A DevOps engineer used an AWS Cloud Formation custom resource to set up AD Connector. The AWS Lambda function ran and created AD Connector, but Cloud Formation is not transitioning from CREATE_IN_PROGRESS to CREATE_COMPLETE.
Which action should the engineer take to resolve this issue?

1. A. Ensure the Lambda function code has exited successfully.
2. B. Ensure the Lambda function code returns a response to the pre-signed URL.
3. C. Ensure the Lambda function IAM role has cloudformation UpdateStack permissions for the stack ARN.
4. D. Ensure the Lambda function IAM role has ds ConnectDirectory permissions for the AWS account.

Correct Answer: B

Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/crpg-ref- responses.html

A company has its AWS accounts in an organization in AWS Organizations. AWS Config is manually configured in each AWS account. The company needs to implement a solution to centrally configure AWS Config for all accounts in the organization The solution also must record resource changes to a central account.
Which combination of actions should a DevOps engineer perform to meet these requirements? (Choose two.)

1. A. Configure a delegated administrator account for AWS Confi
2. B. Enable trusted access for AWS Config in the organization.
3. C. Configure a delegated administrator account for AWS Confi
4. D. Create a service-linked role for AWS Config in the organization’s management account.
5. E. Create an AWS CloudFormation template to create an AWS Config aggregato
6. F. Configure a CloudFormation stack set to deploy the template to all accounts in the organization.
7. G. Create an AWS Config organization aggregator in the organization's management accoun
8. H. Configure data collection from all AWS accounts in the organization and from all AWS Regions.
9. I. Create an AWS Config organization aggregator in the delegated administrator accoun
10. J. Configure data collection from all AWS accounts in the organization and from all AWS Regions.

Correct Answer: AE
https://aws.amazon.com/blogs/mt/org-aggregator-delegated-admin/ https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate- config.html

A DevOps engineer is building a multistage pipeline with AWS CodePipeline to build, verify, stage, test, and deploy an application. A manual approval stage is required between the test stage and the deploy stage. The development team uses a custom chat tool with webhook support that requires near-real-time notifications.
How should the DevOps engineer configure status updates for pipeline activity and approval requests to post to the chat tool?

1. A. Create an Amazon CloudWatch Logs subscription that filters on CodePipeline Pipeline Execution State Chang
2. B. Publish subscription events to an Amazon Simple Notification Service (Amazon SNS) topi
3. C. Subscribe the chat webhook URL to the SNS topic, and complete the subscription validation.
4. D. Create an AWS Lambda function that is invoked by AWS CloudTrail event
5. E. When a CodePipeline Pipeline Execution State Change event is detected, send the event details to the chat webhook URL.
6. F. Create an Amazon EventBridge rule that filters on CodePipeline Pipeline Execution State Chang
7. G. Publish the events to an Amazon Simple Notification Service (Amazon SNS) topi
8. H. Create an AWS Lambda function that sends event details to the chat webhook UR
9. I. Subscribe the function to the SNS topic.
10. J. Modify the pipeline code to send the event details to the chat webhook URL at the end of each stag
11. K. Parameterize the URL so that each pipeline can send to a different URL based on the pipeline environment.

Correct Answer: C
https://aws.amazon.com/premiumsupport/knowledge-center/sns-lambda-webhooks-chime-slack-teams/

A company has chosen AWS to host a new application. The company needs to implement a multi-account strategy. A DevOps engineer creates a new AWS account and an organization in AWS Organizations. The DevOps engineer also creates the OU structure for the organization and sets up a landing zone by using AWS Control Tower.
The DevOps engineer must implement a solution that automatically deploys resources for new accounts that users create through AWS Control Tower Account Factory. When a user creates a new account, the solution must apply AWS CloudFormation templates and SCPs that are customized for the OU or the account to automatically deploy all the resources that are attached to the account. All the OUs are enrolled in AWS Control Tower.
Which solution will meet these requirements in the MOST automated way?

1. A. Use AWS Service Catalog with AWS Control Towe
2. B. Create portfolios and products in AWS Service Catalo
3. C. Grant granular permissions to provision these resource
4. D. Deploy SCPs by using the AWS CLI and JSON documents.
5. E. Deploy CloudFormation stack sets by using the required template
6. F. Enable automatic deploymen
7. G. Deploy stack instances to the required account
8. H. Deploy a CloudFormationstack set to the organization’s management account to deploy SCPs.
9. I. Create an Amazon EventBridge rule to detect the CreateManagedAccount even
10. J. Configure AWS Service Catalog as the target to deploy resources to any new account
11. K. Deploy SCPs by using the AWS CLI and JSON documents.
12. L. Deploy the Customizations for AWS Control Tower (CfCT) solutio
13. M. Use an AWS CodeCommit repository as the sourc
14. N. In the repository, create a custom package that includes the CloudFormation templates and the SCP JSON documents.

Correct Answer: D
The CfCT solution is designed for the exact purpose stated in the question. It extends the capabilities of AWS Control Tower by providing you with a way to automate resource provisioning and apply custom configurations across all AWS accounts created in the Control Tower environment. This enables the company to implement additional account customizations when new accounts are provisioned via the Control Tower Account Factory. The CloudFormation templates and SCPs can be added to a CodeCommit repository and will be automatically deployed to new accounts when they are created. This provides a highly automated solution that does not require manual intervention to deploy resources and SCPs to new accounts.

A DevOps engineer needs to configure a blue green deployment for an existing three-tier application. The application runs on Amazon EC2 instances and uses an Amazon RDS database The EC2 instances run behind an Application Load Balancer (ALB) and are in an Auto Scaling group.
The DevOps engineer has created a launch template and an Auto Scaling group for the blue environment. The DevOps engineer also has created a launch template and an Auto Scaling group for the green environment. Each Auto Scaling group deploys to a matching blue or green target group. The target group also specifies which software blue or green gets loaded on the EC2 instances. The ALB can be configured to send traffic to the blue environments target group or the green environments target group. An Amazon Route 53 record for www example com points to the ALB.
The deployment must move traffic all at once between the software on the blue environment's EC2 instances to the newly deployed software on the green environments EC2 instances
What should the DevOps engineer do to meet these requirements?

1. A. Start a rolling restart to the Auto Scaling group tor the green environment to deploy the new software on the green environment's EC2 instances When the rolling restart is complete, use an AWS CLI command to update the ALB to send traffic to the green environment's target group.
2. B. Use an AWS CLI command to update the ALB to send traffic to the green environment's target grou
3. C. Then start a rolling restart of the Auto Scaling group for the green environment to deploy the new software on the green environment's EC2 instances.
4. D. Update the launch template to deploy the green environment's software on the blue environment's EC2 instances Keep the target groups and Auto Scaling groups unchanged in both environments Perform a rolling restart of the blue environment's EC2 instances.
5. E. Start a rolling restart of the Auto Scaling group for the green environment to deploy the new software on the green environment's EC2 instances When the rolling restart is complete, update the Route 53 DNS to point to the green environments endpoint on the ALB.

Correct Answer: A
This solution will meet the requirements because it will use a rolling restart to gradually replace the EC2 instances in the green environment with new instances that have the new software version installed. A rolling restart is a process that terminates and launches instances in batches, ensuring that there is always a minimum number of healthy instances in service. This way, the green environment can be updated without affecting the availability or performance of the application. When the rolling restart is complete, the DevOps engineer can use an AWS CLI command to modify the listener rules of the ALB and change the default action to forward traffic to the green environment’s target group. This will switch the traffic from the blue environment to the green environment all at once, as required by the question.