DOP-C02 practice questions 91–100

1. Question 91 · 427 in bank

   A company requires its internal business teams to launch resources through pre-approved AWS CloudFormation templates only. The security team requires automated monitoring when resources drift from their expected state. Which strategy should be used to meet these requirements?

   • AAllow users to deploy CloudFormation stacks using a CloudFormation service role only. Use CloudFormation drift detection to detect when resources have drifted from their expected state.
   • BAllow users to deploy CloudFormation stacks using a CloudFormation service role only. Use AWS Config rules to detect when resources have drifted from their expected state.
   • CAllow users to deploy CloudFormation stacks using AWS Service Catalog only. Enforce the use of a launch constraint. Use AWS Config rules to detect when resources have drifted from their expected state.
   • DAllow users to deploy CloudFormation stacks using AWS Service Catalog only. Enforce the use of a template constraint. Use Amazon EventBridge notifications to detect when resources have drifted from their expected state.

   Show answer

   Answer: C

   Explanation

   Checks if the actual configuration of a AWS CloudFormation (AWS CloudFormation) stack differs, or has drifted, from the expected configuration. A stack is considered to have drifted if one or more of its resources differ from their expected configuration. https://docs.aws.amazon.com/config/latest/developerguide/cloudformation-stack-drift-detection-check.html

   Source: Adapted from community discussion — c3518fc

   References

   • AWS documentation

   Next question

2. Question 92 · 427 in bank

   A company has multiple development groups working in a single shared AWS account. The senior manager of the groups wants to be alerted via a third-party API call when the creation of resources approaches the service limits for the account. Which solution will accomplish this with the LEAST amount of development effort?

   • ACreate an Amazon EventBridge rule that runs periodically and targets an AWS Lambda function. Within the Lambda function, evaluate the current state of the AWS environment and compare deployed resource values to resource limits on the account. Notify the senior manager if the account is approaching a service limit.
   • BDeploy an AWS Lambda function that refreshes AWS Trusted Advisor checks, and configure an Amazon EventBridge rule to run the Lambda function periodically. Create another EventBridge rule with an event pattern matching Trusted Advisor events and a target Lambda function. In the target Lambda function, notify the senior manager.
   • CDeploy an AWS Lambda function that refreshes AWS Health Dashboard checks, and configure an Amazon EventBridge rule to run the Lambda function periodically. Create another EventBridge rule with an event pattern matching Health Dashboard events and a target Lambda function. In the target Lambda function, notify the senior manager.
   • DAdd an AWS Config custom rule that runs periodically, checks the AWS service limit status, and streams notifications to an Amazon Simple Notification Service (Amazon SNS) topic. Deploy an AWS Lambda function that notifies the senior manager, and subscribe the Lambda function to the SNS topic.

   Show answer

   Answer: B

   Explanation

   Understanding your service limits (and how close you are to them) is an important part of managing your AWS deployments – continuous monitoring allows you to request limit increases or shut down resources before the limit is reached. One of the easiest ways to do this is via AWS Trusted Advisor’s Service Limit Dashboard, which currently covers 39 limits across 10 services. https://aws.amazon.com/blogs/mt/monitoring-service-limits-with-trusted-advisor-and-amazon-cloudwatch/

   Source: Adapted from community discussion — c3518fc

   References

   • AWS documentation

   Next question

3. Question 93 · 427 in bank

   A DevOps engineer is setting up a container-based architecture. The engineer has decided to use AWS CloudFormation to automatically provision an Amazon ECS cluster and an Amazon EC2 Auto Scaling group to launch the EC2 container instances. After successfully creating the CloudFormation stack, the engineer noticed that, even though the ECS cluster and the EC2 instances were created successfully and the stack finished the creation, the EC2 instances were associating with a different cluster. How should the DevOps engineer update the CloudFormation template to resolve this issue?

   • AReference the EC2 instances in the AWS::ECS::Cluster resource and reference the ECS cluster in the AWS::ECS::Service resource.
   • BReference the ECS cluster in the AWS::AutoScaling::LaunchConfiguration resource of the UserData property.
   • CReference the ECS cluster in the AWS::EC2::Instance resource of the UserData property.
   • DReference the ECS cluster in the AWS::CloudFormation::CustomResource resource to trigger an AWS Lambda function that registers the EC2 instances with the appropriate ECS cluster.

   Show answer

   Answer: B

   Explanation

   B is correct: means we need to link the auto scaling group to the ECS cluster A: incorrect. AWS::ECS::Cluster creates an ECS cluster. AWS::ECS::Service creates its services. However, it does not link the EC2 auto scaling group to the ECS cluster C: incorrect. AWS::EC2::Instance creates an EC2 instance D: incorrect. AWS::CloudFormation::CustomResource creates CustomResource

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 94 · 427 in bank

   Select 2

   A DevOps engineer is implementing governance controls for a company that requires its infrastructure to be housed within the United States. The engineer must restrict which AWS Regions can be used, and ensure an alert is sent as soon as possible if any activity outside the governance policy takes place. The controls should be automatically enabled on any new Region outside the United States (US). Which combination of actions will meet these requirements? (Choose two.)

   • ACreate an AWS Organizations SCP that denies access to all non-global services in non-US Regions. Attach the policy to the root of the organization.
   • BConfigure AWS CloudTrail to send logs to Amazon CloudWatch Logs and enable it for all Regions. Use a CloudWatch Logs metric filter to send an alert on any service activity in non-US Regions.
   • CUse an AWS Lambda function that checks for AWS service activity and deploy it to all Regions. Write an Amazon EventBridge rule that runs the Lambda function every hour, sending an alert if activity is found in a non-US Region.
   • DUse an AWS Lambda function to query Amazon Inspector to look for service activity in non-US Regions and send alerts if any activity is found.
   • EWrite an SCP using the aws:RequestedRegion condition key limiting access to US Regions. Apply the policy to all users, groups, and roles.

   Show answer

   Answer: AB

   Explanation

   A and B are correct: SCP to restrict and AWS cloutrail to monitor C: Lambda cannot check AWS service activity D: AWS inspector has nothing to do here E: : cannot assign a SCP to all users, groups and roles.

   Source: Adapted from community discussion — thanhnv142

   Next question

5. Question 95 · 427 in bank

   A company sells products through an ecommerce web application. The company wants a dashboard that shows a pie chart of product transaction details. The company wants to integrate the dashboard with the company's existing Amazon CloudWatch dashboards. Which solution will meet these requirements with the MOST operational efficiency?

   • AUpdate the ecommerce application to emit a JSON object to a CloudWatch log group for each processed transaction. Use CloudWatch Logs Insights to query the log group and to visualize the results in a pie chart format. Attach the results to the desired CloudWatch dashboard.
   • BUpdate the ecommerce application to emit a JSON object to an Amazon S3 bucket for each processed transaction. Use Amazon Athena to query the S3 bucket and to visualize the results in a pie chart format. Export the results from Athena. Attach the results to the desired CloudWatch dashboard.
   • CUpdate the ecommerce application to use AWS X-Ray for instrumentation. Create a new X-Ray subsegment. Add an annotation for each processed transaction. Use X-Ray traces to query the data and to visualize the results in a pie chart format. Attach the results to the desired CloudWatch dashboard.
   • DUpdate the ecommerce application to emit a JSON object to a CloudWatch log group for each processed transaction. Create an AWS Lambda function to aggregate and write the results to Amazon DynamoDB. Create a Lambda subscription filter for the log file. Attach the results to the desired CloudWatch dashboard.

   Show answer

   Answer: A

   Explanation

   A is correct: means we need to collect application logs and analyze the log. The recommended way is to use cloudwatch logs and cloudwatch logs insights B: Should not use S3. We should use cloudwatch logs so that we can integrate easily to the existing cloudwatch dashboards C: X-ray is for troubleshooting, which is short-term, not for long-term app monitoring D: Should not use lambda and should not write the results to dynamodb, which is primarily used to store session data https://www.examtopics.com/exams/amazon/aws-certified-devops-engineer-professional-dop-c02/view/1/#

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

6. Question 96 · 427 in bank

   A company is launching an application. The application must use only approved AWS services. The account that runs the application was created less than 1 year ago and is assigned to an AWS Organizations OU. The company needs to create a new Organizations account structure. The account structure must have an appropriate SCP that supports the use of only services that are currently active in the AWS account. The company will use AWS Identity and Access Management (IAM) Access Analyzer in the solution. Which solution will meet these requirements?

   • ACreate an SCP that allows the services that IAM Access Analyzer identifies. Create an OU for the account. Move the account into the new OU. Attach the new SCP to the new OU. Detach the default FullAWSAccess SCP from the new OU.
   • BCreate an SCP that denies the services that IAM Access Analyzer identifies. Create an OU for the account. Move the account into the new OU. Attach the new SCP to the new OU.
   • CCreate an SCP that allows the services that IAM Access Analyzer identifies. Attach the new SCP to the organization's root.
   • DCreate an SCP that allows the services that IAM Access Analyzer identifies. Create an OU for the account. Move the account into the new OU. Attach the new SCP to the management account. Detach the default FullAWSAccess SCP from the new OU.

   Show answer

   Answer: A

   Explanation

   A is correct: is a solution for least privilege, which is allow some, deny all. So we need to defy allowed permissions and then remove the B: least privilege is allow some, deny all, not allow all, deny some. C: The step mentioned would have no effect. The root already had default FullAWSAccess SCP. Allowing some more services does not change anything D: : Cannot attach a SCP to an account

   Source: Adapted from community discussion — thanhnv142

   Next question

7. Question 97 · 427 in bank

   A company has multiple development teams in different business units that work in a shared single AWS account. All Amazon EC2 resources that are created in the account must include tags that specify who created the resources. The tagging must occur within the first hour of resource creation. A DevOps engineer needs to add tags to the created resources that include the user ID that created the resource and the cost center ID. The DevOps engineer configures an AWS Lambda function with the cost center mappings to tag the resources. The DevOps engineer also sets up AWS CloudTrail in the AWS account. An Amazon S3 bucket stores the CloudTrail event logs. Which solution will meet the tagging requirements?

   • ACreate an S3 event notification on the S3 bucket to invoke the Lambda function for s3:ObjectTagging:Put events. Enable bucket versioning on the S3 bucket.
   • BEnable server access logging on the S3 bucket. Create an S3 event notification on the S3 bucket for s3:ObjectTagging:* events.
   • CCreate a recurring hourly Amazon EventBridge scheduled rule that invokes the Lambda function. Modify the Lambda function to read the logs from the S3 bucket.
   • DCreate an Amazon EventBridge rule that uses Amazon EC2 as the event source. Configure the rule to match events delivered by CloudTrail. Configure the rule to target the Lambda function.

   Show answer

   Answer: D

   Explanation

   It's D. It says within an hour so it can't be C, looping over the S3 logs may take a lot (apparently there is also consideration about the 15mins limit of lambda)

   Source: Adapted from community discussion — csG13

   Next question

8. Question 98 · 427 in bank

   A company runs an application for multiple environments in a single AWS account. An AWS CodePipeline pipeline uses a development Amazon Elastic Container Service (Amazon ECS) cluster to test an image for the application from an Amazon Elastic Container Registry (Amazon ECR) repository. The pipeline promotes the image to a production ECS cluster. The company needs to move the production cluster into a separate AWS account in the same AWS Region. The production cluster must be able to download the images over a private connection. Which solution will meet these requirements?

   • AUse Amazon ECR VPC endpoints and an Amazon S3 gateway endpoint. In the separate AWS account, create an ECR repository. Set the repository policy to allow the production ECS tasks to pull images from the main AWS account. Configure the production ECS task execution role to have permission to download the image from the ECR repository.
   • BSet a repository policy on the production ECR repository in the main AWS account. Configure the repository policy to allow the production ECS tasks in the separate AWS account to pull images from the main account. Configure the production ECS task execution role to have permission to download the image from the ECR repository.
   • CConfigure ECR private image replication in the main AWS account. Activate cross-account replication. Define the destination account ID of the separate AWS account.
   • DUse Amazon ECR VPC endpoints and an Amazon S3 gateway endpoint. Set a repository policy on the production ECR repository in the main AWS account. Configure the repository policy to allow the production ECS tasks in the separate AWS account to pull images from the main account. Configure the production ECS task execution role to have permission to download the image from the ECR repository.

   Show answer

   Answer: D

   Explanation

   Ans D: Amazon ECS tasks to pull private images from Amazon ECR, you must create a gateway endpoint for Amazon S3. The gateway endpoint is required because Amazon ECR uses Amazon S3 to store your image layers.

   Source: Adapted from community discussion — dkp

   References

   • AWS documentation

   Next question

9. Question 99 · 427 in bank

   A company needs to ensure that flow logs remain configured for all existing and new VPCs in its AWS account. The company uses an AWS CloudFormation stack to manage its VPCs. The company needs a solution that will work for any VPCs that any IAM user creates. Which solution will meet these requirements?

   • AAdd the AWS::EC2::FlowLog resource to the CloudFormation stack that creates the VPCs.
   • BCreate an organization in AWS Organizations. Add the company's AWS account to the organization. Create an SCP to prevent users from modifying VPC flow logs.
   • CTurn on AWS Config. Create an AWS Config rule to check whether VPC flow logs are turned on. Configure automatic remediation to turn on VPC flow logs.
   • DCreate an IAM policy to deny the use of API calls for VPC flow logs. Attach the IAM policy to all IAM users.

   Show answer

   Answer: C

   Explanation

   C is correct: This will monitor and remediate all existing and new VPCs A: AWS::EC2::FlowLog: This is used to configured flow log, not monitor it B: SCP wont address existing VPCs D: IAM policy has nothing to do here

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

10. Question 100 · 427 in bank

    A company uses AWS Organizations and AWS Control Tower to manage all the company's AWS accounts. The company uses the Enterprise Support plan. A DevOps engineer is using Account Factory for Terraform (AFT) to provision new accounts. When new accounts are provisioned, the DevOps engineer notices that the support plan for the new accounts is set to the Basic Support plan. The DevOps engineer needs to implement a solution to provision the new accounts with the Enterprise Support plan. Which solution will meet these requirements?

    • AUse an AWS Config conformance pack to deploy the account-part-of-organizations AWS Config rule and to automatically remediate any noncompliant accounts.
    • BCreate an AWS Lambda function to create a ticket for AWS Support to add the account to the Enterprise Support plan. Grant the Lambda function the support:ResolveCase permission.
    • CAdd an additional value to the control_tower_parameters input to set the AWSEnterpriseSupport parameter as the organization's management account number.
    • DSet the aft_feature_enterprise_support feature flag to True in the AFT deployment input configuration. Redeploy AFT and apply the changes.

    Show answer

    Answer: D

    Explanation

    D. Set the aft_feature_enterprise_support feature flag to True in the AFT deployment input configuration. Redeploy AFT and apply the changes. AWS Organizations is a service that helps to manage multiple AWS accounts. AWS Control Tower is a service that makes it easy to set up and govern secure, compliant multi-account AWS environments. Account Factory for Terraform (AFT) is an AWS Control Tower feature that provisions new accounts using Terraform templates. To provision new accounts with the Enterprise Support plan, the DevOps engineer can set the aft_feature_enterprise_support feature flag to True in the AFT deployment input configuration. This flag enables the Enterprise Support plan for newly provisioned accounts.

    Source: Adapted from community discussion — 5aga

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 91. 427 questions available.