Deployment, Provisioning, and Automation

82. Before applying an AWS CloudFormation stack update, a team must see exactly which resources would be replaced. Which solution meets these requirements?

1. A Run drift detection on the stack and review the reported differences.
2. B Create a nested stack for the changed resources and deploy it separately.
3. C Apply the update and review the stack events as they are generated.
4. D Create a change set for the update and review the listed resource actions before executing it.

83. An operations team must roll out a new AMI to an Auto Scaling group so that instances are replaced gradually and the rollout stops if replacements fail health checks. Which solution meets these requirements?

1. A Update the launch template to the new AMI and increase the desired capacity until the old instances are outnumbered.
2. B Update the launch template to the new AMI and terminate the existing instances so the group replaces them.
3. C Update the launch template to the new AMI and start an instance refresh with a minimum healthy percentage and a checkpoint.
4. D Create a second Auto Scaling group with the new AMI and delete the original group once it is running.

84. An operations team maintains infrastructure with the AWS CDK and must review exactly which resources a change would alter before it is applied. Which solution meets these requirements?

1. A Run cdk diff to compare the synthesized template against the deployed stack, then deploy once the differences are understood.
2. B Run cdk deploy and review the stack events as the resources are updated.
3. C Run cdk destroy and redeploy the stack so the resources are recreated from the current code.
4. D Run cdk synth and inspect the generated template for the intended resources.

85. A production database resource must not be modified or replaced during any AWS CloudFormation stack update. Which solution meets these requirements?

1. A Set a DeletionPolicy of Snapshot on the database resource.
2. B Enable termination protection on the CloudFormation stack.
3. C Apply a stack policy that denies Update:Replace and Update:Modify on that logical resource.
4. D Attach an IAM policy that denies the database delete API to the deploying principal.

86. An AWS CloudFormation stack update has failed and the stack is in UPDATE_ROLLBACK_FAILED. Which action should the team take?

1. A Retry the same update without changes so CloudFormation can complete it.
2. B Enable termination protection and wait for the stack to stabilize.
3. C Continue the update rollback, skipping resources that cannot revert, and correct them afterwards.
4. D Delete the stack and recreate it from the last known good template.

87. An engineer must identify every resource in a stack whose live configuration no longer matches its template definition. Which solution meets these requirements?

1. A Run drift detection on the stack and review the drifted resources and property differences.
2. B Run the CloudFormation linter against the template.
3. C Create a change set against the current template and review the proposed actions.
4. D Perform a stack update with no template changes and review the events.

88. An organization must deploy a standard VPC and logging stack into every account in an organizational unit, including accounts created later. Which solution meets these requirements?

1. A Publish the template as an AWS Service Catalog product for account owners to launch.
2. B Create a CloudFormation StackSet targeting the organizational unit with automatic deployment enabled.
3. C Create an AWS Lambda function that deploys the stack when a new account is detected.
4. D Create the stack manually in each account during onboarding.

89. A StackSet operation across 200 accounts must stop early if failures accumulate and must deploy to several accounts at once. Which solution meets these requirements?

1. A Add Conditions to the template so failing accounts are skipped.
2. B Set the failure tolerance and the maximum concurrent accounts in the operation preferences.
3. C Set a stack policy on each target stack to control the update behaviour.
4. D Attach a permissions boundary to the StackSet administration role.

90. An organization must build and distribute a hardened, patched AMI on a monthly schedule through a repeatable pipeline. Which solution meets these requirements?

1. A Create a Systems Manager Patch Manager baseline that patches the running instances monthly.
2. B Create an AWS Service Catalog product that references the current AMI each month.
3. C Create an AWS CodeDeploy deployment group that delivers the hardened configuration monthly.
4. D Create an EC2 Image Builder pipeline with a recipe and a monthly schedule that distributes the AMI to the target accounts.

91. Two AWS CloudFormation stacks must share a VPC identifier, and the exporting stack must not be deletable while the value is in use. Which solution meets these requirements?

1. A Define an Output with an Export name in one stack and consume it with Fn::ImportValue in the other.
2. B Store the VPC identifier in Systems Manager Parameter Store and read it from both stacks.
3. C Pass the VPC identifier as a parameter when deploying the second stack.
4. D Define the VPC identifier in a Mappings section duplicated in both templates.

92. An AWS CloudFormation deployment fails because the target subnet has too few available IP addresses for the requested instances. Which action resolves the failure?

1. A Enable auto-assign public IPv4 addressing on the existing subnet.
2. B Increase the Auto Scaling group's maximum size so more instances can be launched.
3. C Retry the stack creation so CloudFormation can allocate the addresses again.
4. D Add a larger secondary CIDR range to the VPC and create a subnet with sufficient address space for the stack.

93. A company must let developers provision only approved infrastructure patterns in a sandbox account without granting broad creation permissions. Which solution meets these requirements?

1. A Publish the approved patterns as AWS Service Catalog products with launch constraints and grant developers access to the portfolio.
2. B Create CloudFormation templates in a shared repository and ask developers to deploy them.
3. C Create AWS Config rules that report resources that do not match the approved patterns.
4. D Grant developers a managed policy allowing the underlying service actions and publish a written standard.

94. A network account must share subnets with several application accounts so those accounts can launch resources into them. Which solution meets these requirements?

1. A Create a VPC peering connection between the network VPC and each application VPC.
2. B Attach the network VPC and each application VPC to an AWS Transit Gateway.
3. C Share the subnets with the application accounts through AWS Resource Access Manager.
4. D Copy the subnet configuration into each application account's own VPC.

95. An operations team uses Terraform for some workloads and must keep that state consistent when resources are also managed elsewhere. Which practice meets these requirements?

1. A Disable Terraform state locking so concurrent applies are not blocked.
2. B Manage the resources with both Terraform and CloudFormation so either tool can apply changes.
3. C Manage each resource with exactly one tool and store the Terraform state remotely with locking enabled.
4. D Import all Terraform-managed resources into CloudFormation and retire the Terraform state.

96. An Auto Scaling group must launch instances from a configuration supporting several instance types and both Spot and On-Demand purchasing. Which solution meets these requirements?

1. A Create a launch template and set the instance type in user data at launch.
2. B Create one Auto Scaling group for each instance type and purchasing option.
3. C Create a launch configuration and reference it from the Auto Scaling group.
4. D Create a launch template and configure a mixed instances policy on the Auto Scaling group.

97. An AWS CloudFormation stack fails to create a resource because the deploying role lacks a required permission. Which action resolves the failure?

1. A Recreate the stack in a different Region where the permission is not required.
2. B Add the missing action to the IAM user who initiated the deployment and redeploy.
3. C Disable rollback on the stack so the partially created resources are retained.
4. D Add the missing action to the CloudFormation service role and redeploy the stack.

98. A command must be run on 300 EC2 instances without opening inbound ports or distributing SSH keys. Which solution meets these requirements?

1. A Run a Systems Manager Run Command document against the managed instances.
2. B Connect to each instance with EC2 Instance Connect and run the command.
3. C Deploy a bastion host and distribute SSH keys to the operations team.
4. D Add the command to user data and reboot each instance so it runs at launch.

99. A specific package must remain installed and a service must remain running on all instances, with drift corrected automatically. Which solution meets these requirements?

1. A Create a Systems Manager State Manager association that applies the desired configuration on a schedule.
2. B Add the package installation to the instances' user data script.
3. C Run a Systems Manager Run Command document once against all instances.
4. D Create an AWS Config rule that reports instances where the service is stopped.

100. Operating system patches must be applied to production instances only during a Sunday maintenance window, with compliance reporting. Which solution meets these requirements?

1. A Define a Systems Manager patch baseline, apply it through a maintenance window, and review patch compliance reporting.
2. B Create an AWS Config rule that reports instances missing required patches.
3. C Add a package update command to the instances' user data so patches apply at launch.
4. D Create an AWS Lambda function that patches the instances on a daily schedule.

101. An object uploaded to Amazon S3 must automatically start a processing workflow. Which solution meets these requirements?

1. A Create a CloudWatch alarm on the bucket's NumberOfObjects metric.
2. B Configure an S3 event notification, or an EventBridge rule on the bucket, that starts the workflow.
3. C Create a Systems Manager State Manager association that checks the bucket on a schedule.
4. D Create an AWS Lambda function that lists the bucket contents every minute.

102. A team must know which of 400 EC2 instances have a specific application version installed, without connecting to each one. Which solution meets these requirements?

1. A Review the AWS Config configuration history for each instance.
2. B Enable Systems Manager Inventory collection and query the collected application data.
3. C Review Amazon Inspector findings for the affected instances.
4. D Review the tags applied to each instance for the recorded application version.

103. An AMI must be shared with another account in the same organization. Which combination of steps meets these requirements? (Select TWO.)

1. A Modify the AMI's launch permissions to include the target account.
2. B Make the AMI public and restrict it by tag.
3. C Copy the AMI to the target account's Region.
4. D Share the AMI's underlying snapshots with the target account.
5. E Grant the target account IAM permissions to the AMI's ARN.

104. A Systems Manager patch baseline must approve patches only after they have been available for seven days. Which configuration is appropriate?

1. A Schedule the maintenance window seven days after each patch release.
2. B Set an auto-approval delay of seven days in the baseline's approval rules.
3. C Apply patches manually after a seven-day review.
4. D Reduce the patch baseline's compliance level.

105. An EC2 instance's root volume must be increased in size without replacing the instance. Which steps are required?

1. A Create a new volume and attach it as the root device.
2. B Modify the EBS volume size, which extends the file system automatically.
3. C Modify the EBS volume size, then extend the partition and file system inside the guest operating system.
4. D Stop the instance and change its instance type.

106. A repeated operational task must be captured so it runs identically each time and its execution is recorded. Which approach is appropriate?

1. A Record the steps in a shared document for operators to follow.
2. B Schedule a recurring reminder for the task.
3. C Assign the task to the same operator each time.
4. D Author it as a Systems Manager Automation runbook so each step, its inputs, and its outputs are recorded.

107. An operational automation must be applied to instances as they launch, without modifying the machine image. Which approach is appropriate?

1. A Run a Run Command document manually after each launch.
2. B Create a State Manager association targeting the instances by tag so the configuration applies as they appear.
3. C Rebuild the machine image with the configuration included.
4. D Add the configuration to each instance's user data.