AWS Certified DevOps Engineer – Professional — Practice Set 1

Question 1

A company runs a microservices application across 12 AWS accounts organized under AWS Organizations. Each team owns its own account and maintains an AWS CodePipeline pipeline that deploys to Amazon ECS on AWS Fargate. A new security policy requires that every container image deployed to production must pass a CVE scan with zero critical vulnerabilities. The scan results must be auditable for 7 years. Teams currently push images directly to Amazon ECR in their own accounts. The DevOps team needs to enforce this policy across all 12 accounts without requiring each team to modify their existing pipeline stages. Which solution MOST effectively enforces the policy with the LEAST operational overhead?

Accepted Answer

Amazon ECR enhanced scanning uses Amazon Inspector and can be delegated at the AWS Organizations level, enabling enforcement across all 12 accounts without any per-account or per-pipeline changes by the teams. The EventBridge and Lambda approach allows automated quarantine of non-compliant images after push, and storing findings in S3 with a lifecycle policy satisfies the 7-year audit requirement — all centrally managed. Option A requires every team to modify their pipeline and image tagging convention. Option C requires deploying and maintaining CodeBuild projects in all 12 accounts and does not provide centralized audit storage. Option D uses AWS Config for scanning enforcement, which is less native to ECR than Inspector and adds latency before images can be quarantined.

Question 2

A DevOps engineer is designing a deployment pipeline for a critical e-commerce application that processes 50,000 transactions per hour. The application runs on Amazon EC2 instances behind an Application Load Balancer. The business requires that any production deployment can be rolled back within 5 minutes if the error rate exceeds 1% on the new version. The deployment must not cause any downtime. Which deployment strategy using AWS CodeDeploy BEST meets these requirements?

Accepted Answer

Blue/green deployment with immediate traffic rerouting (AllAtOnce) on an ALB provides zero-downtime deployment by spinning up the new fleet while the old one serves traffic, then cutting over instantly. Configuring an automatic rollback triggered by a CloudWatch alarm on 5xx errors allows rollback within the 5-minute SLA — CodeDeploy re-routes traffic back to the original (blue) environment in seconds. Keeping the original instances alive for 30 minutes ensures the rollback target is available. Option A uses in-place AllAtOnce, which causes downtime during deployment. Option C is an ECS canary pattern not directly applicable to EC2-backed ALB deployments. Option D's linear shifting would take 10 minutes to complete traffic shift, and rollback after full cutover would still require time to restore — the rollback window could exceed 5 minutes in worst-case scenarios.

Question 3

A company wants to implement a multi-account CI/CD pipeline where developers push code to AWS CodeCommit in a development account. The pipeline must build and test in the same development account, then deploy artifacts to a staging account and finally to a production account. The security team requires that production deployments require explicit human approval from a manager and that the pipeline never uses long-lived IAM credentials. Which combination of AWS services and configurations MOST securely implements this cross-account pipeline? (Choose TWO.)

Accepted Answer

Cross-account IAM role assumption via AWS STS is the AWS-recommended pattern for cross-account CodePipeline actions — it uses temporary credentials (no long-lived keys), and CodePipeline natively supports this through cross-account action configurations. Adding a manual approval action with an SNS notification to the manager satisfies the explicit human approval requirement using a built-in CodePipeline feature. Option B uses long-lived IAM credentials stored in Secrets Manager, which directly violates the 'never use long-lived credentials' requirement. Option D is a more complex and unnecessary workaround when CodePipeline's native approval action already provides this capability. Option E deploys to staging and production simultaneously rather than sequentially and does not incorporate a gated approval before production.

Question 4

A DevOps engineer needs to ensure that every AWS CodeBuild build for a Node.js application caches npm dependencies between builds to reduce build times from 8 minutes to under 3 minutes. The builds run on ephemeral build environments that do not retain state between runs. Which caching strategy provides the MOST significant improvement with the LEAST configuration effort?

Accepted Answer

AWS CodeBuild S3 caching allows specifying arbitrary directories (such as the npm cache at /root/.npm or node_modules) that are uploaded to Amazon S3 after each build and restored before the next build. This is the native, low-configuration way to persist npm dependency caches across ephemeral build environments and typically reduces build times by 50–80% for dependency-heavy projects. Option B caches the source code, not npm packages, so it does not reduce npm install time. Option C requires a separate pipeline and weekly rebuilds to keep the image current, adding significant operational complexity. Option D requires mounting and configuring EFS, which is more complex than S3 caching and not a recommended CodeBuild pattern for dependency caching.

Question 5

A company has a monolithic Java application that is being decomposed into microservices. During the transition, the team needs to run both the monolith and new microservices simultaneously and route traffic between them using feature flags. The application is deployed using AWS CodeDeploy to Amazon EC2 instances. The team wants to enable a specific new microservice for 5% of users based on a user attribute stored in an Amazon DynamoDB table, without modifying the application code or requiring a new deployment for each flag change. Which architecture MOST effectively supports this requirement?

Accepted Answer

AWS AppConfig is the purpose-built AWS service for application configuration and feature flags. It supports dynamic configuration changes without redeployment, includes built-in deployment strategies (canary, linear) for gradual rollout, and integrates with AWS Lambda, EC2, and ECS applications via the AppConfig agent or SDK. The application can evaluate the flag per-request against DynamoDB user attributes with no code deployment needed for flag changes. Option B routes traffic at the instance level, not per-user, so user attribute-based routing is not possible with this approach. Option C uses Lambda@Edge and ElastiCache for per-user routing, which is architecturally complex and more appropriate for CDN-level routing, not internal service-to-service routing. Option D uses Parameter Store, which lacks AppConfig's deployment validation, rollback capabilities, and is not purpose-built for feature flag scenarios with per-user targeting.

Question 6

A company's AWS CodePipeline deployment to production failed after the AWS CloudFormation stack update began. The CloudFormation stack is now in an UPDATE_ROLLBACK_FAILED state due to a custom resource Lambda function that timed out during rollback. Production traffic is currently being served by the old stack resources that are still running. Which action should the DevOps engineer take FIRST to restore the ability to deploy new changes?

Accepted Answer

When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the ContinueUpdateRollback API with the SkipResources parameter allows skipping specific resources (in this case, the problematic custom resource Lambda) that are blocking the rollback. Once the rollback completes successfully, the stack returns to UPDATE_ROLLBACK_COMPLETE, and the team can fix the Lambda function before attempting the next deployment. Deleting the stack (Option A) would destroy all stack resources including production infrastructure. Manual template updates via the console (Option C) are not supported when the stack is in UPDATE_ROLLBACK_FAILED — CloudFormation will reject update operations in this state. AWS Support (Option D) cannot directly manipulate CloudFormation stack state; the ContinueUpdateRollback API is the correct self-service path.

Question 7

A company manages 200 AWS CloudFormation stacks across three AWS regions. The DevOps team discovers that 15 stacks have drifted from their templates due to manual changes made during an incident response last quarter. The team needs to detect all drifted resources, remediate them back to the desired state, and prevent future manual changes from causing drift. Which combination of actions MOST effectively addresses all three requirements? (Choose TWO.)

Accepted Answer

AWS Config with the cloudformation-stack-drift-detection-check rule provides continuous, automated drift monitoring across all stacks without manual API invocation, and pairing it with an SSM Automation remediation creates a self-healing loop for drift correction. The SCP with a Deny on write actions for resources tagged with aws:cloudformation:stack-name prevents future manual changes at the organization level — this is the MOST preventative control that cannot be bypassed by individual accounts. Option A and B require periodic manual triggering of drift detection and manual remediation steps, which do not address the 'prevent future drift' requirement. Option D uses CloudWatch alarms to detect changes but only alerts — it does not prevent them. Option E combined with Option C addresses all three requirements: detection, remediation, and prevention.

Question 8

A company is migrating 300 EC2 instances to a new security baseline that requires TLS 1.2 enforcement, specific syslog configuration, and installation of a custom monitoring agent. The instances run a mix of Amazon Linux 2, Ubuntu 20.04, and Windows Server 2019. The security team requires that compliance status be reported within 15 minutes of any configuration change, and non-compliant instances must be automatically remediated within 30 minutes. Currently, there is no configuration management tooling in place. Which solution MOST efficiently meets all requirements?

Accepted Answer

AWS Systems Manager State Manager with SSM Documents natively supports multiple OS types (Amazon Linux 2, Ubuntu, Windows Server) using OS-specific documents. State Manager associations enforce configuration on a schedule and report association compliance status, which AWS Config can continuously evaluate using the managed rule. The Config-to-SSM Automation remediation path can automatically re-apply configurations to non-compliant instances, satisfying the 30-minute remediation SLA. This is a fully managed, agentless (SSM agent is already installed on many AWS instances) solution. Option B requires deploying and maintaining self-managed Chef servers, which introduces significant operational overhead with no AWS-native integration for the 15-minute compliance reporting requirement. Option C uses CloudFormation for infrastructure provisioning, not OS-level configuration management, and hourly drift detection misses the 15-minute reporting requirement. Option D uses OpsWorks Stacks, which AWS announced end-of-life and is not a recommended new deployment target.

Question 9

A DevOps engineer is writing an AWS CloudFormation template that provisions an Amazon RDS MySQL database. The template is used in three environments: development, staging, and production. In production, the database must use Multi-AZ, have deletion protection enabled, and use a db.r6g.2xlarge instance class. In development, it must use a db.t3.micro with no Multi-AZ and no deletion protection. The same template must serve all three environments. Which CloudFormation feature BEST handles this environment-specific configuration?

Accepted Answer

CloudFormation Mappings with FindInMap is the canonical pattern for environment-specific configuration in a single template. A Mappings block can store all environment-specific values (instance class, Multi-AZ boolean, deletion protection boolean) keyed by environment name, and FindInMap retrieves the correct value based on the EnvironmentType parameter. This is fully declarative, requires no external dependencies, and is evaluated at deploy time. Option A uses three templates, which creates duplication and divergence risk. Option C uses Conditions, which work for boolean properties but are cumbersome for selecting string values like instance class — Mappings handle both cases more cleanly. Option D adds unnecessary complexity with a custom resource and runtime dependency on Parameter Store when Mappings achieves the same result natively.

Question 10

A company stores database credentials for an Amazon RDS instance in an AWS CloudFormation template parameter as a NoEcho string. A security audit reveals that the credentials are visible in AWS CloudFormation stack events and can be retrieved from the stack's parameter history. The security team requires that credentials never be visible in any CloudFormation output or log. Which change to the architecture MOST effectively resolves this finding?

Accepted Answer

AWS Secrets Manager dynamic references ({{resolve:secretsmanager:...}}) are the recommended approach for injecting sensitive values into CloudFormation templates. The credential is stored and managed entirely in Secrets Manager and is never passed as a parameter value, which means it never appears in stack events, the AWS Management Console, or CloudFormation API responses. Option C using SSM SecureString is also a valid approach and AWS does protect these values from appearing in stack events, but Secrets Manager is specifically designed for database credentials, provides automatic rotation, and is the preferred choice for RDS credentials. Option B is overly complex — encrypting credentials for a CloudFormation parameter still requires passing a decrypted value through Lambda, which introduces additional risk. Option D does not prevent credentials from appearing in stack events; it only restricts who can see CloudTrail logs.

Question 11

A company runs a stateful web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Sessions are stored locally on each EC2 instance. During a scale-in event, users whose sessions are on the terminating instance lose their session and are logged out. The application handles 10,000 concurrent users during peak hours and must not lose any active sessions during scaling events. Which architecture change MOST effectively resolves the session loss issue with MINIMAL application code changes?

Accepted Answer

Externalizing session state to Amazon ElastiCache for Redis makes the EC2 instances completely stateless. Since no session data is stored locally, scale-in events never result in session loss — the terminating instance holds no unique user data. This is the canonical solution for session persistence in auto-scaling web applications. Option A keeps instances alive for up to an hour, which defeats the purpose of scale-in (cost and capacity management) and does not actually resolve the architectural problem. Option B sticky sessions prevent users from being routed to other instances, but if the specific instance their session is on is terminated, they still lose the session. Option C is a complex workaround using lifecycle hooks and SSM Run Command that requires application changes, custom scripts, and is error-prone; Option D requires application changes but is far simpler, more reliable, and architecturally correct.

Question 12

A company has an RTO of 15 minutes and RPO of 5 minutes for a mission-critical application that uses Amazon RDS for PostgreSQL (Multi-AZ), Amazon DynamoDB, and Amazon ECS on AWS Fargate across us-east-1. A regional disaster scenario requires the ability to fail over to us-west-2. The application currently has no disaster recovery setup. Which disaster recovery strategy MOST cost-effectively meets the RTO and RPO requirements?

Accepted Answer

A Warm Standby strategy with scaled-down but running infrastructure in us-west-2 achieves the 15-minute RTO because the database (via RDS Global Database promotion, which takes ~1 minute) and application infrastructure are already running — only scaling is needed. RDS Global Database provides sub-second replication lag, meeting the 5-minute RPO. DynamoDB Global Tables provides continuous replication. Route 53 health checks with failover routing automate traffic redirection. Warm Standby is more cost-effective than Active-Active (Option A), which runs at full capacity in both regions at all times. Pilot Light (Option C) requires deploying compute infrastructure from scratch during failover, typically taking 30+ minutes, which violates the 15-minute RTO. Backup and Restore (Option D) typically takes hours, far exceeding both RTO and RPO requirements.

Question 13

A company's Auto Scaling group regularly fails to launch new EC2 instances during peak traffic events because the preferred Availability Zone runs out of capacity for the requested instance type (c5.4xlarge). The capacity errors cause the Auto Scaling group to remain at minimum capacity while traffic spikes go unserved. Which configuration change MOST effectively prevents this issue?

Accepted Answer

Configuring multiple instance types (instance type overrides) in the Auto Scaling launch template allows the group to use alternative instance types with equivalent compute capacity when the preferred type is unavailable in a given Availability Zone. This directly addresses InsufficientInstanceCapacity errors. The capacity-optimized allocation strategy also directs launches to instance pools with the most available capacity. Option A addresses Spot Instance interruption, not On-Demand capacity shortages. Option C (scheduled scaling) helps anticipate peaks but does not resolve the capacity error — if c5.4xlarge capacity is exhausted, scheduled launches will still fail. Option D On-Demand Capacity Reservations (not Reserved Instances) guarantee capacity for a specific instance type, but using a Capacity Reservation locks you into a single instance type and incurs cost whether or not the capacity is used, whereas multiple instance types provide more flexibility.

Question 14

A DevOps engineer needs to configure an Amazon EC2 Auto Scaling group to automatically replace unhealthy instances. Currently, instances that fail application health checks remain in service because the Auto Scaling group only uses EC2 status checks. The application exposes an HTTP endpoint /health that the Application Load Balancer checks every 30 seconds. Which change MOST directly addresses this issue?

Accepted Answer

Changing the Auto Scaling group health check type from EC2 to ELB (in the ASG console or via the API HealthCheckType property) is the direct, single-configuration-change solution. When the health check type is ELB, the Auto Scaling group respects the ALB's /health endpoint check results, and instances that fail the ALB health check are marked unhealthy by the ASG and replaced automatically. Option A creates a CloudWatch alarm but scaling policies adjust capacity — they do not directly terminate specific unhealthy instances. Option C uses Lambda to poll and terminate instances, which adds operational complexity when the built-in ELB health check type achieves the same result natively. Option D adds unnecessary complexity with custom metrics when the ALB already performs the health check the team wants to use.

Question 15

A company runs a distributed microservices application on Amazon EKS. The application experiences intermittent latency spikes that only manifest when three specific microservices call each other in sequence. Standard Amazon CloudWatch metrics show no anomalies during the spikes. The engineering team has been unable to identify the root cause after two weeks of investigation. The team needs to trace the exact request path across all services, identify which service call introduces the latency, and correlate this with resource utilization on the specific pods at the time of the spike. Which combination of tools MOST effectively enables this analysis? (Choose TWO.)

Accepted Answer

AWS X-Ray (or ADOT for OpenTelemetry-native instrumentation) provides distributed tracing across all microservices, creating end-to-end trace visualizations that show exactly which service call in the sequence is contributing latency. The X-Ray service map and trace timeline pinpoint the slow segment with microsecond precision. CloudWatch Container Insights provides pod-level CPU, memory, and network metrics on EKS, which can be correlated with the specific time windows identified in X-Ray to determine if resource contention is the cause of the latency. Together, traces (A) and resource metrics (B) provide the full picture. Option C with Prometheus and Grafana is a valid alternative but requires more setup and is not native AWS tooling for this scenario. Option D CloudTrail logs EKS control plane API calls, not application-level request timing between microservices. Option E VPC Flow Logs provide byte/packet counts at the network level but cannot show application response times or service-level latency.

Question 16

A company's application logs are generated by hundreds of EC2 instances across multiple AWS regions and sent to Amazon CloudWatch Logs. The security team needs to receive an alert within 5 minutes whenever any application log entry contains the pattern 'UNAUTHORIZED_ACCESS' or 'PRIVILEGE_ESCALATION'. Currently, no alerting is configured. Which is the MOST operationally efficient way to implement this alerting?

Accepted Answer

CloudWatch Logs metric filters are the native, purpose-built mechanism for creating metrics from log content. A metric filter with the pattern '?UNAUTHORIZED_ACCESS ?PRIVILEGE_ESCALATION' (using OR logic) across each relevant log group, combined with a 1-minute period CloudWatch alarm with a threshold of ≥1, delivers alerts within 1–2 minutes of a log event — well within the 5-minute SLA. This requires no additional compute and is fully managed. Option B using Lambda subscriptions processes every log event through Lambda, which is significantly more expensive and complex for a pattern-matching use case that metric filters handle natively. Option C's S3 export and Athena approach introduces up to 5 minutes of export delay plus query time, potentially exceeding the 5-minute SLA, and is operationally complex. Option D adds Kinesis Data Streams, which is appropriate for high-throughput log processing pipelines but is over-engineered for simple pattern alerting.

Question 17

A DevOps engineer receives an Amazon CloudWatch alarm indicating that an Amazon RDS Multi-AZ instance's WriteLatency metric has been above 50ms for the last 10 minutes. The application team reports that write-heavy batch jobs that run every 30 minutes are impacting production query performance. The team needs to automatically separate batch workloads from production writes without changing application connection strings. Which solution BEST addresses this with MINIMAL application changes?

Accepted Answer

Migrating to Amazon Aurora and directing batch jobs to the Aurora Reader endpoint separates the read-heavy batch workload from the write path on the primary instance. Aurora Replicas share the same underlying storage as the primary and have near-zero replication lag, making this effective for batch jobs that primarily read data or can tolerate reader-replica execution. The Aurora Reader endpoint automatically routes connections across all replicas, and the production application continues using the writer endpoint without connection string changes. Option A RDS Proxy improves connection pooling but does not separate batch write operations from production — both still write to the same primary. Option B Multi-AZ readable standbys help with read offloading but batch jobs that perform writes still hit the primary writer. Option D scaling up treats the symptom rather than the root cause (workload isolation) and does not prevent future degradation as data grows.

Question 18

A company wants to implement automated remediation when an EC2 instance's CPU utilization exceeds 90% for more than 5 consecutive minutes. The remediation should first attempt to scale up the Auto Scaling group, and if that fails, send an alert to the on-call team. Which combination of AWS services implements this automated remediation pipeline with the LEAST custom code?

Accepted Answer

AWS Systems Manager Automation runbooks provide a managed, low-code orchestration mechanism for sequential remediation steps with built-in error handling. A runbook can call SetDesiredCapacity as the first step and use an OnFailure handler to publish to SNS — no custom code is required beyond configuring the runbook steps. Option B requires writing Lambda code for the orchestration logic, which violates the 'least custom code' requirement. Option C with Step Functions is a valid orchestration approach but requires defining state machine states and is more complex than an SSM Automation runbook for this use case. Option D fires both actions simultaneously rather than conditionally — the SNS notification fires even when scale-up succeeds, which does not match the 'if scale-up fails, then alert' requirement.

Question 19

A financial services company must ensure that all Amazon S3 buckets across 50 AWS accounts in an AWS Organizations structure never allow public access, that all objects are encrypted with customer-managed AWS KMS keys, and that bucket access logs are enabled. A new audit revealed 23 non-compliant buckets across 8 accounts. The compliance team needs continuous monitoring and must automatically remediate new violations within 10 minutes of detection. Which architecture MOST effectively implements continuous compliance enforcement across all accounts?

Accepted Answer

AWS Config managed rules with Organizations-level conformance pack deployment and SSM Automation remediation is the native, end-to-end compliance-as-code solution for this scenario. The delegated administrator can deploy conformance packs to all member accounts via StackSets in a single operation. Config triggers remediation actions within minutes of a rule evaluation (which is triggered by configuration changes, satisfying the 10-minute SLA). The Config aggregator provides cross-account compliance visibility in one pane. Option B using Lambda polling every 5 minutes is a fully custom solution with high maintenance overhead and does not use native compliance tooling. Option C Amazon Macie focuses on sensitive data classification, not configuration compliance; it detects sensitive data in public buckets but does not monitor encryption configuration or access logging compliance. Option D Security Hub aggregates findings but does not natively replace Config rules for configuration compliance assessment — Config is still the detection mechanism.

Question 20

A DevOps engineer needs to implement a secrets rotation strategy for an application that accesses an Amazon RDS database. The application runs on Amazon EC2 instances using an IAM instance role. The current implementation uses a hardcoded password in an environment variable. The new solution must rotate the database password every 30 days, ensure the application never has more than 5 seconds of database connectivity interruption during rotation, and store the rotation history for compliance auditing. Which solution BEST meets all requirements?

Accepted Answer

AWS Secrets Manager with the built-in RDS rotation Lambda handles the dual-password rotation strategy automatically: it sets the new password on the database user first while the old password remains valid, then updates the secret, minimizing connectivity gaps to well under 5 seconds. The 30-day rotation schedule is configurable. Using the Secrets Manager SDK with a short cache TTL in the application ensures it picks up the new credential quickly. Secrets Manager maintains all secret versions (AWSCURRENT, AWSPREVIOUS, AWSPENDING) providing the rotation history for compliance. Option B Parameter Store lacks built-in database rotation Lambdas and the custom Lambda lacks the dual-password handshake logic to prevent connectivity interruption. Option C IAM database authentication is excellent and eliminates passwords entirely, but it is not supported for all RDS engine versions and the question specifies the need for a rotation history audit trail, which IAM auth does not provide. Option D is functionally similar to A but describes manual rotation, which does not meet the automatic 30-day rotation requirement.

Question 21

A company needs to ensure that all AWS Lambda functions deployed across their production accounts have the latest CVE patches applied within 48 hours of a patch being released. The functions use custom runtimes based on Amazon Linux 2 container images stored in Amazon ECR. The security team needs an automated pipeline that detects when a base image has CVEs above CVSS score 7.0, rebuilds affected functions, and deploys the updated images. Which solution MOST effectively automates this pipeline?

Accepted Answer

Amazon ECR enhanced scanning with Amazon Inspector continuously scans images and publishes findings as EventBridge events in near real-time when new CVEs are detected. The EventBridge-to-CodePipeline integration provides a fully automated, event-driven pipeline that rebuilds only affected images (those with new HIGH/CRITICAL findings) and deploys updated Lambda functions. This satisfies the 48-hour remediation SLA automatically without human intervention. Option B requires daily polling and manual intervention, which may not meet the 48-hour SLA and adds operational overhead. Option C AWS Systems Manager Patch Manager patches EC2 instances, not Lambda container images — Lambda containers are immutable and must be rebuilt, not patched in-place. Option D rebuilds ALL Lambda images for every security bulletin regardless of applicability, wasting build resources and potentially introducing changes to unaffected functions.

Question 22

A company's AWS CloudTrail is enabled in all regions, but the DevOps engineer discovers that the CloudTrail log files in Amazon S3 have been modified — specifically, some log files from six months ago have been deleted. The security team needs to determine whether any other log files have been tampered with and implement a control to detect future tampering. Which AWS feature directly addresses both requirements?

Accepted Answer

CloudTrail log file integrity validation is the specific AWS feature designed exactly for this use case. When enabled, CloudTrail creates signed digest files (SHA-256 hashes) every hour that reference each log file. The aws cloudtrail validate-logs CLI command uses these digests to verify whether log files have been deleted, modified, or tampered with since delivery. This addresses both requirements: detecting past tampering and detecting future tampering. Option B S3 Object Lock in Compliance mode prevents future deletions but cannot detect whether past files were tampered before the lock was applied (the question states files were already deleted). Option C S3 Versioning enables recovery of deleted files but does not provide a cryptographic integrity verification mechanism to detect modifications to existing files. Option D Amazon Macie classifies sensitive data — it does not perform cryptographic log integrity verification.

Question 23

A company runs a data processing pipeline on Amazon EC2 that processes 10 TB of data daily in batch jobs that start at 2:00 AM and must complete by 6:00 AM. The jobs run on r5.8xlarge instances (currently 20 On-Demand instances). The processing is stateless and can tolerate individual instance failures because jobs are checkpointed to Amazon S3 every 10 minutes. Total monthly EC2 spend for these batch jobs is $45,000. The DevOps engineer needs to reduce this cost by at least 70% without violating the 4-hour completion window. Which purchasing strategy achieves the MOST cost reduction?

Accepted Answer

AWS Batch with Spot Instances is the MOST cost-effective solution for batch workloads that can tolerate interruptions. Spot Instances provide up to 90% discount over On-Demand pricing, which more than meets the 70% reduction target. AWS Batch natively handles Spot interruption retries by re-queuing jobs to replacement instances, and with 10-minute S3 checkpoints, the maximum work lost per interruption is 10 minutes — well within the 4-hour window. AWS Batch also supports multiple instance types, improving Spot availability. The combination of Spot pricing (90% savings) and AWS Batch's managed retry mechanism is purpose-built for this scenario. Option B achieves similar Spot savings but requires custom interruption handling code, whereas AWS Batch handles this natively. Option A Reserved Instances provide only 40% savings, not meeting the 70% target. Option D achieves approximately 60% savings, which does not meet the 70% requirement.

Question 24

A company has 120 Amazon EC2 instances across development, staging, and production environments. AWS Cost Explorer shows that the development and staging instances (60 instances total) run 24/7 but are only actively used Monday through Friday from 8:00 AM to 8:00 PM in the us-east-1 time zone. These instances are costing $18,000/month. The DevOps engineer needs to reduce costs without impacting developer productivity. Which solution achieves the MOST savings with the LEAST operational overhead?

Accepted Answer

AWS Instance Scheduler is an AWS Solutions Library solution that provides a complete, pre-built EC2 and RDS start/stop scheduling system with a DynamoDB configuration backend, support for complex schedules (weekdays only, specific hours, time zone-aware), and tag-based instance enrollment. It requires no custom Lambda code and handles edge cases (holidays, multi-region, etc.) out of the box — LEAST operational overhead. By running 60 instances only 60 hours/week instead of 168 hours/week, the savings are approximately 64% (~$11,500/month saved). Option A requires writing, deploying, and maintaining custom Lambda code, which is more operational overhead than the pre-built Instance Scheduler solution. Option C uses Auto Scaling scheduled actions but requires all 60 instances to be in Auto Scaling groups, which may not be the case, and does not cover instances outside of ASGs. Option D Reserved Instances for non-production environments that run only 12 hours/day on weekdays is wasteful — you pay for 24/7 capacity but only use 60 hours/week.

Question 25

A company is reviewing their AWS bill and notices that Amazon S3 data transfer costs have increased from $2,000/month to $14,000/month over the past 6 months. The application serves static assets (images, videos, JavaScript files) to a global user base from an S3 bucket in us-east-1. Users are distributed across North America, Europe, and Asia-Pacific. Which change MOST cost-effectively reduces S3 data transfer costs while improving performance for global users?

Accepted Answer

Amazon CloudFront is the definitive solution for reducing S3 data transfer costs for globally distributed static content. Data transferred from S3 to CloudFront as origin fetches is free (no S3 egress charge), and CloudFront's data transfer rates to end users are lower than direct S3 transfer rates, particularly for non-US regions. Additionally, CloudFront caches assets at 450+ global edge locations, meaning most user requests are served from cache — dramatically reducing origin (S3) data transfer. The combination of free S3-to-CloudFront transfer, CloudFront caching, and lower CloudFront egress rates typically reduces total data transfer costs by 70–80%. Option A S3 Transfer Acceleration is designed for upload performance and costs MORE than standard transfer — it would increase costs. Option C replicating to three regional buckets incurs S3 Cross-Region Replication data transfer costs and storage costs in multiple regions, which is typically more expensive than CloudFront. Option D S3 Intelligent-Tiering reduces storage costs, not data transfer costs.

DOP-C02 — AWS Certified DevOps Engineer – Professional