Day 5 - D-Day Wrap-Up: Exam-Room Strategy and a Final Integrated Scenario Check

A global fintech runs 40 services in a monorepo. The payments pipeline must run only when paths under services/payments/** change, build artifacts must be protected against tampering, and the Lambda function needs a 10% canary for 5 minutes followed by full cutover, with automatic rollback on an alarm. What is the most appropriate combination?

• ACodePipeline V1 + KMS encryption + AllAtOnce deployment
• BCodePipeline V2 (filePaths trigger) + AWS Signer/Notation signing + Inspector scanning + CodeDeploy Canary10Percent5Minutes + CloudWatch Alarm automatic rollback
• CJenkins + S3 ACLs + Rolling deployment
• DCodePipeline V2 + KMS signing + Linear deployment

In a 60-account environment, you want to satisfy all of the following: (1) GuardDuty and Config enabled in all accounts, with new accounts included automatically; (2) automatic blocking when S3 becomes public (but risky actions such as deleting production resources require human approval); (3) automatic invalidation of stolen IAM credentials. What is the most appropriate design?

• AEnable each account manually + a Lambda that runs every action immediately
• BAudit account as Delegated Admin + Org Auto-Enable / Config Rule + SSM Automation (risky actions gated with aws:approve) / GuardDuty Finding → EventBridge → Lambda (credential invalidation)
• CEnable security only with StackSets + all automation with Step Functions Express
• DTurn on only Security Hub and leave the rest manual

The payments DB needs an RTO of 1 minute and an RPO of a few seconds, the session store (key-value) needs concurrent writes from two Regions, and a partner whitelists the destination IP in their firewall so the IP cannot change, yet wants 1-second failover. Also, the failover procedure must not depend on a failure of the primary Region. What is the most appropriate combination?

• ARDS Multi-AZ + DynamoDB Multi-AZ + Route 53 Failover, with the failover Lambda in the primary Region
• BAurora Global Database + DynamoDB Global Tables + Global Accelerator (static Anycast IP), with the failover automation (Health Check + EventBridge + Step Functions) running in the DR Region
• CRDS Read Replica + ElastiCache + CloudFront
• DAurora Global + DynamoDB Global Tables + Route 53 (TTL 0)

You need distributed traces for 50 microservices, but traffic is large so tracing everything is costly, you must send to multiple backends without vendor lock-in, and you must unify multi-account observability into a single dashboard. What is the most appropriate combination?

• AX-Ray 100% tracing + separate per-account dashboards
• BADOT (OpenTelemetry) + custom sampling (high for critical paths, 0% for health checks) + CloudWatch OAM (Sink/Link)
• CReconstruct traces with CloudWatch Logs Insights + Lambda aggregation
• DInspector + self-hosted Grafana

In a regulated industry, SOC 2 audit evidence must be collected and reported automatically every quarter. CloudTrail, Config, and Security Hub are already enabled, and CloudTrail logs must not be deletable by an attacker in a breach. What is the most appropriate design?

• AKeep the default Trail in each account + manually aggregate with Athena each time
• BAudit Manager (SOC 2 framework) to automatically collect evidence and generate Reports + centralize an Org Trail in the Log Archive account + make it immutable with S3 Object Lock (WORM)
• CCollect evidence with Macie + permanent retention in CloudWatch Logs
• DGenerate reports with Config Aggregator + keep logs in each account

You want to delegate self-service IAM Role creation to developers while safely enforcing that the Roles they create cannot exceed the company policy ceiling (specific Regions only, and so on). What is the most appropriate method?

• AGrant developers AdministratorAccess including iam:CreateRole and catch company-policy violations with after-the-fact CloudTrail auditing
• BDefine a Permission Boundary and, on the Role creation permission, use the iam:PermissionsBoundary condition to force attaching the Boundary to new Roles
• CBan Role creation outright, and have the platform team take tickets and create the needed Roles manually on their behalf
• DAttach only a Region-restriction SCP to the OU to control, at the account level, the ceiling of permissions individual Roles can have

For incident response, you want to build a complex Runbook that needs multiple steps, retries, and an audit trail, and to receive both AWS Health events (scheduled maintenance) and GuardDuty Findings as triggers. What is the most appropriate combination?

• ALambda alone + SNS polling
• BEventBridge (default bus for Health, pattern filter for GuardDuty) → Step Functions Standard (multi-step, retries, execution history for auditing) → Incident Manager
• CRouting with CloudWatch Alarms only
• DA one-shot SSM Run Command

A CodeBuild build environment in a private VPC must access ECR, S3, CodeArtifact, and Secrets Manager without the internet, and the build artifacts must be readable cross-account by the Spoke account at deployment. What is the most appropriate design?

• ANAT Gateway + sharing IAM User keys with the Spoke
• BA VPC Endpoint (PrivateLink) for each service + a Cross-Account bucket policy on the artifact S3 bucket and a KMS CMK key policy (allowing the Spoke to decrypt)
• CInternet Gateway + a public S3 bucket
• DDirect Connect + root credentials for the Spoke

You run feature flags with AppConfig, but a design that assumed "when the configuration changes, AWS pushes it to the application immediately" is in fact not reflecting changes immediately. What is the cause and the correct understanding?

• AIt is a configuration propagation bug in AppConfig, so open a case with AWS Support and wait for a hotfix
• BAppConfig is a polling model, not a push model: the application fetches periodically through the AppConfig Agent/Extension, so there is a reflection delay equal to the polling interval (controlled by adjusting the interval)
• CSwitch to Secrets Manager and trigger an immediate refresh in the application with a rotation event (EventBridge)
• DSwitch to Parameter Store and have the application restart on a change after receiving an SNS notification

Which service performs each of the following: "scanning EC2 for known CVEs," "detecting PII in S3," "pre-validating the external sharing possibility of an IAM policy," and "root cause and linkage analysis of a breach incident"?

• AGuardDuty (CVE) / GuardDuty (PII) / GuardDuty (external exposure) / GuardDuty (causal analysis) — unified as threat detection
• BInspector (CVE) / Macie (PII) / IAM Access Analyzer (external exposure, policy validation) / Detective (causal analysis)
• CSecurity Hub (CVE) / Security Hub (PII) / Security Hub (external exposure) / Security Hub (causal analysis) — aggregation in a single console
• DConfig Rule (CVE) / Config Rule (PII) / Config Rule (external exposure) / Config Rule (causal analysis) — unified as compliance

Both options work. The question is "apply a security baseline, including new accounts, to 60 accounts with the LEAST operational overhead." (A) Deploy with StackSets Self-Managed, creating the execution Role manually in each account; (B) deploy Service-Managed StackSets + Auto-Deployment to the OU. Choosing on the basis of the qualifier, which is it?

• ASelf-Managed — finer-grained control
• BService-Managed + Auto-Deployment — Org integration means AWS manages the execution Role automatically and new accounts are included automatically, with minimal operational burden
• CThey are the same
• DImplement it directly with Lambda

An organization intermittently gets "Access Denied (KMS)" in a cross-account pipeline deployment. They have already modified the S3 bucket policy to allow the Spoke. What is the most appropriate next step?

• ARestart the pipeline
• BAdd kms:Decrypt (and GenerateDataKey if needed) permission for the Spoke account/deployment Role to the key policy of the KMS CMK used to encrypt the artifacts. Both the S3 policy and the KMS key policy must allow it
• CDisable ECR
• DDowngrade the pipeline to V1

What is the most recommended action on D-1 before the exam?

• AWork 3 new mock exam sets to find weak domains up to the last moment and reinforce the wrong-answer notes
• BSecure 7+ hours of sleep, lightly skim only the ⭐ key points of the main material, and avoid new material and new mocks
• CStay up all night to organize the whole scope of the 6 domains once more and memorize weak parts intensively
• DIncrease caffeine above usual to raise alertness and push your concentration up until late

When both options work technically, which direction is generally preferred in a question carrying the qualifier "MOST cost-effective"?

• AOver-provision always-on high-availability infrastructure to peak load to secure performance headroom
• BThe managed, serverless, pay-per-use direction plus tiering (hot/cold), for example S3 + Athena instead of permanent retention in Logs
• CPick the fully managed service with the most features to cover future requirements all at once
• DThe service the team is most familiar with, with low learning cost and fewer operational mistakes

In a question requiring "tamper protection (integrity/provenance)," why is choosing KMS encryption wrong?

• AKMS CMK request and key-storage costs are higher than signing, which runs against cost optimization
• BKMS provides confidentiality (encryption), not integrity or proof of origin; tamper protection is handled by signing such as AWS Signer/Notation
• CKMS cannot directly sign artifact formats such as OCI container images or Lambda zips
• DKMS keys are Region-bound, so one key cannot prove the provenance of multi-Region artifacts

What is the most appropriate strategy for the last 20 minutes of the exam?

• ASolve as many untouched new questions as possible to extend your scoring chances to the end
• BReview flagged (agonized-over) questions first, keep your first instinct if there is no new grounds to change the answer, and bring blank answers to 0
• CRe-review the answers to all questions from number 1 to catch every mistake
• DRe-check only the questions you felt sure you got right to lock in the score safely

You must apply a security baseline, including new accounts, to 60 accounts with the "LEAST operational overhead." Between Self-Managed StackSets and Service-Managed StackSets + Auto-Deployment, what is the correct choice and its rationale?

• ASelf-Managed — you define the execution Role in each account yourself, allowing finer-grained permission control
• BService-Managed + Auto-Deployment — Organizations integration means AWS manages the execution Role automatically and new accounts are included automatically, so the operational burden is minimal
• CBoth support OU-targeted deployment, so the operational burden is effectively the same
• DRun a Lambda daily on an EventBridge schedule to scan for new accounts and deploy the baseline through the API

You designed AppConfig assuming "changes are reflected immediately when the configuration changes," but delay occurs. What is the correct understanding?

• AAppConfig is inherently an immediate-push model, so the behavior is a bug and you must contact AWS Support
• BAppConfig is a polling model, so the client fetches at the interval you set; the reflection delay is normal and is controlled with the polling interval
• CIf immediate reflection is needed, you must switch to Secrets Manager and trigger the refresh with a rotation event
• DYou must change the architecture so that AppConfig changes are received as EventBridge events and pushed to the application

When you meet a question you know nothing about in a Professional exam, what is a reasonable direction for guessing so as not to leave a blank answer?

• AThe longest option with the most technical terms that looks sophisticated
• BThe option suggesting AWS-native, automation, and minimal operational burden (avoid options with unfamiliar, suspicious service names or manual operations)
• CThe one placed first (A) among the options, going by the probability that it is the answer given exam-writing tendencies
• DThe most expensive, most feature-rich full-stack solution, safely the top option