DOP-C02 practice questions 121–130

1. Question 121 · 427 in bank

   A company's organization in AWS Organizations has a single OU. The company runs Amazon EC2 instances in the OU accounts. The company needs to limit the use of each EC2 instance’s credentials to the specific EC2 instance that the credential is assigned to. A DevOps engineer must configure security for the EC2 instances. Which solution will meet these requirements?

   • ACreate an SCP that specifies the VPC CIDR block. Configure the SCP to check whether the value of the aws:VpcSourcelp condition key is in the specified block. In the same SCP check, check whether the values of the aws:EC2InstanceSourcePrivatelPv4 and aws:SourceVpc condition keys are the same. Deny access if either condition is false. Apply the SCP to the OU.
   • BCreate an SCP that checks whether the values of the aws:EC2InstanceSourceVPC and aws:SourceVpc condition keys are the same. Deny access if the values are not the same. In the same SCP check, check whether the values of the aws:EC2InstanceSourcePrivateIPv4 and aws:VpcSourceIp condition keys are the same. Deny access if the values are not the same. Apply the SCP to the OU.
   • CCreate an SCP that includes a list of acceptable VPC values and checks whether the value of the aws:SourceVpc condition key is in the list. In the same SCP check, define a list of acceptable IP address values and check whether the value of the aws:VpcSourceIp condition key is in the list. Deny access if either condition is false. Apply the SCP to each account in the organization.
   • DCreate an SCP that checks whether the values of the aws:EC2InstanceSourceVPC and aws:VpcSourceIp condition keys are the same. Deny access if the values are not the same. In the same SCP check, check whether the values of the aws:EC2InstanceSourcePrivateIPv4 and aws:SourceVpc condition keys are the same. Deny access if the values are not the same. Apply the SCP to each account in the organization.

   Show answer

   Answer: B

   Explanation

   B is the most appropriate solution: Option A introduces unnecessary complexity with multiple conditions and may not provide the intended restriction. Option C suggests creating an SCP with lists of acceptable values, but it might be challenging to maintain and is less straightforward. Option D has the same issues as option A, introducing complexity with multiple conditions.

   Source: Adapted from community discussion — fdoxxx

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 122 · 427 in bank

   A company has containerized all of its in-house quality control applications. The company is running Jenkins on Amazon EC2 instances, which require patching and upgrading. The compliance officer has requested a DevOps engineer begin encrypting build artifacts since they contain company intellectual property. What should the DevOps engineer do to accomplish this in the MOST maintainable manner?

   • AAutomate patching and upgrading using AWS Systems Manager on EC2 instances and encrypt Amazon EBS volumes by default.
   • BDeploy Jenkins to an Amazon ECS cluster and copy build artifacts to an Amazon S3 bucket with default encryption enabled.
   • CLeverage AWS CodePipeline with a build action and encrypt the artifacts using AWS Secrets Manager.
   • DUse AWS CodeBuild with artifact encryption to replace the Jenkins instance running on EC2 instances.

   Show answer

   Answer: D

   Explanation

   The question wants you to know which solution is the easiest to maintain. It's important not to get thrown by information provided about their current environment. Only the question they ask matters. The question asks which solution is the easiest to "maintain". The question did not ask whether it would be easy to transition from one solution to another or ask you to leverage containers like other parts of their environment. As a managed service, AWS CodeBuild does not require patching and upgrading. AWS CodeBuild, using Amazon S3, provides automatic artifact encryption. So this solution is the easiest to maintain of all the solutions listed. https://docs.aws.amazon.com/codebuild/latest/userguide/welcome.html https://docs.aws.amazon.com/codebuild/latest/userguide/security-encryption.html

   Source: Adapted from community discussion — sb333

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 123 · 427 in bank

   Select 2

   A company has a fleet of Amazon EC2 instances that run Linux in a single AWS account. The company is using an AWS Systems Manager Automation task across the EC2 instances. During the most recent patch cycle, several EC2 instances went into an error state because of insufficient available disk space. A DevOps engineer needs to ensure that the EC2 instances have sufficient available disk space during the patching process in the future. Which combination of steps will meet these requirements? (Choose two.)

   • AEnsure that the Amazon CloudWatch agent is installed on all EC2 instances.
   • BCreate a cron job that is installed on each EC2 instance to periodically delete temporary files.
   • CCreate an Amazon CloudWatch log group for the EC2 instances. Configure a cron job that is installed on each EC2 instance to write the available disk space to a CloudWatch log stream for the relevant EC2 instance.
   • DCreate an Amazon CloudWatch alarm to monitor available disk space on all EC2 instances. Add the alarm as a safety control to the Systems Manager Automation task.
   • ECreate an AWS Lambda function to periodically check for sufficient available disk space on all EC2 instances by evaluating each EC2 instance's respective Amazon CloudWatch log stream.

   Show answer

   Answer: AD

   Explanation

   A. Ensure that the Amazon CloudWatch agent is installed on all EC2 instances. The Amazon CloudWatch agent can collect system-level metrics, including disk space usage, and send them to Amazon CloudWatch. This will allow you to monitor the available disk space on each EC2 instance. D. Create an Amazon CloudWatch alarm to monitor available disk space on all EC2 instances. Add the alarm as a safety control to the Systems Manager Automation task. By setting up a CloudWatch alarm to monitor the available disk space, you can trigger actions or notifications when the disk space falls below a certain threshold. Adding this alarm as a safety control to the Systems Manager Automation task ensures that the patching process will only proceed if there is sufficient available disk space.

   Source: Adapted from community discussion — trungtd

   References

   • AWS documentation

   Next question

4. Question 124 · 427 in bank

   Select 3

   A DevOps engineer is building an application that uses an AWS Lambda function to query an Amazon Aurora MySQL DB cluster. The Lambda function performs only read queries. Amazon EventBridge events invoke the Lambda function. As more events invoke the Lambda function each second, the database's latency increases and the database's throughput decreases. The DevOps engineer needs to improve the performance of the application. Which combination of steps will meet these requirements? (Choose three.)

   • AUse Amazon RDS Proxy to create a proxy. Connect the proxy to the Aurora cluster reader endpoint. Set a maximum connections percentage on the proxy.
   • BImplement database connection pooling inside the Lambda code. Set a maximum number of connections on the database connection pool.
   • CImplement the database connection opening outside the Lambda event handler code.
   • DImplement the database connection opening and closing inside the Lambda event handler code.
   • EConnect to the proxy endpoint from the Lambda function.
   • FConnect to the Aurora cluster endpoint from the Lambda function.

   Show answer

   Answer: ACE

   Explanation

   Should be ACE Opening database connections OUTSIDE the Lambda handler allows for efficient reuse of connections and implements connection pooling

   Source: Adapted from community discussion — jamesf

   References

   • AWS documentation

   Next question

5. Question 125 · 427 in bank

   A company has an AWS CloudFormation stack that is deployed in a single AWS account. The company has configured the stack to send event notifications to an Amazon Simple Notification Service (Amazon SNS) topic. A DevOps engineer must implement an automated solution that applies a tag to the specific CloudFormation stack instance only after a successful stack update occurs. The DevOps engineer has created an AWS Lambda function that applies and updates this tag for the specific stack instance. Which solution will meet these requirements?

   • ARun the AWS-UpdateCloudFormationStack AWS Systems ManagerAutomation runbook when Systems Manager detects an UPDATE_COMPLETE event for the instance status of the CloudFormation stack. Configure the runbook to invoke the Lambda function.
   • BCreate a custom AWS Config rule that produces a compliance change event if the CloudFormation stack has an UPDATE_COMPLETE instance status. Configure AWS Config to directly invoke the Lambda function to automatically remediate the change event.
   • CCreate an Amazon EventBridge rule that matches the UPDATE_COMPLETE event pattern for the instance status of the CloudFormation stack. Configure the rule to invoke the Lambda function.
   • DAdjust the configuration of the CloudFormation stack to send notifications for only an UPDATE_COMPLETE instance status event to the SNS topic. Subscribe the Lambda function to the SNS topic.

   Show answer

   Answer: C

   Explanation

   EventBridge is designed to detect specific events in AWS services, and it can be configured to match events such as UPDATE_COMPLETE from CloudFormation. This allows you to automate the process of tagging the CloudFormation stack instancess whenever the UPDATE_COMPLETE event occurs. The EventBridge rule will trigger the Lambda function, which will then apply the necessary tag to the stack.

   Source: Adapted from community discussion — GripZA

   References

   • AWS documentation

   Next question

6. Question 126 · 427 in bank

   A company deploys an application to two AWS Regions. The application creates and stores objects in an Amazon S3 bucket that is in the same Region as the application. Both deployments of the application need to have access to all the objects and their metadata from both Regions. The company has configured two-way replication between the S3 buckets and has enabled S3 Replication metrics on each S3 bucket. A DevOps engineer needs to implement a solution that retries the replication process if an object fails to replicate. Which solution will meet these requirements?

   • ACreate an Amazon EventBridge rule that listens to S3 event notifications for failed replication events. Create an AWS Lambda function that downloads the failed replication object and then runs a PutObject command for the object to the destination bucket. Configure the EventBridge rule to invoke the Lambda function to handle the object that failed to replicate.
   • BCreate an Amazon Simple Queue Service (Amazon SQS) queue. Configure S3 event notifications to send failed replication notifications to the SQS queue. Create an AWS Lambda function that downloads the failed replication object and then runs a PutObject command for the object to the destination bucket. Configure the Lambda function to poll the queue for notifications to process.
   • CCreate an Amazon EventBridge rule that listens to S3 event notifications for failed replications. Create an AWS Lambda function that downloads the failed replication object and then runs a PutObject command for the object to the destination bucket.
   • DCreate an AWS Lambda function that will use S3 batch operations to retry the replication on the existing object for a failed replication. Configure S3 event notifications to send failed replication notifications to the Lambda function.

   Show answer

   Answer: D

   Explanation

   S3 Batch Replication provides you a way to replicate objects that existed before a replication configuration was in place, objects that have previously been replicated, and objects that have failed replication. https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-batch-replication-batch.html

   Source: Adapted from community discussion — r4nd0m1z3r

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 127 · 427 in bank

   A company needs to implement failover for its application. The application includes an Amazon CloudFront distribution and a public Application Load Balancer (ALB) in an AWS Region. The company has configured the ALB as the default origin for the distribution. After some recent application outages, the company wants a zero-second RTO. The company deploys the application to a secondary Region in a warm standby configuration. A DevOps engineer needs to automate the failover of the application to the secondary Region so that HTTP GET requests meet the desired RTO. Which solution will meet these requirements?

   • ACreate a second CloudFront distribution that has the secondary ALB as the default origin. Create Amazon Route 53 alias records that have a failover policy and Evaluate Target Health set to Yes for both CloudFront distributions. Update the application to use the new record set.
   • BCreate a new origin on the distribution for the secondary ALCreate a new origin group. Set the original ALB as the primary origin. Configure the origin group to fail over for HTTP 5xx status codes. Update the default behavior to use the origin group.
   • CCreate Amazon Route 53 alias records that have a failover policy and Evaluate Target Health set to Yes for both ALBs. Set the TTL of both records to 0. Update the distribution's origin to use the new record set.
   • DCreate a CloudFront function that detects HTTP 5xx status codes. Configure the function to return a 307 Temporary Redirect error response to the secondary ALB if the function detects 5xx status codes. Update the distribution's default behavior to send origin responses to the function.

   Show answer

   Answer: B

   Explanation

   B, mazon CloudFront offers origin failover, where if a given request to the primary endpoint fails, CloudFront routes the request to the secondary endpoint. Unlike the failover operations described previously, all subsequent requests still go to the primary endpoint, and failover is done per each request. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/high_availability_origin_failover.html#concept_origin_groups.creating

   Source: Adapted from community discussion — WhyIronMan

   References

   • AWS documentation

   Next question

8. Question 128 · 427 in bank

   A cloud team uses AWS Organizations and AWS IAM Identity Center (AWS Single Sign-On) to manage a company's AWS accounts. The company recently established a research team. The research team requires the ability to fully manage the resources in its account. The research team must not be able to create IAM users. The cloud team creates a Research Administrator permission set in IAM Identity Center for the research team. The permission set has the AdministratorAccess AWS managed policy attached. The cloud team must ensure that no one on the research team can create IAM users. Which solution will meet these requirements?

   • ACreate an IAM policy that denies the iam:CreateUser action. Attach the IAM policy to the Research Administrator permission set.
   • BCreate an IAM policy that allows all actions except the iam:CreateUser action. Use the IAM policy to set the permissions boundary for the Research Administrator permission set.
   • CCreate an SCP that denies the iam:CreateUser action. Attach the SCP to the research team's AWS account.
   • DCreate an AWS Lambda function that deletes IAM users. Create an Amazon EventBridge rule that detects the IAM CreateUser event. Configure the rule to invoke the Lambda function.

   Show answer

   Answer: C

   Explanation

   C is the answer. IAM policy is not as scalable or centralized as using an SCP. You can attach an SCP to the organization root, to an organizational unit (OU), or directly to an account https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_attach.html

   Source: Adapted from community discussion — tristan_07

   References

   • AWS documentation

   Next question

9. Question 129 · 427 in bank

   A company releases a new application in a new AWS account. The application includes an AWS Lambda function that processes messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The Lambda function stores the results in an Amazon S3 bucket for further downstream processing. The Lambda function needs to process the messages within a specific period of time after the messages are published. The Lambda function has a batch size of 10 messages and takes a few seconds to process a batch of messages. As load increases on the application's first day of service, messages in the queue accumulate at a greater rate than the Lambda function can process the messages. Some messages miss the required processing timelines. The logs show that many messages in the queue have data that is not valid. The company needs to meet the timeline requirements for messages that have valid data. Which solution will meet these requirements?

   • AIncrease the Lambda function's batch size. Change the SQS standard queue to an SQS FIFO queue. Request a Lambda concurrency increase in the AWS Region.
   • BReduce the Lambda function's batch size. Increase the SQS message throughput quota. Request a Lambda concurrency increase in the AWS Region.
   • CIncrease the Lambda function's batch size. Configure S3 Transfer Acceleration on the S3 bucket. Configure an SQS dead-letter queue.
   • DKeep the Lambda function's batch size the same. Configure the Lambda function to report failed batch items. Configure an SQS dead-letter queue.

   Show answer

   Answer: D

   Explanation

   Configure a dead-letter queue to avoid creating a snowball anti-pattern in your serverless application’s architecture. For more information, see the Avoiding snowball anti-patterns section of this guide. Configure your Lambda function event source mapping to make only the failed messages visible. To do this, you must include the value ReportBatchItemFailures in the FunctionResponseTypes list when configuring your event source mapping. https://docs.aws.amazon.com/prescriptive-guidance/latest/lambda-event-filtering-partial-batch-responses-for-sqs/best-practices-partial-batch-responses.html

   Source: Adapted from community discussion — c3518fc

   References

   • AWS documentation

   Next question

10. Question 130 · 427 in bank

    Select 3

    A company has an application that runs on AWS Lambda and sends logs to Amazon CloudWatch Logs. An Amazon Kinesis data stream is subscribed to the log groups in CloudWatch Logs. A single consumer Lambda function processes the logs from the data stream and stores the logs in an Amazon S3 bucket. The company’s DevOps team has noticed high latency during the processing and ingestion of some logs. Which combination of steps will reduce the latency? (Choose three.)

    • ACreate a data stream consumer with enhanced fan-out. Set the Lambda function that processes the logs as the consumer.
    • BIncrease the ParallelizationFactor setting in the Lambda event source mapping.
    • CConfigure reserved concurrency for the Lambda function that processes the logs.
    • DIncrease the batch size in the Kinesis data stream.
    • ETurn off the ReportBatchItemFailures setting in the Lambda event source mapping.
    • FIncrease the number of shards in the Kinesis data stream.

    Show answer

    Answer: ABF

    Explanation

    A: Kinesis Enhanced fan-out is an Amazon Kinesis Data Streams feature that enables consumers to receive records from a data stream with dedicated throughput of up to 2 MB of data per second per shard. A consumer that uses enhanced fan-out doesn't have to contend with other consumers that are receiving data from the stream. B: Reserved concurrency – This represents the maximum number of concurrent instances allocated to your function. When a function has reserved concurrency, no other function can use that concurrency. Reserved concurrency is useful for ensuring that your most critical functions always have enough concurrency to handle incoming requests. F: The data capacity of your stream is a function of the number of shards that you specify for the stream. The total capacity of the stream is the sum of the capacities of its shards.

    Source: Adapted from community discussion — GripZA

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 121. 427 questions available.