DOP-C02 practice questions 231–240

1. Question 231 · 427 in bank

   A company has migrated its container-based applications to Amazon EKS and want to establish automated email notifications. The notifications sent to each email address are for specific activities related to EKS components. The solution will include Amazon SNS topics and an AWS Lambda function to evaluate incoming log events and publish messages to the correct SNS topic. Which logging solution will support these requirements?

   • AEnable Amazon CloudWatch Logs to log the EKS components. Create a CloudWatch subscription filter for each component with Lambda as the subscription feed destination.
   • BEnable Amazon CloudWatch Logs to log the EKS components. Create CloudWatch Logs Insights queries linked to Amazon EventBridge events that invoke Lambda.
   • CEnable Amazon S3 logging for the EKS components. Configure an Amazon CloudWatch subscription filter for each component with Lambda as the subscription feed destination.
   • DEnable Amazon S3 logging for the EKS components. Configure S3 PUT Object event notifications with AWS Lambda as the destination.

   Show answer

   Answer: A

   Explanation

   Correct Answer is A. Explanation: Amazon EKS integrates with CloudWatch Logs to provide detailed logs of the state and execution of the services in the cluster. CloudWatch subscription filters can be used to route specific log events from a CloudWatch Logs group to a Lambda function. The Lambda function can then process the events and publish notifications to the appropriate Amazon SNS topic.

   Source: Adapted from community discussion — tartarus23

   References

   • AWS documentation

   Next question

2. Question 232 · 427 in bank

   Select 2

   A company has an AWS CodePipeline pipeline in the eu-west-1 Region. The pipeline stores the build artifacts in an Amazon S3 bucket. The pipeline builds and deploys an AWS Lambda function by using an AWS CloudFormation deploy action. A DevOps engineer needs to update the existing pipeline to also deploy the Lambda function to the us-east-1 Region. The pipeline has already been updated to create an additional artifact to deploy to us-east-1. Which combination of steps should the DevOps engineer take to meet these requirements? (Choose two.)

   • AModify the CloudFormation template to include a parameter for the Lambda function code's .zip file location. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to pass in the us-east-1 artifact location as a parameter override.
   • BCreate a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the additional artifact that was created for us-east-1.
   • CCreate an S3 bucket in us-east-1. Configure the S3 bucket policy to allow CodePipeline to have read and write access.
   • DCreate an S3 bucket in us-east-1. Configure S3 Cross-Region Replication (CRR) from the S3 bucket in eu-west-1 to the S3 bucket in us-east-1.
   • EModify the pipeline to include the S3 bucket for us-east-1 as an artifact store. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the us-east-1 artifact.

   Show answer

   Answer: CE

   Explanation

   Correct ansers "C" and "E". "A" is wrong for sure, because it's not enough to simply bypass a new Lambda code location as a parameter of existing CloudFormation Template: you need NOT only another Lambda code location, but also another region, another VPC id, etc. So you need to have a second dedicated separate template.

   Source: Adapted from community discussion — eugene2owl

   Next question

3. Question 233 · 427 in bank

   A company uses an AWS Cloud Development Kit (AWS CDK) application for its infrastructure. The AWS CDK application creates AWS Lambda functions and the IAM roles that are attached to the functions. The company also uses AWS Organizations. The company's developers can assume the AWS CDK application deployment role. The company's security team discovered that the developers and the role used to deploy the AWS CDK application have more permissions than necessary. The security team also discovered that the roles attached to the Lambda functions that the CDK application creates have more permissions than necessary. The developers must not have the ability to grant additional permissions. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role and the AWS CDK application deployment role. Centrally create new IAM roles to attach to the Lambda functions for the developers to use to provision Lambda functions.
   • BCreate an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Update the account's AWS CDK bootstrapping to use the permission boundary. Update the configuration in the AWS CDK application for the default permissions boundary to use the policy.
   • CCreate an IAM permission boundary policy. Define the maximum actions that the AWS CDK application requires in the policy. Instruct the developers to use the permission boundary policy name when they create a role in the AWS CDK application code.
   • DCreate an SCP that denies the iam:CreateRole action and the iam:UpdateRole action for the developer role. Give the AWS CDK deployment role access to create roles associated with Lambda functions. Run AWS Identity and Access Management Access Analyzer to verify that the Lambda functions role does not have permissions.

   Show answer

   Answer: B

   Explanation

   In Option B, the use of a permission boundary directly in the CDK workflow ensures that the created roles are inherently compliant, removing the need for IAM Access Analyzer’s reactive validation step. This approach reduces operational complexity and aligns with best practices for proactive security.

   Source: Adapted from community discussion — phu0298

   Next question

4. Question 234 · 427 in bank

   A company uses Amazon Elastic Container Registry (Amazon ECR) private registries to store container images. A DevOps team needs to ensure that the container images are regularly scanned for software package vulnerabilities. Which solution will meet this requirement?

   • AEnable enhanced scanning for private registries in Amazon ECR.
   • BEnable basic continuous scanning for private registries in Amazon ECR.
   • CCreate an AWS System Manager Automation document to scan images by using the AWS SDK. Configure the Automation document to run when a new image is pushed to an ECR registry.
   • DCreate an AWS Lambda function that scans all images in Amazon ECR by using the AWS SDK. Create an Amazon EventBridge rule to invoke the Lambda function each day.

   Show answer

   Answer: A

   Explanation

   Amazon ECR offers two levels of image scanning: 1. Basic Scanning: Detects vulnerabilities when images are pushed to the repository. 2. Enhanced Scanning: Provides continuous scanning of images, including detailed reports and automatic rescans when vulnerabilities are published.

   Source: Adapted from community discussion — phu0298

   Next question

5. Question 235 · 427 in bank

   Select 3

   A security team sets up a workflow that invokes an AWS Step Functions workflow when Amazon EventBridge matches specific events. The events can be generated by several AWS services. AWS CloudTrail records user activities. The security team notices that some important events do not invoke the workflow as expected. The CloudTrail logs do not indicate any direct errors related to the missing events. Which combination of steps will identify the root cause of the missing event invocations? (Choose three.)

   • AEnable EventBridge schema discovery on the event bus to determine whether the event patterns match the expected schema.
   • BConfigure Amazon CloudWatch to monitor EventBridge metrics and Step Functions metrics. Set up alerts for anomalies in event patterns and workflow invocations.
   • CConfigure an AWS Lambda logging function to monitor and log events from EventBridge to provide more details about the processed events.
   • DReview the Step Functions execution history for patterns of failures or timeouts that could correlate to the missing event invocations.
   • EReview metrics for the EventBridge failed invocations to ensure that the IAM execution role that is attached to the rule has sufficient permissions.
   • FVerify that the Step Functions workflow has the correct permissions to be invoked by EventBridge.

   Show answer

   Answer: ABE

   Explanation

   I'd say E instead of F. The EventBridge rule contains the IAM execution role, that needs the permissions to invoke the step function. The permissions is not given at the step function side (no resource-based policy, see https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html)

   Source: Adapted from community discussion — Impromptu

   References

   • AWS documentation

   Next question

6. Question 236 · 427 in bank

   A company's DevOps engineer uses AWS Systems Manager to perform maintenance tasks. The company has a few Amazon EC2 instances that require a restart after notifications from AWS Health. The DevOps engineer must implement an automated solution that uses Amazon EventBridge to remediate the notifications during the company's scheduled maintenance windows. How should the DevOps engineer configure an EventBridge rule to meet these requirements?

   • AConfigure an event source of AWS Health. Configure event types that indicate scheduled instance termination and retirement. Target the AWS-RestartEC2Instance Systems Manager Automation runbook to restart the EC2 instances.
   • BConfigure an event source of Systems Manager. Configure an event type that indicates a maintenance window. Target the AWS-RestartEC2Instance Systems Manager Automation runbook to restart the EC2 instances.
   • CConfigure an event source of AWS Health. Configure event types that indicate scheduled instance termination and retirement. Target a newly created AWS Lambda function that registers a Systems Manager maintenance window task to restart the EC2 instances.
   • DConfigure an event source of EC2. Configure an event type that indicates instance state notification. Target a newly created AWS Lambda function that registers a Systems Manager maintenance window task to restart the EC2 instances.

   Show answer

   Answer: A

   Explanation

   C. Lambda Function to Register a Maintenance Window Task • While this approach could work, it unnecessarily complicates the solution. AWS Systems Manager and EventBridge provide native integrations that eliminate the need for a custom Lambda function. Therefore the answer should be A

   Source: Adapted from community discussion — phu0298

   Next question

7. Question 237 · 427 in bank

   A DevOps engineer manages an AWS CodePipeline pipeline that builds and deploys a web application on AWS. The pipeline has a source stage, a build stage, and a deploy stage. When deployed properly, the web application responds with a 200 OK HTTP response code when the URL of the home page is requested. The home page recently returned a 503 HTTP response code after CodePipeline deployed the application. The DevOps engineer needs to add an automated test into the pipeline. The automated test must ensure that the application returns a 200 OK HTTP response code after the application is deployed. The pipeline must fail if the response code is not present during the test. The DevOps engineer has added a CheckURL stage after the deploy stage in the pipeline. What should the DevOps engineer do next to implement the automated test?

   • AConfigure the CheckURL stage to use an Amazon CloudWatch action. Configure the action to use a canary synthetic monitoring check on the application URL and to report a success or failure to CodePipeline.
   • BCreate an AWS Lambda function to check the response code status of the URL and to report a success or failure to CodePipeline. Configure an action in the CheckURL stage to invoke the Lambda function.
   • CConfigure the CheckURL stage to use an AWS CodeDeploy action. Configure the action with an input artifact that is the URL of the application and to report a success or failure to CodePipeline.
   • DDeploy an Amazon API Gateway HTTP API that checks the response code status of the URL and that reports success or failure to CodePipeline. Configure the CheckURL stage to use the AWS Device Farm test action and to provide the API Gateway HTTP API as an input artifact.

   Show answer

   Answer: B

   Next question

8. Question 238 · 427 in bank

   A company has an application that uploads access logs to an Amazon CloudWatch Logs log group. The fields in the log lines include the response code and the application name. The company wants to create a CloudWatch metric to track the number of requests by response code in a specific range and with a specific application name. Which solution will meet these requirements?

   • ACreate a CloudWatch Logs log event filter on the CloudWatch Logs log stream to match the response code range. Configure the log event filter to increment a metric. Set the response code and application name as dimensions.
   • BCreate a CloudWatch Logs metric filter on the CloudWatch Logs log group to match the response code range. Configure the metric filter to increment a metric. Set the response code and application name as dimensions.
   • CCreate a CloudWatch Contributor Insights rule on the CloudWatch Logs log stream with a filter to match the response code range. Configure the Contributor Insights rule to increment a CloudWatch metric with the response code and application name as dimensions.
   • DCreate a CloudWatch Logs Insights query on the CloudWatch Logs log group to match the response code range. Configure the Logs Insights query to increment a CloudWatch metric with the response code and application name as dimensions.

   Show answer

   Answer: B

   Next question

9. Question 239 · 427 in bank

   A DevOps engineer provisioned an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with managed node groups. The DevOps engineer associated an OpenID Connect (OIDC) issuer with the cluster. The DevOps engineer is configuring Amazon Elastic Block Store (Amazon EBS) General Purpose SSD (gp3) volumes for the cluster. The DevOps engineer attempts to initiate a PersistentVolumeClaim (PVC) request but is unable to provision a volume. To troubleshoot the issue, the DevOps engineer runs the kubectl describe pyc command. The DevOps engineer receives a failed to provision volume with StorageClass error and a could not create volume in EC2:UnauthorizedOperation error. Which solution will resolve these errors?

   • ACreate a Kubernetes cluster role that allows the persistent volumes to perform get, list, watch, create, and delete operations. Configure the cluster role to allow get, list, and watch operations for storage in the cluster.
   • BCreate an Amazon EBS Container Storage Interface (CSI) driver IAM role that has the required permissions and trust relationships. Attach the IAM role to the Amazon EBS CSI driver add-on in the cluster.
   • CAdd the ebs.csi.aws.com/volumeType:gp3 annotation to the PersistentVolumeClaim object in the cluster.
   • DCreate a Kubernetes storage class object. Set the provisioner value to ebs.csi.aws.com. Set the volumeBindingMode value to WaitForFirstConsumer in the luster.

   Show answer

   Answer: B

   Explanation

   The root cause of the error is that the EBS CSI driver does not have the necessary IAM permissions to create EBS volumes in EC2. Solution B resolves the issue by creating an appropriate IAM role and attaching it to the EBS CSI driver, giving it the required permissions.

   Source: Adapted from community discussion — uncledana

   References

   • AWS documentation

   Next question

10. Question 240 · 427 in bank

    Select 3

    A company runs a fleet of Amazon EC2 instances in a VPC. The company's employees remotely access the EC2 instances by using the Remote Desktop Protocol (RDP). The company wants to collect metrics about how many RDP sessions the employees initiate every day. Which combination of steps will meet this requirement? (Choose three.)

    • ACreate an Amazon EventBridge rule that reacts to EC2 Instance State-change Notification events.
    • BCreate an Amazon CloudWatch Logs log group. Specify the log group as a target for the EventBridge rule.
    • CCreate a flow log in VPC Flow Logs.
    • DCreate an Amazon CloudWatch Logs log group. Specify the log group as a destination for the flow log.
    • ECreate a log group metric filter.
    • FCreate a log group subscription filter. Use EventBridge as the destination.

    Show answer

    Answer: CDE

    Explanation

    C. Create a flow log in VPC Flow Logs. • Why? VPC Flow Logs capture information about the traffic to and from network interfaces in your VPC. This is crucial for identifying and analyzing RDP sessions, which use TCP port 3389 by default. D. Create an Amazon CloudWatch Logs log group. Specify the log group as a destination for the flow log. • Why? The captured VPC Flow Logs must be stored in a destination to enable analysis. Specifying a CloudWatch Logs log group allows for centralized storage and querying of logs. E. Create a log group metric filter. • Why? A metric filter enables you to extract specific metrics from the flow logs. You can filter for traffic using port 3389 (RDP) and create a metric to count the sessions.

    Source: Adapted from community discussion — Ky_24

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 231. 427 questions available.