AWS DevOps Engineer Professional Practice Test

Answer choices

1. A. Delete the production stack and recreate it to see what changes occur, as selected.
2. B. Create and review a CloudFormation change set before executing the stack update, for this decision.
3. C. Use an S3 Inventory report as the update preview, as the primary implementation for the described business requirement.
4. D. Increase the stack timeout and execute the update directly, for the stated implementation and support requirements.

Wrong-answer review

• A. Delete the production stack and recreate it to see what changes occur, as selected.: Deleting production resources is not a safe preview mechanism.
• C. Use an S3 Inventory report as the update preview, as the primary implementation for the described business requirement.: S3 Inventory reports objects; it does not model CloudFormation stack changes.
• D. Increase the stack timeout and execute the update directly, for the stated implementation and support requirements.: Timeout settings do not provide a preview of resource changes.

Answer choices

1. A. Send NON_COMPLIANT Config events to EventBridge and invoke a custom Lambda that reimplements the fix, as configured.
2. B. Configure AWS Config automatic remediation for the rule using the Systems Manager Automation remediation action, under the stated decision criteria.
3. C. Use a Systems Manager State Manager association on every possible resource regardless of Config compliance state, as the organization’s selected response.
4. D. Use a Config conformance pack only and rely on its compliance report without remediation actions, for the required outcome.

Answer choices

1. A. Use Amazon Route 53 hosted zones to group accounts by business unit, for the stated security, delivery, and accountability requirements.
2. B. Create one IAM user that has administrator access in every account, for the stated implementation and support requirements.
3. C. Create an independent CodePipeline in each account and use pipelines as account governance, in the described situation.
4. D. Use AWS Organizations for centralized account management and service control policies as governance guardrails.

Answer choices

1. A. Enable tag immutability with exclusion filters that make the production tag mutable, as proposed.
2. B. Keep tags mutable and enable enhanced image scanning, as the selected response to the described condition.
3. C. Use lifecycle policies to expire older image digests while leaving release tags mutable, for the stated requirement.
4. D. Enable image tag immutability on the repository, for the described technical objective and its associated operational control requirements.

Answer choices

1. A. Enable AWS Secrets Manager rotation for the supported secret and let applications retrieve the current secret at runtime.
2. B. Commit the new password to the repository each time it changes, as the primary implementation for the described business requirement.
3. C. Create an IAM role and assume that role automatically changes the database password, for the described technical objective and its associated operational control requirements.
4. D. Use CloudTrail log-file validation as the credential rotation mechanism, as the selected approach for the stated technical and business outcome, for this task.

Answer choices

1. A. Set an appropriate retention policy on each log group, for the described technical objective and its associated operational control requirements.
2. B. Create scheduled export tasks to S3 and manually delete log streams afterward, for this decision.
3. C. Use a metric filter that emits a value when events become 14 days old, for the described technical objective.
4. D. Use separate log streams with naming conventions but keep the log groups at Never Expire, for review.

Answer choices

1. A. Use AWS Backup cross-Region copies plus a custom server-rebuild runbook, within the defined security and accountability boundaries.
2. B. Copy EBS snapshots on a schedule and manually recreate each server during an outage, for consideration.
3. C. Use AWS Elastic Disaster Recovery (AWS DRS), for the described technical objective and its associated operational control requirements, as described.
4. D. Use DataSync to replicate application files and assume it captures complete server state, for the specified implementation requirement.

Answer choices

1. A. Configure an Amazon SQS dead-letter queue for the EventBridge target, for the described technical objective and its associated operational control requirements, for this scenario.
2. B. Increase MaximumRetryAttempts indefinitely and configure no dead-letter destination, as the selected approach for the stated technical and business outcome, as presented.
3. C. Create an EventBridge archive and treat it as the target DLQ, within the incident and event response (14%) context.
4. D. Configure an SQS queue as a normal second target rather than the rule target's DLQ, as presented.

Answer choices

1. A. Set MaxErrors to 100, for the described technical objective.
2. B. Set the runbook timeout to 100 seconds, for the described technical objective.
3. C. Set the Patch Manager reboot option to NoReboot, for the required business outcome.
4. D. Set MaxConcurrency to 100 (or the equivalent percentage), as proposed.

Answer choices

1. A. Use AWS CodeBuild as the build action in AWS CodePipeline, as the proposed design for the complete governed operational workflow.
2. B. Run the compilation inside an EventBridge rule target, for the described technical objective and its associated operational control requirements, as selected.
3. C. Use AWS CloudFormation as the build action, under the documented operational and governance requirements.
4. D. Store the source in Amazon S3 and treat the upload as the build step, for the described technical objective.