DOP-C02 practice questions 151–160

1. Question 151 · 427 in bank

   A company uses Amazon EC2 as its primary compute platform. A DevOps team wants to audit the company's EC2 instances to check whether any prohibited applications have been installed on the EC2 instances. Which solution will meet these requirements with the MOST operational efficiency?

   • AConfigure AWS Systems Manager on each instance. Use AWS Systems Manager Inventory. Use Systems Manager resource data sync to synchronize and store findings in an Amazon S3 bucket. Create an AWS Lambda function that runs when new objects are added to the S3 bucket. Configure the Lambda function to identify prohibited applications.
   • BConfigure AWS Systems Manager on each instance. Use Systems Manager Inventory Create AWS Config rules that monitor changes from Systems Manager Inventory to identify prohibited applications.
   • CConfigure AWS Systems Manager on each instance. Use Systems Manager Inventory. Filter a trail in AWS CloudTrail for Systems Manager Inventory events to identify prohibited applications.
   • DDesignate Amazon CloudWatch Logs as the log destination for all application instances. Run an automated script across all instances to create an inventory of installed applications. Configure the script to forward the results to CloudWatch Logs. Create a CloudWatch alarm that uses filter patterns to search log data to identify prohibited applications.

   Show answer

   Answer: B

   Explanation

   Option B: Configure AWS Systems Manager on each instance. Use Systems Manager Inventory and create AWS Config rules that monitor changes from Systems Manager Inventory to identify prohibited applications. This approach leverages Systems Manager Inventory and AWS Config to efficiently track and identify prohibited applications while minimizing operational overhead.

   Source: Adapted from community discussion — limelight04

   References

   • AWS documentation

   Next question

2. Question 152 · 427 in bank

   Select 3

   A company has an event-driven JavaScript application. The application uses decoupled AWS managed services that publish, consume, and route events. During application testing, events are not delivered to the target that is specified by an Amazon EventBridge rule. A DevOps team must provide application testers with additional functionality to view, troubleshoot, and prevent the loss of events without redeployment of the application. Which combination of steps should the DevOps team take to meet these requirements? (Choose three.)

   • ALaunch AWS Device Farm with a standard test environment and project to run a specific build of the application.
   • BCreate an Amazon S3 bucket. Enable AWS CloudTrail. Create a CloudTrail trail that specifies the S3 bucket as the storage location.
   • CConfigure the EventBridge rule to use an Amazon Simple Queue Service (Amazon SQS) standard queue as a dead-letter queue.
   • DConfigure the EventBridge rule to use an Amazon Simple Queue Service (Amazon SQS) FIFO queue as a dead-letter queue.
   • ECreate a log group in Amazon CloudWatch Logs Specify the log group as an additional target of the EventBridge rule.
   • FUpdate the application code base to use the AWS X-Ray SDK tracing feature to instrument the code with support for the X-Amzn-Trace-Id header.

   Show answer

   Answer: BCE

   Explanation

   Keywords: without redeployment of the application. Option B: Enabling CloudTrail will allow testers to track event activities and interactions with AWS services, aiding in troubleshooting. Option C: Using a standard SQS queue as a DLQ ensures that failed events are captured and can be analyzed or retried. Option E: Adding CloudWatch Logs as a target provides immediate logging of event processing, aiding in real-time monitoring and troubleshooting.

   Source: Adapted from community discussion — jamesf

   References

   • repost.aws documentation

   Next question

3. Question 153 · 427 in bank

   Select 2

   A company is migrating its container-based workloads to an AWS Organizations multi-account environment. The environment consists of application workload accounts that the company uses to deploy and run the containerized workloads. The company has also provisioned a shared services account for shared workloads in the organization. The company must follow strict compliance regulations. All container images must receive security scanning before they are deployed to any environment. Images can be consumed by downstream deployment mechanisms after the images pass a scan with no critical vulnerabilities. Pre-scan and post-scan images must be isolated from one another so that a deployment can never use pre-scan images. A DevOps engineer needs to create a strategy to centralize this process. Which combination of steps will meet these requirements with the LEAST administrative overhead? (Choose two.)

   • ACreate Amazon Elastic Container Registry (Amazon ECR) repositories in the shared services account: one repository for each pre-scan image and one repository for each post-scan image. Configure Amazon ECR image scanning to run on new image pushes to the pre-scan repositories. Use resource-based policies to grant the organization write access to the pre-scan repositories and read access to the post-scan repositories.
   • BCreate pre-scan Amazon Elastic Container Registry (Amazon ECR) repositories in each account that publishes container images. Create repositories for post-scan images in the shared services account. Configure Amazon ECR image scanning to run on new image pushes to the pre-scan repositories. Use resource-based policies to grant the organization read access to the post-scan repositories.
   • CConfigure image replication for each image from the image's pre-scan repository to the image's post-scan repository.
   • DCreate a pipeline in AWS CodePipeline for each pre-scan repository. Create a source stage that runs when new images are pushed to the pre-scan repositories. Create a stage that uses AWS CodeBuild as the action provider. Write a buildspec.yaml definition that determines the image scanning status and pushes images without critical vulnerabilities to the post-scan repositories.
   • ECreate an AWS Lambda function. Create an Amazon EventBridge rule that reacts to image scanning completed events and invokes the Lambda function. Write function code that determines the image scanning status and pushes images without critical vulnerabilities to the post-scan repositories.

   Show answer

   Answer: AE

   Explanation

   keywords: LEAST Administrative overhead Option A centralizes the repository management in the shared services account, simplifying access control and configuration management. Pre-scan and post-scan repositories are clearly separated, ensuring that only post-scan images are deployed. Option E uses event-driven automation to handle the scanning results and image promotion, reducing manual intervention and ensuring that only images that pass the security scan are moved to the post-scan repositories. This approach is efficient and minimizes administrative overhead compared to manually setting up pipelines or replication mechanisms.

   Source: Adapted from community discussion — jamesf

   Next question

4. Question 154 · 427 in bank

   A company uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to deploy its web applications on containers. The web applications contain confidential data that cannot be decrypted without specific credentials. A DevOps engineer has stored the credentials in AWS Secrets Manager. The secrets are encrypted by an AWS Key Management Service (AWS KMS) customer managed key. A Kubernetes service account for a third-party tool makes the secrets available to the applications. The service account assumes an IAM role that the company created to access the secrets. The service account receives an Access Denied (403 Forbidden) error while trying to retrieve the secrets from Secrets Manager. What is the root cause of this issue?

   • AThe IAM role that is attached to the EKS cluster does not have access to retrieve the secrets from Secrets Manager.
   • BThe key policy for the customer managed key does not allow the Kubernetes service account IAM role to use the key.
   • CThe key policy for the customer managed key does not allow the EKS cluster IAM role to use the key.
   • DThe IAM role that is assumed by the Kubernetes service account does not have permission to access the EKS cluster.

   Show answer

   Answer: B

   Explanation

   When a service account in Amazon EKS tries to access secrets in AWS Secrets Manager, it does so by assuming an IAM role. The permissions required to access these secrets include: - Secrets Manager permissions: The IAM role must have the necessary permissions to retrieve the secrets from AWS Secrets Manager. - KMS key permissions: The IAM role must also have permissions to use the AWS KMS key that encrypts the secrets.

   Source: Adapted from community discussion — jamesf

   Next question

5. Question 155 · 427 in bank

   A company runs an application on one Amazon EC2 instance. Application metadata is stored in Amazon S3 and must be retrieved if the instance is restarted. The instance must restart or relaunch automatically if the instance becomes unresponsive. Which solution will meet these requirements?

   • ACreate an Amazon CloudWatch alarm for the StatusCheckFailed metric. Use the recover action to stop and start the instance. Use an S3 event notification to push the metadata to the instance when the instance is back up and running.
   • BConfigure AWS OpsWorks, and use the auto healing feature to stop and start the instance. Use a lifecycle event in OpsWorks to pull the metadata from Amazon S3 and update it on the instance.
   • CUse EC2 Auto Recovery to automatically stop and start the instance in case of a failure. Use an S3 event notification to push the metadata to the instance when the instance is back up and running.
   • DUse AWS CloudFormation to create an EC2 instance that includes the UserData property for the EC2 resource. Add a command in UserData to retrieve the application metadata from Amazon S3.

   Show answer

   Answer: B

   Explanation

   Both Amazon CloudWatch's recover action and EC2 Auto Recovery are designed to respond to system status check failures, not instance status check failures. System status check failures indicate issues with the underlying hardware, while instance status check failures are often related to issues within your instance (like an OS-level issue). If the requirement is to handle unresponsiveness due to both system-level and instance-level issues, neither option A nor C would fully meet the requirement. In that case, AWS OpsWorks with auto healing (Option B) could be a better fit since OpsWorks allows you to configure more complex health checks and could recover from both system-level and instance-level issues. So, if you want to handle both types of unresponsiveness, Option B would be the most comprehensive solution.

   Source: Adapted from community discussion — Jonfernz

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 156 · 427 in bank

   A company is migrating its product development teams from an on-premises data center to a hybrid environment. The new environment will add four AWS Regions and will give the developers the ability to use the Region that is geographically closest to them. All the development teams use a shared set of Linux applications. The on-premises data center stores the applications on a NetApp ONTAP storage device. The storage volume is mounted read-only on the development on-premises VMs. The company updates the applications on the shared volume once a week. A DevOps engineer needs to replicate the data to all the new Regions. The DevOps engineer must ensure that the data is always up to date with deduplication. The data also must not be dependent on the availability of the on-premises storage device. Which solution will meet these requirements?

   • ACreate an Amazon S3 File Gateway in the on-premises data center. Create S3 buckets in each Region. Set up a cron job to copy the data from the storage device to the S3 File Gateway. Set up S3 Cross-Region Replication (CRR) to the S3 buckets in each Region.
   • BCreate an Amazon FSx File Gateway in one Region. Create file servers in Amazon FSx for Windows File Server in each Region. Set up a cron job to copy the data from the storage device to the FSx File Gateway.
   • CCreate Multi-AZ Amazon FSx for NetApp ONTAP instances and volumes in each Region. Configure a scheduled SnapMirror relationship between the on-premises storage device and the FSx for ONTAP instances.
   • DCreate an Amazon Elastic File System (Amazon EFS) file system in each Region. Deploy an AWS DataSync agent in the on-premises data center. Configure a schedule for DataSync to copy the data to Amazon EFS daily.

   Show answer

   Answer: C

   Explanation

   Amazon FSx for NetApp ONTAP provides a managed NetApp ONTAP experience in the cloud. By creating Multi-AZ FSx for ONTAP instances in each Region, you can replicate data with high availability and redundancy. Checkout cheaper contributor access here: https://exammatter.net/ SnapMirror is a replication technology provided by NetApp that allows for efficient and reliable data replication. Configuring SnapMirror relationships between your on-premises NetApp storage device and the FSx for ONTAP instances will ensure that your data is consistently replicated across all AWS Regions.

   Source: Adapted from community discussion — Duke315

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 157 · 427 in bank

   Select 2

   A company has an application that stores data that includes personally identifiable information (PII) in an Amazon S3 bucket. All data is encrypted with AWS Key Management Service (AWS KMS) customer managed keys. All AWS resources are deployed from an AWS CloudFormation template. A DevOps engineer needs to set up a development environment for the application in a different AWS account. The data in the development environment's S3 bucket needs to be updated once a week from the production environment's S3 bucket. The company must not move PII from the production environment without anonymizing the PII first. The data in each environment must be encrypted with different KMS customer managed keys. Which combination of steps should the DevOps engineer take to meet these requirements? (Choose two.)

   • AActivate Amazon Macie on the S3 bucket in the production account. Create an AWS Step Functions state machine to initiate a discovery job and redact all PII before copying files to the S3 bucket in the development account. Give the state machine tasks decrypt permissions on the KMS key in the production account. Give the state machine tasks encrypt permissions on the KMS key in the development account.
   • BSet up S3 replication between the production S3 bucket and the development S3 bucket. Activate Amazon Macie on the development S3 bucket. Create an AWS Step Functions state machine to initiate a discovery job and redact all PII as the files are copied to the development S3 bucket. Give the state machine tasks encrypt and decrypt permissions on the KMS key in the development account.
   • CSet up an S3 Batch Operations job to copy files from the production S3 bucket to the development S3 bucket. In the development account, configure an AWS Lambda function to redact ail PII. Configure S3 Object Lambda to use the Lambda function for S3 GET requests. Give the Lambda function's IAM role encrypt and decrypt permissions on the KMS key in the development account.
   • DCreate a development environment from the CloudFormation template in the development account. Schedule an Amazon EventBridge rule to start the AWS Step Functions state machine once a week.
   • ECreate a development environment from the CloudFormation template in the development account. Schedule a cron job on an Amazon EC2 instance to run once a week to start the S3 Batch Operations job.

   Show answer

   Answer: AD

   Explanation

   Option A addresses the need to anonymize PII before moving data to the development environment. By using Amazon Macie, you can identify PII in the production S3 bucket. AWS Step Functions can orchestrate a workflow to redact this PII before transferring the data. This ensures compliance with data protection requirements. You need to provide the necessary KMS key permissions for decrypting and encrypting data as it moves between accounts. Option D ensures that the data update process is automated and scheduled. Using Amazon EventBridge to trigger the AWS Step Functions state machine on a weekly basis automates the data transfer and anonymization process.

   Source: Adapted from community discussion — jamesf

   References

   • AWS documentation

   Next question

8. Question 158 · 427 in bank

   A company uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to host its machine learning (ML) application. As the ML model and the container image size grow, the time that new pods take to start up has increased to several minutes. A DevOps engineer needs to reduce the startup time to seconds. The solution must also reduce the startup time to seconds when the pod runs on nodes that were recently added to the cluster. The DevOps engineer creates an Amazon EventBridge rule that invokes an automation in AWS Systems Manager. The automation prefetches the container images from an Amazon Elastic Container Registry (Amazon ECR) repository when new images are pushed to the repository. The DevOps engineer also configures tags to be applied to the cluster and the node groups. What should the DevOps engineer do next to meet the requirements?

   • ACreate an IAM role that has a policy that allows EventBridge to use Systems Manager to run commands in the EKS cluster's control plane nodes. Create a Systems Manager State Manager association that uses the control plane nodes' tags to prefetch corresponding container images.
   • BCreate an IAM role that has a policy that allows EventBridge to use Systems Manager to run commands in the EKS cluster's nodes. Create a Systems Manager State Manager association that uses the nodes' machine size to prefetch corresponding container images.
   • CCreate an IAM role that has a policy that allows EventBridge to use Systems Manager to run commands in the EKS cluster's nodes. Create a Systems Manager State Manager association that uses the nodes' tags to prefetch corresponding container images.
   • DCreate an IAM role that has a policy that allows EventBridge to use Systems Manager to run commands in the EKS cluster's control plane nodes. Create a Systems Manager State Manager association that uses the nodes' tags to prefetch corresponding container images.

   Show answer

   Answer: C

   Explanation

   The control plane manages the Kubernetes cluster but does not run the application containers => A & D wrong Machine size is not a practical or flexible approach to determining where images should be prefetched. Should be Tag =>B Wrong

   Source: Adapted from community discussion — trungtd

   References

   • AWS documentation

   Next question

9. Question 159 · 427 in bank

   Select 3

   A company's application has an API that retrieves workload metrics. The company needs to audit, analyze, and visualize these metrics from the application to detect issues at scale. Which combination of steps will meet these requirements? (Choose three.)

   • AConfigure an Amazon EventBridge schedule to invoke an AWS Lambda function that calls the API to retrieve workload metrics. Store the workload metric data in an Amazon S3 bucket.
   • BConfigure an Amazon EventBridge schedule to invoke an AWS Lambda function that calls the API to retrieve workload metrics. Store the workload metric data in an Amazon DynamoDB table that has a DynamoDB stream enabled.
   • CCreate an AWS Glue crawler to catalog the workload metric data in the Amazon S3 bucket. Create views in Amazon Athena for the cataloged data.
   • DConnect an AWS Glue crawler to the Amazon DynamoDB stream to catalog the workload metric data. Create views in Amazon Athena for the cataloged data.
   • ECreate Amazon QuickSight datasets from the Amazon Athena views. Create a QuickSight analysis to visualize the workload metric data as a dashboard.
   • FCreate an Amazon CloudWatch dashboard that has custom widgets that invoke AWS Lambda functions. Configure the Lambda functions to query the workload metrics data from the Amazon Athena views.

   Show answer

   Answer: ACE

   Explanation

   Option A: Using Amazon EventBridge to schedule an AWS Lambda function that retrieves workload metrics from the API and stores the data in Amazon S3 provides a scalable and automated way to collect and store the data. Option C: AWS Glue can be used to catalog the data stored in Amazon S3, making it queryable using Amazon Athena. This step prepares the data for analysis by creating a schema and making it available for querying. Option E: Amazon QuickSight can be used to create datasets from the Athena views and then visualize the data in dashboards. This provides the capability to analyze and visualize workload metrics at scale. https://aws.amazon.com/blogs/mt/analyzing-amazon-cloudwatch-internet-monitor-measurement-logs-using-amazon-athena-amazon-quicksight/

   Source: Adapted from community discussion — jamesf

   References

   • AWS documentation

   Next question

10. Question 160 · 427 in bank

    Select 3

    A DevOps engineer is building the infrastructure for an application. The application needs to run on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that includes Amazon EC2 instances. The EC2 instances need to use an Amazon Elastic File System (Amazon EFS) file system as a storage backend. The Amazon EFS Container Storage Interface (CSI) driver is installed on the EKS cluster. When the DevOps engineer starts the application, the EC2 instances do not mount the EFS file system. Which solutions will fix the problem? (Choose three.)

    • ASwitch the EKS nodes from Amazon EC2 to AWS Fargate.
    • BAdd an inbound rule to the EFS file system’s security group to allow NFS traffic from the EKS cluster.
    • CCreate an IAM role that allows the Amazon EFS CSI driver to interact with the file system
    • DSet up AWS DataSync to configure file transfer between the EFS file system and the EKS nodes.
    • ECreate a mount target for the EFS file system in the subnet of the EKS nodes.
    • FDisable encryption or the EFS file system.

    Show answer

    Answer: BCE

    Explanation

    B: The EFS file system’s security group must allow inbound traffic on the NFS port (2049) from the EC2 instances in the EKS cluster. Without this rule, the EC2 instances won't be able to communicate with the EFS file system. C: The EFS CSI driver needs permissions to interact with the EFS file system. This involves creating an IAM role with the necessary permissions and associating it with the EFS CSI driver. E: EFS requires a mount target in each subnet where the EC2 instances reside. This mount target facilitates the network connectivity between the EFS file system and the EC2 instances.

    Source: Adapted from community discussion — jamesf

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 151. 427 questions available.