DOP-C02 practice questions 11–20

1. Question 11 · 427 in bank

   A large enterprise is deploying a web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The application stores data in an Amazon RDS for Oracle DB instance and Amazon DynamoDB. There are separate environments for development, testing, and production. What is the MOST secure and flexible way to obtain password credentials during deployment?

   • ARetrieve an access key from an AWS Systems Manager SecureString parameter to access AWS services. Retrieve the database credentials from a Systems Manager SecureString parameter.
   • BLaunch the EC2 instances with an EC2 IAM role to access AWS services. Retrieve the database credentials from AWS Secrets Manager.
   • CRetrieve an access key from an AWS Systems Manager plaintext parameter to access AWS services. Retrieve the database credentials from a Systems Manager SecureString parameter.
   • DLaunch the EC2 instances with an EC2 IAM role to access AWS services. Store the database passwords in an encrypted config file with the application artifacts.

   Show answer

   Answer: B

   Explanation

   B is correct: means we should consider AWS SSM and secret manager. However, means we should opt for secret manager, which is more costly but more secure A, C and D: no mention of secret manager

   Source: Adapted from community discussion — thanhnv142

   Next question

2. Question 12 · 427 in bank

   The security team depends on AWS CloudTrail to detect sensitive security issues in the company’s AWS account. The DevOps engineer needs a solution to auto-remediate CloudTrail being turned off in an AWS account. What solution ensures the LEAST amount of downtime for the CloudTrail log deliveries?

   • ACreate an Amazon EventBridge rule for the CloudTrail StopLogging event. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on the ARN of the resource in which StopLogging was called. Add the Lambda function ARN as a target to the EventBridge rule.
   • BDeploy the AWS-managed CloudTrail-enabled AWS Config rule, set with a periodic interval of 1 hour. Create an Amazon EventBridge rule for AWS Config rules compliance change. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on the ARN of the resource in which StopLogging was called. Add the Lambda function ARN as a target to the EventBridge rule.
   • CCreate an Amazon EventBridge rule for a scheduled event every 5 minutes. Create an AWS Lambda function that uses the AWS SDK to call StartLogging on a CloudTrail trail in the AWS account. Add the Lambda function ARN as a target to the EventBridge rule.
   • DLaunch a t2.nano instance with a script running every 5 minutes that uses the AWS SDK to query CloudTrail in the current account. If the CloudTrail trail is disabled, have the script re-enable the trail.

   Show answer

   Answer: A

   Explanation

   This solution ensures the least amount of downtime for CloudTrail log deliveries when auto-remediating CloudTrail being turned off. Here's why: Event-Driven Automation: By creating an Amazon EventBridge rule for the CloudTrail StopLogging event, the remediation process is triggered immediately when CloudTrail logging is stopped, minimizing the downtime. Targeted Remediation: The Lambda function uses the AWS SDK to call StartLogging on the specific CloudTrail trail ARN where the StopLogging event occurred. This targeted approach ensures that logging is re-enabled for the affected trail without impacting other trails or introducing unnecessary overhead. Low Latency: EventBridge rules and Lambda functions are designed to be highly responsive, ensuring that the remediation action is initiated with minimal delay after the StopLogging event occurs.

   Source: Adapted from community discussion — c3518fc

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 13 · 427 in bank

   Select 3

   An ecommerce company has chosen AWS to host its new platform. The company's DevOps team has started building an AWS Control Tower landing zone. The DevOps team has set the identity store within AWS IAM Identity Center (AWS Single Sign-On) to external identity provider (IdP) and has configured SAML 2.0. The DevOps team wants a robust permission model that applies the principle of least privilege. The model must allow the team to build and manage only the team's own resources. Which combination of steps will meet these requirements? (Choose three.)

   • ACreate IAM policies that include the required permissions. Include the aws:PrincipalTag condition key.
   • BCreate permission sets. Attach an inline policy that includes the required permissions and uses the aws:PrincipalTag condition key to scope the permissions.
   • CCreate a group in the IdP. Place users in the group. Assign the group to accounts and the permission sets in IAM Identity Center.
   • DCreate a group in the IdP. Place users in the group. Assign the group to OUs and IAM policies.
   • EEnable attributes for access control in IAM Identity Center. Apply tags to users. Map the tags as key-value pairs.
   • FEnable attributes for access control in IAM Identity Center. Map attributes from the IdP as key-value pairs.

   Show answer

   Answer: BCF

   Explanation

   I would go with BCF. I cannot make a large comment on why but manage an identity center setup at work and find that these are the correct ones IMHO. Your IdP has attributes, not tags, ou have to rely on the IdP's attributes for instance. And you work with permission sets almost always, so the three answers about the permission sets make the full answer. You do not use IAM directly or tags for this.

   Source: Adapted from community discussion — bcx

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 14 · 427 in bank

   Select 2

   A company uses AWS CodeArtifact to centrally store Python packages. The CodeArtifact repository is configured with the following repository policy:

   

   A development team is building a new project in an account that is in an organization in AWS Organizations. The development team wants to use a Python library that has already been stored in the CodeArtifact repository in the organization. The development team uses AWS CodePipeline and AWS CodeBuild to build the new application. The CodeBuild job that the development team uses to build the application is configured to run in a VPC. Because of compliance requirements, the VPC has no internet connectivity. The development team creates the VPC endpoints for CodeArtifact and updates the CodeBuild buildspec.yaml file. However, the development team cannot download the Python library from the repository. Which combination of steps should a DevOps engineer take so that the development team can use CodeArtifact? (Choose two.)

   • ACreate an Amazon S3 gateway endpoint. Update the route tables for the subnets that are running the CodeBuild job.
   • BUpdate the repository policy’s Principal statement to include the ARN of the role that the CodeBuild project uses.
   • CShare the CodeArtifact repository with the organization by using AWS Resource Access Manager (AWS RAM).
   • DUpdate the role that the CodeBuild project uses so that the role has sufficient permissions to use the CodeArtifact repository.
   • ESpecify the account that hosts the repository as the delegated administrator for CodeArtifact in the organization.

   Show answer

   Answer: AD

   Explanation

   I guess the answer is AD because of this: "AWS CodeArtifact operates in multiple Availability Zones and stores artifact data and metadata in Amazon S3 and Amazon DynamoDB. Your encrypted data is redundantly stored across multiple facilities and multiple devices in each facility, making it highly available and highly durable." https://aws.amazon.com/codeartifact/features/ With no internet connectivity, a gateway endpoint becomes necessary to access S3.

   Source: Adapted from community discussion — TroyMcLure

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 15 · 427 in bank

   A company uses a series of individual Amazon CloudFormation templates to deploy its multi-Region applications. These templates must be deployed in a specific order. The company is making more changes to the templates than previously expected and wants to deploy new templates more efficiently. Additionally, the data engineering team must be notified of all changes to the templates. What should the company do to accomplish these goals?

   • ACreate an AWS Lambda function to deploy the CloudFormation templates in the required order. Use stack policies to alert the data engineering team.
   • BHost the CloudFormation templates in Amazon S3. Use Amazon S3 events to directly trigger CloudFormation updates and Amazon SNS notifications.
   • CImplement CloudFormation StackSets and use drift detection to trigger update alerts to the data engineering team.
   • DLeverage CloudFormation nested stacks and stack sets for deployments. Use Amazon SNS to notify the data engineering team.

   Show answer

   Answer: D

   Explanation

   The answer is D because: A few hours ago, I just finished the DOP-C02 exam. My score is 1000 points. This question has come up, I choose D.

   Source: Adapted from community discussion — emupsx1

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 16 · 427 in bank

   A DevOps engineer has implemented a CI/CD pipeline to deploy an AWS CloudFormation template that provisions a web application. The web application consists of an Application Load Balancer (ALB), a target group, a launch template that uses an Amazon Linux 2 AMI, an Auto Scaling group of Amazon EC2 instances, a security group, and an Amazon RDS for MySQL database. The launch template includes user data that specifies a script to install and start the application. The initial deployment of the application was successful. The DevOps engineer made changes to update the version of the application with the user data. The CI/CD pipeline has deployed a new version of the template. However, the health checks on the ALB are now failing. The health checks have marked all targets as unhealthy. During investigation, the DevOps engineer notices that the CloudFormation stack has a status of UPDATE_COMPLETE. However, when the DevOps engineer connects to one of the EC2 instances and checks /var/log/messages, the DevOps engineer notices that the Apache web server failed to start successfully because of a configuration error. How can the DevOps engineer ensure that the CloudFormation deployment will fail if the user data fails to successfully finish running?

   • AUse the cfn-signal helper script to signal success or failure to CloudFormation. Use the WaitOnResourceSignals update policy within the CloudFormation template. Set an appropriate timeout for the update policy.
   • BCreate an Amazon CloudWatch alarm for the UnhealthyHostCount metric. Include an appropriate alarm threshold for the target group. Create an Amazon Simple Notification Service (Amazon SNS) topic as the target to signal success or failure to CloudFormation.
   • CCreate a lifecycle hook on the Auto Scaling group by using the AWS::AutoScaling::LifecycleHook resource. Create an Amazon Simple Notification Service (Amazon SNS) topic as the target to signal success or failure to CloudFormation. Set an appropriate timeout on the lifecycle hook.
   • DUse the Amazon CloudWatch agent to stream the cloud-init logs. Create a subscription filter that includes an AWS Lambda function with an appropriate invocation timeout. Configure the Lambda function to use the SignalResource API operation to signal success or failure to CloudFormation.

   Show answer

   Answer: A

   Explanation

   To ensure that the CloudFormation deployment fails if the user data script does not successfully finish, you can use a combination of AWS CloudFormation's CreationPolicy, cfn-signal, and wait condition resources. These mechanisms can signal CloudFormation about the success or failure of the instance creation process, including the execution of user data scripts.

   Source: Adapted from community discussion — zijo

   References

   • AWS documentation

   Next question

7. Question 17 · 427 in bank

   A company has a data ingestion application that runs across multiple AWS accounts. The accounts are in an organization in AWS Organizations. The company needs to monitor the application and consolidate access to the application. Currently, the company is running the application on Amazon EC2 instances from several Auto Scaling groups. The EC2 instances have no access to the internet because the data is sensitive. Engineers have deployed the necessary VPC endpoints. The EC2 instances run a custom AMI that is built specifically for the application. To maintain and troubleshoot the application, system administrators need the ability to log in to the EC2 instances. This access must be automated and controlled centrally. The company’s security team must receive a notification whenever the instances are accessed. Which solution will meet these requirements?

   • ACreate an Amazon EventBridge rule to send notifications to the security team whenever a user logs in to an EC2 instance. Use EC2 Instance Connect to log in to the instances. Deploy Auto Scaling groups by using AWS CloudFormation. Use the cfn-init helper script to deploy appropriate VPC routes for external access. Rebuild the custom AMI so that the custom AMI includes AWS Systems Manager Agent.
   • BDeploy a NAT gateway and a bastion host that has internet access. Create a security group that allows incoming traffic on all the EC2 instances from the bastion host. Install AWS Systems Manager Agent on all the EC2 instances. Use Auto Scaling group lifecycle hooks for monitoring and auditing access. Use Systems Manager Session Manager to log in to the instances. Send logs to a log group in Amazon CloudWatch Logs. Export data to Amazon S3 for auditing. Send notifications to the security team by using S3 event notifications.
   • CUse EC2 Image Builder to rebuild the custom AMI. Include the most recent version of AWS Systems Manager Agent in the image. Configure the Auto Scaling group to attach the AmazonSSMManagedInstanceCore role to all the EC2 instances. Use Systems Manager Session Manager to log in to the instances. Enable logging of session details to Amazon S3. Create an S3 event notification for new file uploads to send a message to the security team through an Amazon Simple Notification Service (Amazon SNS) topic.
   • DUse AWS Systems Manager Automation to build Systems Manager Agent into the custom AMI. Configure AWS Config to attach an SCP to the root organization account to allow the EC2 instances to connect to Systems Manager. Use Systems Manager Session Manager to log in to the instances. Enable logging of session details to Amazon S3. Create an S3 event notification for new file uploads to send a message to the security team through an Amazon Simple Notification Service (Amazon SNS) topic.

   Show answer

   Answer: C

   Explanation

   C and D are left over choice due to no internet access for EC2 C is correct By using EC2 Image Builder to rebuild the custom AMI and including the most recent version of AWS Systems Manager Agent in the image, you can configure the Auto Scaling group to attach the AmazonSSMManagedInstanceCore role to all the EC2 instances. This allows you to use Systems Manager Session Manager to log in to the instances. You can enable logging of session details to Amazon S3 and create an S3 event notification for new file uploads to send a message to the security team through an Amazon Simple Notification Service (Amazon SNS) topic2

   Source: Adapted from community discussion — Blueee

   Next question

8. Question 18 · 427 in bank

   A company uses Amazon S3 to store proprietary information. The development team creates buckets for new projects on a daily basis. The security team wants to ensure that all existing and future buckets have encryption, logging, and versioning enabled. Additionally, no buckets should ever be publicly read or write accessible. What should a DevOps engineer do to meet these requirements?

   • AEnable AWS CloudTrail and configure automatic remediation using AWS Lambda.
   • BEnable AWS Config rules and configure automatic remediation using AWS Systems Manager documents.
   • CEnable AWS Trusted Advisor and configure automatic remediation using Amazon EventBridge.
   • DEnable AWS Systems Manager and configure automatic remediation using Systems Manager documents.

   Show answer

   Answer: B

   Explanation

   AWS Config allows you to remediate noncompliant resources that are evaluated by AWS Config Rules. AWS Config applies remediation using AWS Systems Manager Automation documents. see https://docs.aws.amazon.com/config/latest/developerguide/remediation.html

   Source: Adapted from community discussion — Arnaud92

   References

   • AWS documentation

   Next question

9. Question 19 · 427 in bank

   A DevOps engineer is researching the least expensive way to implement an image batch processing cluster on AWS. The application cannot run in Docker containers and must run on Amazon EC2. The batch job stores checkpoint data on an NFS volume and can tolerate interruptions. Configuring the cluster software from a generic EC2 Linux image takes 30 minutes. What is the MOST cost-effective solution?

   • AUse Amazon EFS for checkpoint data. To complete the job, use an EC2 Auto Scaling group and an On-Demand pricing model to provision EC2 instances temporarily.
   • BUse GlusterFS on EC2 instances for checkpoint data. To run the batch job, configure EC2 instances manually. When the job completes, shut down the instances manually.
   • CUse Amazon EFS for checkpoint data. Use EC2 Fleet to launch EC2 Spot Instances, and utilize user data to configure the EC2 Linux instance on startup.
   • DUse Amazon EFS for checkpoint data. Use EC2 Fleet to launch EC2 Spot Instances. Create a custom AMI for the cluster and use the latest AMI when creating instances.

   Show answer

   Answer: D

   Explanation

   D is the correct answer. Make the calculations 30 min of bootstraping when you have multiple scale actions is a lot of time idle when you have many instances, so the money spent during a lot of spot request that wast time boostraping is larger than keeping a single AMI. Details are everything during an investigation...

   Source: Adapted from community discussion — WhyIronMan

   Next question

10. Question 20 · 427 in bank

    A company recently migrated its legacy application from on-premises to AWS. The application is hosted on Amazon EC2 instances behind an Application Load Balancer, which is behind Amazon API Gateway. The company wants to ensure users experience minimal disruptions during any deployment of a new version of the application. The company also wants to ensure it can quickly roll back updates if there is an issue. Which solution will meet these requirements with MINIMAL changes to the application?

    • AIntroduce changes as a separate environment parallel to the existing one. Configure API Gateway to use a canary release deployment to send a small subset of user traffic to the new environment.
    • BIntroduce changes as a separate environment parallel to the existing one. Update the application’s DNS alias records to point to the new environment.
    • CIntroduce changes as a separate target group behind the existing Application Load Balancer. Configure API Gateway to route user traffic to the new target group in steps.
    • DIntroduce changes as a separate target group behind the existing Application Load Balancer. Configure API Gateway to route all traffic to the Application Load Balancer, which then sends the traffic to the new target group.

    Show answer

    Answer: A

    Explanation

    Option A is also a valid approach that can meet the requirements with MINIMAL changes to the application. In Option A, the changes are introduced as a separate environment parallel to the existing one. This new environment can be used to deploy the new version of the application. By configuring API Gateway to use a canary release deployment, a small subset of user traffic is directed to the new environment, while the majority of traffic continues to be routed to the existing environment hosting the current version of the application.

    Source: Adapted from community discussion — haazybanj

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 11. 427 questions available.