DOP-C02 practice questions 161–170

1. Question 161 · 427 in bank

   Select 2

   A company deploys an application on on-premises devices in the company’s on-premises data center. The company uses an AWS Direct Connect connection between the data center and the company's AWS account. During initial setup of the on-premises devices and during application updates, the application needs to retrieve configuration files from an Amazon Elastic File System (Amazon EFS) file system. All traffic from the on-premises devices to Amazon EFS must remain private and encrypted. The on-premises devices must follow the principle of least privilege for AWS access. The company's DevOps team needs the ability to revoke access from a single device without affecting the access of the other devices. Which combination of steps will meet these requirements? (Choose two.)

   • ACreate an IAM user that has an access key and a secret key for each device. Attach the AmazonElasticFileSystemFullAccess policy to all IAM users. Configure the AWS CLI on the on-premises devices to use the IAM user's access key and secret key.
   • BGenerate certificates for each on-premises device in AWS Private Certificate Authority. Create a trust anchor in IAM Roles Anywhere that references an AWS Private CA. Create an IAM role that trust IAM Roles Anywhere. Attach the AmazonElasticFileSystemClientReadWriteAccess to the role. Create an IAM Roles Anywhere profile for the IAM role. Configure the AWS CLI on the on-premises devices to use the aws_signing_helper command to obtain credentials.
   • CCreate an IAM user that has an access key and a secret key for all devices. Attach the AmazonElasticFileSystemClientReadWriteAccess policy to the IAM user. Configure the AWS CLI on the on-premises devices to use the IAM user's access key and secret key.
   • DUse the amazon-efs-utils package to mount the EFS file system.
   • EUse the native Linux NFS client to mount the EFS file system.

   Show answer

   Answer: BD

   Explanation

   B. Generate certificates for each on-premises device in AWS Private Certificate Authority. Create a trust anchor in IAM Roles Anywhere that references an AWS Private CA. Create an IAM role that trusts IAM Roles Anywhere. Attach the AmazonElasticFileSystemClientReadWriteAccess policy to the role. Create an IAM Roles Anywhere profile for the IAM role. Configure the AWS CLI on the on-premises devices to use the aws_signing_helper command to obtain credentials. D. Use the amazon-efs-utils package to mount the EFS file system.

   Source: Adapted from community discussion — KaranNishad

   References

   • AWS documentation

   Next question

2. Question 162 · 427 in bank

   A DevOps engineer is setting up an Amazon Elastic Container Service (Amazon ECS) blue/green deployment for an application by using AWS CodeDeploy and AWS CloudFormation. During the deployment window, the application must be highly available and CodeDeploy must shift 10% of traffic to a new version of the application every minute until all traffic is shifted. Which configuration should the DevOps engineer add in the CloudFormation template to meet these requirements?

   • AAdd an AppSpec file with the CodeDeployDefault.ECSLinearl OPercentEveryl Minutes deployment configuration.
   • BAdd the AWS::CodeDeployBlueGreen transform and the AWS::CodeDeploy::BlueGreen hook parameter with the CodeDeployDefault.ECSLinear10PercentEvery1Minutes deployment configuration.
   • CAdd an AppSpec file with the ECSCanary10Percent5Minutes deployment configuration.
   • DAdd the AWS::CodeDeployBlueGreen transform and the AWS::CodeDepioy::BlueGreen hook parameter with the ECSCanary10Percent5Minutes deployment configuration.

   Show answer

   Answer: B

   Next question

3. Question 163 · 427 in bank

   A company uses an organization in AWS Organizations to manage its AWS accounts. The company's DevOps team has developed an AWS Lambda function that calls the Organizations API to create new AWS accounts. The Lambda function runs in the organization's management account. The DevOps team needs to move the Lambda function from the management account to a dedicated AWS account. The DevOps team must ensure that the Lambda function has the ability to create new AWS accounts only in Organizations before the team deploys the Lambda function to the new account. Which solution will meet these requirements?

   • AIn the management account, create a new IAM role that has the necessary permission to create new accounts in Organizations. Allow the role to be assumed by the Lambda execution role in the new AWS account. Update the Lambda function code to assume the role when the Lambda function creates new AWS accounts. Update the Lambda execution role to ensure that it has permission to assume the new role.
   • BIn the management account, turn on delegated administration for Organizations. Create a new delegation policy that grants the new AWS account permission to create new AWS accounts in Organizations. Ensure that the Lambda execution role has the organizations:CreateAccount permission.
   • CIn the management account, create a new IAM role that has the necessary permission to create new accounts in Organizations. Allow the role to be assumed by the Lambda service principal. Update the Lambda function code to assume the role when the Lambda function creates new AWS accounts. Update the Lambda execution role to ensure that it has permission to assume the new role.
   • DIn the management account, enable AWS Control Tower. Turn on delegated administration for AWS Control Tower. Create a resource policy that allows the new AWS account to create new AWS accounts in AWS Control Tower. Update the Lambda function code to use the AWS Control Tower API in the new AWS account. Ensure that the Lambda execution role has the controltower:CreateManagedAccount permission.

   Show answer

   Answer: A

   Explanation

   Create an IAM Role with Necessary Permissions: - In the management account, create an IAM role with permissions to call the AWS Organizations API for creating new accounts. Allow Role Assumption: - Configure this IAM role to be assumable by the Lambda execution role in the new AWS account. This way, the Lambda function in the new account can assume the role to gain the necessary permissions. Update Lambda Function and Execution Role: - Modify the Lambda function code in the new account to assume the role created in the management account when it needs to create new AWS accounts. Also, ensure the Lambda execution role in the new account has the permissions required to assume the role in the management account.

   Source: Adapted from community discussion — jamesf

   Next question

4. Question 164 · 427 in bank

   A company has deployed an application in a single AWS Region. The application backend uses Amazon DynamoDB tables and Amazon S3 buckets. The company wants to deploy the application in a secondary Region. The company must ensure that the data in the DynamoDB tables and the S3 buckets persists across both Regions. The data must also immediately propagate across Regions. Which solution will meet these requirements with the MOST operational efficiency?

   • AImplement two-way S3 bucket replication between the primary Region's S3 buckets and the secondary Region’s S3 buckets. Convert the DynamoDB tables into global tables. Set the secondary Region as the additional Region.
   • BImplement S3 Batch Operations copy jobs between the primary Region and the secondary Region for all S3 buckets. Convert the DynamoDB tables into global tables. Set the secondary Region as the additional Region.
   • CImplement two-way S3 bucket replication between the primary Region's S3 buckets and the secondary Region's S3 buckets. Enable DynamoDB streams on the DynamoDB tables in both Regions. In each Region, create an AWS Lambda function that subscribes to the DynamoDB streams. Configure the Lambda function to copy new records to the DynamoDB tables in the other Region.
   • DImplement S3 Batch Operations copy jobs between the primary Region and the secondary Region for all S3 buckets. Enable DynamoDB streams on the DynamoDB tables in both Regions. In each Region, create an AWS Lambda function that subscribes to the DynamoDB streams. Configure the Lambda function to copy new records to the DynamoDB tables in the other Region.

   Show answer

   Answer: A

   Explanation

   Two-Way S3 Bucket Replication: - While two-way replication is not typically needed for most scenarios (one-way replication is generally sufficient), for this requirement, if both regions need to have copies of data and keep them synchronized, you would implement replication rules to ensure data consistency across S3 buckets in different regions. Global DynamoDB Tables: - DynamoDB global tables are designed specifically for multi-Region, fully replicated tables. When you convert your DynamoDB tables into global tables and add the secondary Region, DynamoDB handles the replication of data across Regions automatically and immediately. This provides efficient and consistent data replication without requiring custom solutions.

   Source: Adapted from community discussion — jamesf

   Next question

5. Question 165 · 427 in bank

   A company has configured Amazon RDS storage autoscaling for its RDS DB instances. A DevOps team needs to visualize the autoscaling events on an Amazon CloudWatch dashboard. Which solution will meet this requirement?

   • ACreate an Amazon EventBridge rule that reacts to RDS storage autoscaling events from RDS events. Create an AWS Lambda function that publishes a CloudWatch custom metric. Configure the EventBridge rule to invoke the Lambda function. Visualize the custom metric by using the CloudWatch dashboard.
   • BCreate a trail by using AWS CloudTrail with management events configured. Configure the trail to send the management events to Amazon CloudWatch Logs. Create a metric filter in CloudWatch Logs to match the RDS storage autoscaling events. Visualize the metric filter by using the CloudWatch dashboard.
   • CCreate an Amazon EventBridge rule that reacts to RDS storage autoscaling events from the RDS events. Create a CloudWatch alarm. Configure the EventBridge rule to change the status of the CloudWatch alarm. Visualize the alarm status by using the CloudWatch dashboard.
   • DCreate a trail by using AWS CloudTrail with data events configured. Configure the trail to send the data events to Amazon CloudWatch Logs. Create a metric filter in CloudWatch Logs to match the RDS storage autoscaling events. Visualize the metric filter by using the CloudWatch dashboard.

   Show answer

   Answer: A

   Explanation

   While CloudTrail can capture RDS events and send them to CloudWatch Logs, creating a metric filter in CloudWatch Logs is more complex and indirect compared to using EventBridge and a Lambda function to publish custom metrics directly to CloudWatch.

   Source: Adapted from community discussion — trungtd

   Next question

6. Question 166 · 427 in bank

   A company uses containers for its applications. The company learns that some container images are missing required security configurations. A DevOps engineer needs to implement a solution to create a standard base image. The solution must publish the base image weekly to the us-west-2 Region, us-east-2 Region, and eu-central-1 Region. Which solution will meet these requirements?

   • ACreate an EC2 Image Builder pipeline that uses a container recipe to build the image. Configure the pipeline to distribute the image to an Amazon Elastic Container Registry (Amazon ECR) repository in us-west-2. Configure ECR replication from us-west-2 to us-east-2 and from us-east-2 to eu-central-1. Configure the pipeline to run weekly.
   • BCreate an AWS CodePipeline pipeline that uses an AWS CodeBuild project to build the image. Use AWS CodeDeploy to publish the image to an Amazon Elastic Container Registry (Amazon ECR) repository in us-west-2. Configure ECR replication from us-west-2 to us-east-2 and from us-east-2 to eu-central-1. Configure the pipeline to run weekly.
   • CCreate an EC2 Image Builder pipeline that uses a container recipe to build the image. Configure the pipeline to distribute the image to Amazon Elastic Container Registry (Amazon ECR) repositories in all three Regions. Configure the pipeline to run weekly.
   • DCreate an AWS CodePipeline pipeline that uses an AWS CodeBuild project to build the image. Use AWS CodeDeploy to publish the image to Amazon Elastic Container Registry (Amazon ECR) repositories in all three Regions. Configure the pipeline to run weekly.

   Show answer

   Answer: C

   Explanation

   EC2 Image Builder: - This service is designed to automate the creation and distribution of container images. It supports defining container recipes and automating the build process. Direct Distribution: - EC2 Image Builder can be configured to distribute the images directly to multiple ECR repositories across different regions. This aligns with the requirement of publishing the base image to the us-west-2, us-east-2, and eu-central-1 regions. Weekly Schedule: - EC2 Image Builder can be scheduled to run on a weekly basis, meeting the requirement for regular updates.

   Source: Adapted from community discussion — jamesf

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 167 · 427 in bank

   A DevOps engineer needs to implement a solution to install antivirus software on all the Amazon EC2 instances in an AWS account. The EC2 instances run the most recent version of Amazon Linux. The solution must detect all instances and must use an AWS Systems Manager document to install the software if the software is not present. Which solution will meet these requirements?

   • ACreate an association in Systems Manager State Manager. Target all the managed nodes. Include the software in the association. Configure the association to use the Systems Manager document.
   • BSet up AWS Config to record all the resources in the account. Create an AWS Config custom rule to determine if the software is installed on all the EC2 instances. Configure an automatic remediation action that uses the Systems Manager document for noncompliant EC2 instances.
   • CActivate Amazon EC2 scanning on Amazon Inspector to determine if the software is installed on all the EC2 instances. Associate the findings with the Systems Manager document.
   • DCreate an Amazon EventBridge rule that uses AWS CloudTrail to detect the Runinstances API call. Configure inventory collection in Systems Manager Inventory to determine if the software is installed on the EC2 instances. Associate the Systems Manager inventory with the Systems Manager document.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

8. Question 168 · 427 in bank

   Select 2

   A company needs to increase the security of the container images that run in its production environment. The company wants to integrate operating system scanning and programming language package vulnerability scanning for the containers in its CI/CD pipeline. The CI/CD pipeline is an AWS CodePipeline pipeline that includes an AWS CodeBuild build project, AWS CodeDeploy actions, and an Amazon Elastic Container Registry (Amazon ECR) repository. A DevOps engineer needs to add an image scan to the CI/CD pipeline. The CI/CD pipeline must deploy only images without CRITICAL and HIGH findings into production. Which combination of steps will meet these requirements? (Choose two.)

   • AUse Amazon ECR basic scanning.
   • BUse Amazon ECR enhanced scanning.
   • CConfigure Amazon ECR to submit a Rejected status to the CI/CD pipeline when the image scan returns CRITICAL or HIGH findings.
   • DConfigure an Amazon EventBridge rule to invoke an AWS Lambda function when the image scan is completed. Configure the Lambda function to consume the Amazon Inspector scan status and to submit an Approved or Rejected status to the CI/CD pipeline.
   • EConfigure an Amazon EventBridge rule to invoke an AWS Lambda function when the image scan is completed. Configure the Lambda function to consume the Clair scan status and to submit an Approved or Rejected status to the CI/CD pipeline.

   Show answer

   Answer: BD

   Explanation

   ---> B D As per documentation, basic scanning use CVEs from the open-source Clair project. Enhanced scanning is an integration with Amazon Inspector. This suggests both options use different database/scanners. https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-enhanced.html https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-basic.html

   Source: Adapted from community discussion — tgv

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 169 · 427 in bank

   A company's DevOps team manages a set of AWS accounts that are in an organization in AWS Organizations. The company needs a solution that ensures that all Amazon EC2 instances use approved AM Is that the DevOps team manages. The solution also must remediate the usage of AMIs that are not approved. The individual account administrators must not be able to remove the restriction to use approved AMIs. Which solution will meet these requirements?

   • AUse AWS CloudFormation StackSets to deploy an Amazon EventBridge rule to each account. Configure the rule to react to AWS CloudTrail events for Amazon EC2 and to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps team to the SNS topic.
   • BUse AWS CloudFormation StackSets to deploy the approved-amis-by-id AWS Config managed rule to each account. Configure the rule with the list of approved AMIs. Configure the rule to run the AWS-StopEC2Instance AWS Systems Manager Automation runbook for the noncompliant EC2 instances.
   • CCreate an AWS Lambda function that processes AWS CloudTrail events for Amazon EC2. Configure the Lambda function to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps team to the SNS topic. Deploy the Lambda function in each account in the organization. Create an Amazon EventBridge rule in each account. Configure the EventBridge rules to react to AWS CloudTrail events for Amazon EC2 and to invoke the Lambda function.
   • DEnable AWS Config across the organization. Create a conformance pack that uses the approved-amis-by-id AWS Config managed rule with the list of approved AMIs. Deploy the conformance pack across the organization. Configure the rule to run the AWS-StopEC2lnstance AWS Systems Manager Automation runbook for the noncompliant EC2 instances.

   Show answer

   Answer: D

   Explanation

   A & C. only alert, not automatically remediate noncompliant instances B. deploy via CloudFormation StackSets to individual accounts can still allow account administrators to modify or remove the rules.

   Source: Adapted from community discussion — trungtd

   Next question

10. Question 170 · 427 in bank

    A company gives its employees limited rights to AWS. DevOps engineers have the ability to assume an administrator role. For tracking purposes, the security team wants to receive a near-real-time notification when the administrator role is assumed. How should this be accomplished?

    • AConfigure AWS Config to publish logs to an Amazon S3 bucket. Use Amazon Athena to query the logs and send a notification to the security team when the administrator role is assumed.
    • BConfigure Amazon GuardDuty to monitor when the administrator role is assumed and send a notification to the security team.
    • CCreate an Amazon EventBridge event rule using an AWS Management Console sign-in events event pattern that publishes a message to an Amazon SNS topic if the administrator role is assumed.
    • DCreate an Amazon EventBridge events rule using an AWS API call that uses an AWS CloudTrail event pattern to invoke an AWS Lambda function that publishes a message to an Amazon SNS topic if the administrator role is assumed.

    Show answer

    Answer: D

    Explanation

    Option D provides a robust and effective approach to tracking and alerting on the assumption of the administrator role by leveraging the power of AWS CloudTrail, Amazon EventBridge, AWS Lambda, and Amazon SNS. Not Option C as Incorrect Event Pattern: This option specifies monitoring AWS Management Console sign-in events, which are unrelated to the AssumeRole API call used when assuming a role programmatically. It wouldn't detect role assumptions made through CLI or SDKs.

    Source: Adapted from community discussion — jamesf

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 161. 427 questions available.