DOP-C02 practice questions 141–150

1. Question 141 · 427 in bank

   A company needs to adopt a multi-account strategy to deploy its applications and the associated CI/CD infrastructure. The company has created an organization in AWS Organizations that has all features enabled. The company has configured AWS Control Tower and has set up a landing zone. The company needs to use AWS Control Tower controls (guardrails) in all AWS accounts in the organization. The company must create the accounts for a multi-environment application and must ensure that all accounts are configured to an initial baseline. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate an AWS Control Tower Account Factory Customization (AFC) blueprint that uses the baseline configuration. Use AWS Control Tower Account Factory to provision a dedicated AWS account for each environment and a CI/CD account by using the blueprint.
   • BUse AWS Control Tower Account Factory to provision a dedicated AWS account for each environment and a CI/CD account. Use AWS CloudFormation StackSets to apply the baseline configuration to the new accounts.
   • CUse Organizations to provision a multi-environment AWS account and a CI/CD account. In the Organizations management account, create an AWS Lambda function that assumes the Organizations access role to apply the baseline configuration to the new accounts.
   • DUse Organizations to provision a dedicated AWS account for each environment, an audit account, and a CI/CD account. Use AWS CloudFormation StackSets to apply the baseline configuration to the new accounts.

   Show answer

   Answer: A

   Explanation

   keywords: AWS Control Tower Account Factory Customization (AFC) Option A is the best choice as it meets all the requirements with the least operational overhead by leveraging AWS Control Tower’s Account Factory and Customization features. This option provides an automated, compliant, and consistent approach to account provisioning and baseline configuration.

   Source: Adapted from community discussion — jamesf

   Next question

2. Question 142 · 427 in bank

   A DevOps team has created a Custom Lambda rule in AWS Config. The rule monitors Amazon Elastic Container Repository (Amazon ECR) policy statements for ecr:* actions. When a noncompliant repository is detected, Amazon EventBridge uses Amazon Simple Notification Service (Amazon SNS) to route the notification to a security team. When the custom AWS Config rule is evaluated, the AWS Lambda function fails to run. Which solution will resolve the issue?

   • AModify the Lambda function's resource policy to grant AWS Config permission to invoke the function.
   • BModify the SNS topic policy to include configuration changes for EventBridge to publish to the SNS topic.
   • CModify the Lambda function's execution role to include configuration changes for custom AWS Config rules.
   • DModify all the ECR repository policies to grant AWS Config access to the necessary ECR API actions.

   Show answer

   Answer: A

   Explanation

   When you create a custom AWS Config rule that uses a Lambda function, AWS Config needs permission to invoke it. This is done by adding a resource-based policy to the Lambda function that explicitly permits AWS Config to invoke it. Without this permission, AWS Config cannot trigger the Lambda function, leading to the function failing to run.

   Source: Adapted from community discussion — ThiagoCruzRJ

   Next question

3. Question 143 · 427 in bank

   A developer is creating a proof of concept for a new software as a service (SaaS) application. The application is in a shared development AWS account that is part of an organization in AWS Organizations. The developer needs to create service-linked IAM roles for the AWS services that are being considered for the proof of concept. The solution needs to give the developer the ability to create and configure the service-linked roles only. Which solution will meet these requirements?

   • ACreate an IAM user for the developer in the organization's management account. Configure a cross-account role in the development account for the developer to use. Limit the scope of the cross-account role to common services.
   • BAdd the developer to an IAM group. Attach the PowerUserAccess managed policy to the IAM group. Enforce multi-factor authentication (MFA) on the user account.
   • CAdd an SCP to the development account in Organizations. Configure the SCP with a Deny rule for iam:* to limit the developer's access.
   • DCreate an IAM role that has the necessary IAM access to allow the developer to create policies and roles. Create and attach a permissions boundary to the role. Grant the developer access to assume the role.

   Show answer

   Answer: D

   Explanation

   A. This approach involves creating a user in the management account and setting up cross-account roles, which adds unnecessary complexity and potential security risks. B. PowerUserAccess managed policy provides broad permissions that go beyond just creating and configuring service-linked roles. This approach does not meet the requirement to restrict the developer's capabilities specifically to service-linked role management. C. SCPs are used to set permission guardrails at the organizational or account level, but they do not grant permissions. They are used to restrict actions, and configuring an SCP with a deny rule for iam:* would likely prevent the developer from performing necessary actions D effectively meets the requirements

   Source: Adapted from community discussion — trungtd

   Next question

4. Question 144 · 427 in bank

   Select 2

   A company has an AWS CodePipeline pipeline that is configured with an Amazon S3 bucket in the eu-west-1 Region. The pipeline deploys an AWS Lambda application to the same Region. The pipeline consists of an AWS CodeBuild project build action and an AWS CloudFormation deploy action. The CodeBuild project uses the aws cloudformation package AWS CLI command to build an artifact that contains the Lambda function code’s .zip file and the CloudFormation template. The CloudFormation deploy action references the CloudFormation template from the output artifact of the CodeBuild project’s build action. The company wants to also deploy the Lambda application to the us-east-1 Region by using the pipeline in eu-west-1. A DevOps engineer has already updated the CodeBuild project to use the aws cloudformation package command to produce an additional output artifact for us-east-1. Which combination of additional steps should the DevOps engineer take to meet these requirements? (Choose two.)

   • AModify the CloudFormation template to include a parameter for the Lambda function code’s zip file location. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to pass in the us-east-1 artifact location as a parameter override.
   • BCreate a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the us-east-1 output artifact.
   • CCreate an S3 bucket in us-east-1. Configure the S3 bucket policy to allow CodePipeline to have read and write access.
   • DCreate an S3 bucket in us-east-1. Configure S3 Cross-Region Replication (CRR) from the S3 bucket in eu-west-1 to the S3 bucket in us-east-1.
   • EModify the pipeline to include the S3 bucket for us-east-1 as an artifact store. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the us-east-1 output artifact.

   Show answer

   Answer: CE

   Explanation

   As below. You need S# bucket in the new region so C. You need to output artifacts to this new bucket so E. https://docs.aws.amazon.com/codepipeline/latest/userguide/actions-create-cross-region.html

   Source: Adapted from community discussion — madperro

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 145 · 427 in bank

   Select 3

   A company uses AWS Organizations to manage its AWS accounts. The company wants its monitoring system to receive an alert when a root user logs in. The company also needs a dashboard to display any log activity that the root user generates. Which combination of steps will meet these requirements? (Choose three.)

   • AEnable AWS Config with a multi-account aggregator. Configure log forwarding to Amazon CloudWatch Logs.
   • BCreate an Amazon QuickSight dashboard that uses an Amazon CloudWatch Logs query.
   • CCreate an Amazon CloudWatch Logs metric filter to match root user login events. Configure a CloudWatch alarm and an Amazon Simple Notification Service (Amazon SNS) topic to send alerts to the company's monitoring system.
   • DCreate an Amazon CloudWatch Logs subscription filter to match root user login events. Configure the filter to forward events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure the SNS topic to send alerts to the company's monitoring system.
   • ECreate an AWS CloudTrail organization trail. Configure the organization trail to send events to Amazon CloudWatch Logs.
   • FCreate an Amazon CloudWatch dashboard that uses a CloudWatch Logs Insights query.

   Show answer

   Answer: CEF

   Explanation

   E- AWS CloudTrail will log all activities, including root user logins, across all accounts in the organisation. Sending these logs to CloudWatch Logs enables further processing and analysis. C- Creating a metric filter to detect root user login events will allow you to trigger a CloudWatch alarm. The alarm can then send notifications via SNS to the company's monitoring system, ensuring real-time alerts for root user logins. F- Using CloudWatch Logs Insights, you can create queries to extract and visualise log data related to root user activity. This data can be displayed on a CloudWatch dashboard, providing a centralised view of root user actions.

   Source: Adapted from community discussion — TEC1

   Next question

6. Question 146 · 427 in bank

   Select 2

   A company uses AWS Organizations to manage its AWS accounts. A DevOps engineer must ensure that all users who access the AWS Management Console are authenticated through the company’s corporate identity provider (IdP). Which combination of steps will meet these requirements? (Choose two.)

   • AUse Amazon GuardDuty with a delegated administrator account Use GuardDuty to enforce denial of IAM user logins.
   • BUse AWS IAM Identity Center to configure identity federation with SAML 2.0.
   • CCreate a permissions boundary in AWS IAM Identity Center to deny password logins for IAM users.
   • DCreate IAM groups in the Organizations management account to apply consistent permissions for all IAM users.
   • ECreate an SCP in Organizations to deny password creation for IAM users.

   Show answer

   Answer: BE

   Explanation

   Option B: Configure identity federation with SAML 2.0 using AWS IAM Identity Center. Option E: Implement an SCP to deny password creation for IAM users, enforcing IdP authentication. Incorrect for C - Permissions Boundaries - Permissions boundaries in AWS IAM Identity Center define the maximum permissions an IAM entity can have but are not used to control login methods or deny password logins. - Permissions boundaries do not restrict authentication methods or enforce federation. - Permissions boundaries are not applicable for denying IAM user logins.

   Source: Adapted from community discussion — jamesf

   Next question

7. Question 147 · 427 in bank

   Select 2

   A company has deployed a new platform that runs on Amazon Elastic Kubernetes Service (Amazon EKS). The new platform hosts web applications that users frequently update. The application developers build the Docker images for the applications and deploy the Docker images manually to the platform. The platform usage has increased to more than 500 users every day. Frequent updates, building the updated Docker images for the applications, and deploying the Docker images on the platform manually have all become difficult to manage. The company needs to receive an Amazon Simple Notification Service (Amazon SNS) notification if Docker image scanning returns any HIGH or CRITICAL findings for operating system or programming language package vulnerabilities. Which combination of steps will meet these requirements? (Choose two.)

   • ACreate an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon S3 event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project.
   • BCreate an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon EventBridge event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project.
   • CCreate an AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Turn on basic scanning for the ECR repository. Create an Amazon EventBridge rule that monitors Amazon GuardDuty events. Configure the EventBridge rule to send an event to an SNS topic when the finding-severity-counts parameter is more than 0 at a CRITICAL or HIGH level.
   • DCreate an AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Turn on enhanced scanning for the ECR repository. Create an Amazon EventBridge rule that monitors ECR image scan events. Configure the EventBridge rule to send an event to an SNS topic when the finding-severity-counts parameter is more than 0 at a CRITICAL or HIGH level.
   • ECreate an AWS CodeBuild project that scans the Dockerfile. Configure the project to build the Docker images and store the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository if the scan is successful. Configure an SNS topic to provide notification if the scan returns any vulnerabilities.

   Show answer

   Answer: BD

   Explanation

   B sets up a CI/CD pipeline with AWS CodePipeline triggered by changes in the AWS CodeCommit repository. Using Amazon EventBridge ensures that the pipeline is invoked whenever there is a new commit, automating the build and deployment process. D ensures that Docker images are built and pushed to ECR, where enhanced scanning is enabled. Enhanced scanning provides detailed vulnerability information. An EventBridge rule is configured to monitor scan events and trigger notifications via SNS when HIGH or CRITICAL vulnerabilities are found.

   Source: Adapted from community discussion — trungtd

   Next question

8. Question 148 · 427 in bank

   Select 2

   A company groups its AWS accounts in OUs in an organization in AWS Organizations. The company has deployed a set of Amazon API Gateway APIs in one of the Organizations accounts. The APIs are bound to the account's VPC and have no existing authentication mechanism. Only principals in a specific OU can have permissions to invoke the APIs. The company applies the following policy to the API Gateway interface VPC endpoint:

   

   The company also updates the API Gateway resource policies to deny invocations that do not come through the interface VPC endpoint. After the updates, the following error message appears during attempts to use the interface VPC endpoint URL to invoke an API: "User: anonymous is not authorized." Which combination of steps will solve this problem? (Choose two.)

   • AEnable IAM authentication on all API methods by setting AWS JAM as the authorization method.
   • BCreate a token-based AWS Lambda authorizer that passes the caller's identity in a bearer token.
   • CCreate a request parameter-based AWS Lambda authorizer that passes the caller's identity in a combination of headers, query string parameters, stage variables, and $cortext variables.
   • DUse Amazon Cognito user pools as the authorizer to control access to the API.
   • EVerify the identity of the requester by using Signature Version 4 to sign client requests by using AWS credentials.

   Show answer

   Answer: AE

   Explanation

   Hope is Typo for the Option A, AWS JAM = AWS IAM Option A. Enable IAM authentication on all API methods by setting AWS IAM as the authorization method. - This ensures that all requests to the API must be authenticated using IAM credentials, directly addressing the anonymous access issue. Option E. Verify the identity of the requester by using Signature Version 4 to sign client requests by using AWS credentials. - By using AWS Signature Version 4, requests are authenticated, ensuring they are authorized according to IAM policies linked to the specific Organizational Unit.

   Source: Adapted from community discussion — jamesf

   Next question

9. Question 149 · 427 in bank

   A company wants to decrease the time it takes to develop new features. The company uses AWS CodeBuild and AWS CodeDeploy to build and deploy its applications. The company uses AWS CodePipeline to deploy each microservice with its own CI/CD pipeline. The company needs more visibility into the average time between the release of new features and the average time to recover after a failed deployment. Which solution will provide this visibility with the LEAST configuration effort?

   • AProgram an AWS Lambda function that creates Amazon CloudWatch custom metrics with information about successful runs and failed runs for each pipeline. Create an Amazon EventBridge rule to invoke the Lambda function every 5 minutes. Use the metrics to build a CloudWatch dashboard.
   • BProgram an AWS Lambda function that creates Amazon CloudWatch custom metrics with information about successful runs and failed runs for each pipeline. Create an Amazon EventBridge rule to invoke the Lambda function after every successful run and after every failed run. Use the metrics to build a CloudWatch dashboard.
   • CProgram an AWS Lambda function that writes information about successful runs and failed runs to Amazon DynamoDB. Create an Amazon EventBridge rule to invoke the Lambda function after every successful run and after every failed run. Build an Amazon QuickSight dashboard to show the information from DynamoDB.
   • DProgram an AWS Lambda function that writes information about successful runs and failed runs to Amazon DynamoDB. Create an Amazon EventBridge rule to invoke the Lambda function every 5 minutes. Build an Amazon QuickSight dashboard to show the information from DynamoDB.

   Show answer

   Answer: B

   Explanation

   A. Invoking the Lambda function every 5 minutes is less efficient compared to event-driven invocation B. provides the needed visibility with minimal configuration effort C & D. Using DynamoDB and QuickSight involves more configuration

   Source: Adapted from community discussion — trungtd

   Next question

10. Question 150 · 427 in bank

    A company has developed a static website hosted on an Amazon S3 bucket. The website is deployed using AWS CloudFormation. The CloudFormation template defines an S3 bucket and a custom resource that copies content into the bucket from a source location. The company has decided that it needs to move the website to a new location, so the existing CloudFormation stack must be deleted and re-created. However, CloudFormation reports that the stack could not be deleted cleanly. What is the MOST likely cause and how can the DevOps engineer mitigate this problem for this and future versions of the website?

    • ADeletion has failed because the S3 bucket has an active website configuration. Modify the CloudFormation template to remove the WebsiteConfiguration property from the S3 bucket resource.
    • BDeletion has failed because the S3 bucket is not empty. Modify the custom resource's AWS Lambda function code to recursively empty the bucket when RequestType is Delete.
    • CDeletion has failed because the custom resource does not define a deletion policy. Add a DeletionPolicy property to the custom resource definition with a value of RemoveOnDeletion.
    • DDeletion has failed because the S3 bucket is not empty. Modify the S3 bucket resource in the CloudFormation template to add a DeletionPolicy property with a value of Empty.

    Show answer

    Answer: B

    Explanation

    By default cloudformation can't delete an S3 bucket that's not empty. If the bucket still contains objects when the stack deletion is attempted, the stack deletion will fail. Although the Q doesn't specify that the custom resource uses Lambda. I think it's safe to assume here that since a custom resource is responsible for copying content into the bucket, it can also be used to handle the cleanup process.

    Source: Adapted from community discussion — GripZA

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 141. 427 questions available.