DOP-C02 practice questions 251–260

1. Question 251 · 427 in bank

   A company used a lift and shift strategy to migrate a workload to AWS. The company has an Auto Scaling group of Amazon EC2 instances. Each EC2 instance runs a web application, a database, and a Redis cache. Users are experiencing large variations in the web application's response times. Requests to the web application go to a single EC2 instance that is under significant load. The company wants to separate the application components to improve availability and performance. Which solution will meet these requirements?

   • ACreate a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Application Load Balancer and an Auto Scaling group for the Redis cache.
   • BCreate an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Multi-AZ deployment. Create a Network Load Balancer and an Auto Scaling group in a single Availability Zone for the Redis cache.
   • CCreate a Network Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora Serverless database. Create an Amazon ElastiCache (Redis OSS) cluster for the cache. Create a target group that has a DNS target type that contains the ElastiCache (Redis OSS) cluster hostname.
   • DCreate an Application Load Balancer and an Auto Scaling group for the web application. Migrate the database to an Amazon Aurora database that has a Multi-AZ deployment. Create an Amazon ElastiCache (Redis OSS) cluster for the cache.

   Show answer

   Answer: D

   Next question

2. Question 252 · 427 in bank

   A company is using AWS Organizations and wants to implement a governance strategy with the following requirements: • AWS resource access is restricted to the same two Regions for all accounts. • AWS services are limited to a specific group of authorized services for all accounts. • Authentication is provided by Active Directory. • Access permissions are organized by job function and are identical in each account. Which solution will meet these requirements?

   • AEstablish an organizational unit (OU) with group policies in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.
   • BEstablish a permission boundary in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.
   • CEstablish a service control policy in the management account to restrict Regions and authorized services. Use AWS Resource Access Manager (AWS RAM) to share management account roles with permissions for each job function, including AWS IAM Identity Center for authentication in each account.
   • DEstablish a service control policy in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.

   Show answer

   Answer: D

   Next question

3. Question 253 · 427 in bank

   A company that uses electronic health records is running a fleet of Amazon EC2 instances with an Amazon Linux operating system. As part of patient privacy requirements, the company must ensure continuous compliance for patches for operating system and applications running on the EC2 instances. How can the deployments of the operating system and application patches be automated using a default and custom repository?

   • AUse AWS Systems Manager to create a new patch baseline including the custom repository. Run the AWS-RunPatchBaseline document using the run command to verify and install patches.
   • BUse AWS Direct Connect to integrate the corporate repository and deploy the patches using Amazon CloudWatch scheduled events, then use the CloudWatch dashboard to create reports.
   • CUse yum-config-manager to add the custom repository under /etc/yum.repos.d and run yum-config-manager-enable to activate the repository.
   • DUse AWS Systems Manager to create a new patch baseline including the corporate repository. Run the AWS-AmazonLinuxDefaultPatchBaseline document using the run command to verify and install patches.

   Show answer

   Answer: A

   Explanation

   AWS-AmazonLinuxDefaultPatchBaseline: defines which patches should be applied and which should be avoided. AWS-RunPatchBaseline: provides commands to actually run the patching process on the instance.

   Source: Adapted from community discussion — dzn

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 254 · 427 in bank

   A company detects unusual login attempts in many of its AWS accounts. A DevOps engineer must implement a solution that sends a notification to the company's security team when multiple failed login attempts occur. The DevOps engineer has already created an Amazon Simple Notification Service (Amazon SNS) topic and has subscribed the security team to the SNS topic. Which solution will provide the notification with the LEAST operational effort?

   • AConfigure AWS CloudTrail to send management events to an Amazon CloudWatch Logs log group. Create a CloudWatch Logs metric filter to match failed ConsoleLogin events. Create a CloudWatch alarm that is based on the metric filter. Configure an alarm action to send messages to the SNS topic.
   • BConfigure AWS CloudTrail to send management events to an Amazon S3 bucket. Create an Amazon Athena query that returns a failure if the query finds failed logins in the logs in the S3 bucket. Create an Amazon EventBridge rule to periodically run the query. Create a second EventBridge rule to detect when the query fails and to send a message to the SNS topic.
   • CConfigure AWS CloudTrail to send data events to an Amazon CloudWatch Logs log group. Create a CloudWatch logs metric filter to match failed ConsoleLogin events. Create a CloudWatch alarm that is based on the metric filter. Configure an alarm action to send messages to the SNS topic.
   • DConfigure AWS CloudTrail to send data events to an Amazon S3 bucket. Configure an Amazon S3 event notification for the s3:ObjectCreated event type. Filter the event type by ConsoleLogin failed events. Configure the event notification to forward to the SNS topic.

   Show answer

   Answer: A

   Next question

5. Question 255 · 427 in bank

   A company has deployed a new REST API by using Amazon API Gateway. The company uses the API to access confidential data. The API must be accessed from only specific VPCs in the company. Which solution will meet these requirements?

   • ACreate and attach a resource policy to the API Gateway API. Configure the resource policy to allow only the specific VPC IDs.
   • BAdd a security group to the API Gateway API. Configure the inbound rules to allow only the specific VPC IP address ranges.
   • CCreate and attach an IAM role to the API Gateway API. Configure the IAM role to allow only the specific VPC IDs.
   • DAdd an ACL to the API Gateway API. Configure the outbound rules to allow only the specific VPC IP address ranges.

   Show answer

   Answer: A

   Explanation

   Explanation: API Gateway supports resource policies, which can restrict access based on specific conditions, such as VPC IDs or IP ranges. You can attach a resource policy to the API Gateway that allows access only from specific VPCs. This is the most direct and secure way to meet the requirement of allowing access only from specific VPCs.

   Source: Adapted from community discussion — Ky_24

   References

   • AWS documentation

   Next question

6. Question 256 · 427 in bank

   A company runs a website by using an Amazon Elastic Container Service (Amazon ECS) service that is connected to an Application Load Balancer (ALB). The service was in a steady state with tasks responding to requests successfully. A DevOps engineer updated the task definition with a new container image and deployed the new task definition to the service. The DevOps engineer noticed that the service is frequently stopping and starting new tasks because the ALB healtth checks are failing. What should the DevOps engineer do to troubleshoot the failed deployment?

   • AEnsure that a security group associated with the service allows traffic from the ALB.
   • BIncrease the ALB health check grace period for the service.
   • CIncrease the service minimum healthy percent setting.
   • DDecrease the ALB health check interval.

   Show answer

   Answer: B

   Explanation

   "A" is wrong because in the question it's said that Engineer has only updated image in the task definition. So he could not affect security group. "B" might be correct explanation, because new Docker container (based on a new image) takes longer time to start. So increasing a grace period might help to eventually get a successful health-check result and quit restarting the container.

   Source: Adapted from community discussion — eugene2owl

   Next question

7. Question 257 · 427 in bank

   A company that uses electronic patient health records runs a fleet of Amazon EC2 instances with an Amazon Linux operating system. The company must continuously ensure that the EC2 instances are running operating system patches and application patches that are in compliance with current privacy regulations. The company uses a custom repository to store application patches. A DevOps engineer needs to automate the deployment of operating system patches and application patches. The DevOps engineer wants to use both the default operating system patch repository and the custom patch repository. Which solution will meet these requirements with the LEAST effort?

   • AUse AWS Systems Manager to create a new custom patch baseline that includes the default operating system repository and the custom repository. Run the AWS-RunPatchBaseline document by using the Run command to verify and install patches. Use the BaselineOverride API to configure the new custom patch baseline.
   • BUse AWS Direct Connect to integrate the custom repository with the EC2 instances. Use Amazon EventBridge events to deploy the patches.
   • CUse the yum-config-manager command to add the custom repository to the /etc/yum.repos.d configuration. Run the yum-config-manager-enable command to activate the new repository.
   • DUse AWS Systems Manager to create a patch baseline for the default operating system repository and a second patch baseline for the custom repository. Run the AWS-RunPatchBaseline document by using the Run command to verify and install patches. Use the BaselineOverride API to configure the default patch baseline and the custom patch baseline.

   Show answer

   Answer: A

   Explanation

   AWS Systems Manager allows you to create a custom patch baseline that includes both the default operating system repository and the custom repository. This centralizes the management of patch baselines. The AWS-RunPatchBaseline document can be run using the Systems Manager Run Command to automate the verification and installation of patches, ensuring compliance with current privacy regulations. Using the BaselineOverride API provides flexibility to override the default settings with a custom patch baseline, streamlining the patching process across all EC2 instances.

   Source: Adapted from community discussion — f4b18ba

   Next question

8. Question 258 · 427 in bank

   Select 3

   A company use an organization in AWS Organizations to manage multiple AWS accounts. The company has enabled all features enabled for the organization. The company configured the organization as a hierarchy of OUs under the root OU. The company recently registered all its OUs and enrolled all its AWS accounts in AWS Control Tower. The company needs to customize the AWS Control Tower managed AWS Config configuration recorder in each of the company's AWS accounts. The company needs to apply the customizations to both the existing AWS accounts and to any new AWS accounts that the company enrolls in AWS Control Tower in the future. Which combination of steps will meet these requirements? (Choose three.)

   • ACreate a new AWS account. Create an AWS Lambda function in the new account to apply the customizations to the AWS Config configuration recorder in each AWS account in the organization.
   • BCreate a new AWS account as an AWS Config delegated administrator. Create an AWS Lambda function in the delegated administrator account to apply the customizations to the AWS Config configuration recorder in the delegated administrator account.
   • CConfigure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when the Organizations OU is registered or reregistered. Re-register the root Organizations OU.
   • DConfigure the AWSControlTowerExecution IAM role in each AWS account in the organization to be assumable by an AWS Lambda function. Configure the Lambda function to assume the AWSControlTowerExecution IAM role.
   • ECreate an IAM role in the AWS Control Tower management account that an AWS Lambda function can assume. Grant the IAM role permission to assume the AWSControlTowerExecution IAM role in any account in the organization. Configure the Lambda function to use the new IAM role.
   • FConfigure an Amazon EventBridge rule in the AWS Control Tower management account to invoke an AWS Lambda function when an AWS account is updated or enrolled in AWS Control Tower or when the landing zone is updated. Re-register each Organizations OU in the organization.

   Show answer

   Answer: AEF

   Explanation

   https://aws.amazon.com/solutions/guidance/customizing-aws-config-resources-in-aws-control-tower/ - Need eventbridge in CT management acct to react to CT lifecycle events - need CT management acct lambda function to assume AWSControlTowerExecution role and customise config. - If lambda is not in CT management acct then it will need to assume a role in CT management acct which has trust with AWSControlTowerExecution role in member accts

   Source: Adapted from community discussion — CHRIS12722222

   References

   • AWS documentation

   Next question

9. Question 259 · 427 in bank

   A company runs an application in an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances run Docker containers that make requests to a MySQL database that runs on separate EC2 instances. A DevOps engineer needs to update the application to use a serverless architecture. Which solution will meet this requirement with the FEWEST changes?

   • AReplace the containers that run on EC2 instances and the ALB with AWS Lambda functions. Replace the MySQL database with an Amazon Aurora Serverless v2 database that is compatible with MySQL.
   • BReplace the containers that run on EC2 instances with AWS Fargate. Replace the MySQL database with an Amazon Aurora Serverless v2 database that is compatible with MySQL.
   • CReplace the containers that run on EC2 instances and the ALB with AWS Lambda functions. Replace the MySQL database with Amazon DynamoDB tables.
   • DReplace the containers that run on EC2 instances with AWS Fargate. Replace the MySQL database with Amazon DynamoDB tables.

   Show answer

   Answer: B

   Explanation

   "B" is the most easy-to-implement option - as the question asks. The rest options require moving from SQL to NoSQL (which requires multiple code changes) and/or moving from Docker containers to Lambda (which requires multiple code changes).

   Source: Adapted from community discussion — eugene2owl

   Next question

10. Question 260 · 427 in bank

    A company uses an organization in AWS Organizations to manage 10 AWS accounts. All features are enabled, and trusted access for AWS CloudFormation is enabled. A DevOps engineer needs to use CloudFormation to deploy an IAM role to the Organizations management account and all member accounts in the organization. Which solution will meet these requirements with the LEAST operational overhead?

    • ACreate a CloudFormation StackSet that has service-managed permissions. Set the root OU as a deployment target.
    • BCreate a CloudFormation StackSet that has service-managed permissions. Set the root OU as a deployment target. Deploy a separate CloudFormation stack in the Organizations management account.
    • CCreate a CloudFormation StackSet that has self-managed permissions. Set the root OU as a deployment target.
    • DCreate a CloudFormation StackSet that has self-managed permissions. Set the root OU as a deployment target. Deploy a separate CloudFormation stack in the Organizations management account.

    Show answer

    Answer: B

    Explanation

    Should be B I think. A stackset with service-managed permissions does not deploy to the management account. "StackSets doesn't deploy stack instances to the organization's management account, even if the management account is in your organization or in an OU in your organization." https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html#stacksets-orgs-associate-stackset-with-org

    Source: Adapted from community discussion — Impromptu

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 251. 427 questions available.