Question 1

A financial services company is centralizing its dependency management for multiple development teams using AWS CodeArtifact in a dedicated tooling AWS account. A new CI/CD pipeline, using AWS CodeBuild in a separate development account, needs to pull approved Python packages from the central CodeArtifact repository. The company mandates the use of least privilege and temporary credentials for all cross-account interactions. What is the MOST secure and efficient way to grant the CodeBuild project the necessary permissions?

Accepted Answer

In the tooling account, attach a resource-based policy to the CodeArtifact repository that grants access to the CodeBuild project's IAM role ARN from the development account. No changes are needed in the development account., In the development account, create a new IAM role with a trust policy allowing the CodeBuild service to assume it. Attach a policy to this role that allows it to assume a second role in the tooling account. In the tooling account, create the second role with access to CodeArtifact and a trust policy allowing the first role to assume it., In the tooling account, attach a resource-based policy to the CodeArtifact domain and repository granting access to the CodeBuild service role's ARN from the development account. In the development account, attach a policy to the CodeBuild service role granting it `codeartifact:GetAuthorizationToken` and `sts:GetServiceBearerToken` permissions for the CodeArtifact domain., Create an IAM user in the tooling account with permissions to access CodeArtifact. Store the access keys in AWS Secrets Manager in the development account and configure the CodeBuild project to retrieve them.

Question 2

An AWS Lambda function must be invoked immediately whenever a new gzipped audit log file is uploaded to an Amazon S3 bucket. The invocation must be triggered only for files with a `.gz` suffix to meet compliance requirements. What is the MOST direct and efficient configuration to achieve this automation?

Accepted Answer

Enable AWS CloudTrail data events for the S3 bucket. Create an Amazon EventBridge rule with a pattern that matches the `PutObject` eventName. Set the target to a Lambda function to process the object., Configure an S3 event notification for the `s3:ObjectCreated:*` event type. Set the target to an Amazon SQS queue. Configure the Lambda function to poll the queue for messages and process the corresponding S3 object., Configure an S3 event notification for the `s3:ObjectCreated:Put` event type with a suffix filter for `.gz`. Set the target destination to the Lambda function that will perform the processing., Create an Amazon EventBridge rule that triggers on a schedule every minute. Configure the rule's target to be a Lambda function that lists new objects in the S3 bucket and processes any `.gz` files it finds.

Question 3

A DevOps team manages a critical application running on Amazon EC2 instances fronted by an Application Load Balancer (ALB). The application's `TargetResponseTime` metric exhibits a predictable pattern, with higher latency during business hours and lower latency overnight and on weekends. The team needs to be alerted only when the response time is unusually high for a specific time of day, as static threshold alarms are causing excessive false positives during peak hours. What is the MOST operationally efficient way to configure this alerting?

Accepted Answer

Create multiple CloudWatch alarms with different static thresholds for various time periods. Use an Amazon EventBridge (CloudWatch Events) schedule to enable and disable the appropriate alarms throughout the day., Stream the `TargetResponseTime` metric to Amazon Kinesis Data Analytics. Develop a SQL query to establish a baseline and detect deviations, then send a notification to an Amazon SNS topic., Configure a CloudWatch alarm based on a metric math expression that calculates a moving average of the `TargetResponseTime` and compares it to the current value., Enable CloudWatch Anomaly Detection on the ALB's `TargetResponseTime` metric. Create a single CloudWatch alarm that triggers when the metric goes outside the anomaly detection band.

Question 4

A security operations center (SOC) analyst for a global logistics company receives an alert from their SIEM indicating a coordinated SQL injection attack against a public-facing shipment tracking API. The attack originates from a small, identifiable set of IP addresses. To immediately mitigate this threat with minimal disruption to legitimate customers, which configuration change should be implemented?

Accepted Answer

Initiate a blue/green deployment to replace the running application instances with a new version containing patched code that uses parameterized queries., Modify the network access control lists (NACLs) on the subnet hosting the API servers to deny all inbound traffic from the malicious IP addresses., Place the application instances into a temporary maintenance mode and disable the public API endpoint until a full vulnerability assessment can be completed., Update the Web Application Firewall (WAF) rules to add the source IP addresses to an IP set that is configured with a block action.

Question 5

A global media company is deploying a new video streaming service on AWS. The service requires low-latency access for users in North America and Europe, and must be resilient to a regional outage. The backend application runs on stateless Amazon EC2 instances and uses a relational database for metadata. The DevOps team needs to design a solution that provides both low-latency regional reads and a fast, automated database failover mechanism between regions. Which architecture should the team implement for the data layer?

Accepted Answer

Deploy an Amazon RDS for PostgreSQL Multi-AZ instance in the primary region and use AWS Database Migration Service (DMS) for continuous replication to an instance in the secondary region., Deploy an Amazon RDS for PostgreSQL instance in the primary region and configure cross-Region read replicas in the secondary region. Use Amazon Route 53 to manage failover., Use Amazon DynamoDB global tables with replica tables in both the North American and European regions., Configure an Amazon Aurora Global Database with a primary cluster in one region and a secondary cluster in the other region.

Question 6

Within a multi-account AWS Organization, a solution is needed to automatically detect the use of exposed IAM user access keys from anomalous locations. Upon detection, an immediate notification must be sent to a security team's Amazon SNS topic. Which implementation is the MOST direct and automated?

Accepted Answer

Enable Amazon GuardDuty in all member accounts. Configure GuardDuty to send all findings to a central security account's Amazon S3 bucket. Create an Amazon EventBridge rule in the security account that triggers an AWS Lambda function on S3 PutObject events. The function will parse the finding and publish to the SNS topic if it relates to exposed credentials., Configure AWS CloudTrail in all accounts to deliver logs to a central S3 bucket. Use Amazon Athena in the central account to run a scheduled query that searches for API calls made with IAM user credentials from suspicious IP ranges. If results are found, an AWS Lambda function will send a notification to the SNS topic., Deploy an AWS Config rule in each account to check for IAM user access key age and rotation policies. Configure an Amazon EventBridge rule to trigger on non-compliant resources, sending a notification to the SNS topic., Enable Amazon GuardDuty in all member accounts using Organizations. In the GuardDuty master account, create an Amazon EventBridge rule that filters for GuardDuty findings with the type 'CredentialAccess:IAMUser/AnomalousBehavior'. Configure the rule to target the security operations team's SNS topic directly.

Question 7

A critical monolithic application on EC2 requires a new deployment strategy. The key requirements are zero downtime, the ability to test the new version before a full cutover, and a fast, reliable rollback capability. Which strategy MOST effectively satisfies all these conditions?

Accepted Answer

Create a new Auto Scaling group and Application Load Balancer for the new version. Use Amazon Route 53 weighted routing to gradually shift traffic from the old environment to the new one., Implement a rolling update by updating the Auto Scaling group's launch template and then performing an instance refresh. Set the minimum healthy percentage to 90% to maintain capacity., Configure an in-place deployment using AWS CodeDeploy. This will update the application on existing instances one by one, minimizing infrastructure costs., Use AWS CodeDeploy to perform a blue/green deployment. Configure the deployment group to provision a new fleet of instances, run tests, and then shift traffic using an Application Load Balancer.

Question 8

A DevOps team is responsible for a high-traffic e-commerce application deployed on Amazon ECS with AWS Fargate. To prevent performance regressions, the team must integrate automated load testing into their AWS CodePipeline. The test must simulate 10,000 concurrent users, run after the application is deployed to a staging environment, and automatically fail the pipeline stage if key performance indicators (KPIs), such as p99 latency or error rate, exceed predefined thresholds. The solution must be scalable and cost-effective.

Accepted Answer

Add an approval stage in CodePipeline that sends a notification to the DevOps team. The team will manually run a load test from their local machines and then approve or reject the pipeline stage based on the results., Integrate AWS Fault Injection Simulator (FIS) into the pipeline. Configure an FIS experiment to generate CPU and memory stress on the Fargate tasks. Use the experiment's results to determine if the pipeline should proceed., Create a new AWS CodeBuild project for load testing. In the buildspec file, define commands to install a testing tool, run the load test, and then parse the results. Use shell commands to check the results against thresholds and exit with a non-zero code to fail the build if thresholds are exceeded., Add a stage to CodePipeline that invokes an AWS Step Functions state machine. The state machine launches a large, dedicated EC2 instance with a load testing tool like JMeter, runs the test against the staging endpoint, and then terminates the instance.

Question 9

A logistics company's CI/CD pipeline uses Terraform to manage cloud resources. A `terraform plan` is executed for every pull request to preview infrastructure changes. To satisfy strict change control requirements, the exact changes approved during the pull request review must be the ones deployed. Any deviation between the plan and apply stages is unacceptable. Which approach ensures the `terraform apply` command executes the exact set of changes that were previously approved?

Accepted Answer

Save the output of the `terraform plan` command to a plan file and use this file as an input for the `terraform apply` command., Leverage the `-refresh=false` flag during the `terraform apply` command to prevent state drift from affecting the deployment., Commit the `terraform.tfstate` file to the Git repository after a successful plan and use it to guide the apply step., Configure the pipeline to re-run `terraform plan` immediately before `terraform apply` in the deployment stage.

Question 10

To proactively address regional AWS service events that could impact a critical EC2-based application, a logistics company needs an automated notification and response mechanism. The solution must trigger an AWS Lambda function to initiate a failover process as soon as AWS reports an issue affecting the company's specific resources. Which combination of services provides the most direct and efficient way to meet this requirement?

Accepted Answer

Configure an Amazon EventBridge rule to listen for events from AWS Health, with a Lambda function as the target., Use AWS Config to monitor EC2 instance configurations and trigger a Lambda function when a non-compliant state is detected., Deploy AWS Systems Manager OpsCenter to aggregate operational issues and manually trigger a runbook to execute the Lambda function., Create a CloudWatch alarm based on the StatusCheckFailed metric for each EC2 instance and configure it to publish to an SNS topic that a Lambda function subscribes to.

Question 11

A large enterprise is structuring its AWS environment to allow departmental leads to create and manage IAM roles for their specific applications. The central security team must ensure that no role created by these leads can ever have permissions exceeding a predefined set, such as modifying core networking infrastructure or altering security audit logs. The solution must be enforceable and scalable across dozens of departments.

Accepted Answer

Use AWS Organizations and apply a Service Control Policy (SCP) to each department's organizational unit (OU) that denies the prohibited actions., Instruct departmental leads to use session policies that restrict permissions whenever they assume their administrative role to create new IAM roles., Create a custom IAM policy for the departmental leads that uses conditions to limit the permissions that can be included in any policies they attach to new roles., Grant departmental leads the iam:CreateRole permission and require them to attach a centrally managed IAM permissions boundary policy to every new role they create.

Question 12

A development team is building a containerized application deployed on Amazon EKS and uses AWS CodePipeline for CI/CD. As part of a new security initiative, all application code must undergo static application security testing (SAST), and all container images must be scanned for common vulnerabilities and exposures (CVEs) before deployment. The pipeline must automatically fail if critical vulnerabilities are discovered in either the code or the container image. Which combination of AWS services should be integrated into the pipeline to meet these requirements with the LEAST operational overhead?

Accepted Answer

Deploy the application to a staging environment and then use Amazon Inspector to perform a network reachability scan and a host assessment., Integrate Amazon CodeGuru Security for static application security testing (SAST), and enable Amazon Inspector to scan images as they are pushed to Amazon ECR., Use AWS Config rules to check for insecure code patterns, and configure Amazon ECR basic scanning to identify vulnerabilities., Configure an AWS CodeBuild stage to run a third-party SAST tool, and use Amazon GuardDuty to scan the EKS cluster for vulnerabilities after deployment.

Question 13

To automate TLS certificate rotation for an Application Load Balancer, a team must adhere to a policy requiring renewal every 395 days. Given the application's domain is managed in Amazon Route 53, what is the MOST automated solution to prevent certificate expiration?

Accepted Answer

Use AWS Certificate Manager Private Certificate Authority (ACM Private CA) to issue a certificate. Configure a Lambda function triggered by an Amazon EventBridge scheduled event to renew the certificate and update the ALB listener., Create a cron job on an EC2 instance that uses the AWS CLI to request a new certificate from AWS Certificate Manager (ACM) annually. The script should then update the ALB listener to use the new certificate ARN., Request a public certificate from AWS Certificate Manager (ACM) using DNS validation. Associate the certificate with the ALB listener. Rely on ACM's managed renewal feature to automatically renew and deploy the certificate., Purchase a third-party certificate and import it into AWS Certificate Manager (ACM). Create an Amazon EventBridge rule that triggers an AWS Lambda function 30 days before expiry to send a notification to the team to manually renew and re-import the certificate.

Question 14

To meet a 5-minute Recovery Point Objective (RPO) and a 30-minute Recovery Time Objective (RTO) for a critical transactional database, an organization has enabled continuous backups with point-in-time recovery (PITR). Following a data corruption event, which automated procedure is the most effective way to restore the database to a state just before the incident?

Accepted Answer

A process that triggers the database's built-in automatic failover mechanism to the hot standby replica in a different availability zone., A scheduled hourly script that creates a new database instance from a snapshot taken at the beginning of the hour., A serverless function, triggered by a high-severity monitoring alert, that programmatically initiates a PITR operation to a new database instance and updates the application's configuration to use the new endpoint., An automated runbook that restores the latest full daily snapshot and then replays all transaction logs captured since the snapshot was taken.

Question 15

A company is required to grant a third-party auditor temporary access to its AWS account to review specific Amazon S3 buckets and Amazon EC2 instance configurations. The auditor already has an IAM user in their own separate AWS account. The company wants to provide access that is programmatically restricted to a specific set of read-only permissions for only the duration of the audit session. The solution must not involve creating long-term credentials.

Accepted Answer

Create a new IAM user for the auditor in the company's account with an attached identity-based policy granting the required read-only permissions. Provide the access key and secret key to the auditor., Apply resource-based policies to each S3 bucket and create custom SSM documents for EC2 inspection. In the policies, specify the auditor's IAM user ARN from their account as the Principal to grant direct cross-account access., Create a cross-account IAM role with the required read-only permissions. Attach a permissions boundary to the role that explicitly denies all actions except those specified in the role's identity-based policy., Create a cross-account IAM role with a trust policy that allows the auditor's AWS account to assume it. When the auditor calls the `sts:AssumeRole` API action, instruct them to pass a session policy in the request that further scopes down permissions to the exact read-only actions needed for the audit.

Question 16

An organization's central data analytics team requires applications running in multiple member accounts to write log files to a single Amazon S3 bucket located in a central 'Logging' account. The solution must ensure that the 'Logging' account automatically owns all objects written to the bucket, regardless of which account uploaded them. Additionally, access must be granted with the principle of least privilege. Which combination of actions will meet these requirements? (Select TWO.)

Accepted Answer

In the 'Logging' account, attach an S3 bucket policy that allows the 's3:PutObject' action from the specific IAM roles in the member accounts., In the 'Logging' account, create an IAM role that member accounts can assume to get write access to the S3 bucket., In each member account, create a VPC endpoint for Amazon S3 and attach a policy allowing access to the central bucket., In each member account, attach an IAM policy to the application roles that allows the 's3:PutObject' action on the central S3 bucket., In the 'Logging' account, configure the S3 bucket's Object Ownership setting to 'Bucket owner enforced'.

Question 17

A disaster recovery solution for an Amazon Aurora MySQL cluster must achieve an RPO of under 1 second and an RTO of under 1 minute for a cross-Region failover. The database in the disaster recovery region must also be available for read operations during normal operations. Which solution meets all these requirements?

Accepted Answer

Deploy an Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2., Use AWS Database Migration Service (DMS) for continuous replication to a separate Aurora cluster in us-west-2., Set up a cross-Region read replica for the Aurora cluster in us-west-2 and use a custom script to promote it during a disaster., Configure automated cross-Region snapshots of the Aurora cluster and restore them in us-west-2 during a failover.

Question 18

Upon receiving a critical AWS Health event for a production resource, an automated system must create an incident in an external ITSM tool and post a Slack alert. The entire process needs to be highly resilient, especially against transient failures when calling the ITSM tool's API. Which design provides the MOST operational robustness?

Accepted Answer

Configure AWS Health to send notifications to an Amazon SNS topic. Create two AWS Lambda functions subscribed to the topic: one for the ITSM integration and one for the Slack notification., Use a scheduled AWS Lambda function to poll the AWS Health API every minute for new events affecting production resources. If an event is found, the function should call the ITSM and Slack APIs., Create an Amazon EventBridge rule that matches AWS Health events for production resources. Configure the rule to target an AWS Lambda function that directly calls the ITSM API and the Slack API., Create an Amazon EventBridge rule that matches AWS Health events for production resources. Configure the rule to send the event message to an Amazon SQS queue. Configure an AWS Lambda function to poll the SQS queue, process the message, and integrate with the ITSM and Slack APIs.

Question 19

A serverless loan processing workflow consists of a sequence of dependent steps, each implemented as a separate AWS Lambda function. The orchestration of this workflow must be highly scalable and include graceful error handling with retries for any failed step. Which approach is the MOST resilient for implementing this workflow?

Accepted Answer

Use Amazon SQS FIFO queues between each step. The initial Lambda function places a message in the credit check queue, which triggers the credit check function. This function then places a message in the fraud analysis queue, and so on., Design an AWS Step Functions state machine with a sequence of tasks, where each task invokes the corresponding Lambda function for a step. Configure retry policies with exponential backoff for each task state., Configure the initial Lambda function to synchronously invoke the credit check, fraud analysis, and approval functions in sequence, implementing try/catch blocks for error handling and retries., Use Amazon SNS topics to decouple the steps. The initial Lambda function publishes a message to a credit check topic, which a Lambda function subscribes to. This function then publishes to a fraud analysis topic, and so on.

Question 20

To enforce a strict security baseline, a global manufacturing firm attaches a Service Control Policy (SCP) to its organization's root. The policy contains an explicit deny statement for the `s3:DeleteBucket` action. What is the impact of this SCP on principals operating within the management account?

Accepted Answer

The SCP will not apply to any principals in the management account, allowing them to delete S3 buckets if they have the necessary IAM permissions., The SCP will apply to all IAM users and roles in the management account but will not restrict the root user., The SCP will only be enforced on the management account if an identical policy is also attached as an IAM boundary to the management account's root user., The SCP will prevent all principals, including the root user, in the management account from deleting S3 buckets.

AWS Certified DevOps Engineer Professional Practice Exams (2025) for DevelopersData ScientistsData AnalystsData EngineersAnyoneDevelopers

Master the AWS Certified DevOps Engineer Professional Exam

Practice Exam Domains Covered - Latest 2025 certification alignment

2025 Practice Exam Details

Cutting Edge Exam Prep with AI Enhanced Learning

AI Enhanced Learning With Premium Certification Practice Exams

Real-time AI Learning:

Unparalleled Understanding:

Advanced Learning with AI:

Exam Prep Powered by our Certification Practice System

Fast-Track Your Preparation Path

Realistic Exam Experience and Comprehensive Preparation

Fully Crafted and Supported by Experts in the USA

Proven Quality and Trust for Real Success

In-depth Explanations for Complete Mastery

Chosen and Trusted by Professionals Worldwide

Ella Sanders

Ava Thompson

Jiwon Thomas

Daniel Garcia

Sophia Padilla

Edward Martinez

Ali Karim

Marvin Watson

Brandon Hill

Peter Chen

Ella Sanders

Ava Thompson

Jiwon Thomas

Daniel Garcia

Sophia Padilla

Edward Martinez

Ali Karim

Marvin Watson

Brandon Hill

Peter Chen

Ella Sanders

Ava Thompson

Jiwon Thomas

Daniel Garcia

Sophia Padilla

Edward Martinez

AWS Certified DevOps Engineer Professional Certification Preparation Path

Focus on Passing on the First Attempt

Practice with Realistic Exams for Real Success

Build a Deep and Solid Foundation

Invest in Your Future

Why Choose Our AWS Practice Exams?

Built on Trust, Quality, and Proven Success

Expertise Backed by Professionals

Customer Focused, Always

AWS Certified DevOps Engineer Professional Certification PreparationChoose Your Path to Success

Starter Practice Exam1 Exam

Pro Practice Pack3 Exam Bundle

Ultimate Practice Pack6 Exam Bundle

Prepare for Success with AWS Certified DevOps Engineer Professional Exam Practice

AWS Certified DevOps Engineer Professional Certification Preparation

The Goal of our Certification Preparation

Who Should Pursue this Certification Preparation?

ConsiderationsWhen Choosing Practice Exams

Beware of Outdated Content

Quality Matters in Exam Prep

Avoid Non-Expert Materials

Anytime, Anywhere Access

Unlimited Attempts

Cross-Device Sync

Frequently Asked Questions

How closely do your practice questions resemble the actual exam?▼

How up-to-date are your practice exams?▼

How long do I have access to the practice exams?▼

Are your practice exams available on mobile devices?▼

Do you provide explanations for the answers?▼

Take the Next Step Towards AWS Certification Prep

AWS Certified DevOps Engineer Professional Practice Exams (2025) for
Developers
Data Scientists
Data Analysts
Data Engineers
Anyone
Developers

AWS Certified DevOps Engineer Professional Certification Preparation
Choose Your Path to Success

Starter Practice Exam
1 Exam

Pro Practice Pack
3 Exam Bundle

Ultimate Practice Pack
6 Exam Bundle

Considerations
When Choosing Practice Exams