DOP-C02 practice questions 131–140

1. Question 131 · 427 in bank

   A company operates sensitive workloads across the AWS accounts that are in the company's organization in AWS Organizations. The company uses an IP address range to delegate IP addresses for Amazon VPC CIDR blocks and all non-cloud hardware. The company needs a solution that prevents principals that are outside the company’s IP address range from performing AWS actions in the organization's accounts. Which solution will meet these requirements?

   • AConfigure AWS Firewall Manager for the organization. Create an AWS Network Firewall policy that allows only source traffic from the company's IP address range. Set the policy scope to all accounts in the organization.
   • BIn Organizations, create an SCP that denies source IP addresses that are outside of the company’s IP address range. Attach the SCP to the organization's root.
   • CConfigure Amazon GuardDuty for the organization. Create a GuardDuty trusted IP address list for the company's IP range. Activate the trusted IP list for the organization.
   • DIn Organizations, create an SCP that allows source IP addresses that are inside of the company’s IP address range. Attach the SCP to the organization's root.

   Show answer

   Answer: B

   Explanation

   answer b uses an SCP within AWS Organizations to deny source IP addresses that are outside of the company’s IP address range, providing a centralized and organization-wide control over AWS actions based on source IP addresses for all accounts and resources within the organization.

   Source: Adapted from community discussion — dkp

   References

   • AWS documentation

   Next question

2. Question 132 · 427 in bank

   Select 3

   A company deploys an application in two AWS Regions. The application currently uses an Amazon S3 bucket in the primary Region to store data. A DevOps engineer needs to ensure that the application is highly available in both Regions. The DevOps engineer has created a new S3 bucket in the secondary Region. All existing and new objects must be in both S3 buckets. The application must fail over between the Regions with no data loss. Which combination of steps will meet these requirements with the MOST operational efficiency? (Choose three.)

   • ACreate a new IAM role that allows the Amazon S3 and S3 Batch Operations service principals to assume the role that has the necessary permissions for S3 replication.
   • BCreate a new IAM role that allows the AWS Batch service principal to assume the role that has the necessary permissions for S3 replication.
   • CCreate an S3 Cross-Region Replication (CRR) rule on the source S3 bucket. Configure the rule to use the IAM role for Amazon S3 to replicate to the target S3 bucket.
   • DCreate a two-way replication rule on the source S3 bucket. Configure the rule to use the IAM role for Amazon S3 to replicate to the target S3 bucket.
   • ECreate an AWS Batch job that has an AWS Fargate orchestration type. Configure the job to use the IAM role for AWS Batch. Specify a Bash command to use the AWS CLI to synchronize the contents of the source S3 bucket and the target S3 bucket
   • FCreate an operation in S3 Batch Operations to replicate the contents of the source S3 bucket to the target S3 bucket. Configure the operation to use the IAM role for Amazon S3.

   Show answer

   Answer: ADF

   Explanation

   "The application must fail over between the Regions with no data loss." C is not enough, because if we failover to region B and then to A application couldn't access data that was created in region B in the meantime

   Source: Adapted from community discussion — xdkonorek2

   References

   • AWS documentation

   Next question

3. Question 133 · 427 in bank

   An IT team has built an AWS CloudFormation template so others in the company can quickly and reliably deploy and terminate an application. The template creates an Amazon EC2 instance with a user data script to install the application and an Amazon S3 bucket that the application uses to serve static webpages while it is running. All resources should be removed when the CloudFormation stack is deleted. However, the team observes that CloudFormation reports an error during stack deletion, and the S3 bucket created by the stack is not deleted. How can the team resolve the error in the MOST efficient manner to ensure that all resources are deleted without errors?

   • AAdd a DelelionPolicy attribute to the S3 bucket resource, with the value Delete forcing the bucket to be removed when the stack is deleted.
   • BAdd a custom resource with an AWS Lambda function with the DependsOn attribute specifying the S3 bucket, and an IAM role. Write the Lambda function to delete all objects from the bucket when RequestType is Delete.
   • CIdentify the resource that was not deleted. Manually empty the S3 bucket and then delete it.
   • DReplace the EC2 and S3 bucket resources with a single AWS OpsWorks Stacks resource. Define a custom recipe for the stack to create and delete the EC2 instance and the S3 bucket.

   Show answer

   Answer: B

   Explanation

   B. As per the AWS DeletionPolicy Options documentation it says, "For Amazon S3 buckets, you must delete all objects in the bucket for deletion to succeed." https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html

   Source: Adapted from community discussion — n_d1

   References

   • AWS documentation

   Next question

4. Question 134 · 427 in bank

   Select 2

   A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company needs an automated process across all AWS accounts to isolate any compromised Amazon EC2 instances when the instances receive a specific tag. Which combination of steps will meet these requirements? (Choose two.)

   • AUse AWS CloudFormation StackSets to deploy the CloudFormation stacks in all AWS accounts.
   • BCreate an SCP that has a Deny statement for the ec2:* action with a condition of "aws:RequestTag/isolation": false.
   • CAttach the SCP to the root of the organization.
   • DCreate an AWS CloudFormation template that creates an EC2 instance role that has no IAM policies attached. Configure the template to have a security group that has an explicit Deny rule on all traffic. Use the CloudFormation template to create an AWS Lambda function that attaches the IAM role to instances. Configure the Lambda function to add a network ACL. Set up an Amazon EventBridge rule to invoke the Lambda function when a specific tag is applied to a compromised EC2 instance.
   • ECreate an AWS CloudFormation template that creates an EC2 instance role that has no IAM policies attached. Configure the template to have a security group that has no inbound rules or outbound rules. Use the CloudFormation template to create an AWS Lambda function that attaches the IAM role to instances. Configure the Lambda function to replace any existing security groups with the new security group. Set up an Amazon EventBridge rule to invoke the Lambda function when a specific tag is applied to a compromised EC2 instance.

   Show answer

   Answer: AE

   Explanation

   This CloudFormation template creates the necessary resources: An EC2 instance role with no IAM policies, ensuring the instance cannot perform any actions. A security group with no inbound or outbound rules, effectively isolating the instance from all network traffic. A Lambda function that will be triggered by an EventBridge rule when a specific tag is applied to an EC2 instance. This function will attach the isolated security group to the compromised instance, ensuring it is isolated from any network communication. Combining these steps will provide an automated and consistent approach to isolate compromised EC2 instances across all AWS accounts in the organization.

   Source: Adapted from community discussion — trungtd

   Next question

5. Question 135 · 427 in bank

   A company manages multiple AWS accounts by using AWS Organizations with OUs for the different business divisions. The company is updating their corporate network to use new IP address ranges. The company has 10 Amazon S3 buckets in different AWS accounts. The S3 buckets store reports for the different divisions. The S3 bucket configurations allow only private corporate network IP addresses to access the S3 buckets. A DevOps engineer needs to change the range of IP addresses that have permission to access the contents of the S3 buckets. The DevOps engineer also needs to revoke the permissions of two OUs in the company. Which solution will meet these requirements?

   • ACreate a new SCP that has two statements, one that allows access to the new range of IP addresses for all the S3 buckets and one that denies access to the old range of IP addresses for all the S3 buckets. Set a permissions boundary for the OrganizationAccountAccessRole role in the two OUs to deny access to the S3 buckets.
   • BCreate a new SCP that has a statement that allows only the new range of IP addresses to access the S3 buckets. Create another SCP that denies access to the S3 buckets. Attach the second SCP to the two OUs.
   • COn all the S3 buckets, configure resource-based policies that allow only the new range of IP addresses to access the S3 buckets. Create a new SCP that denies access to the S3 buckets. Attach the SCP to the two OUs.
   • DOn all the S3 buckets, configure resource-based policies that allow only the new range of IP addresses to access the S3 buckets. Set a permissions boundary for the OrganizationAccountAccessRole role in the two OUs to deny access to the S3 buckets.

   Show answer

   Answer: C

   References

   • repost.aws documentation

   Next question

6. Question 136 · 427 in bank

   A company has started using AWS across several teams. Each team has multiple accounts and unique security profiles. The company manages the accounts in an organization in AWS Organizations. Each account has its own configuration and security controls. The company's DevOps team wants to use preventive and detective controls to govern all accounts. The DevOps team needs to ensure the security of accounts now and in the future as the company creates new accounts in the organization. Which solution will meet these requirements?

   • AUse Organizations to create OUs that have appropriate SCPs attached for each team. Place team accounts in the appropriate OUs to apply security controls. Create any new team accounts in the appropriate OUs.
   • BCreate an AWS Control Tower landing zone. Configure OUs and appropriate controls in AWS Control Tower for the existing teams. Configure trusted access for AWS Control Tower. Enroll the existing accounts in the appropriate OUs that match the appropriate security policies for each team. Use AWS Control Tower to provision any new accounts.
   • CCreate AWS CloudFormation stack sets in the organization's management account. Configure a stack set that deploys AWS Config with configuration rules and remediation actions for all controls to each account in the organization. Update the stack sets to deploy to new accounts as the accounts are created.
   • DConfigure AWS Config to manage the AWS Config rules across all AWS accounts in the organization. Deploy conformance packs that provide AWS Config rules and remediation actions across the organization.

   Show answer

   Answer: B

   Explanation

   A control is a high-level rule that provides ongoing governance for your overall AWS environment. It's expressed in plain language. AWS Control Tower implements preventive, detective, and proactive controls that help you govern your resources and monitor compliance across groups of AWS accounts. https://docs.aws.amazon.com/controltower/latest/controlreference/controls.html

   Source: Adapted from community discussion — c3518fc

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 137 · 427 in bank

   A company uses an AWS CodeCommit repository to store its source code and corresponding unit tests. The company has configured an AWS CodePipeline pipeline that includes an AWS CodeBuild project that runs when code is merged to the main branch of the repository. The company wants the CodeBuild project to run the unit tests. If the unit tests pass, the CodeBuild project must tag the most recent commit. How should the company configure the CodeBuild project to meet these requirements?

   • AConfigure the CodeBuild project to use native Git to done the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use native Git to create a tag and to push the Git tag to the repository if the code passes the unit tests.
   • BConfigure the CodeBuild projed to use native Git to done the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use AWS CLI commands to create a new repository tag in the repository if the code passes the unit tests.
   • CConfigure the CodeBuild project to use AWS CLI commands to copy the code from the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use AWS CLI commands to create a new Git tag in the repository if the code passes the unit tests.
   • DConfigure the CodeBuild project to use AWS CLI commands to copy the code from the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use AWS CLI commands to create a new repository tag in the repository if the code passes the unit tests.

   Show answer

   Answer: A

   Explanation

   Using Native Git: By configuring CodeBuild to use native Git, you ensure the repository is cloned in a way that supports all Git operations, including tagging and pushing changes. Running Unit Tests: CodeBuild can be set up to run the unit tests using the build specification file (buildspec.yml), ensuring that the tests are executed before any further actions are taken. Creating and Pushing Tags: post_build: commands: - echo Unit tests passed, tagging commit... - git tag -a v1.0.0 -m "Tagging commit after successful unit tests" - git push origin v1.0.0

   Source: Adapted from community discussion — trungtd

   References

   • AWS documentation

   Next question

8. Question 138 · 427 in bank

   A DevOps engineer manages a company's Amazon Elastic Container Service (Amazon ECS) cluster. The cluster runs on several Amazon EC2 instances that are in an Auto Scaling group. The DevOps engineer must implement a solution that logs and reviews all stopped tasks for errors. Which solution will meet these requirements?

   • ACreate an Amazon EventBridge rule to capture task state changes. Send the event to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to investigate stopped tasks.
   • BConfigure tasks to write log data in the embedded metric format. Store the logs in Amazon CloudWatch Logs. Monitor the ContainerInstanceCount metric for changes.
   • CConfigure the EC2 instances to store logs in Amazon CloudWatch Logs. Create a CloudWatch Contributor Insights rule that uses the EC2 instance log data. Use the Contributor Insights rule to investigate stopped tasks.
   • DConfigure an EC2 Auto Scaling lifecycle hook for the EC2_INSTANCE_TERMINATING scale-in event. Write the SystemEventLog file to Amazon S3. Use Amazon Athena to query the log file for errors.

   Show answer

   Answer: A

   Explanation

   By using Amazon EventBridge to capture ECS task state changes and sending these events to CloudWatch Logs, combined with the analytical capabilities of CloudWatch Logs Insights, option A provides a comprehensive and straightforward solution for logging and investigating stopped tasks for errors.

   Source: Adapted from community discussion — 6ef9a08

   Next question

9. Question 139 · 427 in bank

   Select 2

   A company wants to deploy a workload on several hundred Amazon EC2 instances. The company will provision the EC2 instances in an Auto Scaling group by using a launch template. The workload will pull files from an Amazon S3 bucket, process the data, and put the results into a different S3 bucket. The EC2 instances must have least-privilege permissions and must use temporary security credentials. Which combination of steps will meet these requirements? (Choose two.)

   • ACreate an IAM role that has the appropriate permissions for S3 buckets Add the IAM role to an instance profile.
   • BUpdate the launch template to include the IAM instance profile.
   • CCreate an IAM user that has the appropriate permissions for Amazon S3 Generate a secret key and token.
   • DCreate a trust anchor and profile Attach the IAM role to the profile.
   • EUpdate the launch template Modify the user data to use the new secret key and token.

   Show answer

   Answer: AB

   Explanation

   A. This step ensures that the EC2 instances have the necessary permissions to access the S3 buckets. The IAM role should have policies attached that allow it to pull files from one S3 bucket and put results into another S3 bucket. By using an instance profile, the role can be associated with the EC2 instances. B. This step ensures that the EC2 instances launched by the Auto Scaling group will automatically use the instance profile (and thus the IAM role) with the appropriate permissions. C. This approach uses long-term credentials D. The term "trust anchor" is more relevant to AWS IAM Identity Center (formerly AWS Single Sign-On) or AWS Organizations. It is not directly applicable to setting up permissions for EC2 instances via Auto Scaling. E. Storing and using secret keys and tokens in user data scripts is insecure and not recommended.

   Source: Adapted from community discussion — trungtd

   Next question

10. Question 140 · 427 in bank

    A company is using AWS CodeDeploy to automate software deployment. The deployment must meet these requirements: • A number of instances must be available to serve traffic during the deployment. Traffic must be balanced across those instances, and the instances must automatically heal in the event of failure. • A new fleet of instances must be launched for deploying a new revision automatically, with no manual provisioning. • Traffic must be rerouted to the new environment to half of the new instances at a time. The deployment should succeed if traffic is rerouted to at least half of the instances: otherwise, it should fail. • Before routing traffic to the new fleet of instances, the temporary files generated during the deployment process must be deleted. • At the end of a successful deployment, the original instances in the deployment group must be deleted immediately to reduce costs. How can a DevOps engineer meet these requirements?

    • AUse an Application Load Balancer and an in-place deployment. Associate the Auto Scaling group with the deployment group. Use the Automatically copy Auto Scaling group option, and use CodeDeployDefault.OneAtAtime as the deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the AllowTraffic hook within appspec.yml to delete the temporary files.
    • BUse an Application Load Balancer and a blue/green deployment. Associate the Auto Scaling group and Application Load Balancer target group with the deployment group. Use the Automatically copy Auto Scaling group option, create a custom deployment configuration with minimum healthy hosts defined as 50%, and assign the configuration to the deployment group. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the BeforeBlockTraffic hook within appspec.yml to delete the temporary files.
    • CUse an Application Load Balancer and a blue/green deployment. Associate the Auto Scaling group and the Application Load Balancer target group with the deployment group. Use the Automatically copy Auto Scaling group option, and use CodeDeployDefault.HalfAtAtime as the deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the BeforeAllowTraffic hook within appspec.yml to delete the temporary files.
    • DUse an Application Load Balancer and an in-place deployment. Associate the Auto Scaling group and Application Load Balancer target group with the deployment group. Use the Automatically copy Auto Scaling group option, and use CodeDeployDefault.AllatOnce as a deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the BlockTraffic hook within appspec.yml to delete the temporary files.

    Show answer

    Answer: C

    Explanation

    Option C is the best choice as it meets all the given requirements by utilizing a blue/green deployment strategy, correct traffic routing, proper temporary file cleanup timing, and automatic instance termination to manage costs. Option B is wrong due to: - Allows for custom deployment configuration, ensuring at least 50% of the instances must be healthy. However, "reroute to half" is somewhat ambiguous, as custom deployment with 50% only ensures half remain healthy but doesn't explicitly guarantee half reroute. - Uses BeforeBlockTraffic hook, which is not the correct timing for cleaning up temporary files because it should occur after instance provisioning but before allowing traffic.

    Source: Adapted from community discussion — jamesf

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 131. 427 questions available.