Configuration Management and Infrastructure as Code

52. An AWS CloudFormation stack must not report creation complete until the application on its instances signals readiness. Which solution meets these requirements?

1. A Add a DependsOn attribute between the instance and its dependencies.
2. B Run a Systems Manager Automation document after the stack completes to verify readiness.
3. C Add a CreationPolicy to the resource and invoke cfn-signal from the instance when the application is ready.
4. D Add a DeletionPolicy of Retain to the instance resource.

53. An Auto Scaling group defined in CloudFormation must replace its instances in batches during a stack update, waiting for signals from each batch. Which solution meets these requirements?

1. A Add a stack policy that denies updates to the Auto Scaling group.
2. B Add a CreationPolicy to the Auto Scaling group resource.
3. C Add an UpdatePolicy with AutoScalingRollingUpdate specifying the batch size, pause time, and minimum successful instances percentage.
4. D Add a DependsOn attribute between the group and its launch template.

54. Infrastructure patterns must be published so application teams provision approved configurations without holding the underlying creation permissions. Which solution meets these requirements?

1. A Publish the patterns as AWS Service Catalog products with launch constraints and grant teams access to the portfolio.
2. B Create CloudFormation modules and document their use in the team wiki.
3. C Publish the CloudFormation templates in a shared repository for teams to deploy.
4. D Grant the teams a managed policy allowing the underlying service actions.

55. A production database resource must be protected from modification or replacement during any stack update. Which solution meets these requirements?

1. A Set a DeletionPolicy of Snapshot on the database resource.
2. B Enable termination protection on the CloudFormation stack.
3. C Attach an IAM policy denying the database delete action to the deploying principal.
4. D Apply a stack policy that denies Update:Replace and Update:Modify on that logical resource.

56. An organization must automate account creation with a consistent security baseline as it scales to hundreds of accounts. Which solution meets these requirements?

1. A Deploy AWS Control Tower and provision accounts through Account Factory with its preventive and detective controls.
2. B Create the accounts manually and apply a CloudFormation template to each.
3. C Publish an account onboarding checklist for the requesting team to follow.
4. D Write a Lambda function that creates each account and applies a baseline template.

57. A standard logging and monitoring stack must be deployed to every account in an organizational unit, including accounts added later. Which solution meets these requirements?

1. A Create an EventBridge rule that deploys the stack when a new account is created.
2. B Deploy the stack manually in each account during onboarding.
3. C Create a CloudFormation StackSet targeting the organizational unit with automatic deployment enabled.
4. D Publish the template in AWS Service Catalog for account owners to launch.

58. Member accounts must be prevented from disabling CloudTrail, regardless of local administrator permissions. Which solution meets these requirements?

1. A Enable CloudTrail log file validation on the organization trail.
2. B Attach a service control policy to the organizational unit denying the CloudTrail stop and delete actions.
3. C Attach an IAM policy denying those actions to every administrator role in each account.
4. D Create an AWS Config rule that re-enables a trail when it is stopped.

59. A security tooling account must administer GuardDuty, Security Hub, and Config for the whole organization without using the management account. Which solution meets these requirements?

1. A Share the management account credentials with the security team.
2. B Register the security tooling account as the delegated administrator for each service.
3. C Enable each service separately in every member account and aggregate the findings manually.
4. D Grant the security team cross-account roles into every member account.

60. A package must remain installed and a service running across a fleet, with drift corrected automatically. Which solution meets these requirements?

1. A Run a Systems Manager Run Command document once against the fleet.
2. B Create a Systems Manager State Manager association that reapplies the desired configuration on a schedule.
3. C Add the package installation to the instances' user data script.
4. D Create an AWS Config rule that reports instances where the service is stopped.

61. A complex operational task requires several AWS API calls with branching and error handling, and each step must be visible. Which solution meets these requirements?

1. A Implement all the steps inside one Lambda function with conditional logic.
2. B Chain several Lambda functions, each invoking the next.
3. C Orchestrate the steps as an AWS Step Functions state machine with Choice, Retry, and Catch states.
4. D Schedule the steps as separate EventBridge rules at fixed intervals.

62. Operating system patches must be applied on a defined schedule with per-instance compliance reporting. Which solution meets these requirements?

1. A Create a Lambda function that patches every instance daily.
2. B Add a package update command to the instances' user data so patches apply at launch.
3. C Create an AWS Config rule that reports instances missing required patches.
4. D Define a Systems Manager patch baseline, apply it through a maintenance window, and review the patch compliance report.

63. An inventory of installed software across hundreds of instances must be queryable without connecting to each one. Which solution meets these requirements?

1. A Review AWS Config configuration history for each instance.
2. B Enable Systems Manager Inventory collection and query the collected application data.
3. C Review Amazon Inspector findings for the affected instances.
4. D Apply resource tags recording the software installed on each instance.

64. A CloudFormation update must be reviewed for its effect on existing resources before it is applied. Which solution meets these requirements?

1. A Apply the update and monitor the stack events.
2. B Create a change set and review the resource actions it reports before executing it.
3. C Review the template diff in the pull request.
4. D Apply the update to a copy of the stack and compare the results.

65. A reusable component must be published so teams consume it as a versioned CloudFormation resource type. Which approach is appropriate?

1. A Document the pattern in the platform team's wiki.
2. B Publish the template in a shared repository for teams to copy.
3. C Publish it as a CloudFormation module or resource type in the registry, versioned so consumers pin a release.
4. D Publish the template to Amazon S3 and have teams reference the object URL.

66. An architect must decide between AWS CDK and raw CloudFormation templates for a large platform. Which consideration favours CDK?

1. A The team needs to express repeated patterns programmatically and share them as typed constructs.
2. B The team wants the deployed resources to be described in JSON or YAML.
3. C The team wants to avoid any build step before deployment.
4. D The team has no programming experience.

67. An application's configuration must change without redeploying the application, with a gradual rollout and automatic rollback. Which solution meets these requirements?

1. A AWS Systems Manager Parameter Store read at application startup.
2. B A configuration file bundled into the deployment artifact.
3. C Environment variables set on the compute platform.
4. D AWS AppConfig with a deployment strategy and a monitor alarm attached.

68. A StackSet deployment fails in a subset of accounts while succeeding elsewhere. Which cause should be investigated first?

1. A Whether the organizational unit contains too many accounts.
2. B Whether those accounts have the required execution role and whether a resource in the template conflicts with something already present.
3. C Whether the administrator account has enabled trusted access.
4. D Whether the StackSet template exceeds the maximum permitted size.

69. An organization must ensure new accounts receive a security baseline before any workload is deployed into them. Which approach is appropriate?

1. A Apply the baseline with StackSets on a nightly schedule.
2. B Ask the requesting team to apply the baseline after the account is created.
3. C Apply the baseline when the first workload is deployed.
4. D Provision accounts through a landing zone so the baseline is applied as part of account creation.

70. An organization must delegate permission management to teams without allowing them to exceed their own permissions. Which solution meets these requirements?

1. A Publish a standard describing the permissions teams may grant.
2. B Grant each team full IAM access within its own account.
3. C Route every role request through a central team.
4. D Require a permissions boundary on every role a team creates, and permit role creation only when that boundary is attached.

71. An automation must run a script on hundreds of instances and report which succeeded. Which solution meets these requirements?

1. A Connect to each instance and run the script by hand.
2. B Place the script in each instance's user data and restart them.
3. C Run a Systems Manager Run Command document against a tag-based target and review the per-instance command output.
4. D Distribute the script by file share and ask owners to run it.

72. An automation workflow must handle a step that occasionally fails transiently and a step that must never be retried. Which approach is appropriate?

1. A Configure a single retry policy applied to every step in the workflow.
2. B Disable retries for the whole workflow and fail on any error.
3. C Configure retry behaviour per step so the transient step retries with backoff while the non-idempotent step does not.
4. D Retry the whole workflow from the start on any failure.

73. An automation must maintain software compliance across a fleet and report which instances deviate. Which solution meets these requirements?

1. A Tag each instance with the software version it should run.
2. B Run a script weekly that logs the installed software versions.
3. C Define the required state with Systems Manager and review its compliance reporting for deviations.
4. D Enable Amazon Inspector and review its vulnerability findings.

74. A CloudFormation template must create a resource only in production accounts. Which construct is appropriate?

1. A A DependsOn attribute on the resource.
2. B A Mapping listing the production account identifiers.
3. C A Condition evaluated against a parameter, referenced by the resource's Condition attribute.
4. D An Output exporting the resource's identifier.

75. A CloudFormation stack must reference a value exported by another stack in the same account and Region. Which function is appropriate?

1. A Fn::GetAtt, which reads an attribute of a resource in the same stack.
2. B Ref, which returns a resource's default identifier.
3. C Fn::Sub, which substitutes values into a string.
4. D Fn::ImportValue, which imports a value exported by another stack.

76. A CDK application must define a reusable pattern that several teams instantiate with different parameters. Which construct level is appropriate?

1. A A shell script that generates templates.
2. B A separate CDK application per team.
3. C A custom construct encapsulating the pattern with properties for the variable parts.
4. D A raw CloudFormation resource for each team.

77. A CloudFormation deployment must prevent accidental deletion of a stack. Which configuration is appropriate?

1. A Apply a stack policy denying updates.
2. B Apply a DeletionPolicy of Retain to every resource.
3. C Remove delete permissions from all principals.
4. D Enable termination protection on the stack.

78. A StackSet must deploy to accounts as they join an organizational unit. Which configuration is required?

1. A Use service-managed permissions with automatic deployment enabled for the target organizational unit.
2. B Create a separate StackSet for each account.
3. C Deploy to the organizational unit once and redeploy when accounts join.
4. D Use self-managed permissions and add each account manually.

79. An organization must apply a tagging standard so that untagged resources cannot be created. Which combination of steps meets these requirements? (Select TWO.)

1. A Ask teams to apply tags during onboarding.
2. B Attach a service control policy denying resource creation when the required tag keys are absent.
3. C Create an AWS Config rule reporting untagged resources.
4. D Attach a tag policy defining the required tag keys and permitted values.
5. E Enable cost allocation tags in the billing console.

80. An organization must ensure a new account cannot be used until its baseline controls are applied. Which approach is appropriate?

1. A Create the account and rely on the organization's service control policies alone.
2. B Create the account and apply the baseline when the team requests access.
3. C Provision the account through a landing zone that applies the baseline as part of creation, before handing it over.
4. D Create the account and audit it after the first week.

81. An automation must run across accounts and Regions from a single invocation. Which capability is appropriate?

1. A A CloudFormation StackSet deploying the automation.
2. B A Lambda function invoked separately in each account.
3. C A Systems Manager Automation runbook executed with multi-account and multi-Region targets.
4. D A Run Command document executed once per account manually.

82. A long-running automation must be resumable if it fails at a late step. Which design is appropriate?

1. A Express the automation as a workflow with discrete states so execution resumes from the failed state rather than the beginning.
2. B Implement the automation as one long script that restarts from the top on failure.
3. C Reduce the number of steps so failure is less likely.
4. D Increase the automation's timeout.

83. An operational task must run on instances that have no inbound network access and no SSH keys. Which approach is appropriate?

1. A Run a Systems Manager document through the SSM agent, which connects outbound and requires no inbound access.
2. B Deploy a bastion host in a public subnet.
3. C Attach an Elastic IP address to each instance.
4. D Open port 22 temporarily and connect over SSH.

84. An organization must prevent a member account's resources from being created outside approved Regions during onboarding. Which approach is appropriate?

1. A Apply the restriction after the first workload is deployed.
2. B Audit the account's Regions weekly.
3. C Ask the account owner to use approved Regions only.
4. D Apply the Region restriction policy at the organizational unit level before the account is handed over.

85. An organization must roll out a new service control policy without breaking existing workloads. Which approach is appropriate?

1. A Analyse recorded API activity to identify what the policy would deny, then apply it to a non-production organizational unit first.
2. B Apply the policy and remove it if problems are reported.
3. C Apply the policy only to new accounts.
4. D Apply the policy to the organization root immediately.

86. An automation must apply a configuration change only to instances matching specific tags. Which approach is appropriate?

1. A Maintain a list of matching instances manually.
2. B Target the automation by tag so instances are selected dynamically as tags change.
3. C Apply the change to every instance and skip those that do not match.
4. D Enumerate the instance identifiers in the automation.

87. An automated task must run on instances that may be stopped at the time it is scheduled. Which approach is appropriate?

1. A Define the desired state so it is applied when the instance next starts, rather than relying on a point-in-time execution.
2. B Run the task more frequently so stopped instances are eventually covered.
3. C Start every instance before the task runs.
4. D Skip stopped instances and record them as exceptions.