DOP-C02 practice questions 101–110

1. Question 101 · 427 in bank

   Select 3

   A company's application teams use AWS CodeCommit repositories for their applications. The application teams have repositories in multiple AWS accounts. All accounts are in an organization in AWS Organizations. Each application team uses AWS IAM Identity Center (AWS Single Sign-On) configured with an external IdP to assume a developer IAM role. The developer role allows the application teams to use Git to work with the code in the repositories. A security audit reveals that the application teams can modify the main branch in any repository. A DevOps engineer must implement a solution that allows the application teams to modify the main branch of only the repositories that they manage. Which combination of steps will meet these requirements? (Choose three.)

   • AUpdate the SAML assertion to pass the user's team name. Update the IAM role's trust policy to add an access-team session tag that has the team name.
   • BCreate an approval rule template for each team in the Organizations management account. Associate the template with all the repositories. Add the developer role ARN as an approver.
   • CCreate an approval rule template for each account. Associate the template with all repositories. Add the "aws:ResourceTag/access-team": "$ ;{aws:PrincipalTag/access-team}" condition to the approval rule template.
   • DFor each CodeCommit repository, add an access-team tag that has the value set to the name of the associated team.
   • EAttach an SCP to the accounts. Include the following statement:
   • FCreate an IAM permissions boundary in each account. Include the following statement:

   Show answer

   Answer: ADE

   Explanation

   Correction, its ADE: Permissions boundaries (Option F) are more granular and would be set on each IAM role individually. While they could achieve a similar effect, they are not as broad in scope as SCPs and would require setting up on every IAM role, which could be less efficient than a blanket policy across the organization with an SCP

   Source: Adapted from community discussion — ogerber

   References

   • AWS documentation

   Next question

2. Question 102 · 427 in bank

   A company uses AWS WAF to protect its cloud infrastructure. A DevOps engineer needs to give an operations team the ability to analyze log messages from AWS WAF. The operations team needs to be able to create alarms for specific patterns in the log output. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate an Amazon CloudWatch Logs log group. Configure the appropriate AWS WAF web ACL to send log messages to the log group. Instruct the operations team to create CloudWatch metric filters.
   • BCreate an Amazon OpenSearch Service cluster and appropriate indexes. Configure an Amazon Kinesis Data Firehose delivery stream to stream log data to the indexes. Use OpenSearch Dashboards to create filters and widgets.
   • CCreate an Amazon S3 bucket for the log output. Configure AWS WAF to send log outputs to the S3 bucket. Instruct the operations team to create AWS Lambda functions that detect each desired log message pattern. Configure the Lambda functions to publish to an Amazon Simple Notification Service (Amazon SNS) topic.
   • DCreate an Amazon S3 bucket for the log output. Configure AWS WAF to send log outputs to the S3 bucket. Use Amazon Athena to create an external table definition that fits the log message pattern. Instruct the operations team to write SQL queries and to create Amazon CloudWatch metric filters for the Athena queries.

   Show answer

   Answer: A

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 103 · 427 in bank

   A software team is using AWS CodePipeline to automate its Java application release pipeline. The pipeline consists of a source stage, then a build stage, and then a deploy stage. Each stage contains a single action that has a runOrder value of 1. The team wants to integrate unit tests into the existing release pipeline. The team needs a solution that deploys only the code changes that pass all unit tests. Which solution will meet these requirements?

   • AModify the build stage. Add a test action that has a runOrder value of 1. Use AWS CodeDeploy as the action provider to run unit tests.
   • BModify the build stage. Add a test action that has a runOrder value of 2. Use AWS CodeBuild as the action provider to run unit tests.
   • CModify the deploy stage. Add a test action that has a runOrder value of 1. Use AWS CodeDeploy as the action provider to run unit tests.
   • DModify the deploy stage. Add a test action that has a runOrder value of 2. Use AWS CodeBuild as the action provider to run unit tests.

   Show answer

   Answer: B

   Explanation

   B is correct: Runorder value of 2 ensure that we do unit tests after we build artifacts. A: The unit tests would run in parellel with the build step, which is incorrect. We can only test after we have done building C and D: The unit tests would not run before the deploy step.

   Source: Adapted from community discussion — thanhnv142

   Next question

4. Question 104 · 427 in bank

   A company uses an organization in AWS Organizations to manage several AWS accounts that the company's developers use. The company requires all data to be encrypted in transit. Multiple Amazon S3 buckets that were created in developer accounts allow unencrypted connections. A DevOps engineer must enforce encryption of data in transit for all existing S3 buckets that are created in accounts in the organization. Which solution will meet these requirements?

   • AUse AWS CloudFormation StackSets to deploy an AWS Network Firewall firewall to each account. Route all outbound requests from the AWS environment through the firewall. Deploy a policy to block access to all outbound requests on port 80.
   • BUse AWS CloudFormation StackSets to deploy an AWS Network Firewall firewall to each account. Route all inbound requests to the AWS environment through the firewall. Deploy a policy to block access to all inbound requests on port 80.
   • CTurn on AWS Config for the organization. Deploy a conformance pack that uses the s3-bucket-ssl-requests-only managed rule and an AWS Systems Manager Automation runbook. Use a runbook that adds a bucket policy statement to deny access to an S3 bucket when the value of the aws:SecureTransport condition key is false.
   • DTurn on AWS Config for the organization. Deploy a conformance pack that uses the s3-bucket-ssl-requests-only managed rule and an AWS Systems Manager Automation runbook. Use a runbook that adds a bucket policy statement to deny access to an S3 bucket when the value of the s3:x-amz-server-side-encryption-aws-kms-key-id condition key is null.

   Show answer

   Answer: C

   Explanation

   Answer C 100%. aws:SecureTransport condition this will be allowing only encrypted connections over HTTPS (TLS) --> THIS IS WHAT WE NEED s3:x-amz-server-side-encryption-aws-kms-key-id --> To require that a particular AWS KMS key be used to encrypt the objects in a bucket. WE DON'T NEED THIS HERE!

   Source: Adapted from community discussion — kabary

   References

   • repost.aws documentation

   Next question

5. Question 105 · 427 in bank

   A company is reviewing its IAM policies. One policy written by the DevOps engineer has been flagged as too permissive. The policy is used by an AWS Lambda function that issues a stop command to Amazon EC2 instances tagged with Environment: NonProduction over the weekend. The current policy is:

   

   What changes should the engineer make to achieve a policy of least permission? (Choose three.)

   • AAdd the following conditional expression:
   • BChange "Resource": "*"to "Resource": "arn:aws:ec2:*:*:instance/*"
   • CAdd the following conditional expression:
   • DAdd the following conditional expression:
   • EChange "Action": "ec2:*"to "Action": "ec2:StopInstances"
   • FAdd the following conditional expression:

   Show answer

   Answer: B

   Explanation

   B, D and E are correct: A: This allow all any lambda func to do the task, wont make any change B: This allow action only on EC2, so it is correct C: We need to allow action on Ec2 instances tagged with NonProdction only. Using this would grant permissions to other tags as well D: perfectly correct E: Only permit stop action, so it is correct F: irrelevant

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

6. Question 106 · 427 in bank

   Select 3

   A company is developing an application that will generate log events. The log events consist of five distinct metrics every one tenth of a second and produce a large amount of data. The company needs to configure the application to write the logs to Amazon Timestream. The company will configure a daily query against the Timestream table. Which combination of steps will meet these requirements with the FASTEST query performance? (Choose three.)

   • AUse batch writes to write multiple log events in a single write operation.
   • BWrite each log event as a single write operation.
   • CTreat each log as a single-measure record.
   • DTreat each log as a multi-measure record.
   • EConfigure the memory store retention period to be longer than the magnetic store retention period.
   • FConfigure the memory store retention period to be shorter than the magnetic store retention period.

   Show answer

   Answer: ADF

   Explanation

   While E suggests configuring the memory store retention period to be longer than the magnetic store retention period, this is typically not aimed at optimizing query performance but rather at keeping data in the faster-access memory store for longer periods, which could be beneficial for workloads requiring frequent access to recent data. However, for the scenario described, focusing on efficient data ingestion methods (A and D) and understanding the role of retention periods (F) provides a balanced approach to achieving the fastest query performance for daily queries.

   Source: Adapted from community discussion — vortegon

   References

   • AWS documentation

   Next question

7. Question 107 · 427 in bank

   Select 2

   A DevOps engineer has created an AWS CloudFormation template that deploys an application on Amazon EC2 instances. The EC2 instances run Amazon Linux. The application is deployed to the EC2 instances by using shell scripts that contain user data. The EC2 instances have an IAM instance profile that has an IAM role with the AmazonSSMManagedinstanceCore managed policy attached. The DevOps engineer has modified the user data in the CloudFormation template to install a new version of the application. The engineer has also applied the stack update. However, the application was not updated on the running EC2 instances. The engineer needs to ensure that the changes to the application are installed on the running EC2 instances. Which combination of steps will meet these requirements? (Choose two.)

   • AConfigure the user data content to use the Multipurpose Internet Mail Extensions (MIME) multipart format. Set the scripts-user parameter to always in the text/cloud-config section.
   • BRefactor the user data commands to use the cfn-init helper script. Update the user data to install and configure the cfn-hup and cfn-init helper scripts to monitor and apply the metadata changes.
   • CConfigure an EC2 launch template for the EC2 instances. Create a new EC2 Auto Scaling group. Associate the Auto Scaling group with the EC2 launch template. Use the AutoScalingScheduledAction update policy for the Auto Scaling group.
   • DRefactor the user data commands to use an AWS Systems Manager document (SSM document). Add an AWS CLI command in the user data to use Systems Manager Run Command to apply the SSM document to the EC2 instances.
   • ERefactor the user data command to use an AWS Systems Manager document (SSM document). Use Systems Manager State Manager to create an association between the SSM document and the EC2 instances.

   Show answer

   Answer: BE

   Explanation

   B and E are the most effective in ensuring that updates to the application are installed on the running EC2 instances by leveraging CloudFormation's and AWS Systems Manager's capabilities for managing and applying updates.

   Source: Adapted from community discussion — vortegon

   Next question

8. Question 108 · 427 in bank

   Select 3

   A company is refactoring applications to use AWS. The company identifies an internal web application that needs to make Amazon S3 API calls in a specific AWS account. The company wants to use its existing identity provider (IdP) auth.company.com for authentication. The IdP supports only OpenID Connect (OIDC). A DevOps engineer needs to secure the web application's access to the AWS account. Which combination of steps will meet these requirements? (Choose three.)

   • AConfigure AWS IAM Identity Center (AWS Single Sign-On). Configure an IdP. Upload the IdP metadata from the existing IdP.
   • BCreate an IAM IdP by using the provider URL, audience, and signature from the existing IP.
   • CCreate an IAM role that has a policy that allows the necessary S3 actions. Configure the role's trust policy to allow the OIDC IP to assume the role if the sts.amazon.com:aud context key is appid_from_idp.
   • DCreate an IAM role that has a policy that allows the necessary S3 actions. Configure the role's trust policy to allow the OIDC IP to assume the role if the auth.company.com:aud context key is appid_from_idp.
   • EConfigure the web application to use the AssumeRoleWithWebIdentity API operation to retrieve temporary credentials. Use the temporary credentials to make the S3 API calls.
   • FConfigure the web application to use the GetFederationToken API operation to retrieve temporary credentials. Use the temporary credentials to make the S3 API calls.

   Show answer

   Answer: BDE

   Explanation

   "Use OpenID Connect (OIDC) federated identity providers instead of creating" IAM users." "With an" IdP "you can manage" "user identities outside of AWS and give these external user identities permissions to access AWS resources in your account." B: (YES) "IAM OIDC identity Providers" "This is useful when creating a mobile app or web application that requires access to AWS resources, but you don't want to create custom sign-in code or manage your own user identities." D: (YES) "For OIDC providers, use the fully qualified URL of the OIDC IdP with the aud context key" e.g.: "Condition": {"StringEquals": {"server.example.com:aud": "appid_from_oidc_idp"}}" E: (YES) "AssumeRoleWithWebIdentity" "Federation through a web-based" IDP "returns a set of temporary security credentials for federated users" "authenticated" "with a public identity provider." "This operation is useful for" "client-based web applications that require access to AWS."

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation

   Next question

9. Question 109 · 427 in bank

   A company uses Amazon RDS for all databases in its AWS accounts. The company uses AWS Control Tower to build a landing zone that has an audit and logging account. All databases must be encrypted at rest for compliance reasons. The company's security engineer needs to receive notification about any noncompliant databases that are in the company’s accounts. Which solution will meet these requirements with the MOST operational efficiency?

   • AUse AWS Control Tower to activate the optional detective control (guardrail) to determine whether the RDS storage is encrypted. Create an Amazon Simple Notification Service (Amazon SNS) topic in the company's audit account. Create an Amazon EventBridge rule to filter noncompliant events from the AWS Control Tower control (guardrail) to notify the SNS topic. Subscribe the security engineer's email address to the SNS topic.
   • BUse AWS CloudFormation StackSets to deploy AWS Lambda functions to every account. Write the Lambda function code to determine whether the RDS storage is encrypted in the account the function is deployed to. Send the findings as an Amazon CloudWatch metric to the management account. Create an Amazon Simple Notification Service (Amazon SNS) topic. Create a CloudWatch alarm that notifies the SNS topic when metric thresholds are met. Subscribe the security engineer's email address to the SNS topic.
   • CCreate a custom AWS Config rule in every account to determine whether the RDS storage is encrypted. Create an Amazon Simple Notification Service (Amazon SNS) topic in the audit account. Create an Amazon EventBidge rule to filter noncompliant events from the AWS Control Tower control (guardrail) to notify the SNS topic. Subscribe the security engineer's email address to the SNS topic.
   • DLaunch an Amazon C2 instance. Run an hourly cron job by using the AWS CLI to determine whether the RDS storage is encrypted in each AWS account. Store the results in an RDS database. Notify the security engineer by sending email messages from the EC2 instance when noncompliance is detected

   Show answer

   Answer: A

   Explanation

   Leverages existing infrastructure: It utilizes native AWS Control Tower functionality for compliance checks and integrates seamlessly with SNS for notifications. Centralized management: Configuration and monitoring are done in the audit account, eliminating the need for individual resources in each account. Scalability: Handles future account growth without manual intervention.

   Source: Adapted from community discussion — Ramdi1

   References

   • AWS documentation

   Next question

10. Question 110 · 427 in bank

    Select 2

    A company is migrating from its on-premises data center to AWS. The company currently uses a custom on-premises Cl/CD pipeline solution to build and package software. The company wants its software packages and dependent public repositories to be available in AWS CodeArtifact to facilitate the creation of application-specific pipelines. Which combination of steps should the company take to update the CI/CD pipeline solution and to configure CodeArtifact with the LEAST operational overhead? (Choose two.)

    • AUpdate the C1ICD pipeline to create a VM image that contains newly packaged software. Use AWS Import/Export to make the VM image available as an Amazon EC2 AMI. Launch the AMI with an attached IAM instance profile that allows CodeArtifact actions. Use AWS CLI commands to publish the packages to a CodeArtifact repository.
    • BCreate an AWS Identity and Access Management Roles Anywhere trust anchor. Create an IAM role that allows CodeArtifact actions and that has a trust relationship on the trust anchor. Update the on-premises CI/CD pipeline to assume the new IAM role and to publish the packages to CodeArtifact.
    • CCreate a new Amazon S3 bucket. Generate a presigned URL that allows the PutObject request. Update the on-premises CI/CD pipeline to use the presigned URL to publish the packages from the on-premises location to the S3 bucket. Create an AWS Lambda function that runs when packages are created in the bucket through a put command. Configure the Lambda function to publish the packages to CodeArtifact.
    • DFor each public repository, create a CodeArutact repository that is configured with an external connection. Configure the dependent repositories as upstream public repositories.
    • ECreate a Codeartitact repository that is configured with a set of external connections to the public repositories. Configure the external connections to be downstream of the repository.

    Show answer

    Answer: BD

    Explanation

    B & D B - https://docs.aws.amazon.com/rolesanywhere/latest/userguide/getting-started.html D - Best practice for external connections is to have one repository per domain with an external connection to a given public repository.

    Source: Adapted from community discussion — DanShone

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 101. 427 questions available.