DOP-C02 practice questions 241–250

1. Question 241 · 427 in bank

   A company is using Amazon Elastic Kubernetes Service (Amazon EKS) to run its applications. The EKS cluster is successfully running multiple pods. The company stores the pod images in Amazon Elastic Container Registry (Amazon ECR). The company needs to configure Pod Identity access for the EKS cluster. The company has already updated the node IAM role by using the permissions for Pod Identity access. Which solution will meet these requirements?

   • ACreate an IAM OpenID Connect (OIDC) provider for the EKS cluster.
   • BEnsure that the nodes can reach the EKS Auth API. Add and configure the EKS Pod Identity Agent add-on for the EKS cluster.
   • CCreate an EKS access entry that uses the API_AND-CONFIG_MAP cluster authentication mode.
   • DConfigure the AWS Security Token Service (AWS STS) endpoint for the Kubernetes service account that the pods in the EKS cluster use.

   Show answer

   Answer: B

   Explanation

   Pod Identity is a "new" way to provide Pod access to AWS services and does not rely on OIDC. Instead you have to setup the EKS Pod Identity Agent and must ensure kubernetes nodes can reach the EKS Auth API endpoint. https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html

   Source: Adapted from community discussion — pma17

   References

   • AWS documentation

   Next question

2. Question 242 · 427 in bank

   Select 3

   A company is implementing an Amazon Elastic Container Service (Amazon ECS) cluster to run its workload. The company architecture will run multiple ECS services on the cluster. The architecture includes an Application Load Balancer on the front end and uses multiple target groups to route traffic. A DevOps engineer must collect application and access logs. The DevOps engineer then needs to send the logs to an Amazon S3 bucket for near-real-time analysis. Which combination of steps must the DevOps engineer take to meet these requirements? (Choose three.)

   • ADownload the Amazon CloudWatch Logs container instance from AWS. Configure this instance as a task. Update the application service definitions to include the logging task.
   • BInstall the Amazon CloudWatch Logs agent on the ECS instances. Change the logging driver in the ECS task definition to awslogs.
   • CUse Amazon EventBridge to schedule an AWS Lambda function that will run every 60 seconds and will run the Amazon CloudWatch Logs create-export-task command. Then point the output to the logging S3 bucket.
   • DActivate access logging on the ALB. Then point the ALB directly to the logging S3 bucket.
   • EActivate access logging on the target groups that the ECS services use. Then send the logs directly to the logging S3 bucket.
   • FCreate an Amazon Kinesis Data Firehose delivery stream that has a destination of the logging S3 bucket. Then create an Amazon CloudWatch Logs subscription filter for Kinesis Data Firehose.

   Show answer

   Answer: BDF

   Explanation

   Explanation: Option B is correct because you can change the logging driver in the ECS task definition to awslogs, which will direct the logs to Amazon CloudWatch Logs. Then, the logs can be forwarded to the Amazon S3 bucket. Option D is correct because enabling access logging on the Application Load Balancer (ALB) allows the collection of access logs that can be sent directly to an S3 bucket. Option F is correct because you can create an Amazon Kinesis Data Firehose delivery stream that can deliver logs from CloudWatch Logs directly to an Amazon S3 bucket in near-real-time.

   Source: Adapted from community discussion — tartarus23

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 243 · 427 in bank

   A company has multiple AWS accounts in an organization in AWS Organizations that has all features enabled. The company’s DevOps administrator needs to improve security across all the company's AWS accounts. The administrator needs to identify the top users and roles in use across all accounts. Which solution will meet these requirements with the MOST operational efficiency?

   • ACreate a new organization trail in AWS CloudTrail. Configure the trail to send log events to Amazon CloudWatch Logs. Create a CloudWatch Contributor Insights rule for the userIdentity.arn log field. View the results in CloudWatch Contributor Insights.
   • BCreate an unused access analysis for the organization by using AWS Identity and Access Management Access Analyzer. Review the analyzer results and determine if each finding has the intended level of permissions required for the workload.
   • CCreate a new organization trail in AWS CloudTrail. Create a table in Amazon Athena that uses partition projection. Load the Athena table with CloudTrail data. Query the Athena table to find the top users and roles.
   • DGenerate a Service access report for each account by using Organizations. From the results, pull the last accessed date and last accessed by account fields to find the top users and roles.

   Show answer

   Answer: C

   Explanation

   You can use partition projection in Athena to optimize your queries by specifying how the logs are structured in S3. This makes the process of querying CloudTrail logs across multiple AWS accounts much more efficient.

   Source: Adapted from community discussion — Ky_24

   Next question

4. Question 244 · 427 in bank

   A company has an organization in AWS Organizations with many Oils that contain many AWS accounts. The organization has a dedicated delegated administrator AWS account. The company needs the accounts in one OU to have server-side encryption enforced for all Amazon Elastic Block Store (Amazon EBS) volumes and Amazon Simple Queue Service (Amazon SQS) queues that are created or updated on an AWS CloudFormation stack. Which solution will enforce this policy before a CloudFormation stack operation in the accounts of this OU?

   • AActivate trusted access to CloudFormation StackSets. Create a CloudFormation Hook that enforces server-side encryption on EBS volumes and SQS queues. Deploy the Hook across the accounts in the OU by using StackSets.
   • BSet up AWS Config in all the accounts in the OU. Use AWS Systems Manager to deploy AWS Config rules that enforce server-side encryption for EBS volumes and SQS queues across the accounts in the OU.
   • CWrite an SCP to deny the creation of EBS volumes and SQS queues unless the EBS volumes and SQS queues have server-side encryption. Attach the SCP to the OU.
   • DCreate an AWS Lambda function in the delegated administrator account that checks whether server-side encryption is enforced for EBS volumes and SQS queues. Create an IAM role to provide the Lambda function access to the accounts in the OU.

   Show answer

   Answer: A

   Explanation

   CloudFormation Hooks allow you to intercept stack operations and perform validations or enforce policies before resources are created or updated. Develop a CloudFormation Hook that checks whether EBS volumes and SQS queues in the CloudFormation templates have SSE enabled. Use CloudFormation StackSets with trusted access to deploy the Hook across all accounts in the OU. The Hook will validate templates and prevent non-compliant resources from being created or updated during stack operations. Applies only to resources managed via CloudFormation, aligning with the company's requirement. Centralized Deployment: StackSets allow you to deploy the Hook across multiple accounts and regions efficiently. Hooks do not interfere with non-CloudFormation operations, limiting the scope to what's required.

   Source: Adapted from community discussion — f4b18ba

   Next question

5. Question 245 · 427 in bank

   Select 3

   A company is running an internal application in an Amazon Elastic Container Service (Amazon ECS) cluster on Amazon EC2. The ECS cluster instances can connect to the public internet. The ECS tasks that run on the cluster instances are configured to use images from both private Amazon Elastic Container Registry (Amazon ECR) repositories and a public ECR registry repository. A new security policy requires the company to remove the ECS cluster's direct access to the internet. The company must remove any NAT gateways and internet gateways from the VPC that hosts the cluster. A DevOps engineer needs to ensure the ECS cluster can still download images from both the public ECR registry and the private ECR repositories. Images from the public ECR registry must remain up-to-date. New versions of the images must be available to the ECS cluster within 24 hours of publication. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)

   • ACreate an AWS CodeBuild project and a new private ECR repository for each image that is downloaded from the public ECR registry. Configure each project to pull the image from the public ECR repository and push the image to the new private ECR repository. Create an Amazon EventBridge rule that invokes the CodeBuild project once every 24 hours. Update each task definition in the ECS cluster to refer to the new private ECR repository.
   • BCreate a new Amazon ECR pull through cache rule for each image that is downloaded from the public ECR registry. Create an AWS Lambda function that invokes each pull through cache rule. Create an Amazon EventBridge rule that invokes the Lambda function once every 24 hours. Update each task definition in the ECS cluster to refer to the image from the pull through cache.
   • CCreate a new Amazon ECR pull through cache rule for the public ECR registry. Update each task definition in the ECS cluster to refer to the image from the pull through cache. Ensure each public image has been downloaded through the pull through cache at least once before removing internet access from the VPC.
   • DCreate an Amazon ECR interface VPC endpoint for the public ECR repositories that are in the VPC.
   • ECreate an Amazon ECR interface VPC endpoint for the private ECR repositories that are in the VPC.
   • FCreate an Amazon S3 gateway endpoint in the VPC.

   Show answer

   Answer: CEF

   Explanation

   By using an Amazon ECR pull through cache rule (Option C) and setting up the necessary VPC endpoints for private ECR (Option E) and S3 (Option F), the company can: Eliminate Internet Access: Remove NAT gateways and internet gateways from the VPC. Maintain Image Access: Allow ECS tasks to pull images from both private and public ECR repositories without internet access. Ensure Image Updates: Automatically receive updates to public images within 24 hours via the pull through cache. Minimize Operational Overhead: Avoid complex setups with additional services like CodeBuild, Lambda, or custom scripts.

   Source: Adapted from community discussion — f4b18ba

   References

   • AWS documentation

   Next question

6. Question 246 · 427 in bank

   Select 2

   A company has a continuous integration pipeline where the company creates container images by using AWS CodeBuild. The created images are stored in Amazon Elastic Container Registry (Amazon ECR). Checking for and fixing the vulnerabilities in the images takes the company too much time. The company wants to identify the image vulnerabilities quickly and notify the security team of the vulnerabilities. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)

   • AActivate Amazon Inspector enhanced scanning for Amazon ECR. Configure the enhanced scanning to use continuous scanning. Set up a topic in Amazon Simple Notification Service (Amazon SNS).
   • BCreate an Amazon EventBridge rule for Amazon Inspector findings. Set an Amazon Simple Notification Service (Amazon SNS) topic as the rule target.
   • CActivate AWS Lambda enhanced scanning for Amazon ECR. Configure the enhanced scanning to use continuous scanning. Set up a topic in Amazon Simple Email Service (Amazon SES).
   • DCreate a new AWS Lambda function. Invoke the new Lambda function when scan findings are detected.
   • EActivate default basic scanning for Amazon ECR for all container images. Configure the default basic scanning to use continuous scanning. Set up a topic in Amazon Simple Notification Service (Amazon SNS).

   Show answer

   Answer: AB

   References

   • AWS documentation

   Next question

7. Question 247 · 427 in bank

   A DevOps administrator is configuring a repository to store a company's container images. The administrator needs to configure a lifecycle rule that automatically deletes container images that have a specific tag and that are older than 15 days. Which solution will meet these requirements with the MOST operational efficiency?

   • ACreate a repository in Amazon Elastic Container Registry (Amazon ECR). Add a lifecycle policy to the repository to expire images that have the matching tag after 15 days.
   • BCreate a repository in AWS CodeArtifact. Add a repository policy to the CodeArtifact repository to expire old assets that have the matching tag after 15 days.
   • CCreate a bucket in Amazon S3. Add a bucket lifecycle policy to expire old objects that have the matching tag after 15 days
   • DCreate an EC2 Image Builder container recipe. Add a build component to expire the container that has the matching tag after 15 days.

   Show answer

   Answer: A

   Explanation

   The requirement is to automatically manage container images based on a specific tag and age. Amazon Elastic Container Registry (Amazon ECR) supports lifecycle policies, which are specifically designed to automate the management of image lifecycle events like expiration. Lifecycle policies in ECR allow you to define rules for expiring or retaining images based on criteria like image tags and age, providing an efficient solution with minimal operational overhead.

   Source: Adapted from community discussion — uncledana

   Next question

8. Question 248 · 427 in bank

   Select 2

   A company uses Amazon Redshift as its data warehouse solution. The company wants to create a dashboard to view changes to the Redshift users and the queries the users perform. Which combination of steps will meet this requirement? (Choose two.)

   • ACreate an Amazon CloudWatch log group. Create an AWS CloudTrail trail that writes to the CloudWatch log group.
   • BCreate a new Amazon S3 bucket. Configure default audit logging on the Redshift cluster. Configure the S3 bucket as the target.
   • CConfigure the Redshift cluster database audit logging to include user activity logs. Configure Amazon CloudWatch as the target.
   • DCreate an Amazon CloudWatch dashboard that has a log widget. Configure the widget to display user details from the Redshift logs.
   • ECreate an AWS Lambda function that uses Amazon Athena to query the Redshift logs. Create an Amazon CloudWatch dashboard that has a custom widget type that uses the Lambda function.

   Show answer

   Answer: CD

   Explanation

   To log users queries you need to include user activity logs which require additional setup on the Redshift cluster. So C, because it is not mentioned on B. Then to display this logs the only option is D, because E requires the logs to be on S3.

   Source: Adapted from community discussion — pma17

   Next question

9. Question 249 · 427 in bank

   A company uses an organization in AWS Organizations to manage its 500 AWS accounts. The organization has all features enabled. The AWS accounts are in a single OU. The developers need to use the CostCenter tag key for all resources in the organization's member accounts. Some teams do not use the CostCenter tag key to tag their Amazon EC2 instances. The cloud team wrote a script that scans all EC2 instances in the organization's member accounts. If the EC2 instances do not have a CostCenter tag key, the script will notify AWS account administrators. To avoid this notification, some developers use the CostCenter tag key with an arbitrary string in the tag value. The cloud team needs to ensure that all EC2 instances in the organization use a CostCenter tag key with the appropriate cost center value. Which solution will meet these requirements?

   • ACreate an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Create a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Update the script to scan the tag keys and tag values. Modify the script to update noncompliant resources with a default approved tag value for the CostCenter tag key.
   • BCreate an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Update the script to scan the tag keys and tag values and notify the administrators when the tag values are not valid.
   • CCreate an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Create an IAM permission boundary in the organization's member accounts that restricts the CostCenter tag values to a list of valid cost centers.
   • DCreate a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Configure an AWS Lambda function that adds an empty CostCenter tag key to an EC2 instance. Create an Amazon EventBridge rule that matches events to the RunInstances API action with the Lambda function as the target.

   Show answer

   Answer: A

   Explanation

   Service Control Policy (SCP): Creating an SCP ensures that any attempt to create EC2 instances without the CostCenter tag key is denied right from the start. This enforces the requirement at the organizational level. Tag Policy: By creating a tag policy that enforces the CostCenter tag values to be from a known list, you can ensure that only valid cost center values are used across all EC2 instances. Script Update: Updating the script to not only scan for tag keys and values but also to update noncompliant resources with a default approved tag value ensures compliance and mitigates the issue of arbitrary string values. Comprehensive Solution: This approach addresses both the presence of the CostCenter tag and the correctness of its value, providing a comprehensive solution to the problem.

   Source: Adapted from community discussion — f4b18ba

   Next question

10. Question 250 · 427 in bank

    Select 2

    A DevOps engineer uses a pipeline in AWS CodePipeline. The pipeline has a build action and a deploy action for a single-page web application that is delivered to an Amazon S3 bucket. Amazon CloudFront serves the web application. The build action creates an artifact for the web application. The DevOps engineer has created an AWS CloudFormation template that defines the S3 bucket and configures the S3 bucket to host the application. The DevOps engineer has configured a CloudFormation deploy action before the S3 action. The CloudFormation deploy action creates the S3 bucket. The DevOps engineer needs to configure the S3 deploy action to use the S3 bucket from the CloudFormation template. Which combination of steps will meet these requirements? (Choose two.)

    • AAdd an output named BucketName to the CloudFormation template. Set the output's value to refer to the S3 bucket from the CloudFormation template. Configure the output value to export to an AWS::SSM::Parameter resource named Stackvariables.
    • BAdd an output named BucketName to the CloudFormation template. Set the output's value to refer to the S3 bucket from the CloudFormation template. Set the CloudFormation action's namespace to StackVariables in the pipeline.
    • CConfigure the output artifacts of the CloudFormation action in the pipeline to be an AWS Systems Manager Parameter Store parameter named StackVariables. Name the artifact BucketName.
    • DConfigure the build artifact from the build action as the input to the CodePipeline S3 deploy action. Configure the deploy action to deploy to the S3 bucket by using the StackVariables.BucketName variable.
    • EConfigure the build artifact from the build action and the AWS Systems Manager parameter as the inputs to the deploy action. Configure the deploy action to deploy to the S3 bucket by using the StackVariables.BucketName variable.

    Show answer

    Answer: BD

    Explanation

    Option B: Adding an output to the CloudFormation template allows the pipeline to extract the S3 bucket name created during the stack deployment. Setting the namespace (StackVariables) in the CloudFormation action enables other actions in the pipeline to reference the output values using that namespace. Option D: The build artifact needs to be input to the S3 deploy action to provide the files for deployment. By using StackVariables.BucketName, the deploy action dynamically references the bucket created by the CloudFormation stack, ensuring that the files are deployed to the correct location.

    Source: Adapted from community discussion — f4b18ba

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 241. 427 questions available.