DOP-C02 practice questions 181–190

1. Question 181 · 427 in bank

   Select 2

   A company has set up AWS CodeArtifact repositories with public upstream repositories. The company's development team consumes open source dependencies from the repositories in the company's internal network. The company's security team recently discovered a critical vulnerability in the most recent version of a package that the development team consumes. The security team has produced a patched version to fix the vulnerability. The company needs to prevent the vulnerable version from being downloaded. The company also needs to allow the security team to publish the patched version. Which combination of steps will meet these requirements? (Choose two.)

   • AUpdate the status of the affected CodeArtifact package version to unlisted.
   • BUpdate the status of the affected CodeArtifact package version to deleted.
   • CUpdate the status of the affected CodeArtifact package version to archived.
   • DUpdate the CodeArtifact package origin control settings to allow direct publishing and to block upstream operations.
   • EUpdate the CodeArtifact package origin control settings to block direct publishing and to allow upstream operations.

   Show answer

   Answer: CD

   Explanation

   I had this question in my exam and checking what was the correct option for the package version led me here. C - archived seems to be the right one. A - unlisted will only remove the package version from the list of versions returned to package managers, but it WILL NOT prevent the download. B - deleted - it's not a valid package version status (https://docs.aws.amazon.com/codeartifact/latest/ug/packages-overview.html#package-version-status) C - archived - will block the package version download. D - Allow direct publishing will give the internal team permissions to upload the new version of the package E - block direct publishing means the package version are updated from external (public) repos More on the packages origin control settings here: https://docs.aws.amazon.com/codeartifact/latest/ug/package-origin-controls.html

   Source: Adapted from community discussion — Weninka

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 182 · 427 in bank

   A company is running a custom-built application that processes records. All the components run on Amazon EC2 instances that run in an Auto Scaling group. Each record's processing is a multistep sequential action that is compute-intensive. Each step is always completed in 5 minutes or less. A limitation of the current system is that if any steps fail, the application has to reprocess the record from the beginning. The company wants to update the architecture so that the application must reprocess only the failed steps. What is the MOST operationally efficient solution that meets these requirements?

   • ACreate a web application to write records to Amazon S3. Use S3 Event Notifications to publish to an Amazon Simple Notification Service (Amazon SNS) topic. Use an EC2 instance to poll Amazon SNS and start processing. Save intermediate results to Amazon S3 to pass on to the next step.
   • BPerform the processing steps by using logic in the application. Convert the application code to run in a container. Use AWS Fargate to manage the container instances. Configure the container to invoke itself to pass the state from one step to the next.
   • CCreate a web application to pass records to an Amazon Kinesis data stream. Decouple the processing by using the Kinesis data stream and AWS Lambda functions.
   • DCreate a web application to pass records to AWS Step Functions. Decouple the processing into Step Functions tasks and AWS Lambda functions.

   Show answer

   Answer: D

   References

   • AWS documentation

   Next question

3. Question 183 · 427 in bank

   A company is migrating its on-premises Windows applications and Linux applications to AWS. The company will use automation to launch Amazon EC2 instances to mirror the on-premises configurations. The migrated applications require access to shared storage that uses SMB for Windows and NFS for Linux. The company is also creating a pilot light disaster recovery (DR) environment in another AWS Region. The company will use automation to launch and configure the EC2 instances in the DR Region. The company needs to replicate the storage to the DR Region. Which storage solution will meet these requirements?

   • AUse Amazon S3 for the application storage. Create an S3 bucket in the primary Region and an S3 bucket in the DR Region. Configure S3 Cross-Region Replication (CRR) from the primary Region to the DR Region.
   • BUse Amazon Elastic Block Store (Amazon EBS) for the application storage. Create a backup plan in AWS Backup that creates snapshots of the EBS volumes that are in the primary Region and replicates the snapshots to the DR Region.
   • CUse a Volume Gateway in AWS Storage Gateway for the application storage. Configure Cross-Region Replication (CRR) of the Volume Gateway from the primary Region to the DR Region.
   • DUse Amazon FSx for NetApp ONTAP for the application storage. Create an FSx for ONTAP instance in the DR Region. Configure NetApp SnapMirror replication from the primary Region to the DR Region.

   Show answer

   Answer: D

   Explanation

   Amazon FSx for NetApp ONTAP support Multi-protocol access to data using the Network File System (NFS), Server Message Block (SMB), Internet Small Computer Systems Interface (iSCSI), and Non-Volatile Memory Express (NVMe) protocols https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/what-is-fsx-ontap.html#features-overview

   Source: Adapted from community discussion — jamesf

   References

   • AWS documentation

   Next question

4. Question 184 · 427 in bank

   Select 2

   A company's application uses a fleet of Amazon EC2 On-Demand Instances to analyze and process data. The EC2 instances are in an Auto Scaling group. The Auto Scaling group is a target group for an Application Load Balancer (ALB). The application analyzes critical data that cannot tolerate interruption. The application also analyzes noncritical data that can withstand interruption. The critical data analysis requires quick scalability in response to real-time application demand. The noncritical data analysis involves memory consumption. A DevOps engineer must implement a solution that reduces scale-out latency for the critical data. The solution also must process the noncritical data. Which combination of steps will meet these requirements? (Choose two.)

   • AFor the critical data, modify the existing Auto Scaling group. Create a warm pool instance in the stopped state. Define the warm pool size. Create a new version of the launch template that has detailed monitoring enabled. Use Spot Instances.
   • BFor the critical data, modify the existing Auto Scaling group. Create a warm pool instance in the stopped state. Define the warm pool size. Create a new version of the launch template that has detailed monitoring enabled. Use On-Demand Instances.
   • CFor the critical data, modify the existing Auto Scaling group. Create a lifecycle hook to ensure that bootstrap scripts are completed successfully. Ensure that the application on the instances is ready to accept traffic before the instances are registered. Create a new version of the launch template that has detailed monitoring enabled.
   • DFor the noncritical data, create a second Auto Scaling group that uses a launch template. Configure the launch template to install the unified Amazon CloudWatch agent and to configure the CloudWatch agent with a custom memory utilization metric. Use Spot Instances. Add the new Auto Scaling group as the target group for the ALB. Modify the application to use two target groups for critical data and noncritical data.
   • EFor the noncritical data, create a second Auto Scaling group. Choose the predefined memory utilization metric type for the target tracking scaling policy. Use Spot Instances. Add the new Auto Scaling group as the target group for the ALB. Modify the application to use two target groups for critical data and noncritical data.

   Show answer

   Answer: BD

   Explanation

   Option B (For critical data): Creates a warm pool and ensures quick scaling with On-Demand Instances, addressing the need for low latency in scaling. Option D (For noncritical data): Uses Spot Instances with memory-based scaling policies to handle noncritical data efficiently.

   Source: Adapted from community discussion — jamesf

   References

   • AWS documentation

   Next question

5. Question 185 · 427 in bank

   Select 3

   A company recently migrated its application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that uses Amazon EC2 instances. The company configured the application to automatically scale based on CPU utilization. The application produces memory errors when it experiences heavy loads. The application also does not scale out enough to handle the increased load. The company needs to collect and analyze memory metrics for the application over time. Which combination of steps will meet these requirements? (Choose three.)

   • AAttach the CloudWatchAgentServerPolicy managed IAM policy to the IAM instance profile that the cluster uses.
   • BAttach the CloudWatchAgentServerPolicy managed IAM policy to a service account role for the cluster.
   • CCollect performance metrics by deploying the unified Amazon CloudWatch agent to the existing EC2 instances in the cluster. Add the agent to the AMI for any new EC2 instances that are added to the cluster.
   • DCollect performance logs by deploying the AWS Distro for OpenTelemetry collector as a DaemonSet.
   • EAnalyze the pod_memory_utilization Amazon CloudWatch metric in the ContainerInsights namespace by using the Service dimension.
   • FAnalyze the node_memory_utilization Amazon CloudWatch metric in the ContainerInsights namespace by using the ClusterName dimension.

   Show answer

   Answer: ACE

   Explanation

   A. This policy grants the necessary permissions for the Amazon CloudWatch agent to collect and publish metrics from the EC2 instances. C. The unified Amazon CloudWatch agent can collect both CPU and memory utilization metrics. Deploying it ensures you capture memory metrics across all EC2 instances in the EKS cluster. E. pod_memory_utilization metric provides detailed insights into memory usage at the pod level B. service account role is more relevant for applications running within Kubernetes pods needing AWS permissions. D irrelevant F Node-level metrics do not provide the granularity needed to diagnose pod-level memory issues effectively

   Source: Adapted from community discussion — trungtd

   Next question

6. Question 186 · 427 in bank

   A company's video streaming platform usage has increased from 10,000 users each day to 50,000 users each day in multiple countries. The company deploys the streaming platform on Amazon Elastic Kubernetes Service (Amazon EKS). The EKS workload scales up to thousands of nodes during peak viewing time. The company's users report occurrences of unauthorized logins. Users also report sudden interruptions and logouts from the platform. The company wants additional security measures for the entire platform. The company also needs a summarized view of the resource behaviors and interactions across the company's entire AWS environment. The summarized view must show login attempts, API calls, and network traffic. The solution must permit network traffic analysis while minimizing the overhead of managing logs. The solution must also quickly investigate any potential malicious behavior that is associated with the EKS workload. Which solution will meet these requirements?

   • AEnable Amazon GuardDuty for EKS Audit Log Monitoring. Enable AWS CloudTrail logs. Store the EKS audit logs and CloudTrail log files in an Amazon S3 bucket. Use Amazon Athena to create an external table. Use Amazon QuickSight to create a dashboard.
   • BEnable Amazon GuardDuty for EKS Audit Log Monitoring. Enable Amazon Detective in the company's AWS account. Enable EKS audit logs from optional source packages in Detective.
   • CEnable Amazon CloudWatch Container Insights. Enable AWS CloudTrail logs. Store the EKS audit logs and CloudTrail log files in an Amazon S3 bucket. Use Amazon Athena to create an external table. Use Amazon QuickSight to create a dashboard.
   • DEnable Amazon GuardDuty for EKS Audit Log Monitoring. Enable Amazon CloudWatch Container Insights and VPC Flow Logs. Enable AWS CloudTrail logs.

   Show answer

   Answer: B

   Explanation

   Amazon Detective helps you quickly analyze and investigate security events across one or more AWS accounts by generating data visualizations that represent the ways your resources behave and interact over time. Detective creates visualizations of GuardDuty findings. https://docs.aws.amazon.com/guardduty/latest/ug/detective-integration.html Amazon EKS audit logs is an optional data source package that can be added to your Detective behavior graph. https://docs.aws.amazon.com/detective/latest/userguide/source-data-types-EKS.html

   Source: Adapted from community discussion — jamesf

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 187 · 427 in bank

   A company has an on-premises application that is written in Go. A DevOps engineer must move the application to AWS. The company's development team wants to enable blue/green deployments and perform A/B testing. Which solution will meet these requirements?

   • ADeploy the application on an Amazon EC2 instance, and create an AMI of the instance. Use the AMI to create an automatic scaling launch configuration that is used in an Auto Scaling group. Use Elastic Load Balancing to distribute traffic. When changes are made to the application, a new AMI will be created, which will initiate an EC2 instance refresh.
   • BUse Amazon Lightsail to deploy the application. Store the application in a zipped format in an Amazon S3 bucket. Use this zipped version to deploy new versions of the application to Lightsail. Use Lightsail deployment options to manage the deployment.
   • CUse AWS CodeArtifact to store the application code. Use AWS CodeDeploy to deploy the application to a fleet of Amazon EC2 instances. Use Elastic Load Balancing to distribute the traffic to the EC2 instances. When making changes to the application, upload a new version to CodeArtifact and create a new CodeDeploy deployment.
   • DUse AWS Elastic Beanstalk to host the application. Store a zipped version of the application in Amazon S3. Use that location to deploy new versions of the application. Use Elastic Beanstalk to manage the deployment options.

   Show answer

   Answer: D

   Explanation

   D. Use AWS Elastic Beanstalk to host the application. Store a zipped version of the application in Amazon S3. Use that location to deploy new versions of the application. Use Elastic Beanstalk to manage the deployment options. AWS Elastic Beanstalk provides a platform for deploying web applications, which is well-suited for use cases that require blue/green deployments and A/B testing. Elastic Beanstalk can deploy applications written in a variety of programming languages and frameworks, including Go. Elastic Beanstalk supports blue/green deployments, which allow you to deploy a new version of your application to a separate environment before switching traffic to it. This enables you to perform A/B testing before fully rolling out a new version of your application. Elastic Beanstalk also allows you to manage the deployment options, including the deployment strategy, instance types, and autoscaling options.

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation

   Next question

8. Question 188 · 427 in bank

   Select 3

   A company uses AWS Organizations to manage hundreds of AWS accounts. The company has a team that is responsible for AWS Identity and Access Management (IAM). The IAM team wants to implement AWS IAM Identity Center (AWS Single Sign-On). The IAM team must have only the minimum needed permissions to manage IAM Identity Center. The IAM team must not be able to gain unneeded access to the Organizations management account. The IAM team must be able to provision new IAM Identity Center permission sets and assignments for existing and new member accounts. Which combination of steps will meet these requirements? (Choose three.)

   • ACreate a new AWS account for the IAM team. In the new account, enable IAM Identity Center. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
   • BCreate a new AWS account for the IAM team. In the Organizations management account, enable IAM Identity Center. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
   • CIn IAM Identity Center, create users and a group for the IAM team. Add the users to the group. Create a new permission set. Attach the AWSSSODirectoryAdministrator managed IAM policy to the group.
   • DIn IAM Identity Center, create users and a group for the IAM team. Add the users to the group. Create a new permission set. Attach the AWSSSOMemberAccountAdministrator managed IAM policy to the group.
   • EAssign the permission set to the Organizations management account. Allow the IAM team group to use the permission set.
   • FAssign the permission set to the new AWS account. Allow the IAM team group to use the permission set.

   Show answer

   Answer: ADF

   Explanation

   A ensures that the IAM team operates within their own account, isolating their permissions and activities from the Organizations management account. D provides the IAM team with the necessary permissions to manage IAM Identity Center across member accounts, without granting broader access. *Note that AWSSSODirectoryAdministrator policy grants broader permissions than necessary F. ensures that the IAM team has the necessary permissions within their designated account B. "The IAM team must not be able to gain unneeded access to the Organizations management account" => So B is wrong C contradicting the principle of least privilege. E should be avoided to prevent the IAM team from gaining unneeded access.

   Source: Adapted from community discussion — trungtd

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 189 · 427 in bank

   Select 2

   A company uses an organization in AWS Organizations that has all features enabled. The company uses AWS Backup in a primary account and uses an AWS Key Management Service (AWS KMS) key to encrypt the backups. The company needs to automate a cross-account backup of the resources that AWS Backup backs up in the primary account. The company configures cross-account backup in the Organizations management account. The company creates a new AWS account in the organization and configures an AWS Backup backup vault in the new account. The company creates a KMS key in the new account to encrypt the backups. Finally, the company configures a new backup plan in the primary account. The destination for the new backup plan is the backup vault in the new account. When the AWS Backup job in the primary account is invoked, the job creates backups in the primary account. However, the backups are not copied to the new account's backup vault. Which combination of steps must the company take so that backups can be copied to the new account's backup vault? (Choose two.)

   • AEdit the backup vault access policy in the new account to allow access to the primary account.
   • BEdit the backup vault access policy in the primary account to allow access to the new account.
   • CEdit the backup vault access policy in the primary account to allow access to the KMS key in the new account.
   • DEdit the key policy of the KMS key in the primary account to share the key with the new account.
   • EEdit the key policy of the KMS key in the new account to share the key with the primary account.

   Show answer

   Answer: AD

   Explanation

   https://docs.aws.amazon.com/aws-backup/latest/devguide/create-cross-account-backup.html In your destination account, you must create a backup vault. Then, you assign a customer managed key to encrypt backups in the destination account, and a resource-based access policy to allow AWS Backup to access the resources you would like to copy. In the source account, if your resources are encrypted with a customer managed key, you must share this customer managed key with the destination account. You can then create a backup plan and choose a destination account that is part of your organizational unit in AWS Organizations.

   Source: Adapted from community discussion — auxwww

   References

   • AWS documentation
   • repost.aws documentation

   Next question

10. Question 190 · 427 in bank

    Select 3

    A company runs an application that uses an Amazon S3 bucket to store images. A DevOps engineer needs to implement a multi-Region strategy for the objects that are stored in the S3 bucket. The company needs to be able to fail over to an S3 bucket in another AWS Region. When an image is added to either S3 bucket, the image must be replicated to the other S3 bucket within 15 minutes. The DevOps engineer enables two-way replication between the S3 buckets. Which combination of steps should the DevOps engineer take next to meet the requirements? (Choose three.)

    • AEnable S3 Replication Time Control (S3 RTC) on each replication rule.
    • BCreate an S3 Multi-Region Access Point in an active-passive configuration.
    • CCall the SubmitMultiRegionAccessPointRoutes operation in the AWS API when the company needs to fail over to the S3 bucket in the other Region.
    • DEnable S3 Transfer Acceleration on both S3 buckets.
    • EConfigure a routing control in Amazon Route 53 Recovery Controller. Add the S3 buckets in an active-passive configuration.
    • FCall the UpdateRoutingControlStates operation in the AWS API when the company needs to fail over to the S3 bucket in the other Region.

    Show answer

    Answer: ABC

    Explanation

    A. Enable S3 Replication Time Control (S3 RTC) on each replication rule. This ensures that 99.99% of objects are replicated within 15 minutes. B. Create an S3 Multi-Region Access Point in an active-passive configuration. This is crucial for managing access to data across multiple S3 buckets in different AWS Regions and facilitating failover. C. Call the SubmitMultiRegionAccessPointRoutes operation in the AWS API when the company needs to fail over to the S3 bucket in the other Region. This operation updates the routes to direct traffic to the designated S3 bucket, enabling failover.

    Source: Adapted from community discussion — TEC1

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 181. 427 questions available.