NULL`
Only since 2024-01-01
Return 10 most recent errors
“Most recent” ⇒ must use ORDER BY eventtime DESC
No requirement for grouping or counting
So the correct query should look like:
```sql
SELECT eventtime, eventname, errorcode, errormessage
FROM cloudtrail_logs
WHERE errorcode IS NOT NULL
AND eventtime >= '2024-01-01T00:00:00Z'
ORDER BY eventtime DESC
LIMIT 10;
```
---
Option Analysis
❌ Option A
```sql
SELECT count() AS TotalEvents, eventname, errorcode, errormessage
FROM cloudtrail_logs
WHERE errorcode IS NOT NULL
AND eventtime >= '2024-01-01T00:00:00Z'
GROUP BY eventname, errorcode, errormessage
ORDER BY TotalEvents DESC
LIMIT 10;
```
Why it is incorrect:
Uses `GROUP BY` → aggregates data instead of listing individual error events
Orders by `TotalEvents` → shows most frequent error types, not most recent
Does NOT use `eventtime` ordering → cannot satisfy “most recent”
When this is used:
When you need top recurring error patterns (e.g., “most common CloudTrail errors”)
---
❌ Option B
```sql
SELECT count() AS TotalEvents, eventname, errorcode, errormessage
FROM cloudtrail_logs
WHERE eventtime >= '2024-01-01T00:00:00Z'
GROUP BY eventname, errorcode, errormessage
ORDER BY TotalEvents DESC
LIMIT 10;
```
Why it is incorrect:
No `errorcode IS NOT NULL` filter (may include non-errors depending on schema behavior)
Still aggregates data (GROUP BY) instead of returning raw logs
Still sorts by frequency, not recency
When this is used:
When you want top error categories since 2024, regardle...
Author: Lucas · Last updated Jun 25, 2026
An online retailer uses multiple delivery partners to deliver products to customers. The delivery partners send order summaries to the retailer. The retailer stores the order summaries in Amazon S3.
Some of the order summaries contain personally identifiable information (PII) about customers. A data engineer needs to detect PI...
The requirement is to detect PII in files stored in Amazon S3 with the least operational overhead so the data can later be redacted. The key here is automatic sensitive data discovery at scale in S3 with minimal setup and maintenance.
---
Correct Option: C) Amazon Macie
Amazon Macie is purpose-built for exactly this use case.
It is a fully managed data security service that uses machine learning to:
Automatically discover sensitive data in S3
Detect PII such as names, emails, addresses, credit card numbers, etc.
Continuously monitor and classify data
Generate findings without requiring custom code or pipelines
Why it fits best (key reasoning factors):
Least operational overhead: No need to build ML models or pipelines
Native S3 integration: Works directly on S3 buckets
Automatic classification: Built-in PII detection (no manual rules required)
Scales automatically across large datasets
Typical use case:
> You want to continuously scan S3 buckets for sensitive data (PII/PHI/financial data) and generate security findings for compliance or remediation workflows.
---
Why the other options are incorrect
A) Amazon Textract
Amazon Textract
Designed for OCR (scanned documents, PDFs, images)
Extracts text, forms, and tables from documents
Does not natively detect PII across datasets in S3
Would require additional services like Amazon Comprehend or custom logic to identify PII
When it is used:
Proc...
Author: Sophia · Last updated Jun 25, 2026
A company is building a data stream processing application. The application runs in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The application stores processed data in an Amazon DynamoDB table.
The company needs the application containers in the EKS cluster to have secure access to the D...
The requirement is to allow EKS pods to securely access Amazon DynamoDB without embedding long-term AWS credentials. The key constraint is to use temporary, role-based access with least privilege, ideally at the pod/service-account level, not at the container or node credential level.
✅ Correct Approach: IAM Roles for Service Accounts (IRSA)
The correct solution is IAM Roles for Service Accounts (IRSA) in Amazon EKS, which allows Kubernetes service accounts to assume an IAM role using OIDC federation. This provides temporary AWS credentials via STS, eliminating the need to store or hardcode credentials in containers.
---
✔️ Evaluation of Options
B) Attach an IAM role to the EKS worker nodes + use IRSA
This is the best available option because it includes the concept of IRSA, which is the correct security mechanism.
IRSA allows each Kubernetes service account to assume a specific IAM role.
Uses OIDC trust between EKS and IAM.
Provides temporary credentials via AWS STS.
Avoids embedding credentials in containers.
Enables fine-grained access control per pod, not per node.
🔴 Note: Attaching an IAM role to worker nodes alone would be too broad, but the inclusion of IRSA makes this the correct choice.
When this is used:
Secure pod-level access to AWS services like DynamoDB, S3, SQS
Multi-tenant EKS clusters ...
Author: Oliver · Last updated Jun 25, 2026
A gaming company uses Amazon Kinesis Data Streams to collect clickstream data. The company uses Amazon Data Firehose delivery streams to store the data in JSON format in Amazon S3. Data scientists at the company use Amazon Athena to query the most recent data to obtain business insights.
The company wants to reduce Ath...
Key goal
Reduce Amazon Athena query cost with minimal operational/management overhead, without redesigning the entire pipeline.
The biggest cost driver in Athena here is scanning large volumes of JSON. The standard fix is:
Convert to columnar format (Parquet) → reduces scanned data
Use partitioning (YYYYMMDD prefix) → reduces scanned data scope
Also important constraint: no pipeline recreation → prefer native Firehose capabilities over new compute systems.
---
✅ Selected Option: A
Why Option A is correct
This option uses the lowest-maintenance, AWS-native approach:
1. Amazon Data Firehose → native Parquet conversion
Firehose supports format conversion (JSON → Parquet) using AWS Glue Data Catalog schema.
No custom infrastructure required.
2. S3 partitioning using YYYYMMDD prefix
Enables partition pruning in Amazon Athena
Dramatically reduces scanned data per query
3. Large buffer size
Reduces number of small files → improves Athena efficiency (fewer S3 GET/list operations)
4. AWS Glue ETL only for backfill
Used once to convert historical JSON → Parquet
Avoids continuous compute overhead
👉 This is the AWS best practice pattern: “Firehose + Parquet + Partitioning + Glue backfill”
---
❌ Why other options are incorrect
❌ Option B (EMR Spark daily job)
Uses Amazon EMR, which requires:
Cluster provisioning
...
Author: FrostFalcon88 · Last updated Jun 25, 2026
A company uses AWS Lambda to process files that users upload to an Amazon S3 bucket. When a user uploads a file to the S3 bucket, S3 Event Notifications invokes a Lambda function to process the file.
The company wants to automatically invoke the Lambda function only...
The key requirement is:
Invoke AWS Lambda automatically
Only when users upload `.txt` files
Files are uploaded to an S3 bucket
Use S3 Event Notifications
Key factors to identify
Trigger: File upload → S3 ObjectCreated (PUT) event.
Filtering: Only `.txt` objects.
Native AWS feature: S3 Event Notifications support prefix and suffix filters (such as `.txt`) when invoking Lambda directly.
Now let's evaluate each option.
---
Option A) Configure a Lambda function that is invoked by S3 PUT requests for .txt files in the S3 bucket.
✅ Correct
Why?
S3 Event Notifications can be configured to:
Trigger on ObjectCreated:Put (or all ObjectCreated events)
Filter objects using a suffix filter like `.txt`
Invoke Lambda directly
Example configuration:
Event: `ObjectCreated`
Suffix filter: `.txt`
Then:
```
notes.txt → Lambda invoked
image.jpg → No invocation
report.pdf → No invocation
```
This is exactly what the question asks.
Key factors
Direct integration
No unnecessary services
Native S3 suffix filtering
Lowest cost
Simplest architecture
When this option is used
Use this whenever:
Lambda should run only for certain object names
Triggering directly from S3
Need prefix/suffix filtering
Examples:
Process only `.csv`
Resize only `.png`
Scan only `.pdf`
Process only files under `incoming/`
---
Option B) Configure a Lambda function that is invoked by S3 GET requests for .txt files in the S3 bucket.
❌ Incorrect
Why?
GET request means:
Someone downloads or reads the object.
Question says:
> When a user uploads a file
Upload corresponds to:
PUT
POST
Multipart upload completion
NOT GET.
Lambda would execute only when someone reads the file, not when it is uploaded.
Key factor
| Operation | Meaning |
| --------- | -------- |
| PUT | Upload |
| GET | Download |
When is GET event useful?
Practically, S3 Event Notifications do not support GET object events for Lambda triggers. If you're interested in object access, you'd typically use services like CloudTrail data events for auditing, not S3 Event Notifications.
---
Option C)
> Configure an S3 bucket notification to send all object creation events to an Amazon SNS topic. Subscribe the Lambda function to the SNS topic. Apply a filter policy on the SNS topic for .txt file extensions.
❌ Incorrect
Why?
This introduces SNS unnecessarily.
More importantly:
SNS filter policies work on message attributes, not on object key suffixes.
S3 event notifications sent to SNS do not automatically include message attributes containin...
Author: IceDragon2023 · Last updated Jul 11, 2026
An ecommerce company hires a cybersecurity company to audit the ecommerce company's AWS account. The cybersecurity company requests read-only access to the account. The ecommerce company creates an IAM role, adds a trust relationship with the cybersecurity company's AWS account, and adds read-only permissions to the ecommerce company's account.
An employee at the cybersecurity company unsuccessfully tries to assum...
The correct answer is:
> ✅ C) Create a policy that allows the `sts:AssumeRole` action. Add the policy to the cybersecurity employee's role. Ensure that the resource for the policy is the role that the employee needs to assume.
---
Understand the scenario
There are two AWS accounts:
Ecommerce company (Account A)
Owns the AWS resources.
Creates an IAM Role with:
ReadOnly permissions
Trust relationship allowing Account B
Cybersecurity company (Account B)
Employee wants to assume that role.
The employee cannot assume the role.
---
Key concept: Cross-account role assumption
For cross-account AssumeRole to work, two permissions are required.
Requirement 1 (Already done)
The target role must trust the external account.
Example:
```json
Trust Policy
Principal:
AWS: Account B
Action:
sts:AssumeRole
```
This answers:
> "Who is allowed to assume me?"
The question explicitly says:
> "adds a trust relationship with the cybersecurity company's AWS account"
So Requirement 1 is already satisfied.
---
Requirement 2 (Missing)
The IAM user/role in Account B must also have permission to call
```
sts:AssumeRole
```
Example policy:
```json
{
"Effect":"Allow",
"Action":"sts:AssumeRole",
"Resource":"arn:aws:iam::AccountA:role/ReadOnlyRole"
}
```
Without this permission:
The employee cannot even request the role.
This is exactly what Option C adds.
---
Why C is correct
Option C says:
> Create a policy that allows `sts:AssumeRole`.
>
> Add the policy to the cybersecurity employee's role.
>
> Resource = ecommerce role.
This satisfies the second half of cross-account IAM authorization.
AWS always evaluates BOTH:
Trust policy on target role ✅
IAM permissions of caller ✅
Both are required.
---
Visual flow
```
Employee (Account B)
|
| sts:AssumeRole ?
|
IAM Policy must Allow
|
V
ReadOnly Role (Account A)
Trust Policy says:
"I trust Account B"
```
Both arrows must exist.
---
Why the other options are wrong
---
A) Configure multi-factor authentication (MFA)
Why rejected
MFA is unrelated to the reported problem.
The failure is authorization.
Cross-account AssumeRole requires:
Trust policy
sts:AssumeRole permission
Not MFA.
MFA would only matter if:
The trust policy contains something like
```json
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": "true"
}
}
```
The question never mentions this.
Therefore adding MFA does nothing.
---
Key factor
Use MFA only when:
Trust policy explicitly requires MFA
IAM policy explicitly requires MFA
Security best practice for privileged access
Not for missing AssumeRole permissions.
---
B) Configure an identity provid...
Author: ShadowWolf101 · Last updated Jul 11, 2026
A healthcare company uses Amazon SageMaker within a VPC to build machine learning (ML) models that use data that is stored in Amazon S3 buckets. The company wants to ensure that SageMaker accesses the data ...
The key requirement is:
Amazon SageMaker is running inside a VPC
Data is stored in Amazon S3
Traffic must not use public IP addresses
Secure private connectivity is required
The AWS exam keyword here is:
> Access Amazon S3 privately from resources inside a VPC
The AWS service specifically designed for this is VPC Endpoints.
---
Correct Answer: A) Create Amazon S3 gateway endpoints. Configure SageMaker to access the S3 buckets by using AWS PrivateLink.
Why this is correct
Amazon S3 supports Gateway VPC Endpoints.
A Gateway Endpoint allows resources inside a VPC (EC2, SageMaker notebooks, SageMaker training jobs, etc.) to access S3 without traversing the public internet, NAT Gateway, Internet Gateway, or public IP addresses.
Traffic stays on the AWS private network.
Key reasoning:
SageMaker runs inside the VPC.
S3 is an AWS service.
Gateway Endpoint provides private connectivity.
No public IP required.
No NAT Gateway required.
Lower cost than NAT Gateway.
Why does the option mention AWS PrivateLink?
This is a little tricky.
AWS PrivateLink generally refers to Interface Endpoints.
However:
S3 primarily uses Gateway Endpoints.
AWS documentation sometimes groups VPC Endpoints under the PrivateLink family, but technically Gateway Endpoints are different from Interface Endpoints.
The important exam keyword is:
> Create Amazon S3 Gateway Endpoint
That satisfies the requirement.
---
Why B is wrong
> Provision a NAT gateway within the same VPC.
A NAT Gateway allows private subnet resources to reach the public internet.
Traffic path becomes:
SageMaker → NAT Gateway → Internet → S3 public endpoint
Although the traffic remains on AWS infrastructure for S3, the access is still through the public S3 endpoint, not through a private VPC endpoint.
The requirement explicitly says:
> without using public IP addresses
A NAT Gateway has a public Elastic IP.
Therefore this is not the best solution.
Key exam clue
Whenever you see:
Access AWS services privately
No public internet
No public IP
Think:
> VPC Endpoint
Not NAT Gateway.
---
When is NAT Gateway used?
Use NAT Gateway when private instances need outbound internet access, such as:
Download software updates
Access GitHub
Reach public APIs
Install packages
Access services that don't suppor...
Author: Ava · Last updated Jul 11, 2026
A company stores critical data in Amazon S3 buckets. A CloudOps engineer must build a solution to record all S3 API ac...
The key phrase in the question is:
> "record all S3 API activity"
For AWS exams, whenever you see API activity, your first thought should be AWS CloudTrail.
Let's analyze each option.
---
Option A) Configure S3 bucket metrics to record object access logs.
Why it's incorrect
S3 bucket metrics (CloudWatch request metrics or Storage Lens metrics) provide statistics such as:
Number of requests
Bytes uploaded/downloaded
4xx/5xx errors
Latency
They do not record individual API calls.
Key factor
Metrics = numerical statistics
Not detailed API logs
When is this used?
Use S3 bucket metrics when you want to monitor:
Request rates
Performance
Errors
Throughput
Example:
> "Monitor PUT request count and latency."
Bucket metrics are appropriate.
---
Option B) Create an AWS CloudTrail trail to log data events for all S3 objects.
Why it is correct
CloudTrail records AWS API activity.
There are two types of CloudTrail events:
Management events
Examples:
CreateBucket
DeleteBucket
PutBucketPolicy
These are bucket-level administrative actions.
Data events
Examples:
GetObject
PutObject
DeleteObject
CopyObject
These are object-level API calls.
The question asks:
> record all S3 API activity
To record object operations, CloudTrail Data Events must be enabled.
Key factor
Remember:
| API Type | CloudTrail Event |
| ----------------- | ----------------- |
| Bucket management | Management events |
| Object access | Data events |
Since the option says:
> log data events for all S3 objects
this captures object-level API activity.
When is this used?
Use CloudTrail Data Events when you need:
Audit logs
Compliance
Security investigations
Who accessed which object
When an object was deleted
Which IAM user downloaded a file
Example exam questions:
Track object deletion
Audit object downloads
Record GetObject API calls
Answer → CloudTrail Data Events
---
Option C) Enable S3 server access logging for each S3 bucket.
This is the most tempting wrong answer.
Why it's incorrect
S3 Server Access Logging records HTTP requests made to an S3 bucket.
It contains information like:
Requester
Bucket
Request time
HTTP status
Object requested
However,
AWS exam distinguishes:
...
Author: Sara · Last updated Jul 11, 2026
A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB).
A CloudOps engineer must implement deployments without any service interruptions. The company needs the ability to shift traffic between application versions and quickly ...
The key requirements in this question are:
✅ No service interruption (zero downtime)
✅ Ability to shift traffic between application versions
✅ Quick rollback by redirecting traffic
✅ EC2 + Auto Scaling Group + ALB
The phrase "shift traffic between application versions" is the biggest clue. AWS provides a managed deployment strategy specifically for this: CodeDeploy Blue/Green Deployment.
Let's analyze each option.
---
Option A
> Use AWS CodeDeploy blue/green deployment with two ALB target groups. Deploy the new version to a separate fleet. Shift traffic gradually to the new target group. Maintain the original fleet for immediate rollback if necessary.
Why this is correct
This is exactly how AWS CodeDeploy Blue/Green deployment works for EC2.
Architecture:
```
...
Author: Zara · Last updated Jul 11, 2026
A company needs to deploy a MySQL database on AWS to support an application. The database must be highly available and recoverable. The database must meet a recovery time objective (RTO) of 15 minutes. The database must meet a recovery point objective (...
The correct answer is:
> ✅ B) Deploy a MySQL database across two Availability Zones by using Amazon RDS with a Multi-AZ deployment. Enable point-in-time restore.
Let's analyze the requirements first.
Requirements
Highly available → Database should continue operating even if an AZ fails.
Recoverable
RTO = 15 minutes
Recovery Time Objective = maximum acceptable downtime.
Database should become available again within 15 minutes.
RPO = 5 minutes
Recovery Point Objective = maximum acceptable data loss.
At most 5 minutes of data can be lost.
The exam asks for the MOST operationally effective solution.
This is a very important keyword.
Key factor: AWS always prefers managed services (RDS) over self-managed EC2 when they satisfy the requirements.
---
Option A
Deploy a MySQL database in a single Availability Zone by using Amazon RDS. Enable automated backups.
Why it is rejected
Single AZ means:
No standby database
No automatic failover
Hardware failure or AZ failure causes downtime
Automated backups help recover data but:
Restore requires creating a new database
Recovery can easily exceed 15 minutes
Not highly available
Key factors
✅ Automated backups
❌ Single AZ
❌ No HA
❌ Doesn't meet RTO
---
When should you use this?
Use when:
Development environments
Test databases
Low-cost production
Downtime is acceptable
---
Option B (Correct)
Deploy a MySQL database across two Availability Zones by using Amazon RDS with a Multi-AZ deployment. Enable point-in-time restore.
Why it is correct
Multi-AZ provides:
Synchronous replication
Automatic failover
Standby instance in another AZ
If primary fails:
RDS automatically promotes standby.
Usually failover completes in 60–120 seconds, well within 15-minute RTO.
Point-in-time restore provides:
Recovery to any second within backup retention period
Meets recovery requirements
RPO
Because Multi-AZ uses synchronous replication:
No committed transactions are lost
Effectively near-zero RPO
Requirement is only 5 minutes.
So this easily satisfies it.
Key factors
✅ High Availability
✅ Automatic failover
✅ Managed service
✅ Synchronous replication
✅ Meets RTO
✅ Meets RPO
✅ Least operational effort
---
When should you use this?
Production databases requiring:
High availability
Disaster recovery
Minimal administration
Automatic failover
AWS exam favorite answer whenever:
High Availability
Managed database
Least operational overhead
---
Option C
Deploy a MySQL database across two Availability Zones by using Amazon EC2 instances. Configure database replication and Amazon EBS volume snapshots.
Why it is rejected
This is a self-managed database.
You must manage:
MySQL installation
Replicati...
Author: Sophia Clark · Last updated Jul 11, 2026
A CloudOps engineer maintains the security and compliance of a company's AWS account. To ensure the company's Amazon EC2 instances are following company policy, a CloudOps engineer wants to terminate any EC2 instances that do not contain a department tag...
The key requirements are:
✅ Terminate EC2 instances
✅ If they do not have a department tag
✅ Near real time
✅ Automatic enforcement (no manual intervention)
Let's evaluate each option.
---
Option A
> Create an AWS Config rule with the required-tags managed rule to identify noncompliant resources. Configure automatic remediation to run the AWS-TerminateEC2Instance automation runbook to terminate noncompliant resources.
Why this is correct
This is exactly what AWS Config is designed for.
Step 1
AWS Config continuously evaluates AWS resources for compliance.
AWS already provides the managed rule:
required-tags
It checks whether specified tags exist.
Example:
```
department = Finance
```
If missing:
```
NON_COMPLIANT
```
---
Step 2
AWS Config supports automatic remediation.
When a resource becomes noncompliant:
```
AWS Config
↓
Automatic Remediation
↓
SSM Automation Runbook
↓
AWS-TerminateEC2Instance
↓
Instance terminated
```
No manual intervention.
---
Near real time?
AWS Config evaluates configuration changes shortly after they occur (typically within minutes), which satisfies the exam's interpretation of near real time.
---
Key factors
Built specifically for compliance
Uses managed rule
Automatic remediation
Can terminate resources
Native AWS solution
Exactly matches every requirement.
---
Option B
> Create a new Amazon EventBridge rule to monitor when new EC2 instances are created. Send the event to an Amazon SNS topic for automatic remediation.
Why this is wrong
At first glance this sounds fast.
But let's inspect carefully.
EventBridge can detect:
```
RunInstances
```
event.
Good.
But then it sends the event to:
```
SNS
```
SNS only delivers notifications.
SNS does not remediate anything.
There is:
no Lambda
no Systems Manager Automation
no Step Functions
Nothing performs termination.
---
Even if SNS triggers email:
```
Human receives email
↓
Manual action
```
Not automatic.
---
Another issue
This only checks creation events.
Suppose:
```
Instance created
↓
Tag removed later
```
EventBridge won't detect compliance violations unless additional rules are built.
AWS Config continuously evaluates compliance.
---
Key factor
EventBridge is event detection.
It is not a compliance service.
Use EventBridge when:
EC2 launches
IAM changes
CloudTrail events
Schedule tasks
Trigger Lambda
Not for policy compliance.
---
Option C
> Ensure all users who can create EC2 instances also have the permissions to use the ec2:CreateTags and ec2:DescribeTags actions. Change the instance's shutdown behavior to terminate.
Why this is wrong
This option never enforces the tag.
Giving permission to create tags
≠
Forcing users to create tags.
Someone can still launch:
```
No tags
```
Perfectly allowed.
---
Second issue...
Author: CrimsonViperX · Last updated Jul 11, 2026
A CloudOps engineer has used AWS CloudFormation to deploy a serverless application into a production VPC. The application consists of an AWS Lambda function, an Amazon DynamoDB table, and an Amazon API Gateway API. The CloudOps engineer must delete the AWS CloudFormation stack without d...
The key phrase in the question is:
> "Delete the AWS CloudFormation stack without deleting the DynamoDB table."
This is asking how to preserve one resource while allowing the CloudFormation stack itself to be deleted.
---
Correct Answer: A) Add a Retain deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
Why this is correct
AWS CloudFormation provides a DeletionPolicy attribute that determines what happens to a resource when the stack is deleted.
If you specify:
```yaml
DeletionPolicy: Retain
```
CloudFormation:
Deletes the stack.
Removes the DynamoDB table from CloudFormation management.
Leaves the DynamoDB table running with all its data intact.
This is exactly what the question requires.
Key factor
The requirement is:
✅ Delete the stack
✅ Keep the DynamoDB table
Only Retain satisfies both.
---
Why the other options are wrong
---
B) Add a Snapshot deletion policy to the DynamoDB resource.
Why it is wrong
A Snapshot deletion policy tells CloudFormation:
Before deleting the resource,
Create a snapshot (if the resource supports snapshots),
Then delete the resource.
The important part is:
The resource is still deleted.
The requirement says:
> Do not delete the DynamoDB table.
Therefore Snapshot is incorrect.
Another important AWS exam trick
Not every AWS resource even supports snapshots.
Snapshot is mainly used for resources like:
Amazon RDS
Amazon EBS
Amazon Redshift
Amazon ElastiCache (certain cases)
DynamoDB does not use DeletionPolicy: Snapshot in the same way these snapshot-capable resources do.
When Snapshot is used
Suppose you have:
RDS database
EBS volume
You want:
Delete stack
Keep a backup
Then:
```
DeletionPolicy: Snapshot
```
is appropriate.
Key factor
Snapshot = backup first, then delete
Requirement here:
Keep resource
Not:
Backup then delete
Rejected.
---
C) Enable termination protection on the AWS CloudFormation stack.
Why it is wrong
Termination protection prevents someone from deleting the CloudFormation stack.
The question says:
> The engineer must delete the stack.
Termination protection does exactly the opposite.
When is termination protection used?
Production environments.
Example:
Production stack containing:
VPC
RDS
ALB
To prevent accidental deletion:
Enable termination protection.
If someone clicks Delete Stack:
CloudFormation refuses.
Key factor
Question wants:
D...
Author: Ishaan · Last updated Jul 11, 2026
A company has business-critical resources in one of its AWS accounts. The company wants to receive an email notification every time an AWS Management Console root user sign-in event occurs in the acco...
The key phrases in the question are:
Business-critical resources
Receive an email notification
Every time a root user signs in to the AWS Management Console
MOST operational efficiency
This immediately suggests an event-driven, serverless solution with minimal maintenance.
---
Step 1: Identify the AWS service that detects the event
A root user console login is recorded by AWS CloudTrail as a management event.
CloudTrail events can be consumed in real time by:
Amazon EventBridge ✅
CloudWatch Logs (after extra configuration)
Custom scripts (not operationally efficient)
Key factor:
> CloudTrail → EventBridge is the native AWS event-driven architecture.
---
Evaluate each option
Option A
> Create an Amazon CloudWatch alarm that detects AWS Management Console root user sign-in events. Configure the alarm to send email notifications directly through AWS Trusted Advisor.
Why it is wrong
There are two issues.
1. CloudWatch Alarms don't detect login events
CloudWatch Alarms monitor metrics, such as:
CPU utilization
Memory (custom)
Network traffic
Billing metrics
A root login is an event, not a metric.
CloudWatch alarm is the wrong service.
---
2. Trusted Advisor cannot send emails for custom events
Trusted Advisor provides recommendations such as:
Security
Cost optimization
Fault tolerance
It is not an email notification service for login events.
So this option contains two incorrect service usages.
❌ Reject.
---
Option B
> Launch an EC2 instance. Schedule a script every hour to analyze CloudTrail events. Send email notifications through SNS.
Why it works
Technically, yes.
CloudTrail stores login events.
A script can:
Read CloudTrail logs
Detect Root login
Publish to SNS
SNS sends email.
So technically possible.
---
Why it is rejected
The exam asks:
> MOST operational efficiency
Problems:
EC2 must be maintained
Patch operating system
Schedule cron jobs
Pay for EC2
Polls every hour
Notification delayed up to one hour
AWS always prefers:
> Event-driven over polling.
Key factor:
Polling + EC2 = Operational overhead
❌ Reject.
---
Option C
> Create an EventBridge rule. Send email notifications to an Amazon SQS queue.
Why EventBridge is correct
Yes.
EventBridge can detect:
```
AWS Console Sign In
```
No issue there.
---
Why SQS is wrong
SQS is:
Message queue
Stores messages
Buffers workloads
It does not send emails.
Question specifically says:
> Receive an email notification.
SQS cannot email anyone.
You would still need:
```
EventBridge
↓
SQS
↓
Lambda
↓
SNS
↓
Email
```
Extra services.
More complexity.
Not operationally efficient.
❌ Reject.
---
Option D
> Create an EventBridge rule that reacts to root sign-in events. Configure the rule to send email notifications to an SNS topic.
Why it is correct
This is the AWS recommended architecture.
Flow:
```
Root Console Login
↓
CloudTrail
↓
EventBridge Rule
↓
SNS Topic
↓
Email
```
Advantages:
Fully managed
Real-time
...
Author: CrystalWolfX · Last updated Jul 11, 2026
A company has a new security policy that requires all Amazon EBS volumes to be encrypted at rest. The company needs to use a custom key policy to manage access to the encryption keys. The company must rotate the keys once...
The correct answer is:
> ✅ A) Create AWS KMS symmetric customer managed keys. Enable automatic key rotation.
Let's analyze the requirements one by one.
| Requirement | Needed |
| -------------------------- | ------ |
| Encrypt Amazon EBS volumes | Yes |
| Custom key policy | Yes |
| Annual key rotation | Yes |
| Least operational overhead | Yes |
---
Step 1: What type of KMS key does Amazon EBS support?
Amazon EBS encryption supports symmetric KMS keys.
It does not support asymmetric keys.
This immediately eliminates one option.
Key factor
EBS → Symmetric CMK
Not Asymmetric
---
Step 2: Custom key policy
The question specifically says:
> company needs to use a custom key policy
Only Customer Managed Keys (CMKs) allow:
custom key policies
IAM control
grants
auditing
AWS owned keys cannot be customized.
So AWS owned keys are rejected.
---
Step 3: Annual rotation
AWS KMS provides:
Automatic yearly rotation
Only for AWS-generated symmetric customer managed keys
No manual work needed.
This satisfies
yearly rotation
least operational overhead
---
Option Analysis
---
A) Create AWS KMS symmetric customer managed keys. Enable automatic key rotation.
✅ Meets every requirement.
Why?
Symmetric → supported by EBS
Customer managed → custom key policy
Automatic annual rotation
Least operational work
Exactly matches every requirement.
✅ Correct
---
B) Use AWS owned AWS KMS keys across the company's AWS environment.
AWS owned keys are managed completely by AWS.
Advantages
Zero management
Automatic rotation
But
❌ No custom key policy
The question explicitly requires
> custom key policy
AWS owned keys cannot have:
custom permissions
key policies
grants
Rejected.
---
When is AWS owned key used?
Use when
you don't care about key management
AWS service manages everything
no custom access control needed
Example
S3 default encryption using AWS-owned keys.
---
C) Create AWS KMS asymmetric customer managed keys. Enable automatic key rotation.
Two problems.
Problem 1
Amazon EBS re...
Author: SolarFalcon11 · Last updated Jul 11, 2026
To comply with regulations, a CloudOps engineer needs to back up an Amazon EC2 Amazon Machine Image (AMI) to an Amazon S3 bucket. If the CloudOps engineer restores the AMI from the bucket in the future, the AMI must...
Question focus
Requirement:
Back up an Amazon EC2 AMI to an Amazon S3 bucket for compliance.
When restored in the future, the AMI must retain the same AMI image ID as the original AMI.
The key factor is preserving the AMI ID during backup and restore.
Normally, copying or recreating an AMI creates a new AMI ID. The solution must use a method that stores the AMI itself in S3 and allows restoration with the same image ID.
---
Option analysis
A) Create a copy of the AMI. Specify the destination S3 bucket. Set the launch permissions to implicit.
❌ Rejected
Why:
The EC2 Copy AMI operation creates a new AMI.
The copied AMI receives a new AMI ID.
Launch permissions control who can launch the AMI; they do not affect AMI identity preservation.
When this option is useful:
When you need to:
Copy AMIs between AWS Regions.
Create independent AMI copies for disaster recovery.
Share AMIs with another account.
Key exam point:
> AMI copy = new AMI ID.
---
B) Archive the snapshot that is associated with the AMI. Specify the S3 bucket as the archive destination.
❌ Rejected
Why:
An AMI consists of:
AMI metadata (image ID, launch permissions, block device mappings)
Associated EBS snapshots
Archiving only the EBS snapshot does not back up the AMI metadata.
Restoring the snapshot later creates a volume, but it does not recreate the original AMI ID.
When this option is useful:
Long-term retention of EBS snapshots.
Reducing storage costs using snapshot archive tiers.
Key exam point:
> Snapshot backup ≠ AMI backup.
---
C) Create a store image task. Specify the image ID and the destination S3 bucket.
✅ Selected
Why:
The Create St...
Author: StarryEagle42 · Last updated Jul 11, 2026
A CloudOps engineer manages policies for many AWS member accounts in an AWS Organizations structure. Administrators on other teams have access to the account root user credentials of the member accounts. The CloudOps engineer must prevent all teams, including their administrators, from using Amazon DynamoDB...
Key requirements from the scenario
The CloudOps engineer manages many AWS member accounts in AWS Organizations.
Administrators in member accounts have access to the root user credentials.
The restriction must apply to everyone, including root users.
The restriction must apply only to Amazon DynamoDB and must not impact other AWS services.
The solution should be centrally managed.
The key AWS concept here is:
> Service Control Policies (SCPs) in AWS Organizations can set maximum permissions for member accounts and apply to the root user. IAM policies cannot restrict the root user.
---
Option A: Configure IAM policies that deny DynamoDB access for all users, including the root user.
❌ Rejected
Why?
IAM policies are used to control permissions for IAM users, groups, and roles. They do not apply to the AWS account root user.
Even if an administrator creates a policy like:
```
Deny dynamodb:
```
it only affects IAM identities. The root user credentials bypass IAM permission boundaries because the root user is not governed by IAM policies.
When can this option be used?
When you need to restrict IAM users or roles inside an account.
Example: Prevent developers from accessing DynamoDB while administrators still retain access.
Why it fails here?
The requirement explicitly says:
> Prevent all teams, including their administrators, from using DynamoDB.
Since administrators have root credentials, IAM policies cannot guarantee this restriction.
---
Option B: Create an SCP in the management account to deny all DynamoDB actions. Apply the SCP to the root of the organization.
✅ Correct approach
Why?
An SCP is applied at the AWS Organizations level and defines the maximum available permissions for accounts.
A deny statement such as:
```
{
"Effect": "Deny",
"Action": "dynamodb:",
"Resource": ""
}
```
will prevent DynamoDB usage in all member accounts.
Important factors:
SCPs apply to IAM users, IAM roles, and root users in member accounts.
SCPs are centrally managed from the management account.
The policy can target only DynamoDB actions.
Other AWS services remain unaffected.
When should this option be used?
Use SCPs when you need organization-wide governance, such as:
Blocking specific AWS services.
Enforcing security compliance.
Preventing account administrators from bypassing restrictions.
Applying controls across multiple AWS accounts.
Example:
A company wants to prevent all development accoun...
Author: Stella · Last updated Jul 11, 2026
A company hosts an ecommerce website on a fleet of Nitro-based Amazon EC2 Linux instances. During a recent sales event, some customers reported HTTP timeout errors.
To help identify the root cause of the errors, a CloudOps engineer needs more detailed network metrics from the Elastic Network Adapter (ENA) driver. The CloudOps engineer must obtain the conntrac...
Correct Answer: A) Install the Amazon CloudWatch agent on the instances. Filter by the conntrack_allowance_available metric and the conntrack_allowance_exceeded metric.
Key AWS Exam Reasoning
The requirement is to obtain Elastic Network Adapter (ENA) driver metrics:
`conntrack_allowance_available`
`conntrack_allowance_exceeded`
These are EC2 instance-level network performance metrics exposed by the ENA driver on Nitro-based EC2 instances. The operationally efficient solution is to use the Amazon CloudWatch agent, which can collect these OS-level and ENA-related metrics and publish them to CloudWatch.
The question emphasizes:
Nitro-based EC2 instances
ENA driver
Need for specific conntrack allowance metrics
Need for operational efficiency
This points directly to the CloudWatch agent.
---
Option Analysis
✅ A) Install the Amazon CloudWatch agent on the instances. Filter by the conntrack_allowance_available metric and the conntrack_allowance_exceeded metric.
Correct
Why:
The Amazon CloudWatch agent can collect ENA driver metrics from EC2 Linux instances.
It requires only one agent installation and integrates directly with CloudWatch.
It provides centralized monitoring across a fleet of instances.
It is the simplest operational approach.
When to use:
When you need detailed EC2 instance-level metrics not available as default CloudWatch metrics.
When monitoring OS-level, application-level, or ENA driver metrics.
When you need custom metrics from EC2 instances.
Example:
Detecting network connection tracking exhaustion during traffic spikes.
Troubleshooting HTTP timeouts caused by connection tracking limits.
---
❌ B) Install the collectd daemon and the Amazon CloudWatch agent on the EC2 instances. Filter by the conntrack_allowance_available metric and the conntrack_allowance_exceeded metric.
Incorrect
Why rejected:
`collectd` is used for collecting general system metrics and custom statistics.
It is not required for ENA driver conntrack metrics.
Installing both collectd and the CloudWatch agent introduces unnecessary components and operational overhead.
When collectd is used:
When an organization already uses collectd for system monitoring.
When collecting custom application or infrastructure metrics t...
Author: Nathan · Last updated Jul 11, 2026
A CloudOps engineer configured AWS Backup to capture snapshots from a single Amazon EC2 instance that has one Amazon EBS volume attached. On the first snapshot, the EBS volume has 10 GiB of data. On the second snapshot, the EBS volume still contains 10 GiB of data, but 4 GiB have changed. On the third snapsho...
Key AWS Concept: EBS snapshots are incremental
Amazon EBS snapshots are incremental, meaning:
The first snapshot stores all blocks that contain data on the volume.
Later snapshots store only the changed blocks since the previous snapshot.
If data is deleted or added, only the changed blocks are tracked.
The snapshot size is not the same as the full EBS volume size every time.
Let's calculate step by step.
Snapshot 1
EBS volume contains 10 GiB of data.
First snapshot must capture all existing data.
Storage used:
10 GiB
---
Snapshot 2
Volume still has 10 GiB of data.
4 GiB changed since the first snapshot.
Because snapshots are incremental, only the changed 4 GiB needs to be stored.
Additional storage:
4 GiB
Total so far:
10 + 4 = 14 GiB
---
Snapshot 3
Volume grows from 10 GiB to 12 GiB.
2 GiB of new data is added.
No other changes are mentioned.
Only the new changed blocks need to be stored.
Additional storage:
2 GiB
Total storage:
10 + 4 + 2 = 16 GiB
---
Evaluating the options
A) 12 GiB ❌
Rejected
Why:
This assumes only the latest snapshot size matters.
EBS snapshots do not overwrite previous snapshots.
All snapshots must retain their unique changed blocks.
When this could be used:
If the question asked for the current EBS volume data size, not snapshot storage.
---
B) 16 GiB ✅
Selected
Why:
EBS snapshots are incremental.
First snapshot stores the initial 10 GiB.
Second snapshot stores only 4 GiB of changed data.
Third snapshot stores only 2 GiB of newly added data.
Calculation:
...
Author: IronLion88 · Last updated Jul 11, 2026
A CloudOps engineer is troubleshooting a VPC with public and private subnets that leverage custom network ACLs. Instances in the private subnet are unable to access the internet. There is an internet gateway attached to the public subnet. The private subnet has a route to a NAT gateway that is also attached to the public ...
Key factors to identify the issue
For private subnet instances accessing the internet through a NAT gateway, the traffic path should be:
EC2 instance (private subnet)
→ Private subnet route table (`0.0.0.0/0 → NAT Gateway`)
→ NAT Gateway (public subnet)
→ Public subnet route table (`0.0.0.0/0 → Internet Gateway`)
→ Internet
The question gives these facts:
✅ Internet Gateway is attached to the VPC/public subnet.
✅ NAT Gateway exists in the public subnet.
✅ Private subnet route points to the NAT Gateway.
✅ Instances use the default security group.
❌ Custom network ACLs are being used.
The important clue is custom network ACLs. Unlike security groups, network ACLs are stateless and require both inbound and outbound rules to allow traffic.
---
Option A: There is a network ACL on the private subnet set to deny all outbound traffic.
Why this is correct
A network ACL (NACL) controls traffic at the subnet level.
If the private subnet NACL has:
Outbound rule: Deny all traffic
then the EC2 instances cannot send any traffic to the NAT Gateway.
The traffic flow stops at the private subnet because:
```
EC2 instance
|
| (Outbound denied by NACL)
X
NAT Gateway
|
Internet Gateway
```
Even though:
The route table is correct.
The NAT Gateway exists.
The security group allows outbound traffic by default.
The NACL overrides this because subnet-level filtering happens before traffic leaves the subnet.
When to use this reasoning
Choose a NACL option when:
The question mentions custom network ACLs.
Traffic is failing despite correct routes and security groups.
There are symptoms such as:
No outbound connectivity.
Return traffic being blocked.
Asymmetric communication failures.
Remember:
Security Groups = stateful
Network ACLs = stateless
---
Why the other options are rejected
---
Option B: There is no NAT gateway deployed in the private subnet of the VPC.
Why it is incorrect
A NAT Gateway should not be deployed in a private subnet.
The correct architecture is:
```
Private subnet
|
| Route to NAT Gateway
|
Public subnet
|
| Route to Internet Gateway
|
Internet
```
A NAT Gateway requires a route to the Internet Gateway, so it must reside in a public subnet.
The question already states:
NAT Gateway is attached to the public subnet.
Therefore, the NAT Gateway placement is correct.
When this option would be correct
Choose this type of answer if:
The private subnet has no NAT Gateway path.
The NAT Gateway does not exist.
The NAT Gate...
Author: Lina Zhang · Last updated Jul 11, 2026
A company runs an application on a fleet of Amazon EC2 Windows instances in a Multi-AZ deployment. The company needs a solution that will give the instances access to shared files.
The solution must be highly available, must use native Windows storage cap...
Key requirements from the question
The application runs on Amazon EC2 Windows instances in a Multi-AZ deployment and needs:
1. Shared file access between multiple EC2 instances
2. High availability
3. Native Windows storage capabilities
4. Maximum consistency for all file requests
The key words that drive the answer are:
Windows instances → Prefer a Windows-native file system.
Shared files → Need a managed file share, not block storage.
Multi-AZ + highly available → Need built-in redundancy.
Consistency for all requests → All instances should see the same file state immediately.
---
Option analysis
✅ A) Create an Amazon FSx for Windows File Server Multi-AZ file system. Map file shares on the instances by using the file system's DNS name.
Correct option
Amazon FSx for Windows File Server provides a fully managed Windows file system based on Windows Server Message Block (SMB).
Why it meets the requirements:
| Requirement | How FSx for Windows File Server satisfies it |
| ---------------------- | ---------------------------------------------------------------------------------------------- |
| Shared files | Provides SMB file shares that multiple EC2 instances can access simultaneously |
| Windows native storage | Uses native Windows technologies such as SMB, NTFS, Active Directory integration, Windows ACLs |
| High availability | Multi-AZ deployment automatically replicates data and provides automatic failover |
| Maximum consistency | All clients access the same file system, so changes are immediately visible |
For Windows applications that require shared storage, FSx for Windows File Server is usually the preferred AWS solution.
When to use this option:
Windows applications requiring shared folders
Applications using SMB protocols
File shares with NTFS permissions
Microsoft workloads such as SQL Server file shares, IIS shared content, enterprise applications, and user profiles
---
❌ B) Grant the instances access to a shared Amazon S3 bucket. Use Windows Task Scheduler to synchronize the contents of the S3 bucket locally to each instance periodically.
Why it is rejected:
Amazon S3 is object storage, not a native Windows file system.
Problems:
Synchronization is periodic, so instances may not have the latest data immediately.
Multiple local copies can become inconsistent.
Does not provide SMB/NTFS native Windows file capabilities.
Task Scheduler-based synchronization introduces delays and operational overhead.
When S3 can be used:
Backup storage
Static...
Author: SolarFalcon11 · Last updated Jul 11, 2026
A company runs on-premises workloads that need to use AWS hosted DNS services. The company requires high availability for DNS queries to ensure continuous DNS resolution ...
Correct answer: A) Deploy Amazon Route 53 Resolver inbound endpoints to multiple Availability Zones. Configure on-premises DNS resolvers to use the endpoint IP addresses in a failover configuration.
Key requirement analysis
The scenario says:
Workloads are on-premises.
They need to use AWS hosted DNS services.
DNS resolution must have high availability.
The company needs continuous DNS resolution for critical applications.
The key AWS concept is hybrid DNS resolution using Amazon Route 53 Resolver endpoints.
Inbound Resolver endpoint → Allows on-premises DNS resolvers to query AWS Route 53 Resolver for DNS names hosted in AWS (such as private hosted zones).
Outbound Resolver endpoint → Allows AWS VPC resources to query on-premises DNS servers.
Since the DNS queries originate from on-premises systems and need to reach AWS DNS, inbound endpoints are required.
---
Option analysis
✅ A) Deploy Amazon Route 53 Resolver inbound endpoints to multiple Availability Zones. Configure on-premises DNS resolvers to use the endpoint IP addresses in a failover configuration.
Why this is correct:
Route 53 Resolver inbound endpoints provide DNS resolution acces...
Author: Layla · Last updated Jul 11, 2026
A company has an application that processes events sequentially by using an Amazon SQS FIFO queue. The company needs a solution that automatically sends notifications to the SQS queue when new objects are uploaded to an Amazon S3 bucket. The solution must ...
Key requirements from the question
The company needs:
1. Automatic notifications when new objects are uploaded to Amazon S3
2. Messages sent to an existing Amazon SQS FIFO queue
3. Maintain message ordering
4. Least operational overhead
Important AWS exam clues:
S3 event notifications are the native, serverless way to react to object creation events.
SQS FIFO requires ordered message delivery.
Avoid custom polling or extra services unless required.
---
Option analysis
A) Create a Lambda function that polls objects using `ListObjectsV2` and detects new objects
❌ Rejected
Why?
This solution creates unnecessary operational overhead.
Problems:
Lambda must continuously poll S3, which is inefficient.
The function needs logic to:
Track previously seen objects
Detect new objects
Handle duplicate processing
Manage state
Polling introduces delays and additional cost.
It does not use the native event-driven capability of S3.
When could this be used?
A polling approach may be used when:
The source system does not provide event notifications.
You need to periodically scan a data repository.
Historical reconciliation jobs are required.
For S3 object creation events, polling is not the preferred architecture.
---
B) Create an event notification on the S3 bucket. Use the FIFO delivery option. Route notifications to the existing SQS queue.
❌ Rejected
Why?
Amazon S3 event notifications cannot directly send notifications to SQS FIFO queues.
S3 event notifications support:
Standard SQS queues
SNS standard topics
Lambda functions
They do not support SQS FIFO destinations directly.
Also, S3 does not provide a "FIFO delivery option" for event notifications.
When could this be used?
This approach works when:
The destination is an SQS Standard queue.
Ordering is not required.
At-least-once delivery is acceptable.
---
C) Create an Amazon SNS FIFO topic. Configure S3 event notification to send messages to SNS FIFO. Subscribe the existing SQS FIFO queue.
✅ Selected
Why?
This satisfies all requirements with minimal operational overhead.
Architecture:
S3 bucket → SNS FIFO topic → SQS FIFO queue
Benefits:
S3 automatically generates events when objects are uploaded.
SNS FIFO provides ordered message delivery.
...
Author: Kai99 · Last updated Jul 11, 2026
A company asks a CloudOps engineer to provision an additional environment for an application in four additional AWS Regions. The application is running on more than 100 Amazon EC2 instances in the us-east-1 Region, using fully configured Amazon Machine Images (AMIs). The company has an AWS CloudFormation template to depl...
Question Summary
A company wants to deploy an existing application into four additional AWS Regions. The application currently runs on 100+ EC2 instances in us-east-1 and uses fully configured AMIs. There is already a CloudFormation template that deploys the application in us-east-1.
The goal is to provision the application in the most operationally efficient manner.
Key factors:
The application already has configured AMIs.
The deployment must happen across multiple AWS Regions.
CloudFormation should be reused as much as possible.
Avoid unnecessary manual steps.
AMIs are Region-specific, so they must exist in target Regions before use.
---
Option A
Copy the AMI to each Region by using the aws ec2 copy-image command. Update the CloudFormation template to include mappings for the copied AMIs.
Why this is correct
This is the most operationally efficient approach because:
1. Existing AMIs are already fully configured
The application environment is already captured in the AMI.
Copying the AMI preserves:
OS configuration
Installed software
Application configuration
Instance settings
2. AMI copies are the AWS-native solution for multi-Region deployments
AMIs are Region-specific.
An AMI created in `us-east-1` cannot directly launch EC2 instances in another Region.
`aws ec2 copy-image` creates a usable AMI in the destination Region.
3. CloudFormation can dynamically select the correct AMI
CloudFormation mappings can associate each Region with its corresponding AMI ID.
Example:
```
Mappings:
RegionMap:
us-west-2:
AMI: ami-xxxx
eu-west-1:
AMI: ami-yyyy
```
The same template can then be deployed in multiple Regions.
When to use this option
Use this approach when:
You already have a golden AMI.
You need identical deployments across multiple Regions.
You want repeatable infrastructure deployment.
You want to minimize configuration drift.
---
Option B
Create a snapshot of the running instance. Copy the snapshot to the other Regions. Create an AMI from the snapshots. Update the CloudFormation template for each Region to use the new AMI.
Why it is rejected
Although technically possible, it is less efficient.
Problems:
1. Unnecessary steps
The application already has AMIs.
Creating snapshots first adds extra work:
Create snapshot
Copy snapshot
Create AMI
Update templates
2. Higher operational overhead
More steps mean more chances for errors.
It increases management complexity.
3. Does not use the existing golden image process
The existing AMIs are already the desired application state.
When to use this option
Use this approach when:
You only have...
Author: Max · Last updated Jul 11, 2026
A company experiences increased production incidents. A CloudOps engineer must provide developers with secure access to Amazon EC2 instances from the AWS Management Console. The developers must be able to successfully connect by using EC2 Instance Connect for real-time troubleshooting.
The EC2 instances are based on the latest Amazon Linux 2023 AMIs. The EC2 instances are publicly accessible. The EC2 instances have been properly configured with security groups that allow inbound SSH traffic. The developers ...
Key factors in the scenario
The requirement is secure access to EC2 instances from the AWS Management Console using EC2 Instance Connect.
The instances are running Amazon Linux 2023 latest AMIs.
The instances are publicly accessible.
Security groups already allow inbound SSH (port 22).
Developers will use the default `ec2-user` account.
The question asks for the NEXT step to make developers successfully connect.
The important AWS exam clue is:
> Amazon Linux 2023 AMIs already include and support EC2 Instance Connect by default.
Therefore, the problem is most likely IAM authorization, not instance configuration.
---
Option analysis
A) Create an IAM role with EC2 access. Attach the role to the EC2 instances.
❌ Incorrect
An IAM role attached to an EC2 instance is used when the instance itself needs permission to call AWS services (for example, accessing S3, DynamoDB, Secrets Manager).
EC2 Instance Connect works differently:
The developer's IAM identity needs permissions to use EC2 Instance Connect.
The instance does not need an IAM role just to allow SSH access through EC2 Instance Connect.
When would this option be used?
Example:
An EC2 application needs to upload logs to S3.
The instance requires an IAM role with S3 permissions.
It does not solve developer console login access.
---
B) Download and install the EC2 Instance Connect agent on the production instances.
❌ Incorrect
The EC2 Instance Connect agent is required for some operating systems and older AMIs.
However:
Amazon Linux 2023 AMIs already have EC2 Instance Connect support installed/configured.
The instances are already based on the latest Amazon Linux 2023 AMIs.
Installing the agent manually is unnecessary.
When would this option be used?
Example:
A custom Linux AMI does not have the EC2 Instance Connect package installed.
A supported distribution requires manual installation of the EC2 Instance Connect package.
That is not the case here.
---
C) Grant IAM permissions to the developers to use EC2 Instance Connect and describe the EC2 instances.
✅ Correct
EC2 Instance Connect requires IAM permissions for the user who is connecting.
Th...
Author: Ahmed97 · Last updated Jul 11, 2026
A company's developers deploy applications to multiple AWS accounts. The developers are able to create any AWS resource within the AWS accounts.
A security team wants to audit the resources that the devel...
Question focus
Requirement:
Developers can create any AWS resources in multiple AWS accounts. The security team needs to audit the resources that exist and were created across all accounts.
Key requirements:
Need visibility across multiple AWS accounts.
Need to know resource configurations and inventory.
Need centralized reporting for the security team.
Solution should support continuous auditing of AWS resources.
---
Option A
Create an AWS account for the security team. Configure AWS Audit Manager. Create an assessment. Include company AWS accounts in scope. Generate an assessment report.
Why it looks attractive
AWS Audit Manager is designed for compliance auditing and can collect evidence against compliance frameworks.
Why it is rejected
AWS Audit Manager does not primarily provide a complete inventory of all AWS resources created by developers.
Audit Manager:
Collects evidence from AWS services.
Helps prepare compliance reports (PCI DSS, CIS, SOC, etc.).
Tracks audit evidence.
However, the requirement is about auditing resources created in AWS accounts, not proving compliance controls.
Example use case for Audit Manager:
A company needs evidence that IAM policies, logging controls, and encryption requirements meet a compliance framework.
It is not the best choice for:
Listing all EC2 instances, S3 buckets, security groups, databases, and their configurations across accounts.
---
Option B
Configure AWS Config recorder in each AWS account. Create an AWS Config aggregator in the security team's account. Authorize the aggregator in every AWS account. Use Amazon Quick Suite and Amazon Athena to generate a report.
Why it is correct
AWS Config is specifically designed to record and audit AWS resource configurations.
AWS Config provides:
Resource inventory.
Configuration history.
Relationship tracking between resources.
Compliance evaluation.
Centralized aggregation across accounts.
The AWS Config aggregator allows the security team to view resources from multiple AWS accounts in one place.
Architecture:
```
Developer AWS Accounts
|
|
AWS Config Recorder
|
|
+----------------+
|
AWS Config Aggregator
|
Security Team AWS Account
|
Athena / Quick Suite Reports
```
Example:
Developers create 500 EC2 instances across 20 accounts.
AWS Config records those resources.
The security team uses the aggregator to query all resources centrally.
Reports can identify:
Unencrypted EBS volumes.
Public S3 buckets.
Missing tags.
Unauthorized configurations.
When to use AWS Config Aggregator
Use it when:
You need centralized resource visibility across AWS Organizations/accounts.
You need configuration auditing.
You need compliance reporting.
---
Option C
...
Author: Ryan · Last updated Jul 11, 2026
A CloudOps engineer needs to quickly resolve issues in an application that runs in a production environment on Amazon EC2 instances. The application uses an Amazon RDS database. To resolve the issues, the CloudOps engineer needs a centralized solution to collec...
Question Summary
A CloudOps engineer needs a centralized logging solution for:
Amazon EC2 application logs
Amazon RDS database logs
Ability to collect and query logs quickly for troubleshooting production issues
The key requirements are:
1. Centralized log collection
2. Support for both EC2 and RDS logs
3. Query capability for troubleshooting
4. Suitable AWS-native solution
The best fit is Amazon CloudWatch Logs + CloudWatch Logs Insights.
---
Option A
> Install and configure the Amazon CloudWatch agent on the EC2 instances to forward ERROR log events to Amazon CloudWatch Logs. Configure the RDS database to export log events to CloudWatch Logs. Use CloudWatch Logs Insights to query the logs.
Why this is correct
✅ CloudWatch Logs is designed for centralized log collection.
The CloudWatch agent can collect application and system logs from EC2 instances and send them to CloudWatch Logs.
Amazon RDS supports exporting database logs directly to CloudWatch Logs.
CloudWatch Logs Insights allows querying logs from multiple sources using a single query interface.
This provides:
Centralized visibility
Fast troubleshooting
AWS-managed log storage
Search and query capabilities
Key exam factors
When you see:
EC2 logs + RDS logs
Centralized logging
Query/search logs
Troubleshooting production issues
Think:
CloudWatch Logs + CloudWatch Logs Insights
When to use this option
Use this approach when:
You need operational troubleshooting
Applications run on EC2
Databases run on RDS
Engineers need to search logs quickly
Example:
A web application returns errors. Engineers need to correlate:
```
EC2 application error logs
+
RDS database error logs
=
Find root cause
```
CloudWatch Logs Insights is built exactly for this.
---
Option B
> Install and configure the CloudWatch agent on EC2 instances to forward INFO log events to an Amazon S3 bucket. Install the CloudWatch agent on the RDS database. Forward ERROR log events to the S3 bucket. Configure S3 Event Notifications to invoke AWS Lambda functions to analyze the logs.
Why it is incorrect
❌ RDS does not use the CloudWatch agent.
The CloudWatch agent runs on:
EC2 instances
On-premises servers
Other supported hosts
It cannot be installed on Amazon RDS, because RDS is a managed database service where AWS manages the operating system.
Also:
❌ S3 + Lambda is not the best solution for interactive troubleshooting.
S3 is suitable for:
Long-term log archival
Data lake storage
Batch analysis
It is not ideal for:
Real-time log investigation
Searching across application and database logs quickly
When this option could be used
A similar S3-based architecture is useful when:
Logs must be stored cheaply for years
Compliance requires retention
Batch processi...
Author: Stella · Last updated Jul 11, 2026
A company is hosting a public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The company needs the website to support H...
Question: Supporting HTTPS connections for an EC2-based website behind an ALB
Key AWS exam factors to identify
Application Load Balancer (ALB) supports HTTPS listeners and can terminate SSL/TLS connections.
SSL/TLS certificates for ALB listeners are managed through AWS Certificate Manager (ACM) or imported into ACM.
The certificate is attached to the ALB listener, not the target group.
AWS KMS is used for encryption key management, not for storing or serving SSL/TLS certificates to load balancers.
A Network Load Balancer (NLB) is used for high-performance Layer 4 load balancing (TCP/UDP/TLS), but replacing an ALB is unnecessary when the requirement is simply HTTPS support.
---
Option analysis
A) Replace the ALB with a Network Load Balancer.
❌ Rejected
Why:
An ALB already supports HTTPS by using an HTTPS listener and an SSL/TLS certificate.
Replacing it with an NLB does not solve the requirement more efficiently.
When this option can be used:
Use an NLB when you need:
Very high throughput and low latency.
Layer 4 load balancing (TCP/UDP).
Static IP addresses for the load balancer.
TLS pass-through or TLS load balancing requirements.
Why not here:
The company already has an ALB, which is designed for HTTP/HTTPS web applications.
---
B) Use AWS Certificate Manager (ACM) to issue a public SSL/TLS certificate. Configure the ALB to use the certificate.
✅ Selected
Why:
ACM provides free public SSL/TLS certificates for AWS-integrated services.
An ALB HTTPS listener requires an SSL/TLS certificate.
The certificate can be directly attached to the ALB listener.
ACM automatically handles certificate renewal.
Correct architecture:
```
Client
|
HTTPS request
|
Application Load Balancer
|
HTTPS Listener + ACM Certificate
|
EC2 Target Group
|
EC2 Instances
```
When this option is used:
Public websites hosted on:
ALB
CloudFront
API Gateway
Other ACM-integrated AWS services
Exam clue:
If the question mentions ALB + HTTPS + public website...
Author: Krishna · Last updated Jul 11, 2026
A company uses AWS Systems Manager to automate tasks across AWS accounts. The company uses monitoring tools to detect issues. The company creates a Systems Manager Automation runbook that runs an AWS Lambda function to remediate the issues.
Initially, the company runs the runbook manually. Now, the comp...
Question Summary
The company already has:
AWS Systems Manager Automation runbook → performs remediation using a Lambda function.
Monitoring tools → detect operational issues.
Current process → runbook is manually executed.
Requirement → automatically trigger the Systems Manager Automation runbook whenever monitoring tools detect issues.
The key requirement is event-driven automation based on monitoring tool findings.
---
Key AWS Exam Factors
1. Amazon EventBridge is the preferred service for event-driven automation
EventBridge receives events from AWS services and external/custom sources.
It can match events using rules and trigger targets.
Systems Manager Automation runbooks can be invoked as EventBridge targets.
Typical pattern:
Monitoring tool → EventBridge event → EventBridge Rule → Systems Manager Automation Runbook → Remediation
This is the standard AWS automation design.
---
Option Analysis
A) Configure the monitoring tools to publish findings to Amazon EventBridge. Create an EventBridge rule that invokes the runbook in response to events from the monitoring tools.
✅ Correct
Why?
EventBridge is designed to react to operational events and trigger automated workflows.
Monitoring tools can send findings/events to EventBridge.
EventBridge rules can filter specific events (for example, severity, resource type, issue category).
The rule can invoke a Systems Manager Automation runbook automatically.
Example scenario:
A monitoring system detects that an EC2 instance has a problem.
It sends an event to EventBridge.
EventBridge matches the event pattern.
EventBridge starts an SSM Automation runbook.
The runbook runs remediation steps.
This provides:
Real-time automation
Loose coupling between monitoring and remediation
Event filtering
Native AWS integration
When to use this option:
Any time you need "when event X happens, automatically perform action Y."
Security findings, operational issues, compliance events, infrastructure failures.
---
B) Configure the monitoring tools to send findings to an Amazon SNS topic. Subscribe the runbook to the SNS topic. Invoke the runbook when a message is received.
❌ Incorrect
Why rejected?
SNS is a notification and fan-out service, not an automation orchestration service.
SNS can deliver messages to:
Email
SMS
Lambda
SQS
HTTP endpoints
However:
A Systems Manager Automation runbook cannot directly subscribe to an SNS topic.
SNS does not natively invoke SSM Automation documents.
A possible architecture would be:
Monitoring tool → SNS → Lambda → StartAutomationExecution API
But this requires an additional Lambda layer.
When SNS is used:
Sending alerts to administrators.
Broadcasting notifications to multiple subscribers.
Triggering Lambda/SQS workflows.
It is not the best choice for direct remediation automation.
---
C) Configure the monitoring tools to write findings to Amazon C...
Author: Kai · Last updated Jul 11, 2026
A company is attempting to manage its costs in the AWS Cloud. A CloudOps engineer needs specific company-defined tags that are assigned to resources to appear on the billin...
Question Summary
A company wants company-defined tags assigned to AWS resources to appear on the AWS billing report. A CloudOps engineer must configure AWS so that these tags can be used for cost tracking.
The key requirement is:
The tags are created by the company → these are user-defined tags
They must appear in billing reports → they must be enabled as cost allocation tags
---
Key AWS Concept: Cost Allocation Tags
AWS resource tags do not automatically appear in billing data. To use tags for cost tracking, they must be activated in the AWS Billing and Cost Management console.
There are two types:
1. AWS-generated cost allocation tags
Created automatically by AWS.
Examples:
`aws:createdBy`
AWS service-generated tags.
Used when AWS automatically adds metadata to resources.
2. User-defined cost allocation tags
Created by customers.
Examples:
`Environment=Production`
`Department=Finance`
`Project=MobileApp`
Must be manually activated before they appear in billing reports.
---
Option Analysis
A) Activate the tags as AWS generated cost allocation tags.
❌ Incorrect
Why rejected:
AWS-generated cost allocation tags are created by AWS services, not by the company.
Example scenario where this option is used:
A company wants to analyze costs based on AWS-created metadata such as who created a resource through AWS services.
Example:
```
aws:createdBy = arn:aws:iam::123456789012:user/admin
```
This option cannot be used for custom company-defined tags because AWS does not generate them.
---
B) Activate the tags as user-defined cost allocation tags.
✅ Correct
Why selected:
The company-defined tags are user-created tags, so they must be activated as user-defined cost allocation tags.
Process:
1. Company assigns tags to AWS resources.
Example:
```
Environment = Production
CostCenter = 1001
Application = WebApp
```
2. CloudOps engineer activates these tags in:
```
AWS Billing and Cost Management
→ Cost Allocation Tags
→ User-defined cost allocation tags
```
3. AWS includes these tags in billing data and cost reports.
When this option is used:
Use this when an organization wants to:
Track costs by department
Allocate expenses to teams
Monitor project spen...
Author: Maya2022 · Last updated Jul 11, 2026
A company uses a custom Amazon Machine Image (AMI) as part of an EC2 Image Builder pipeline. A CloudOps engineer notices that the custom AMI will reach the end of its support lifespan in few months. The CloudOps engineer needs to update ...
Key requirement
The company uses a custom AMI as the base image in an EC2 Image Builder pipeline. The current AMI is approaching the end of its support lifespan, so the CloudOps engineer must update the Image Builder pipeline to use a newer AMI ID.
The important AWS concepts involved:
EC2 Image Builder recipes define the source/base image used to build new AMIs.
The pipeline uses a recipe version to create images.
A recipe version is immutable after creation. If the source AMI changes, a new recipe version must be created.
Components are used for installing software, running tests, and applying configurations — they do not define the base AMI.
---
Option A — Create a new version of the existing EC2 Image Builder recipe. Update the AMI ID details. Update the pipeline to use the new recipe version.
✅ Correct
Why this is selected
An EC2 Image Builder recipe contains the parent/base image information. When the AMI ID needs to change, the correct approach is to create a new recipe version with the updated AMI ID.
The process is:
1. Create a new version of the existing image recipe.
2. Specify the latest supported AMI as the parent image.
3. Update the Image Builder pipeline to use that new recipe version.
4. Run the pipeline to create images based on the updated AMI.
Key exam factor
Recipes are versioned and immutable.
You cannot modify an existing recipe version's parent AMI. You must create a new version.
When this option is used
Use this approach when:
The base AMI needs to be updated.
A custom AMI is reaching end-of-life.
Security patches require moving to a newer OS image.
The pipeline should continue using the same recipe name but with updated source image details.
---
Option B — Disable the AMI in the lifecycle rules for the existing AMI. Update the existing EC2 Image Builder recipe with the latest AMI ID details. Rerun the pipeline.
❌ Incorrect
Why it is rejected
The problem is not about preventing the old AMI from being deleted or disabled. The issue is that the Image Builder recipe needs a new source AMI.
Also, an existing Image Builder recipe version cannot be updated. Recipes are immutable.
Lifecycle rules are used for:
Automatically deprecating old AMIs.
Removing unused AMIs.
Managing image retention.
They do not update the AMI used by Image Builder.
When this option can be used
AMI li...
Author: Sara · Last updated Jul 11, 2026
A company has many accounts in an organization in AWS Organizations. The company must automate resource provisioning from the organization's management account ...
Question Summary
A company has multiple AWS accounts in AWS Organizations and needs to automate resource provisioning from the management account to member accounts.
The key requirement is:
Centralized deployment from the AWS Organizations management account
Provision resources across multiple member accounts
Automation at organization scale
The AWS service designed for this requirement is AWS CloudFormation StackSets.
---
Option Analysis
A) Create an AWS CloudFormation change set. Deploy the change set to all member accounts.
❌ Rejected
Why?
A CloudFormation change set is used to preview changes before updating an existing CloudFormation stack.
Key factors:
It shows what resources will be created, modified, or deleted.
It does not provide multi-account deployment capability.
It works with an individual CloudFormation stack in a single account/Region.
When to use Change Sets?
Use change sets when:
You want to review infrastructure changes before applying them.
You need approval workflows before modifying a stack.
Example: A production stack update requires review before execution.
Why it does not fit?
The requirement is deploying automatically across many AWS accounts, not reviewing stack changes.
---
B) Create an AWS CloudFormation nested stack. Deploy the nested stack to all member accounts.
❌ Rejected
Why?
A nested stack allows one CloudFormation stack to create another CloudFormation stack as a resource.
Key factors:
It is used for modularizing templates.
It helps reuse common CloudFormation components.
It does not deploy stacks across multiple AWS accounts.
Example use case:
A company has a standard application architecture:
Network stack
Database stack
Application stack
A parent stack can call child stacks using nested stacks.
Why it does not fit?
Nested stacks operate inside the same account and deployment context. They do not provide organization-wide account provisioning.
---
C) Create an AWS CloudFormation stack set. Deploy the stack set to all member accounts.
✅ Selected
Why?
AWS CloudFormation StackSets are specifically designed for deploying CloudFormation templates across:
Multiple AWS accounts
Multiple AWS Regions
AWS Organizations
Key factors:
Can be managed centrally from the management account.
Can target:
Specific AWS accounts
Organizational Units (OUs)
The entire organization
Automatically creates and manages CloudFormation stacks in target accounts.
Supports automatic deplo...
Author: Andrew · Last updated Jul 11, 2026
A company has a software as a service (SaaS) application. The company has integrated the application with AWS services by using the AWS SDK and an IAM user's access key ID and secret access key.
The company needs to implement the principle of least privilege for the ...
Question focus
The requirements are:
1. Implement least privilege for the identity used by the SaaS application.
2. Avoid permanent credentials (the current IAM user access key ID and secret access key are long-term credentials).
3. The application uses the AWS SDK to access AWS services.
The key phrase is "must avoid the usage of permanent credentials". This rules out solutions that continue using an IAM user's access keys.
---
Option analysis
A) Migrate the application to use the AWS STS AssumeRoleWithSAML API operation.
❌ Rejected
Why?
`AssumeRoleWithSAML` is used for federated user access with SAML 2.0 identity providers.
Typical use cases:
Enterprise users signing in through Active Directory Federation Services (AD FS).
Workforce federation scenarios.
Human users accessing AWS Console or AWS resources.
Example scenario:
Employees authenticate through a corporate SAML identity provider.
The SAML assertion is exchanged for temporary AWS credentials.
Why it does not fit:
A SaaS application is an application workload, not a human user federation scenario.
The application normally needs a role that it can assume programmatically, not SAML federation.
When this option is appropriate:
A company wants employees to access AWS using corporate identities without creating IAM users.
---
B) Migrate the application to use the AWS STS AssumeRole API operation. Allow the IAM user to call only AWS STS.
✅ Selected
Why?
`AssumeRole` allows an application to obtain temporary security credentials instead of using permanent IAM user access keys.
The correct design pattern:
1. Create an IAM role with only the permissions required by the SaaS application.
2. Allow the application identity to call `sts:AssumeRole`.
3. The application uses the temporary credentials returned by STS.
4. Temporary credentials automatically expire and are rotated.
Example:
Current insecure design:
```
Application
|
| IAM User Access Key + Secret Key (Permanent)
|
AWS Services
```
Improved design:
```
Application
|
| sts:AssumeRole
|
AWS STS
|
| Temporary Credentials
|
IAM Role (Least Privilege Permissions)
|
AWS Services
```
Why this meets requirements:
| Requirement | How it is satisfied |
| --------------------------- | ------------------------------------------------ |
| Least privilege | IAM role policy grants only required permissions |
| Avoid permanent credentials | Application uses temporary STS credentials |
| SDK support | AWS SDK supports AssumeRole credential providers |
| Security improvement | Credentials expire automatically |
Important exam concept:
An IAM user should not have broad permissions. It can be restricted to only:
```
sts:AssumeRole
```
The role contains the actual permissions needed by the applica...
Author: RadiantJaguar56 · Last updated Jul 11, 2026
A CloudOps engineer is working on cost savings for a company. The CloudOps engineer notices multiple unused Elastic IP addresses. The addresses are spread across different accounts and AWS Regions in an organization in AWS Organizations.
The CloudOps engineer must administer and track the addresses based on securi...
Question Summary
A CloudOps engineer needs to:
Find unused Elastic IP addresses (EIPs) to reduce costs.
Track EIPs across multiple AWS accounts and AWS Regions.
Manage addresses based on security domains.
View the history of assigned addresses.
The key requirements are:
1. Centralized IP address management across an AWS Organization
2. Visibility across accounts and Regions
3. IP address history tracking
4. Ability to organize IP addresses by security/business domains
---
Option Analysis
A) Enable AWS Config with an IP address tracking rule.
Why it looks possible:
AWS Config records configuration changes.
It can track resources such as Elastic IP associations.
It provides configuration history.
Why it is rejected:
AWS Config is primarily a compliance and configuration auditing service, not an IP address management solution.
There is no native AWS Config rule specifically designed to provide centralized IP address inventory management across AWS Organizations.
It does not provide features like:
IP address pools
IP ownership management
security domain grouping
IP address planning
When AWS Config is useful:
Checking whether resources comply with rules.
Example:
Detect security groups open to the internet.
Track whether resources have encryption enabled.
Audit configuration changes.
It is not designed for enterprise IP address management.
---
B) Use Amazon CloudWatch with custom IP metrics to view addresses by account and Region.
Why it looks possible:
CloudWatch can create dashboards.
Custom metrics can display operational information.
Why it is rejected:
CloudWatch only stores metrics and monitoring data.
It does not maintain an inventory of IP addresses.
It does not understand:
EIP ownership
IP allocation history
address pools
security domains
The engineer would need to build custom automation to collect and publish IP data, which does not satisfy the requirement for native IP management.
When CloudWatch is useful:
Monitoring:
CPU usage
network traffic
application performance
operational alarms
It is not an IP address lifecycle management tool.
---
C) Enable Amazon VPC IP Address Manager for Organizations integrations.
Why it is correct:
Amazon VPC IP Address Manager (IPAM) is designed specifically for IP address management.
IPAM supports:
Multiple AWS accounts.
Multiple AWS Regions.
AWS Organizations integration.
Centralized visibility of IP addresses.
Tracking IP address allocations and associations.
IP address history.
Organizing IP addresses using IPAM scopes and ...
Author: GlowingTiger · Last updated Jul 11, 2026
A development team wants to match events on Amazon EventBridge where the state of an Amazon EC2 machine is not "terminated".
An example event is as follows:
Whi...
Correct answer: D)
```json
{
"detail": {
"state": [
{
"anything-but": {
"equals-ignore-case": "terminated"
}
}
]
}
}
```
Key AWS EventBridge pattern matching concept
Amazon EventBridge event patterns do not support general operators like `not equals` or `!=`. To match events where a field does not have a specific value, EventBridge uses the `anything-but` comparison operator.
The requirement is:
> Match EC2 state change events where `state` is not `"terminated"` (case-insensitive).
Therefore, the pattern must use:
`anything-but` → excludes a value
`equals-ignore-case` → makes the comparison case-insensitive
---
Option analysis
A)
```json
{
"detail": {
"state": [
"not equals-ignore-case": "terminated"
]
}
}
```
❌ Rejected
Why:
This is not valid EventBridge event pattern syntax.
EventBridge does not provide a `"not equals-ignore-case"` operator.
Event patterns use supported comparison operators such as:
`prefix`
`suffix`
`anything-but`
`numeric`
`exists`
`equals-ignore-case`
When something similar would be used:
If you need to exclude a value, use `anything-but`.
Example:
```json
{
"state": [
{
"anything-but": "terminated"
}
]
}
```
---
B)
```json
{
"detail": {
"state": [
"! equals-ignore-case": "terminated"
]
}
}
```
❌ Rejected
Why:
EventBridge does not support `!` or logical negation syntax.
Patterns are declarative JSON structures, not programming expressions.
Operators cannot be prefixed with `!` to invert their meaning.
When this style would be used:
This type of syntax is common in programming languages (`!=`, `!condition`), but not in EventBridge event patterns.
---
C)
```json
{
"detail": {
"state": [
{
"equals-ignore-case": "terminated"
}
]
...
Author: Elizabeth · Last updated Jul 11, 2026
A company is managing a website with a global user base hosted on Amazon EC2 with an Application Load Balancer (ALB). To reduce the load on the web servers, a CloudOps engineer configures an Amazon CloudFront distribution with the ALB as the origin. After a week of monitoring the solution, the CloudOps engineer notices that reques...
Question focus:
The goal of adding Amazon CloudFront in front of an Application Load Balancer (ALB) is to allow CloudFront to cache content at edge locations and reduce requests reaching the ALB and backend web servers.
The issue observed:
> "Requests are still being served by the ALB and there is no change in web server load."
This means either:
1. Users are bypassing CloudFront completely, or
2. CloudFront is not caching content and is forwarding every request to the ALB.
Let's analyze each option.
---
A) CloudFront does not have the ALB configured as the origin access identity. ❌
Rejected
Origin Access Identity (OAI) is used with Amazon S3 origins to restrict direct access to private S3 buckets.
An ALB does not use an OAI.
For CloudFront with an ALB origin, you configure the ALB as the origin, not an origin access identity.
When this option would be correct:
A CloudFront distribution uses a private S3 bucket as an origin, and the bucket policy must allow CloudFront through an OAI or Origin Access Control (OAC).
Why it does not apply here:
The origin is an ALB, not S3.
---
B) The DNS is still pointing to the ALB instead of the CloudFront distribution. ✅
Selected
This is a common configuration issue.
The correct request flow should be:
```
User
↓
DNS (Route 53 / other DNS provider)
↓
CloudFront Distribution
↓
ALB
↓
EC2 Web Servers
```
If DNS still points directly to the ALB:
```
User
↓
ALB
↓
EC2 Web Servers
```
CloudFront is completely bypassed, so:
No edge caching occurs.
ALB continues receiving all requests.
Web server load remains unchanged.
Key exam factor:
When introducing CloudFront, the application DNS record must point to the CloudFront distribution domain name, not the origin.
---
C) The ALB security group is not permitting inbound traffic from CloudFront. ❌
Rejected
If the ALB security group blocks CloudFront traffic:
CloudFront cannot reach the ALB.
Users would receive errors such as 502 Bad Gateway or connection failures.
Requests would not continue being served normally by the ALB.
When this option would be correct:
After moving traffic to CloudFront, users see errors because the ALB does not allow inbo...
Author: Lina Zhang · Last updated Jul 11, 2026
A company uses a large number of Linux based Amazon EC2 instances to run business operations such as ordering, fulfillment, and billing. The company uses AWS Systems Manager to manage the EC2 instances. The company wants to ensure that the Systems Manager Agent (SSM Agent) is always...
Question Summary
The company has many Linux-based EC2 instances managed by AWS Systems Manager (SSM) and wants to ensure the SSM Agent is always updated to the latest version with the least operational effort.
The key requirement is:
Automatic SSM Agent updates
Large fleet of EC2 instances
Most operationally efficient solution
Avoid custom maintenance workflows
---
Key AWS Concepts
Systems Manager Agent (SSM Agent)
SSM Agent is installed on EC2 instances and enables Systems Manager features such as:
Run Command
Patch Manager
Automation
Inventory
Session Manager
AWS periodically releases newer SSM Agent versions.
AWS provides a built-in mechanism to automatically update the agent.
Operational efficiency factor
For AWS exam questions, prefer:
1. Native AWS managed features
2. No custom code
3. No manual monitoring
4. Automatic scaling across large fleets
---
Option Analysis
---
A) Enable the Auto update SSM Agent setting in Systems Manager Fleet Manager.
Why this is correct
Fleet Manager in AWS Systems Manager provides a setting to automatically update SSM Agent on managed nodes.
Advantages:
Fully managed by AWS Systems Manager
No scripts required
No Lambda functions required
No SNS notifications required
Works across large EC2 fleets
Reduces operational overhead
This directly satisfies the requirement:
> "Ensure that SSM Agent is always up to date with the latest version."
The company does not need to know when new versions are released because AWS handles the update process.
When to use this option
Use Fleet Manager auto-update when:
You want AWS-managed automatic SSM Agent upgrades.
You manage many EC2 instances.
You want the simplest operational approach.
---
Option B) Subscribe to SSM Agent notifications on GitHub → SNS → Lambda → Run Command API
Why this is rejected
This approach creates a custom automation pipeline:
Flow:
GitHub notification
→ SNS
→ Lambda
→ Systems Manager Run Command
→ Update SSM Agent
Problems:
Requires writing and maintaining Lambda code.
Requires handling GitHub notification events.
Requires testing whenever AWS changes release processes.
Requires error handling for failed updates.
Adds unnecessary operational components.
Although it can work, it is not the most operationally efficient solution.
When could this option be used?
Use this type of custom solution when:
You need a customized ...
Author: Leah · Last updated Jul 11, 2026
A CloudOps engineer needs to configure a caching layer for a read-heavy application that uses an Amazon RDS for PostgreSQL database. The application exists across three AWS Regions. Read and write activities occur in the primary Region. In the two secondary Regions, read-only activity occurs on RDS for PostgreSQL cross-Region read replicas.
The cache in each Regi...
Key requirement analysis
The application has:
Three AWS Regions
Primary Region:
Read + write traffic
Amazon RDS for PostgreSQL primary database
Two secondary Regions:
Read-only traffic
RDS for PostgreSQL cross-Region read replicas
Caching requirement:
Each Region must have a cache
All caches must contain the same data
Users should get a consistent experience regardless of Region
The solution needs a multi-Region, replicated cache that supports:
1. A primary cache that accepts writes.
2. Read-only cache replicas in other Regions.
3. Automatic replication of cached data across Regions.
---
Option A: Amazon ElastiCache (Redis OSS) global datastore ✅
Why it is correct:
Amazon ElastiCache for Redis OSS supports Global Datastore, which provides:
One primary Redis cluster in the primary Region.
Up to multiple read-only secondary Redis clusters in other AWS Regions.
Automatic asynchronous replication from the primary Region to secondary Regions.
Low-latency local reads in each Region.
Architecture:
```
Primary Region
RDS PostgreSQL Primary
|
v
Redis OSS Primary Cluster (Read + Write)
|
| Global Datastore replication
|
--------------------------------
| |
v v
Secondary Region 1 Secondary Region 2
Redis Read Replica Redis Read Replica
(Read only) (Read only)
```
This matches the requirement exactly:
Writes happen in the primary Region.
Cache updates replicate to secondary Regions.
Users in every Region read the same cached data.
When to use Redis OSS Global Datastore
Use it when:
You need cross-Region cache replication.
Applications require low-latency reads worldwide.
You need a globally consistent cache dataset.
The workload is read-heavy with a single write Region.
Examples:
Global gaming leaderboards.
Product catalog caching.
User profile caching.
Session data replication.
---
Why the other options are rejected
---
Option B: ElastiCache (Memcached) global database ❌
Why incorrect:
There is no Amazon ElastiCache Memcached Global Datastore feature.
ElastiCache Global Datastore is available for:
Redis OSS only
Memcached is a distributed caching engine, but it does not provide:
Cross-Region replication.
Primary/secondary cluster relationships.
Multi-Region synchronized cache data.
When Memcached is used
Memcached is suitable for:
Simple key-value caching.
Stateless caching.
Applications where cache loss is acceptable.
Horizontal scaling of cache nodes.
Ex...
Author: Maya · Last updated Jul 11, 2026
A CloudOps engineer is unable to launch Amazon EC2 instances into a VPC because there are no available private IPv4 addresses in the VPC.
Which combination of action...
Question:
A CloudOps engineer cannot launch Amazon EC2 instances into a VPC because there are no available private IPv4 addresses in the VPC. Which combination of actions must the engineer take to launch the instances? (Choose two.)
Key exam concept:
A VPC receives a CIDR block that defines its available IP address range.
Subnets are created inside the VPC and each subnet gets a CIDR range from the VPC.
EC2 instances launched into a subnet consume private IPv4 addresses from that subnet.
When IPv4 addresses are exhausted, the solution is to expand the available IPv4 address space at the VPC or subnet level.
---
Option analysis
✅ A) Associate a secondary IPv4 CIDR block with the VPC.
Correct
Why:
A VPC can have multiple IPv4 CIDR blocks.
Adding a secondary IPv4 CIDR block expands the total IPv4 address pool available in the VPC.
After adding the CIDR block, the engineer can create additional subnets in that new address range and launch EC2 instances.
Key factor:
The problem states that there are no available private IPv4 addresses in the VPC, meaning the entire VPC address space may be exhausted.
Adding a secondary CIDR block increases the VPC's address capacity without recreating the VPC.
Scenario where this is used:
A production VPC originally created with `10.0.0.0/16` runs out of addresses.
The engineer adds `10.1.0.0/16` as a secondary CIDR block and creates new subnets there.
---
❌ B) Associate a primary IPv6 CIDR block with the VPC.
Incorrect
Why:
IPv6 addresses do not solve a shortage of private IPv4 addresses.
EC2 instances requiring private IPv4 connectivity still need available IPv4 addresses unless the architecture is specifically redesigned for IPv6.
Key factor:
The issue is IPv4 exhaustion, not lack of address types.
Scenario where this is used:
When applications need IPv6 connectivity.
When designing dual-stack VPCs that support both IPv4 and IPv6.
---
❌ C) Create a new subnet for the VPC.
Incorrect
Why:
A new subnet does not automatically create more IP addresses.
The subnet CIDR must come from the existing VPC CIDR range.
If the VPC CIDR is exhausted, there is no remaining address space from which to create a new subnet.
Key factor:...
Author: Aarav2020 · Last updated Jul 11, 2026
A company uses default settings to create an AWS Lambda function. The function needs to access an Amazon RDS database that is in a private subnet of a VPC. The function has the correct IAM permissions to access the database. The private subnet has appropriate routing configurations and is accessible from within the VPC. However, th...
Key AWS exam reasoning
The important clues are:
The Lambda function was created with default settings.
The RDS database is in a private subnet inside a VPC.
IAM permissions are correct.
The subnet routing is correct and the private subnet is reachable from within the VPC.
Lambda still cannot connect.
The key AWS concept: A Lambda function is not automatically placed inside your VPC. By default, Lambda runs in an AWS-managed VPC and does not have network access to resources inside your VPC, such as an RDS instance in a private subnet.
To allow Lambda to access RDS, the Lambda function must be configured with VPC settings:
Select the same VPC as the RDS database.
Select appropriate private subnets.
Attach security groups that allow communication.
---
Option analysis
A) The company did not set the RDS instance as the destination for the Lambda function in the function configuration.
❌ Incorrect
Lambda does not require an RDS instance to be configured as a "destination."
Lambda destinations are used for asynchronous invocation results, such as sending execution results to:
Amazon SQS
Amazon SNS
EventBridge
Another Lambda function
They do not control network connectivity to databases.
When this option would apply:
When a company wants to send Lambda success/failure results to another AWS service after execution.
It does not help Lambda connect to RDS.
---
B) The Lambda function configuration did not deploy the function in the same VPC that contains the RDS instance.
✅ Correct
By default, Lambda functions are not connected to your VPC.
An RDS instance in a private subnet can only be accessed by resources that have network connectivity to that VPC. If Lambda is not configured for the VPC, it cannot reach:
Private IP addresses
Private subnets
Internal RDS endpoints
The fix is:
1. Configure the Lambda function to run inside the VPC.
2. Choose subnets in that VPC.
3. Configure security groups to allow database traffic.
Key exam factor:
"Created with default sett...
Author: Deepak · Last updated Jul 11, 2026
A company has an Amazon S3 bucket that has server-side encryption with AWS KMS keys (SSE-KMS) enabled. Several applications read from the S3 bucket for daily reporting. The company clears the data in the S3 bucket weekly when the company moves the data into a data warehouse.
As more applications read from the S3 bucket, the cost of KMS-related transactions is increasing. A CloudOps engineer needs to reduc...
Correct answer: A) Enable S3 Bucket Keys on the S3 bucket. Specify the existing KMS key.
Key factors in this scenario
The bucket uses SSE-KMS, so every object operation that requires encryption/decryption involves AWS KMS API calls.
As more applications read objects, the number of KMS requests increases, causing higher KMS costs.
The company must keep S3 encryption enabled.
Existing objects must remain accessible.
The solution should require the least operational overhead.
The main issue is too many KMS requests, not the encryption itself. The goal is to reduce the number of direct calls from Amazon S3 to AWS KMS.
---
Option A — Enable S3 Bucket Keys on the S3 bucket. Specify the existing KMS key. ✅
Why this is correct
S3 Bucket Keys reduce AWS KMS request costs for SSE-KMS encrypted objects.
Normally:
1. Application requests an object.
2. S3 calls AWS KMS to obtain a data key.
3. KMS charges apply for these KMS operations.
With S3 Bucket Keys enabled:
1. S3 uses the existing KMS key to generate a bucket-level key.
2. S3 uses that bucket key to create data keys for objects.
3. S3 makes far fewer requests to AWS KMS.
Benefits:
✅ Keeps SSE-KMS encryption.
✅ Uses the existing KMS key.
✅ Reduces KMS API request costs.
✅ No application changes required.
✅ Existing objects remain accessible.
✅ Minimal operational effort.
When to use S3 Bucket Keys
Use S3 Bucket Keys when:
A bucket has many SSE-KMS encrypted objects.
There are many object reads/writes.
KMS request costs are significant.
You want to reduce KMS usage without changing security requirements.
Example:
A reporting bucket receives millions of reads daily from many applications.
Data is encrypted using SSE-KMS.
KMS charges are increasing.
Enable S3 Bucket Keys.
---
Why other options are rejected
B) Change encryption type to SSE-C ❌
Why it is rejected
SSE-C uses customer-provided encryption keys. The customer must provide the encryption key with every request.
Problems:
Applications must send encryption keys when accessing objects.
The company must manage key distribution and storage.
AWS cannot manage the keys.
Existing SSE-KMS objects would require additional migration steps.
This increases operational complexity.
When SSE-C is used
SSE-C is appropriate when:
A company requires complete control over encryption keys.
The organization does not want AWS to store encryption keys.
The application can securel...
Author: Chloe · Last updated Jul 11, 2026
A company plans to deploy a database on an Amazon Aurora MySQL DB cluster. The database will store data for a demonstration environment. The data must be reset on a daily basis.
W...
Question Analysis
Requirement:
Database runs on Amazon Aurora MySQL DB cluster.
It is used for a demonstration environment.
Data must be reset every day.
Need the MOST operationally efficient solution.
The key phrase is "demonstration environment". This means:
The data does not need long-term backup.
The database only needs to return to a known clean state daily.
The solution should minimize operational overhead, time, and cost.
---
Option A — Manual snapshot + EventBridge + Lambda restore snapshot
How it works:
1. Populate the database with the desired demo data.
2. Create a manual Aurora snapshot.
3. Daily EventBridge rule triggers Lambda.
4. Lambda restores the snapshot into a new DB cluster.
5. Delete the old cluster.
Why it works:
Manual snapshots provide a fixed baseline state.
Restoring a snapshot returns the database exactly to the desired demo state.
Suitable for environments where data needs periodic resets.
Drawbacks:
Restoring an Aurora cluster from a snapshot creates a new DB cluster.
Requires deleting the old cluster and updating endpoints/connections.
More operational steps and slower than alternatives.
When to use this option:
Use snapshots when:
You need a reusable database image.
You need to recreate environments.
You need backups retained for longer periods.
You need a recovery mechanism.
Example:
> A development team wants to create identical test environments every week from a known database state.
---
Option B — Enable Aurora Backtrack and perform daily backtrack
How it works:
1. Enable Aurora Backtrack.
2. Set a backtrack window (48 hours).
3. Daily Lambda performs a backtrack operation to return the database to an earlier point.
Why it is the BEST choice:
Aurora Backtrack is designed specifically for quickly rewinding database changes without restoring from backups.
Advantages:
No need to create a new DB cluster.
No need to delete the existing cluster.
Database remains available with minimal disruption.
Much faster than snapshot restoration.
Perfect for temporary environments such as demos, testing, and development.
Key exam clue:
"Data must be reset daily" + "demonstration environment" = Aurora Backtrack
Backtrack allows you to quickly return to a known state.
Limitations:
Only available for Aurora MySQL.
Limited by the configured backtrack window.
Not a replacement for backups.
Cannot be used for long-term disaster recovery.
When to use this option:
Use Backtrack when:
You need to undo accidental changes.
You need fast database resets.
You have development, testing, or demo workloads.
Example:
> A training environment is modified by students throughout the day and needs to return to the original dataset every morning.
---
Option C — Export snapshot to S3 and restore from S3
How it works:
1. Export Aurora snapshot data to Amazon S3.
2. Daily Lambda restores f...
Author: Matthew · Last updated Jul 11, 2026
A CloudOps engineer must troubleshoot performance issues for a web application that is delivered through Amazon CloudFront. The metrics show a consistently low cache hit ratio that leads to many requests ...
Correct option: C) Reduce the number of request headers, query strings, and cookies included in the cache key.
Key reasoning
Amazon CloudFront determines whether a request can be served from cache by comparing the request's cache key with previously cached objects.
The cache key can include:
URL path
Query strings
HTTP headers
Cookies
If too many headers, query strings, or cookies are included in the cache key, CloudFront creates many different cache variations for the same content. This causes:
More cache misses
Lower cache hit ratio
More requests forwarded to the origin
By reducing unnecessary values in the cache key, CloudFront can reuse the same cached object for more requests, increasing the cache hit ratio.
Example scenario
Suppose an application serves the same product image:
```
/images/product123.jpg
```
But the cache key includes:
```
User-Agent
Cookie: session-id
Language
Tracking query parameters
```
CloudFront may store separate cache objects:
```
/images/product123.jpg + Chrome + User A cookie
/images/product123.jpg + Firefox + User B cookie
/images/product123.jpg + Mobile + User C cookie
```
Even though the image is identical.
Removing unnecessary headers/cookies/query strings allows all users to use the same cached object:
```
/images/product123.jpg
```
Result:
✅ Fewer cache objects
✅ More cache reuse
✅ Higher cache hit ratio
✅ Reduced origin traffic
---
Why the other options are rejected
A) Modify the origin's Cache-Control header to `max-age=0`
Rejected
`max-age=0` tells CloudFront and other caches that the object is immediately stale and must be revalidated with the origin.
Effect:
Cached objects expire immediately
More requests reach the origin
Cache hit ratio decreases
When this option is useful:
Use `Cache-Control: max-age=0` when:
Content must always be fresh
Dynamic data should not be cached
You need frequent origin validation
Example:
Banking account balances
Real-time dashboar...
Author: Noah · Last updated Jul 11, 2026
A company uses an organization in AWS Organizations to manage a multi-account AWS environment. The company creates a new Amazon EBS backed Amazon Machine Image (AMI). The company shares the AMI across the organization. Employees must use the AMI to launch all new Linux-based Amazon EC2 instances across the entire organization.
In one of the company's application accounts, an employee use...
Question focus:
The key clue is:
The company created an Amazon EBS-backed AMI.
The AMI is shared across AWS Organizations.
An employee in another account launches an EC2 instance using this AMI.
The instance launches successfully but is terminated immediately.
The question asks why it did not fully boot.
The issue is most likely related to encrypted EBS snapshots used by the AMI.
---
Analyze each option
A) The user who launched the instance does not have `ec2:RunInstances` permissions within the application account.
❌ Rejected
Reasoning:
If the user did not have `ec2:RunInstances` permission:
The EC2 launch API request would be denied.
The instance would never enter the running state.
The user would receive an AccessDenied error.
Since the instance launches and then terminates, the user already had sufficient permissions to call `RunInstances`.
When this option applies:
A user clicks "Launch Instance" and receives:
`UnauthorizedOperation`
`AccessDenied`
API authorization failure
---
B) The company encrypted the AMI by using an AWS KMS key that the user who launched the EC2 instance does not have access to.
✅ Correct
Reasoning:
An EBS-backed AMI consists of:
AMI metadata
EBS snapshots
If the AMI uses encrypted EBS snapshots, the encryption is controlled by an AWS KMS key.
Important AWS exam rule:
> Sharing an AMI does not automatically share the KMS key used to encrypt the AMI.
When another AWS account launches an instance from an encrypted AMI:
1. EC2 starts the launch process.
2. It tries to create EBS volumes from the encrypted snapshots.
3. AWS KMS checks whether the launching account/user has permission to use the KMS key.
4. If access is denied, the volume cannot be created/decrypted.
5. The instance fails to boot and is usually terminated.
The instance can appear briefly as launching because EC2 has accepted the request, but it cannot complete initialization.
Key factor:
Encrypted AMI + cross-account sharing = KMS key permissions must also be shared.
The company must grant the application accounts permission to use the KMS key through:
KMS key policy
IAM permissions
Grants (if applicable)
When this option applies:
AMI shared between AWS accounts
AMI uses encrypted...
Author: Chloe · Last updated Jul 11, 2026
A company has scientists who upload large data objects to an Amazon S3 bucket. The scientists upload the objects as multipart uploads. The multipart uploads often fail because of poor end-client connectivity.
The company wants to optimize storage costs that are associated with the data. A CloudOps engineer must implement a solution that presents metric...
Question focus
The requirements are:
1. Present metrics for incomplete multipart uploads
2. Automatically delete incomplete multipart uploads after 7 days
3. Optimize storage costs caused by failed multipart uploads
The key AWS services involved are:
Amazon S3 Storage Lens → provides storage usage metrics, including incomplete multipart upload metrics.
S3 Lifecycle rules → automatically delete incomplete multipart uploads after a specified number of days.
---
Option analysis
A) Review the Incomplete Multipart Upload Bytes metric in the S3 Storage Lens dashboard. Create an S3 Lifecycle policy to automatically delete any incomplete multipart uploads after 7 days.
✅ Correct
Why this works:
S3 Storage Lens provides visibility into S3 storage usage across buckets and accounts.
It includes the Incomplete Multipart Upload Bytes metric, which shows how much storage is being consumed by unfinished multipart uploads.
S3 Lifecycle configuration supports the action:
Abort incomplete multipart uploads after N days
Setting this value to 7 days automatically removes failed multipart uploads and prevents unnecessary storage charges.
When to use this approach:
Use this when:
You need visibility into incomplete multipart upload storage usage.
You need automatic cleanup without writing custom code.
You want a native S3-managed solution with minimal operational overhead.
This is the recommended AWS architecture because it combines monitoring (Storage Lens) and automated cleanup (Lifecycle rules).
---
Why other options are rejected
---
B) Implement S3 Intelligent-Tiering to move data into lower-cost storage classes after 7 days. Create an S3 Storage Lens policy to automatically delete any incomplete multipart uploads after 7 days.
❌ Incorrect
Reasons:
1. S3 Intelligent-Tiering does not apply to incomplete multipart uploads
Intelligent-Tiering manages completed objects by automatically moving objects between access tiers.
Incomplete multipart uploads are not objects yet, so they cannot be transitioned.
2. S3 Storage Lens cannot delete uploads
Storage Lens is a reporting and analytics tool.
It provides metrics but does not perform lifecycle actions.
When Intelligent-Tiering is used:
Use S3 Intelligent-Tiering when:
Objects have unpredictable access patterns.
You want automatic cost optimization for completed objects.
Example:
Research data files are uploaded successfully.
Some files are accessed frequently, others rarely.
Intelligent-Tiering automatically moves objects to cheaper tiers.
It is not suitable for failed multipart uploads.
---
C) Access the S3 console. Review the Metrics tab to check the storage that incomplete multipart uploads are consuming. Create an AWS Lambda function t...
