Configuration Management and IaC

A financial services company uses AWS CloudFormation to deploy a three-tier web application. The stack includes an Amazon RDS for PostgreSQL database. The database master password is stored in AWS Secrets Manager, and the CloudFormation template uses a dynamic reference to retrieve it during stack creation. The team recently rotated the database password in Secrets Manager. When they attempt to update the stack to change other parameters, the update fails with the error: 'Value of property MasterUserPassword must be a string.' The team is using the following template snippet for the password: 'MasterUserPassword': '{{resolve:secretsmanager:MySecret:SecretString:password}}'. The stack was originally created with AWS CloudFormation. What is the most likely cause of the failure?

A DevOps engineer needs to manage configuration files for multiple applications across several EC2 instances. The configuration values are sensitive (e.g., database passwords) and must be encrypted at rest and in transit. Which AWS service should be used to store and retrieve these configuration values?

An organization uses AWS OpsWorks for configuration management. They have a stack with multiple layers, including a PHP application layer and a MySQL database layer. The operations team needs to deploy a custom configuration file to all PHP application instances. How should this be accomplished using OpsWorks?

A company uses AWS CodeBuild to build and test their application. They want to integrate Infrastructure as Code (IaC) scanning into their build pipeline to detect security misconfigurations in CloudFormation templates before deployment. Which TWO tools or services can be used for this purpose? (Choose TWO.)

A company uses AWS OpsWorks for configuration management. They want to automate the installation of a custom agent on new EC2 instances. Which OpsWorks feature should they use?

A DevOps team is using AWS CloudFormation to manage infrastructure. They want to reuse the same template across multiple environments (dev, test, prod) with minor parameter variations. Which CloudFormation feature should they use to pass environment-specific values without modifying the template?

A team is using AWS CodeDeploy to deploy an application to EC2 instances. They want to ensure that if a deployment fails, the instances are automatically rolled back to the previous version. What should they configure?

A company uses AWS OpsWorks for configuration management. The DevOps team wants to run a custom recipe on all instances in a layer during stack updates. Which OpsWorks lifecycle event should they hook the recipe into?

A team uses AWS CloudFormation to manage a VPC with multiple subnets. They want to ensure that when a stack is updated, the update does not accidentally replace the VPC or any subnet. Which CloudFormation property should they set on the resources?

A company uses AWS Elastic Beanstalk to deploy web applications. The DevOps team wants to implement a blue/green deployment strategy to minimize downtime. Which Elastic Beanstalk feature should be used?

A DevOps engineer is troubleshooting a CloudFormation stack that failed to update. The error message indicates a circular dependency among resources. The template includes an Auto Scaling group, a launch template, and an IAM instance profile. The launch template references the IAM instance profile, and the Auto Scaling group references the launch template. The IAM instance profile's role references the Auto Scaling group name in its trust policy. How can the engineer resolve the circular dependency?

A company uses AWS CloudFormation StackSets to deploy a VPC with subnets across multiple accounts and regions. Recently, a new account was added to the organization, and the DevOps team wants to deploy the stack set to this new account without affecting existing stacks. The stack set has self-managed permissions. The engineer creates a new stack instance for the account and region, but the operation fails with an 'Access Denied' error when CloudFormation tries to create resources in the new account. The engineer has verified that the stack set's IAM roles exist in the new account. What is the most likely cause?

A company is using AWS Elastic Beanstalk with a custom platform. The DevOps team wants to automate the creation of a new platform version whenever changes are pushed to a Git repository. The pipeline should run tests, build the platform, and then update the Elastic Beanstalk environment to use the new platform version. Which services should be used together to achieve this? (Choose THREE.)

A company uses AWS CodePipeline with a GitHub source action. The pipeline triggers on changes to the master branch. However, the pipeline does not trigger when changes are pushed to the master branch. What is the MOST likely cause?

A DevOps engineer runs this command to list resources of a CloudFormation stack. The stack status is 'CREATE_COMPLETE'. However, the EC2 instance 'i-0abcd1234efgh5678' was manually terminated by another team. The engineer wants to restore the stack to its intended state without deleting the stack. What should the engineer do?

A company uses AWS OpsWorks for configuration management. They need to automate the installation of a custom package on all instances in a layer. Which OpsWorks feature should they use?

A company uses AWS OpsWorks for Chef Automate. They have a stack that includes a PHP application layer. The application requires a custom PHP configuration file. The DevOps engineer creates a custom Chef cookbook with a recipe that deploys the configuration file. The recipe is assigned to the layer's Setup lifecycle event. The engineer notices that the configuration file is not being created on new instances when they are added to the layer. The cookbook is stored in a private S3 bucket. The engineer has verified that the cookbook is correctly associated with the stack. What should the engineer do to fix the issue?

Which THREE actions are best practices for managing secrets in AWS CloudFormation templates? (Choose three.)

Which TWO options are valid approaches for managing configuration drift in an AWS environment? (Choose two.)

A company uses AWS Elastic Beanstalk for application deployments. They want to integrate infrastructure-as-code practices using AWS CloudFormation. Which approach allows them to manage the Elastic Beanstalk environment and underlying resources as part of a CloudFormation stack?

A financial services company uses AWS CloudFormation to deploy a multi-tier application. The security team mandates that all data at rest must be encrypted using KMS CMKs. The CloudFormation template creates an RDS instance with encryption enabled using a KMS key. After deployment, the security team reports that the RDS instance is not using the specified KMS key. The DevOps engineer checks the template and finds the KMS Key ID is correct. What is the MOST likely cause?

A company uses AWS CloudFormation to deploy infrastructure. They want to enforce mandatory tags on all resources created by CloudFormation. Which TWO approaches can achieve this? (Choose TWO.)

An organization uses AWS OpsWorks for configuration management of their EC2 instances. They need to ensure that all instances have the latest security patches applied automatically. Which action should the team take?

A DevOps engineer updated an EC2 instance's InstanceType in a CloudFormation stack and received the stack events shown in the exhibit. What is the most likely cause of the failure?

A company uses AWS OpsWorks for configuration management. The DevOps team wants to deploy a new application version to a stack of EC2 instances. What should the team use to perform the deployment?

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. During a deployment, the new instances fail the health check and are terminated. The deployment fails. The team wants to automatically roll back to the previous working version. What should they do?

A company is adopting Infrastructure as Code (IaC) using AWS CloudFormation. They want to ensure that stack updates are safe and minimize the risk of resource replacement. Which TWO of the following strategies should they use?

A company runs a critical web application on AWS using an Auto Scaling group of EC2 instances behind an Application Load Balancer. The application is deployed using AWS CodeDeploy with a blue/green deployment configuration. The DevOps team is responsible for configuration management using AWS Systems Manager State Manager. They have set up a State Manager association to ensure that the instances have a specific security configuration (e.g., firewall rules). Recently, after a new deployment, the team noticed that the security configuration is missing on some new instances. The old instances still have the correct configuration. The association is configured to apply the configuration only at instance launch (using the AWS-RunShellScript document). The team suspects that the new instances are not being targeted by the association. Upon investigation, they find that the association is set to target instances based on tags, and the new instances do have the required tags. However, the association status shows 'Success' for the old instances but no status for the new instances. Which of the following is the MOST likely cause of this issue?

Which TWO are correct about using AWS CloudFormation to manage infrastructure across multiple AWS accounts? (Select TWO.)

An organization uses AWS CodeCommit to store CloudFormation templates. They have a requirement that all templates must pass a series of validation checks before being merged to the main branch. The checks include syntax validation, IAM policy linting, and compliance rules. The DevOps team wants to implement this validation using AWS services with minimal operational overhead. They already use AWS CodePipeline for CI/CD. What should the team do?

A company is using AWS Elastic Beanstalk to deploy a web application. The development team wants to ensure that environment variables are set consistently across all environments (development, staging, production) without manual intervention. Which AWS service or feature should be used to manage these environment variables?

A company is using AWS Elastic Beanstalk for a production environment. They have observed that during deployments, the environment's health status intermittently becomes 'Severe' even though the application is functioning correctly. The deployment uses rolling updates with a batch size of 50%. Which TWO configuration changes would improve deployment stability without completely redesigning the deployment process? (Select TWO.)

A company runs a production e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) distributing traffic across EC2 instances in an Auto Scaling group. The application uses a custom configuration stored in an S3 bucket. The DevOps team uses AWS CodeDeploy to deploy application updates. Recently, a deployment failed because new instances launched by the Auto Scaling group did not have the latest configuration from S3. The team had manually updated the configuration in S3 but the deployment did not pull the new version. The team wants to ensure that all instances always have the latest configuration at launch. Current setup: The Auto Scaling group uses a launch template that specifies an IAM instance profile with permissions to read from S3. The user data script runs at launch to download configuration from S3. However, the user data script is static and does not account for configuration updates. The team wants a solution that automatically applies configuration changes to both existing and new instances without manual intervention.

A company uses AWS Systems Manager to manage a fleet of EC2 instances. They need to run a custom script on all instances every time the instance is started. The script is stored in an S3 bucket. Which approach ensures the script runs automatically on every instance start with minimal administrative overhead?

A DevOps team uses Ansible for configuration management of EC2 instances. They want to ensure that the Ansible control node can connect to managed nodes securely without storing SSH keys in plaintext. Which AWS service should they integrate with Ansible to securely manage SSH keys?

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture on AWS. They want to use AWS CodeDeploy to deploy applications to an Auto Scaling group. The pipeline must ensure that only a small percentage of instances are updated at a time, and if health checks fail, the deployment is automatically rolled back. Which deployment configuration should be used?

A company uses AWS CloudFormation StackSets to deploy a common network infrastructure across multiple AWS accounts. They need to ensure that all StackSet operations are audited and any failed stack instances are automatically retried. Which THREE configurations should be implemented? (Select THREE.)

A team is using AWS CodeDeploy to deploy a web application to EC2 instances. They want to ensure that rollbacks occur automatically if the deployment fails. Which THREE configurations are necessary?

A DevOps team is using AWS CloudFormation to manage infrastructure. They need to update a stack that includes an EC2 instance with a security group. The update requires changing a security group rule. Which method should the team use to perform this update with minimal disruption?

A company uses AWS CloudFormation to manage infrastructure. They have a nested stack that creates an ECS cluster. The parent stack fails with the error: 'The following resource(s) failed to create: [ECSCluster]'. Which TWO are possible causes? (Choose TWO.)

Which TWO AWS services can be used to automate the configuration of EC2 instances at launch? (Choose two.)

A team manages a large fleet of EC2 instances using AWS Systems Manager. They want to enforce a consistent configuration across all instances, including installed software packages, firewall rules, and user accounts. The team also needs to audit configuration changes and remediate drift automatically. Which AWS service should the team use?

A company uses AWS CodeCommit to store infrastructure as code templates. The DevOps team has set up an AWS CodePipeline that automatically deploys a CloudFormation stack when changes are pushed to the main branch. The pipeline includes a deployment action that uses the CloudFormation create/update stack action. Recently, a developer pushed a change that caused the CloudFormation stack update to fail because the change would have deleted a critical resource. The pipeline did not catch this issue, and the stack update failed midway, leaving the stack in a partially updated state. The team wants to implement a safety mechanism to prevent such issues in the future. Which solution should they implement?

A CloudFormation stack creation failed. The engineer runs the describe-stack-events command and sees the output above. What is the root cause of the failure?

A company uses AWS OpsWorks for configuration management. They want to ensure that a custom recipe runs on all instances in a layer every 30 minutes. What should they do?

A DevOps team manages AWS Lambda functions using the Serverless Application Model (SAM). They need to deploy a new version of a function that requires an increased memory allocation from 128 MB to 256 MB. The team updates the SAM template and runs sam deploy. The deployment succeeds, but the function's memory remains at 128 MB. What is the MOST likely reason?

A company uses Terraform to manage a multi-account AWS environment. The Terraform state files are stored in an S3 bucket with DynamoDB locking. Recently, a DevOps engineer ran 'terraform apply' from a CI/CD pipeline, and it failed with the error: 'Error acquiring the state lock. Lock ID: "abc123". Possible causes: Another process has the lock; or a previous process crashed.' The engineer checks DynamoDB and sees that the lock item exists but there is no active Terraform process. The engineer needs to proceed with the deployment urgently. What should the engineer do?

A DevOps team uses AWS CloudFormation to deploy a web application stack. The stack includes an EC2 instance, an RDS database, and an Application Load Balancer. After a successful deployment, they notice that the database security group does not allow inbound traffic from the instance security group. The team wants to enforce that the database security group always allows traffic only from the instance security group, even if the stack is updated. Which TWO methods should the team use? (Choose TWO.)

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. They want to ensure that the VPC has internet access for the public subnets. Which THREE resources must be included in the template?

A DevOps engineer uses AWS CodeBuild to build a Java application. The build fails with an error indicating that the build environment does not have the required Java version. What is the MOST efficient way to ensure the correct Java version is installed for all future builds?

A DevOps engineer is designing a CI/CD pipeline for a containerized application using AWS CodePipeline and Amazon ECS. The pipeline should build a Docker image, push it to Amazon ECR, and deploy it to an ECS service. Which deployment action should they use in the pipeline?

A company uses AWS CloudFormation to manage a stack that includes an Auto Scaling group with a LaunchTemplate. The DevOps team wants to update the LaunchTemplate with a new AMI. The stack update fails with the error 'Launch template version does not exist'. What is the most likely cause?

A company uses AWS CloudFormation to manage its infrastructure. The operations team needs to update a stack that includes an RDS database. The update requires changing the DB instance class, which will cause a replacement of the database. The team wants to minimize downtime and ensure that data is not lost. Which CloudFormation stack update policy should they use?

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team has a template that creates an Amazon RDS DB instance and an EC2 instance that runs a web application. The EC2 instance needs to connect to the RDS instance using the database endpoint and password. The team currently passes the endpoint and password as CloudFormation parameters, which are then stored in the EC2 instance's user data. However, security audit has flagged this as a security risk because the password is visible in the user data. The team wants to securely pass the database credentials to the EC2 instance without exposing them in the template or user data. The EC2 instance has an IAM role that allows it to read from AWS Secrets Manager. Which solution should the team implement?

A DevOps team manages hundreds of EC2 instances using AWS Systems Manager State Manager. They need to ensure that a specific configuration (e.g., a custom firewall rule) is applied to all instances and remains enforced. Which THREE steps should they take? (Choose THREE.)

A DevOps engineer is designing a Git-based workflow for Infrastructure as Code using AWS CodeCommit and CodePipeline. The pipeline should deploy infrastructure changes to a test environment automatically when a pull request is merged to the 'main' branch. What is the minimal set of resources required?

A DevOps engineer creates the IAM policy above for an instance role. The role is attached to an EC2 instance that runs an application. The application starts and stops EC2 instances and reads a database password from Systems Manager Parameter Store. However, the application fails to retrieve the parameter. What is the most likely cause?

A company uses AWS OpsWorks for configuration management of a fleet of EC2 instances running a legacy application. The operations team needs to deploy a new version of the application across all instances without causing downtime. The application runs on each instance and requires a rolling update. Which approach should the team use?

A DevOps engineer is writing an AWS CloudFormation template that creates an Amazon S3 bucket with versioning enabled. The engineer wants to ensure that the bucket cannot be deleted accidentally. What should the engineer add to the template?

A DevOps team wants to enforce that all EC2 instances launched in an AWS account have a specific tag 'Environment' with value 'Production' or 'Development'. The team uses AWS CloudFormation to provision resources. Which approach should the team use to enforce tagging compliance at launch?

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences high traffic during business hours and low traffic at night. The company wants to configure automatic scaling based on CPU utilization. Which THREE steps are required to achieve this? (Select THREE.)

Which TWO tools can be used to manage configuration drift detection for AWS resources? (Choose two.)

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template needs to reference the secret value dynamically during stack creation. How should the template retrieve the secret?

An organization uses AWS System Manager Patch Manager to patch EC2 instances. The patches are not being applied to some instances. The instances are running Amazon Linux 2 and have the SSM Agent installed. What is the MOST likely reason for the failure?

A company uses AWS OpsWorks to manage a set of EC2 instances. They need to ensure that a custom recipe runs on all instances during the 'Configure' lifecycle event. What is the correct way to achieve this?

An organization uses AWS OpsWorks for configuration management. They want to migrate to AWS Systems Manager to reduce costs and improve flexibility. Their current stack includes custom Chef recipes that manage package installations and service configurations. What is the MOST effective migration strategy?

A DevOps team uses Ansible for configuration management of EC2 instances. They want to ensure that the latest security patches are applied to all instances. Which THREE steps should they include in their Ansible playbook? (Choose THREE.)

An organization uses AWS Elastic Beanstalk to manage a production web application. The application uses a custom AMI that needs to be updated periodically. The team wants to automate the process of updating the AMI and deploying it to the environment with zero downtime. Which THREE steps should the team include in the automation? (Choose THREE.)

A company uses AWS CodePipeline to orchestrate a multi-stage CI/CD pipeline. The build stage uses AWS CodeBuild and the deploy stage uses AWS CodeDeploy. The pipeline includes a manual approval step between build and deploy. The team wants to automatically trigger the pipeline when changes are pushed to a Git repository hosted in AWS CodeCommit. Which pipeline configuration is required for automatic triggers?

A company uses AWS CodeBuild to compile and test code. The buildspec.yml file includes commands that require access to a private S3 bucket. The DevOps engineer wants to securely provide AWS credentials to the build project. What is the recommended approach?

A company uses AWS CodePipeline to deploy a static website to an S3 bucket. The pipeline has a Source stage (GitHub), a Build stage (CodeBuild), and a Deploy stage (CodeDeploy). The deployment fails intermittently with the error: 'Bucket does not allow ACLs'. The S3 bucket is configured to use the 'bucket-owner-enforced' setting for Object Ownership. The team wants to resolve the failure while maintaining security best practices. What should the team do?

Which TWO are benefits of using AWS CloudFormation for infrastructure as code? (Select TWO.)

A DevOps team is designing a CI/CD pipeline for a microservices application using AWS CodePipeline. They want to incorporate infrastructure as code (IaC) using AWS CloudFormation. Which three practices should they follow to ensure reliable and repeatable deployments? (Choose THREE.)

A company is using AWS OpsWorks for configuration management of their application stack. The stack includes a PHP application layer and a MySQL database layer. The DevOps team wants to automate the deployment of a new PHP version across all instances in the PHP layer. The team has created a custom Chef recipe that updates PHP. They want to run this recipe on all instances in the PHP layer in a rolling update fashion to avoid downtime. Which OpsWorks feature should they use?

An operations team manages a fleet of Amazon EC2 instances that require periodic software updates. They want to use AWS Systems Manager to apply patches automatically while ensuring that patches are tested before production deployment. Which approach meets these requirements?

A company uses AWS CodePipeline with a multi-branch strategy. The pipeline deploys a Lambda function using CloudFormation. The DevOps engineer notices that when a new branch is created, the pipeline executes but the CloudFormation stack fails because the stack name already exists. What is the MOST efficient way to resolve this issue?

A DevOps engineer deploys the CloudFormation snippet shown in the exhibit. After the stack is deleted, the engineer checks for the S3 bucket. Which statement best describes the outcome?

A company uses AWS Systems Manager to manage patching of EC2 instances. They want to ensure that instances in a specific Auto Scaling group are patched before being allowed to serve traffic. Which THREE steps should be part of the solution?

A gaming company uses AWS Elastic Beanstalk to deploy a web application. The operations team needs to update environment configuration variables (e.g., database URL) without causing downtime. They want to change the value of an environment property. What is the CORRECT way to apply this change?

Which THREE actions should a DevOps engineer take to ensure that AWS CloudFormation stacks are securely managed? (Choose three.)

Which TWO actions should a DevOps engineer take to implement a GitFlow branching strategy for infrastructure as code using AWS CodeCommit and CodePipeline? (Choose two.)

A DevOps team is using AWS CodeBuild to run unit tests and package a Java application. They want to cache the Maven local repository (~/.m2) between builds to improve build times. Which TWO steps are necessary to enable caching in CodeBuild? (Select TWO.)

A company uses AWS OpsWorks for configuration management. The operations team needs to apply a configuration change to all instances in a layer without downtime. Which approach should they use?

A DevOps team is using AWS CloudFormation to manage a multi-tier application. They want to ensure that when an update to the stack causes a resource replacement, the replacement occurs only after the new resource is fully created and tested. Which CloudFormation feature should they use?

A company uses AWS CloudFormation to manage infrastructure. After updating a stack, a resource fails to update because it requires a physical replacement. The stack update is set to 'Rollback on failure'. The engineer wants to test the effect of the change without affecting the production environment. Which approach should the engineer use?

A company wants to use AWS OpsWorks for configuration management of their EC2 instances. They need to ensure that the instances are automatically configured with the latest security patches upon boot. Which OpsWorks feature should they use?

A company uses AWS CloudFormation to manage infrastructure. They have a stack that includes a VPC, subnets, and EC2 instances. They want to update the AMI ID of an EC2 instance without causing downtime. Which TWO approaches meet this requirement?

A developer is writing an AWS CloudFormation template to create an Amazon S3 bucket. The bucket name must be unique across all AWS accounts. Which property should the developer use to ensure the name is unique?

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance in us-east-1. What will happen?

A DevOps engineer is troubleshooting an AWS OpsWorks for Chef Automate deployment. The Chef server is configured with a custom run list that includes a recipe to install and configure an application. The test environment works correctly, but in the production environment, the application fails to start. The Chef client logs show that the recipe executed successfully, but the application process is not running. What is the most likely cause of this issue?

Match each AWS service to its primary function in a DevOps pipeline.

A DevOps engineer is troubleshooting an AWS CloudFormation stack that failed to create. The error message indicates that a resource 'AWS::Lambda::Function' timed out while being created. The Lambda function code is packaged as a ZIP file in Amazon S3. What is the most likely cause?

A startup uses AWS CloudFormation to manage its infrastructure. The team stores stack templates in an S3 bucket and creates stacks using the AWS CLI. Recently, a developer accidentally deleted a CloudFormation stack, causing a production outage. The team wants to prevent accidental stack deletions while allowing authorized users to delete stacks after approval. What is the MOST effective solution?

A company uses AWS CodeCommit to store source code. The development team wants to automatically trigger a build in AWS CodeBuild whenever a pull request is created or updated. Which TWO resources must be configured to accomplish this? (Select TWO.)

A DevOps engineer uses AWS Secrets Manager to rotate database credentials. The rotation fails because the Lambda function used for rotation does not have network access to the database. The database is in a private VPC. How should the engineer fix this?

A company uses AWS CodeCommit as a source repository and AWS CodeBuild for building artifacts. The DevOps team wants to ensure that all commits to the main branch trigger a build. Which steps should be taken? (Choose THREE.)

An organization uses AWS CloudFormation StackSets to deploy resources across multiple accounts. They notice that a stack instance in one account is in a 'FAILED' status because of a permissions issue. After fixing the permissions, what is the most efficient way to retry the stack instance operation?

A company uses AWS CloudFormation StackSets to deploy a VPC across multiple AWS accounts in AWS Organizations. The StackSet is created with self-managed permissions. The deployment fails in some accounts with the error: 'Insufficient IAM permissions to create resources'. What is the most likely cause of this failure?

A company uses AWS Config to evaluate resource compliance. They have a custom AWS Config rule that checks whether EC2 instances have a specific tag. The rule is triggered by configuration changes. The DevOps engineer notices that the rule evaluation results show 'NON_COMPLIANT' for some instances that actually have the tag. Which TWO could be causes? (Choose TWO.)

A DevOps team uses Elastic Beanstalk to deploy a web application. They want to configure environment variables without modifying the application code. Where should they define these variables?

A DevOps engineer is designing an infrastructure as code solution for a microservices application that runs on Amazon ECS with Fargate. The application requires a shared Application Load Balancer (ALB) and multiple ECS services. Which CloudFormation resources are required to expose each service behind the ALB? (Choose THREE.)

A DevOps team is using AWS CodeDeploy to deploy a web application. The deployment group consists of an Auto Scaling group with a minimum of 2 instances. They want to ensure high availability during the deployment. Which THREE of the following deployment configurations support zero-downtime deployments?

A DevOps team wants to manage EC2 instance configurations using AWS Systems Manager. Which THREE capabilities of Systems Manager can be used to ensure instances are in a desired state? (Choose THREE.)

A DevOps team manages a multi-account AWS environment using AWS Organizations. They need to enforce a mandatory tag (e.g., 'CostCenter') on all resources created across accounts. Which combination of services should be used to automatically remediate non-compliant resources?

A company manages a fleet of EC2 instances using AWS Systems Manager State Manager. They have a State Manager association that ensures a specific software package is installed on all instances. Recently, they noticed that some instances are reporting the association as 'Success' even though the software is not installed. The association uses a custom document that runs a script to install the package. The engineer checks the association execution history and sees that the script exited with code 0 on those instances. What is the most likely cause?

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage using AWS CodeBuild. Developers notice that the deployed application occasionally crashes due to missing environment variables that were configured in the Elastic Beanstalk environment but not passed from CodeBuild. What is the MOST efficient way to ensure the environment variables are consistently applied?

A large enterprise uses AWS Systems Manager to manage configuration drift on thousands of EC2 instances. The compliance team requires that instances must have a specific security configuration enforced by a Systems Manager State Manager association. The association is configured to run every 30 minutes. However, some instances consistently report a status of 'Failed' in the association compliance dashboard. The instances are running and have the SSM Agent installed. What is the MOST likely cause of the failures?

Match each AWS Config rule to its purpose.

Which THREE are valid AWS Systems Manager capabilities for configuration management? (Select THREE.)