DOP-C02 practice questions 191–200

1. Question 191 · 427 in bank

   Select 2

   A company uses the AWS Cloud Development Kit (AWS CDK) to define its application. The company uses a pipeline that consists of AWS CodePipeline and AWS CodeBuild to deploy the CDK application. The company wants to introduce unit tests to the pipeline to test various infrastructure components. The company wants to ensure that a deployment proceeds if no unit tests result in a failure. Which combination of steps will enforce the testing requirement in the pipeline? (Choose two.)

   • AUpdate the CodeBuild build phase commands to run the tests then to deploy the application. Set the OnFailure phase property to ABORT.
   • BUpdate the CodeBuild build phase commands to run the tests then to deploy the application. Add the --rollback true flag to the cdk deploy command.
   • CUpdate the CodeBuild build phase commands to run the tests then to deploy the application. Add the --require-approval any-change flag to the cdk deploy command.
   • DCreate a test that uses the AWS CDK assertions module. Use the template.hasResourceProperties assertion to test that resources have the expected properties.
   • ECreate a test that uses the cdk diff command. Configure the test to fail if any resources have changed.

   Show answer

   Answer: AD

   Explanation

   Option A: - This option involves configuring the build phase in CodeBuild to run tests before deployment. Setting the OnFailure phase property to ABORT ensures that if any test fails, the build process is stopped, and the deployment doesn't proceed. - This ensures that the build and deployment process only proceeds if the tests are successful, which is crucial for maintaining application integrity. Option D: - This option involves writing unit tests using the AWS CDK assertions module. The template.hasResourceProperties assertion checks if CloudFormation templates have resources with expected properties, ensuring the infrastructure's logical correctness. - This enforces unit testing by checking that the CloudFormation templates have the expected properties, ensuring the application’s infrastructure is as intended.

   Source: Adapted from community discussion — jamesf

   Next question

2. Question 192 · 427 in bank

   A company has an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are in multiple Availability Zones. The application was misconfigured in a single Availability Zone, which caused a partial outage of the application. A DevOps engineer made changes to ensure that the unhealthy EC2 instances in one Availability Zone do not affect the healthy EC2 instances in the other Availability Zones. The DevOps engineer needs to test the application's failover and shift where the ALB sends traffic. During failover, the ALB must avoid sending traffic to the Availability Zone where the failure has occurred. Which solution will meet these requirements?

   • ATurn off cross-zone load balancing on the ALB. Use Amazon Route 53 Application Recovery Controller to start a zonal shift away from the Availability Zone.
   • BTurn off cross-zone load balancing on the ALB’s target group. Use Amazon Route 53 Application Recovery Controller to start a zonal shift away from the Availability Zone.
   • CCreate an Amazon Route 53 Application Recovery Controller resource set that uses the DNS hostname of the ALB. Start a zonal shift for the resource set away from the Availability Zone.
   • DCreate an Amazon Route 53 Application Recovery Controller resource set that uses the ARN of the ALB’s target group. Create a readiness check that uses the ElbV2TargetGroupsCanServeTraffic rule.

   Show answer

   Answer: A

   Explanation

   - Turning off cross-zone load balancing on the ALB ensures that each Availability Zone only handles traffic directed to its own healthy instances, allowing for granular control over traffic distribution. This prevents the ALB from sending traffic to the unhealthy instances across all zones, thereby isolating the problem to the affected zone. - Amazon Route 53 Application Recovery Controller's Zonal Shifts is used to direct traffic away from a specific AZ that experiences a failure, allowing the ALB to reroute requests to healthy AZs automatically. Amazon Route 53 Application Recovery Controller currently supports the following resources for zonal shift and zonal autoshift: - Network Load Balancers with cross-zone load balancing disabled - Application Load Balancers with cross-zone load balancing disabled https://docs.aws.amazon.com/r53recovery/latest/dg/arc-zonal-shift.resource-types.html

   Source: Adapted from community discussion — jamesf

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 193 · 427 in bank

   A company sends its AWS Network Firewall flow logs to an Amazon S3 bucket. The company then analyzes the flow logs by using Amazon Athena. The company needs to transform the flow logs and add additional data before the flow logs are delivered to the existing S3 bucket. Which solution will meet these requirements?

   • ACreate an AWS Lambda function to transform the data and to write a new object to the existing S3 bucket. Configure the Lambda function with an S3 trigger for the existing S3 bucket. Specify all object create events for the event type. Acknowledge the recursive invocation.
   • BEnable Amazon EventBridge notifications on the existing S3 bucket. Create a custom EventBridge event bus. Create an EventBridge rule that is associated with the custom event bus. Configure the rule to react to all object create events for the existing S3 bucket and to invoke an AWS Step Functions workflow. Configure a Step Functions task to transform the data and to write the data into a new S3 bucket.
   • CCreate an Amazon EventBridge rule that is associated with the default EventBridge event bus. Configure the rule to react to all object create events for the existing S3 bucket. Define a new S3 bucket as the target for the rule. Create an EventBridge input transformation to customize the event before passing the event to the rule target.
   • DCreate an Amazon Kinesis Data Firehose delivery stream that is configured with an AWS Lambda transformer. Specify the existing S3 bucket as the destination. Change the Network Firewall logging destination from Amazon S3 to Kinesis Data Firehose.

   Show answer

   Answer: D

   Explanation

   Amazon Kinesis Data Firehose: Kinesis Data Firehose is designed for real-time streaming data delivery and transformation. It can ingest data, process it with a Lambda function, and deliver the transformed data to destinations like Amazon S3, Redshift, or Elasticsearch. https://aws.amazon.com/firehose/faqs/ AWS Lambda Transformer: By configuring a Lambda function as a transformer within Kinesis Data Firehose, you can implement custom logic to transform the flow logs and add any additional data required before the logs are written to the existing S3 bucket.

   Source: Adapted from community discussion — jamesf

   References

   • AWS documentation

   Next question

4. Question 194 · 427 in bank

   Select 3

   A DevOps engineer needs to implement integration tests into an existing AWS CodePipeline CI/CD workflow for an Amazon Elastic Container Service (Amazon ECS) service. The CI/CD workflow retrieves new application code from an AWS CodeCommit repository and builds a container image. The Cl/CD workflow then uploads the container image to Amazon Elastic Container Registry (Amazon ECR) with a new image tag version. The integration tests must ensure that new versions of the service endpoint are reachable and that various API methods return successful response data. The DevOps engineer has already created an ECS cluster to test the service. Which combination of steps will meet these requirements with the LEAST management overhead? (Choose three.)

   • AAdd a deploy stage to the pipeline. Configure Amazon ECS as the action provider.
   • BAdd a deploy stage to the pipeline. Configure AWS CodeDeploy as the action provider.
   • CAdd an appspec.yml file to the CodeCommit repository.
   • DUpdate the image build pipeline stage to output an imagedefinitions.json file that references the new image tag.
   • ECreate an AWS Lambda function that runs connectivity checks and API calls against the service. Integrate the Lambda function with CodePipeline by using a Lambda action stage.
   • FWrite a script that runs integration tests against the service. Upload the script to an Amazon S3 bucket. Integrate the script in the S3 bucket with CodePipeline by using an S3 action stage.

   Show answer

   Answer: ADE

   Explanation

   keywords: LEAST management overhead A. Add a deploy stage to the pipeline. Configure Amazon ECS as the action provider. - Directly deploys the container image to ECS, ensuring the service is updated with the latest code without unnecessary complexity. D. Update the image build pipeline stage to output an image definitions.json file that references the new image tag. - Necessary for ECS to recognize and deploy the new image version, facilitating automated updates. E. Create an AWS Lambda function that runs connectivity checks and API calls against the service. Integrate the Lambda function with CodePipeline by using a Lambda action stage. - Provides a low-management solution for running integration tests, leveraging AWS Lambda's serverless capabilities.

   Source: Adapted from community discussion — jamesf

   References

   • AWS documentation

   Next question

5. Question 195 · 427 in bank

   Select 3

   A company runs applications on Windows and Linux Amazon EC2 instances. The instances run across multiple Availability Zones in an AWS Region. The company uses Auto Scaling groups for each application. The company needs a durable storage solution for the instances. The solution must use SMB for Windows and must use NFS for Linux. The solution must also have sub-millisecond latencies. All instances will read and write the data. Which combination of steps will meet these requirements? (Choose three.)

   • ACreate an Amazon Elastic File System (Amazon EFS) file system that has targets in multiple Availability Zones.
   • BCreate an Amazon FSx for NetApp ONTAP Multi-AZ file system.
   • CCreate a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume to use for shared storage.
   • DUpdate the user data for each application’s launch template to mount the file system.
   • EPerform an instance refresh on each Auto Scaling group.
   • FUpdate the EC2 instances for each application to mount the file system when new instances are launched.

   Show answer

   Answer: BDE

   Explanation

   To meet the requirements of the scenario, the company should take the following steps: Create an Amazon FSx for NetApp ONTAP Multi-AZ file system (Option B): Amazon FSx for NetApp ONTAP supports both SMB (for Windows) and NFS (for Linux), and it provides sub-millisecond latencies. It also supports Multi-AZ configurations for high availability and durability. Update the user data for each application’s launch template to mount the file system (Option D): This ensures that every new instance launched by the Auto Scaling group will have the file system mounted. Perform an instance refresh on each Auto Scaling group (Option E): This will update the existing instances with the new launch template configuration, ensuring that they have the file system mounted.

   Source: Adapted from community discussion — raycomh

   Next question

6. Question 196 · 427 in bank

   A company uses an organization in AWS Organizations that a security team and a DevOps team manage. Both teams access the accounts by using AWS IAM Identity Center. A dedicated group has been created for each team. The DevOps team's group has been assigned a permission set named DevOps. The permission set has the AdministratorAccess managed IAM policy attached. The permission set has been applied to all accounts in the organization. The security team wants to ensure that the DevOps team does not have access to IAM Identity Center in the organization's management account. The security team has attached the following SCP to the organization root:

   

   After implementing the policy, the security team discovers that the DevOps team can still access IAM Identity Center. Which solution will fix the problem?

   • AIn the organization's management account, create a new OU. Move the organization's management account to the new OU. Detach the SCP from the organization root. Attach the SCP to the new OU.
   • BIn the organization's management account, update the SCP condition reference to the ARN of the DevOps team's group role to include the AWS account ID of the organization's management account.
   • CIn IAM Identity Center, create a new permission set. Ensure that the assigned policy has full access but explicitly denies permission for the sso:* action and the sso-directory:* action. Update the assigned permission set for the DevOps team's group role in the organization's management account. Delete the SCP.
   • DIn IAM Identity Center, update the DevOps permission set. Ensure that the assigned policy has full access but explicitly denies permission for the sso:* action and the sso-directory:* action. In the Deny statement, add a StringEquals condition that compares the aws:SourceAccount global condition context key with the organization's management account IDelete the SCP.

   Show answer

   Answer: D

   Explanation

   A and B do not work. SCPs do not apply to the management account. https://docs.aws.amazon.com/organizations/latest/userguide/orgs_best-practices_mgmt-acct.html Best practice is to limit access to the management account, and/or to delegate to Identity Centro to another member account. But since that's not an option given these answers, limiting the permission set is the next best thing.

   Source: Adapted from community discussion — Impromptu

   References

   • AWS documentation

   Next question

7. Question 197 · 427 in bank

   An Amazon EC2 Auto Scaling group manages EC2 instances that were created from an AMI. The AMI has the AWS Systems Manager Agent installed. When an EC2 instance is launched into the Auto Scaling group, tags are applied to the EC2 instance. EC2 instances that are launched by the Auto Scaling group must have the correct operating system configuration. Which solution will meet these requirements?

   • ACreate a Systems Manager Run Command document that configures the desired instance configuration. Set up Systems Manager Compliance to invoke the Run Command document when the EC2 instances are not in compliance with the most recent patches.
   • BCreate a Systems Manager State Manager association that links to the Systems Manager command document. Create a tag query that runs immediately.
   • CCreate a Systems Manager Run Command task that specifies the desired instance configuration. Create a maintenance window in Systems Manager Maintenance Windows that runs daily. Register the Run Command task against the maintenance window. Designate the targets.
   • DCreate a Systems Manager Patch Manager patch baseline and a patch group that use the same tags that the Auto Scaling group applies. Register the patch group with the patch baseline. Define a Systems Manager command document to patch the instances Invoke the document by using Systems Manager Run Command.

   Show answer

   Answer: B

   Explanation

   Option B: Create a Systems Manager State Manager association that links to the Systems Manager command document. Create a tag query that runs immediately. Here’s why: State Manager allows you to define and maintain consistent configuration of your instances. By creating an association that links to the command document, you can ensure that the desired configuration is applied as soon as the instances are launched. Using a tag query ensures that the configuration is applied to the correct instances based on their tags, which are applied by the Auto Scaling group.

   Source: Adapted from community discussion — limelight04

   Next question

8. Question 198 · 427 in bank

   A developer is maintaining a fleet of 50 Amazon EC2 Linux servers. The servers are part of an Amazon EC2 Auto Scaling group, and also use Elastic Load Balancing for load balancing. Occasionally, some application servers are being terminated after failing ELB HTTP health checks. The developer would like to perform a root cause analysis on the issue, but before being able to access application logs, the server is terminated. How can log collection be automated?

   • AUse Auto Scaling lifecycle hooks to put instances in a Pending:Wait state. Create an Amazon CloudWatch alarm for EC2 Instance Terminate Successful and trigger an AWS Lambda function that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.
   • BUse Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an AWS Config rule for EC2 Instance-terminate Lifecycle Action and trigger a step function that invokes a script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.
   • CUse Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon CloudWatch subscription filter for EC2 Instance Terminate Successful and trigger a CloudWatch agent that invokes a script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.
   • DUse Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon EventBridge rule for EC2 Instance-terminate Lifecycle Action and trigger an AWS Lambda function that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.

   Show answer

   Answer: D

   Explanation

   D. Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon EventBridge rule for EC2 Instance-terminate Lifecycle Action and trigger an AWS Lambda function that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected. With this solution, you can use an Auto Scaling lifecycle hook to put instances in a wait state before termination. This provides an opportunity to collect logs before the instance is terminated. The solution can use an Amazon EventBridge rule for EC2 Instance-terminate Lifecycle Action to trigger an AWS Lambda function that will execute an SSM Run Command script. The script can collect logs and push them to Amazon S3 before completing the lifecycle action and allowing the instance to terminate. This solution provides a way to collect logs before instances are terminated, allowing for root cause analysis of issues.

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation

   Next question

9. Question 199 · 427 in bank

   A company uses AWS Organizations to manage its AWS accounts. The organization root has a child OU that is named Department. The Department OU has a child OU that is named Engineering. The default FullAWSAccess policy is attached to the root, the Department OU, and the Engineering OU. The company has many AWS accounts in the Engineering OU. Each account has an administrative IAM role with the AdministratorAccess IAM policy attached. The default FullAWSAccessPolicy is also attached to each account. A DevOps engineer plans to remove the FullAWSAccess policy from the Department OU. The DevOps engineer will replace the policy with a policy that contains an Allow statement for all Amazon EC2 API operations. What will happen to the permissions of the administrative 1AM roles as a result of this change?

   • AAll API actions on all resources will be allowed.
   • BAll API actions on EC2 resources will be allowed. All other API actions will be denied.
   • CAll API actions on all resources will be denied.
   • DAll API actions on EC2 resources will be denied. All other API actions will be allowed.

   Show answer

   Answer: B

   Explanation

   When the FullAWSAccess policy is replaced with a policy that allows only EC2 actions, this new SCP will act as a boundary. Even if an IAM role or user within the account has a broader permission set (like AdministratorAccess), the SCP limits what can be done.

   Source: Adapted from community discussion — hzaki

   References

   • AWS documentation

   Next question

10. Question 200 · 427 in bank

    A company manages AWS accounts in AWS Organizations. The company needs a solution to send Amazon CloudWatch Logs data to an Amazon S3 bucket in a dedicated AWS account. The solution must support all existing and future CloudWatch Logs log groups. Which solution will meet these requirements?

    • AEnable Organizations backup policies to back up all log groups to a dedicated S3 bucket. Add an S3 bucket policy that allows access from all accounts that belong to the company.
    • BCreate a backup plan in AWS Backup. Specify a dedicated S3 bucket as a backup vault. Assign all CloudWatch Logs log group resources to the backup plan. Create resource assignments in the backup plan for all accounts that belong to the company.
    • CCreate a backup plan in AWS Backup. Specify a dedicated S3 bucket as a backup vault. Assign all existing log groups to the backup plan. Create resource assignments in the backup plan for all accounts that belong to the company. Create an AWS Systems Manager Automation runbook to assign log groups to a backup plan. Create an AWS Config rule that has an automatic remediation action for all noncompliant log groups. Specify the runbook as the rule's target.
    • DCreate a CloudWatch Logs destination and an Amazon Kinesis Data Firehose delivery stream in the dedicated AWS account. Specify the S3 bucket as the destination of the delivery stream. Create subscription filters for all existing log groups in all accounts. Create an AWS Lambda function to call the CloudWatch Logs PutSubscriptionFilter API operation. Create an Amazon EventBridge rule to invoke the Lambda function when a CreateLogGroup event occurs.

    Show answer

    Answer: D

    Explanation

    C seems like the most elegant solution, but I was not able to find any documentation that supports it. For option D I found this - https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html#FirehoseExample

    Source: Adapted from community discussion — aws_god

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 191. 427 questions available.