AWS Certified DevOps Engineer - Professional

You are a DevOps Engineer at a company that has a microservices architecture built using AWS Lambda. You have been tasked with setting up a Continuous Integration/Continuous Deployment (CI/CD) pipeline that automates the deployment of these Lambda functions. The deployment must ensure zero downtime and should integrate seamlessly with AWS CodeDeploy. Which deployment strategy should you choose?

You are a DevOps engineer at a mid-sized tech company. Your team is in the process of implementing a new infrastructure as code (IaC) strategy using AWS CloudFormation to manage your cloud resources. You have created several reusable CloudFormation templates to standardize the deployment of various AWS services, including EC2 instances, RDS databases, and VPC configurations. However, you recently discovered that some of your templates grant overly permissive IAM roles, which has raised security concerns. Now, you need to enforce more stringent IAM policies within your CloudFormation templates and ensure that only needed permissions are granted to various resources. Which solution will help you achieve this objective most effectively?

Your company runs a fleet of web applications across multiple AWS regions to ensure high availability and low latency for users around the globe. The architecture leverages Amazon EC2 instances running behind Elastic Load Balancers (ELBs) and uses Amazon Route 53 for DNS routing. The business requirements dictate that even in the event of a regional outage, your users should experience minimal downtime and uninterrupted service. How can you meet these requirements with the least amount of manual intervention while also improving the performance of your globally distributed applications?

A healthcare company uses AWS to host its applications, and it is critical to ensure the privacy and security of patient information. The DevOps team has been tasked with configuring Amazon CloudWatch to monitor application logs and store them in an encrypted format to comply with stringent security policies and industry regulations like HIPAA. After setting up CloudWatch, they must ensure that the log data collected is encrypted at rest. Which of the following actions should the DevOps team take to properly configure the encryption of log data using AWS KMS while ensuring the log metrics remain available for alerting and analysis?

Your team has built a financial application that stores transactional data in an Amazon DynamoDB table. To ensure the consistency and reliability of your system, you need to update a secondary system whenever there is an insertion or update in your DynamoDB table. The requirements are to process these changes efficiently, ensure persistence, and allow retry mechanisms in case of failures. What AWS service combination would be the most suitable for this task?

You are designing a new internal application for an enterprise that is rapidly scaling its AWS infrastructure. To ensure secure access management, you need to implement permissions boundaries to restrict the maximum permissions that IAM and machine identities can receive. You also need to ensure that only certain trusted administrators can grant IAM roles with elevated permissions. What combination of approaches should you use to achieve this? A) Apply permissions boundaries to all IAM roles and users, and grant administrators the necessary IAM permissions to make changes. B) Use AWS Organizations Service Control Policies (SCPs) to manage permissions across accounts, and use IAM roles with MFA to restrict access further. C) Apply permissions boundaries to IAM roles and users, use AWS STS for temporary elevated permissions when required, and implement MFA for administrative actions. D) Use IAM access advisor combined with VPC endpoint policies to restrict permissions and access.