A DevOps Engineer is using AWS CodeDeploy across a fleet of Amazon EC2 instances in an EC2 Auto Scaling group. The associated CodeDeploy deployment group, which is integrated with EC2 Auto Scaling, is configured to perform in-place deployments with CodeDeployDefault.OneAtATime. During an ongoing new deployment, the Engineer discovers that, although the overall deployment finished successfully, two out of five instances have the previous application revision deployed. The other three instances have the newest application revision.
What is likely causing this issue?

1. A. The two affected instances failed to fetch the new deployment.
2. B. A failed AfterInstall lifecycle event hook caused the CodeDeploy agent to roll back to the previous version on the affected instances.
3. C. The CodeDeploy agent was not installed in two affected instances.
4. D. EC2 Auto Scaling launched two new instances while the new deployment had not yet finished, causing the previous version to be deployed on the affected instances.

Correct Answer: D

A company discovers that some IAM users have been storing their AWS access keys in configuration files that have been pushed to a Git repository hosting service.
Which solution will require the LEAST amount of management overhead while preventing the exposed AWS access keys from being used?

1. A. Build an application that will create a list of all AWS access keys in the account and search each key on Git repository hosting service
2. B. If a match is found, configure the application to disable the associated access ke
3. C. Then deploy the application to an AWS Elastic Beanstalk worker environment and define a periodic task to invoke the application every hour.
4. D. Use Amazon Inspector to detect when a key has been exposed onlin
5. E. Have Amazon Inspector send a notification to an Amazon SNS topic when a key has been expose
6. F. Create an AWS Lambda function subscribed to the SNS topic to disable the IAM user to whom the key belongs, and then delete the key so that it cannot be used.
7. G. Configure AWS Trusted Advisor and create an Amazon CloudWatch Events rule that uses Trusted Advisor as the event sourc
8. H. Configure the CloudWatch Events rule to invoke an AWS Lambda function as the targe
9. I. If the Lambda function finds the exposed access keys, then have it disable the access key so that it cannot be used.
10. J. Create an AWS Config rule to detect when a key is exposed onlin
11. K. Haw AWS Config send change notifications to an SNS topi
12. L. Configure an AWS Lambda function that is subscribed to the SNS topic to check the notification sent by AWS Config, and then disable the access key so it cannot be used.

Correct Answer: C
https://github.com/aws/Trusted-Advisor-Tools/tree/master/ExposedAccessKeys/stepbystep

An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). A DevOps engineer is using AWS CodeDeploy to release a new version. The deployment fails during the AllowTraffic lifecycle event, but a cause for the failure is not indicated in the deployment logs.
What would cause this?

1. A. The appspec.yml file contains an invalid script to execute in the AllowTraffic lifecycle hook.
2. B. The user who initiated the deployment does not have the necessary permissions to interact with the ALB
3. C. The health checks specified for the ALB target group are misconfigured.
4. D. The CodeDeploy agent was not installed in the EC2 instances that are part of the ALB target group.

Correct Answer: C

A DevOps Engineer must automate a weekly process of identifying unnecessary permissions on a per-user basis, across all users in an AWS account. This process should evaluate the permissions currently granted to each user by examining the user's attached IAM access policies compared to the permissions the user has actually used in the past 90 days. Any differences in the comparison would indicate that the user has more permissions than are required. A report of the deltas should be sent to the Information Security team for further review and IAM user access policy revisions, as required.
Which solution is fully automated and will produce the MOST detailed deltas report?

1. A. Create an AWS Lambda function that calls the IAM Access Advisor API to pull service permissions granted on a user-by-user basis for all users in the AWS accoun
2. B. Ensure that Access Advisor is configured with a tracking period of 90 day
3. C. Invoke the Lambda function using an Amazon CloudWatch Events rule on a weekly schedul
4. D. For each record, by user, by service, if the Access Advisor Last Accesses field indicates a day count instead of "Not accesses in the tracking period," this indicates a delta compared to what is in the user's currently attached access police
5. E. After Lambda has iterated through all users in the AWS account, configure it to generate a report and send the report using Amazon SES.
6. F. Configure an AWS CloudTrail trail that spans all AWS Regions and all read/write events, and point this trail to an Amazon S3 bucke
7. G. Create Amazon Athena table and specify the S3 bucket ARN in the CREATE TABLE quer
8. H. Create an AWS Lambda function that accesses the Athena table using the SDK, which performs a SELECT, ensuring that the WHERE clause includes userIdentity, eventName, and eventTim
9. I. Compare the results against the user's currently attached IAM access policies to determine any delta
10. J. Configure an Amazon CloudWatch Events schedule to automate this process to run once a wee
11. K. Configure Amazon SES to send a consolidated report to the Information Security team.
12. L. Configure VPC Flow Logs on all subnets across all VPCs in all regions to capture user traffic across the entire accoun
13. M. Ensure that all logs are being sent to a centralized Amazon S3 bucket, so all flow logs can be consolidated and aggregate
14. N. Create an AWS Lambda function that is triggered once a week by an Amazon CloudWatch Events schedul
15. O. Ensure that the Lambda function parses the flow log files for the following information: IAM user ID, subnet ID, VPC ID, Allow/Reject status per API call, and service nam
16. P. Then have the function determine the deltas on a user-by-user basi
17. Q. Configure the Lambda function to send the consolidated report using Amazon SES.
18. R. Create an Amazon ES cluster and note its endpoint URL, which will be provided as an environment variable into a Lambda functio
19. S. Configure an Amazon S3 event on a AWS CloudTrail trail destination S3 bucket and ensure that the event is configured to send to a Lambda functio
20. T. Create the Lambda function to consume the events, parse the input from JSON, and transform it to an Amazon ES document forma
21. . POST the documents to the Amazon ES cluster's endpoint by way of the passed-in environment variabl
22. . Make sure that the proper indexing exists in Amazon ES and use Apache Lucene queries to parse the permissions on a user-by-user basi
23. . Export the deltas into a report and have Amazon ES send the reports to the Information Security team using Amazon SES every week.

Correct Answer: C

An e-commerce company is running a web application in an AWS Elastic Beanstalk environment. In recent months, the average load of the Amazon EC2 instances has been increased to handle more traffic.
The company would like to improve the scalability and resilience of the environment. The Development team has been asked to decouple long-running tasks from the environment if the tasks can be executed asynchronously. Examples of these tasks include confirmation emails when users are registered to the platform, and processing images or videos. Also, some of the periodic tasks that are currently running within the web server should be offloaded.
What is the most time-efficient and integrated way to achieve this?

1. A. Create an Amazon SQS queue and send the tasks that should be decoupled from the Elastic Beanstalk web server environment to the SQS queu
2. B. Create a fleet of EC2 instances under an Auto Scaling grou
3. C. Use an AMI that contains the application to process the asynchronous tasks, configure the application to listen for messages within the SQS queue, and create periodic tasks by placing those into the cron in the operating syste
4. D. Create an environment variable within the Elastic Beanstalk environment with a value pointing to the SQS queue endpoint.
5. E. Create a second Elastic Beanstalk worker tier environment and deploy the application to process the asynchronous tasks ther
6. F. Send the tasks that should be decoupled from the original Elastic Beanstalk web server environment to the auto-generated Amazon SQS queue by the Elastic Beanstalk worker environmen
7. G. Place a cron.yaml file within the root of the application source bundle for the worker environment periodic task
8. H. Use environment links to link the web server environment with the worker environment.
9. I. Create a second Elastic Beanstalk web server tier environment and deploy the application to process the asynchronous task
10. J. Send the tasks that should be decoupled from the original Elastic Beanstalk web server to the auto-generated Amazon SQS queue by the Elastic Beanstalk web server tier environmen
11. K. Place a cron.yaml file within the root of the application source bundle for the second web server tier environment with the necessary periodic task
12. L. Use environment links to link both web server environments.
13. M. Create an Amazon SQS queue and send the tasks that should be decoupled from the Elastic Beanstalk web server environment to the SQS queu
14. N. Create a fleet of EC2 instances under an Auto Scaling grou
15. O. Install and configure the application to listen for messages within the SQS queue from UserData and create periodic tasks by placing those into the cron in the operating syste
16. P. Create an environment variable within the Elastic Beanstalk web server environment with a value pointing to the SQS queue endpoint.

Correct Answer: C