DOP-C02 practice questions 261–270

1. Question 261 · 427 in bank

   Select 2

   A company runs an application that stores artifacts in an Amazon S3 bucket. The application has a large user base. The application writes a high volume of objects to the S3 bucket. The company has enabled event notifications for the S3 bucket. When the application writes an object to the S3 bucket, several processing tasks need to be performed simultaneously. The company's DevOps team needs to create an AWS Step Functions workflow to orchestrate the processing tasks. Which combination of steps should the DevOps team take to meet these requirements with the LEAST operational overhead? (Choose two.)

   • ACreate a Standard workflow that contains a parallel state that defines the processing tasks. Create an Asynchronous Express workflow that contains a parallel state that defines the processing tasks.
   • BCreate a Synchronous Express workflow that contains a map state that defines the processing tasks.
   • CCreate an Amazon EventBridge rule to match when a new S3 object is created. Configure the EventBridge rule to invoke an AWS Lambda function. Configure the Lambda function to start the processing workflow.
   • DCreate an Amazon EventBridge rule to match when a new S3 object is created. Configure the EventBridge rule to start the processing workflow.

   Show answer

   Answer: AD

   Explanation

   There's a misspelling and the option B is included in the option A, said that, going for standard workflow as it's recommended for long-running (up to one year), durable, and auditable workflows instead of Express Workflows that are ideal for high-volume, event-processing workloads such as IoT data ingestion, streaming data processing and transformation, and mobile application backends and can run for up to five minutes. .

   Source: Adapted from community discussion — teo2157

   Next question

2. Question 262 · 427 in bank

   Select 2

   A DevOps team supports an application that runs in an Amazon Elastic Container Service (Amazon ECS) cluster behind an Application Load Balancer (ALB). Currently, the DevOps team uses AWS CodeDeploy to deploy the application by using a blue/green all-at-once strategy. Recently, the DevOps team had to roll back a deployment when a new version of the application dramatically increased response times for requests. The DevOps team needs use to a deployment strategy that will allow the team to monitor a new version of the application before the team shifts all traffic to the new version. If a new version of the application increases response times, the deployment should be rolled back as quickly as possible. Which combination of steps will meet these requirements? (Choose two.)

   • AModify the CodeDeploy deployment to use the CodeDeployDefault.ECSCanary10Percent5Minutes configuration.
   • BModify the CodeDeploy deployment to use the CodeDeployDefault.ECSLinear10PercentEvery3Minutes configuration.
   • CCreate an Amazon CloudWatch alarm to monitor the UnHealthyHostCount metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDeploy deployment group. Modify the deployment group to roll back when a deployment fails.
   • DCreate an Amazon CloudWatch alarm to monitor the TargetResponseTime metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDeploy deployment group. Modify the deployment group to roll back when alarm thresholds are met.
   • ECreate an Amazon CloudWatch alarm to monitor the TargetConnectionErrorCount metric for the ALB. Set the alarm to activate if the metric is higher than the desired value. Associate the alarm with the CodeDeploy deployment group. Modify the deployment group to roll back when alarm thresholds are met.

   Show answer

   Answer: AD

   Explanation

   Using a canary deployment strategy with CodeDeployDefault.ECSCanary10Percent5Minutes allows for controlled, gradual deployment, providing the ability to monitor the new version's performance. Simultaneously, monitoring the TargetResponseTime with CloudWatch alarms ensures that any issues with response times are detected early, allowing for quick rollbacks to the previous stable version.

   Source: Adapted from community discussion — f4b18ba

   Next question

3. Question 263 · 427 in bank

   A security team must record the configuration of AWS resources, detect issues, and send notifications for findings. The main workload in the AWS account consists of an Amazon EC2 Auto Scaling group that scales in and out several times during the day. The team wants to be notified within 2 days if any Amazon EC2 security group allows traffic on port 22 for 0.0.0.0/0. The team also needs a snapshot of the configuration of the AWS resources to be taken routinely. The security team has already created and subscribed to an Amazon Simple Notification Service (Amazon SNS) topic. Which solution meets these requirements?

   • AConfigure AWS Config to use periodic recording for the AWS account. Deploy the vpc-sg-port-restriction-check AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
   • BConfigure AWS Config to use configuration change recording for the AWS account. Deploy the vpc-sg-open-only-to-authorized-ports AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
   • CConfigure AWS Config to use configuration change recording for the AWS account. Deploy the ssh-restricted AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
   • DCreate an AWS Lambda function to evaluate security groups and publish a message to the SNS topic. Use an Amazon EventBridge rule to schedule the Lambda function to run once a day.

   Show answer

   Answer: C

   Explanation

   Configuration Change Recording: By configuring AWS Config to use configuration change recording, the system will continuously monitor and record configurations of your AWS resources whenever there are changes. This ensures real-time compliance monitoring and reduces the delay in detection. Appropriate Managed Rule: The ssh-restricted AWS Config managed rule specifically checks for security groups that allow unrestricted SSH (port 22) access. This rule directly addresses the requirement to be notified if any EC2 security group allows traffic on port 22 for 0.0.0.0/0. Notification Setup: Configuring AWS Config to use the SNS topic ensures that the security team will be notified within the specified time frame if the rule is violated. AWS Config can send notifications to the SNS topic as soon as a non-compliant resource is detected.

   Source: Adapted from community discussion — f4b18ba

   Next question

4. Question 264 · 427 in bank

   A company is using AWS CodePipeline to automate its release pipeline. AWS CodeDeploy is being used in the pipeline to deploy an application to Amazon Elastic Container Service (Amazon ECS) using the blue/green deployment model. The company wants to implement scripts to test the green version of the application before shifting traffic. These scripts will complete in 5 minutes or less. If errors are discovered during these tests, the application must be rolled back. Which strategy will meet these requirements?

   • AAdd a stage to the CodePipeline pipeline between the source and deploy stages. Use AWS CodeBuild to create a runtime environment and build commands in the buildspec file to invoke test scripts. If errors are found, use the aws deploy stop-deployment command to stop the deployment.
   • BAdd a stage to the CodePipeline pipeline between the source and deploy stages. Use this stage to invoke an AWS Lambda function that will run the test scripts. If errors are found, use the aws deploy stop-deployment command to stop the deployment.
   • CAdd a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTestTraffic lifecycle event to invoke an AWS Lambda function to run the test scripts. If errors are found, exit the Lambda function with an error to initiate rollback.
   • DAdd a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTraffic lifecycle event to invoke the test scripts. If errors are found, use the aws deploy stop-deployment CLI command to stop the deployment.

   Show answer

   Answer: C

   Explanation

   Add a hooks section to the CodeDeploy AppSpec file. The AppSpec file is a YAML file that describes how to deploy an application to Amazon ECS using CodeDeploy. We can use the AfterAllowTestTraffic lifecycle event to run the test scripts. This event is triggered after the new version of the application is deployed, and before traffic is shifted to the new version. In the AfterAllowTestTraffic lifecycle event, invoke an AWS Lambda function to run the test scripts. The Lambda function can be written in any programming language supported by Lambda, such as Python, Node.js, or Java. If the test scripts detect any errors, exit the Lambda function with an error code. This will cause the deployment to fail, and CodeDeploy will initiate a rollback.

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation

   Next question

5. Question 265 · 427 in bank

   A company has proprietary data available by using an Amazon CloudFront distribution. The company needs to ensure that the distribution is accessible by only users from the corporate office that have a known set of IP address ranges. An AWS WAF web ACL is associated with the distribution and has a default action set to Count. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate a new regex pattern set. Add the regex pattern set to a new rule group. Create a new web ACL that has a default action set to Block. Associate the web ACL with the CloudFront distribution. Add a rule that allows traffic based on the new rule group.
   • BCreate an AWS WAF IP address set that matches the corporate office IP address range. Create a new web ACL that has a default action set to Allow. Associate the web ACL with the CloudFront distribution. Add a rule that allows traffic from the IP address set.
   • CCreate a new regex pattern set. Add the regex pattern set to a new rule group. Set the default action on the existing web ACL to Allow. Add a rule that has priority 0 that allows traffic based on the regex pattern set.
   • DCreate a WAF IP address set that matches the corporate office IP address range. Set the default action on the existing web ACL to Block. Add a rule that has priority 0 that allows traffic from the IP address set.

   Show answer

   Answer: D

   Explanation

   Using Existing Web ACL: This approach leverages the existing web ACL, minimizing the need to create a new one, which reduces operational overhead. IP Address Set: By creating a WAF IP address set that matches the corporate office IP address range, you precisely define which IP addresses are allowed access. Blocking by Default: Setting the default action to Block ensures that only traffic from the defined IP addresses is allowed, meeting the security requirement. High Priority Rule: Adding a high-priority rule (priority 0) to allow traffic from the IP address set ensures that legitimate traffic from the corporate office is not blocked.

   Source: Adapted from community discussion — f4b18ba

   Next question

6. Question 266 · 427 in bank

   A company runs several applications in the same AWS account. The applications send logs to Amazon CloudWatch. A data analytics team needs to collect performance metrics and custom metrics from the applications. The analytics team needs to transform the metrics data before storing the data in an Amazon S3 bucket. The analytics team must automatically collect any new metrics that are added to the CloudWatch namespace. Which solution will meet these requirements with the LEAST operational overhead?

   • AConfigure a CloudWatch metric stream to include metrics from the application and the CloudWatch namespace. Configure the metric stream to deliver the metrics to an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.
   • BConfigure a CloudWatch metrics stream to include all the metrics and to deliver the metrics to an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.
   • CConfigure metric filters for the CloudWatch logs to create custom metrics. Configure a CloudWatch metric stream to deliver the application metrics to the S3 bucket.
   • DConfigure subscription filters on the application log groups to target an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.

   Show answer

   Answer: B

   Explanation

   Why not option B? Just collect all the metrics in the namespace, if new ones are added later, it will also be collected

   Source: Adapted from community discussion — CHRIS12722222

   Next question

7. Question 267 · 427 in bank

   A company uses an HPC platform to run analysis jobs for data. The company uses AWS CodeBuild to create container images and store the images on Amazon Elastic Container Registry (Amazon ECR). The images are then deployed on Amazon Elastic Kubernetes Service (Amazon EKS). To maintain compliance, the company needs to ensure that the images are signed before the images are deployed on Amazon EKS. The signing keys must be rotated periodically and must be managed automatically. The company needs to track who generates the signatures. Which solution will meet these requirements with the LEAST operational effort?

   • AUse CodeBuild to retrieve the image that was previously pushed to Amazon ECR. Use AWS Signer to sign the image. Use AWS CloudTrail to track who generates the signatures.
   • BUse AWS Lambda to retrieve the image that was previously pushed to Amazon ECR. Use a Lambda function to sign the image. Use Amazon CloudWatch to track who generates the signatures.
   • CUse AWS Lambda to retrieve the image that was previously pushed to Amazon ECR. Use AWS Signer to sign the image. Use Amazon CloudWatch to track who generates the signatures.
   • DUse CodeBuild to build the image. Sign the image by using AWS Signer before pushing the image to Amazon ECR. Use AWS CloudTrail to track who generates the signatures.

   Show answer

   Answer: D

   Explanation

   Explanation: This solution meets all of the requirements with the least operational effort because: 1. Image Signing with AWS Signer: 2. Automated Key Rotation: 3. Tracking Who Signs the Images: 4. Using CodeBuild for Image Creation: 5. Least Operational Effort:

   Source: Adapted from community discussion — uncledana

   Next question

8. Question 268 · 427 in bank

   A company uses an AWS CodeArtifact repository to store Python packages that the company developed internally. A DevOps engineer needs to use AWS CodeDeploy to deploy an application to an Amazon EC2 instance. The application uses a Python package that is stored in the CodeArtifact repository. A BeforeInstall lifecycle event hook will install the package. The DevOps engineer needs to grant the EC2 instance access to the CodeArtifact repository. Which solution will meet this requirement?

   • ACreate a service-linked role for CodeArtifact. Associate the role with the EC2 instance. Use the aws codeartifact get-authorization-token CLI command on the instance.
   • BConfigure a resource-based policy for the CodeArtifact repository that allows the ReadFromRepository action for the EC2 instance principal.
   • CConfigure ACLs on the CodeArtifact repository to allow the EC2 instance to access the Python package.
   • DCreate an instance profile that contains an IAM role that has access to CodeArtifact. Associate the instance profile with the EC2 instance. Use the aws codeartifact login CLI command on the instance.

   Show answer

   Answer: D

   Explanation

   D. Create an instance profile that contains an IAM role that has access to CodeArtifact. Associate the instance profile with the EC2 instance. Use the aws codeartifact login CLI command on the instance. Explanation: To allow the EC2 instance to access the CodeArtifact repository, the EC2 instance must have the necessary IAM permissions to interact with AWS CodeArtifact. Here’s why option D is the best solution:

   Source: Adapted from community discussion — uncledana

   References

   • AWS documentation

   Next question

9. Question 269 · 427 in bank

   A company has a file-reading application that saves files to a database that runs on Amazon EC2 instances. Regulations require the company to delete files from EC2 instances every day at a specific time. The company must delete database records that are older than 60 days. The database record deletion must occur after the file deletions. The company has created scripts to delete files and database records. The company needs to receive an email notification for any failure of the deletion scripts. Which solution will meet these requirements with the LEAST development effort?

   • AUse AWS Systems Manager State Manager to automatically invoke a Systems Manager Automation document at the specified time each day. Configure the Automation document to use a run command to run the deletion scripts in sequential order. Create an Amazon EventBridge rule to use Amazon Simple Notification Service (Amazon SNS) to send failure notifications to the company.
   • BUse AWS Systems Manager State Manager to automatically invoke a Systems Manager Automation document at the specified time each day. Configure the Automation document to use a run command to run the deletion scripts in sequential order. Create a conditional statement inside the Automation document as the last step to check for errors. Use Amazon Simple Email Service (Amazon SES) to send failure notifications as email messages to the company.
   • CCreate an Amazon EventBridge rule that invokes an AWS Lambda function at the specified time. Add the necessary permissions for the invocation to the Lambda function's resource-based policy. Configure the Lambda function to run the deletion scripts in sequential order. Configure the Lambda function to use Amazon Simple Notification Service (Amazon SNS) to send failure notifications to the company.
   • DCreate an Amazon EventBridge rule that invokes an AWS Lambda function at the specified time. Add the necessary permissions for the invocation to the Lambda function's resource-based policy. Configure the Lambda function to run the deletion scripts in sequential order. Configure the Lambda function to use Amazon Simple Email Service (Amazon SES) to send failure notifications as email messages to the company.

   Show answer

   Answer: A

   Explanation

   Option A provides the most efficient solution with the least development effort. It uses AWS Systems Manager Automation for orchestrating the execution of deletion scripts and uses Amazon SNS to handle failure notifications, which is simpler and more streamlined than using SES.

   Source: Adapted from community discussion — uncledana

   Next question

10. Question 270 · 427 in bank

    A company uses an organization in AWS Organizations that has all features enabled to manage its AWS accounts. Amazon EQ instances run in the AWS accounts. The company requires that all current EC2 instances must use Instance Metadata Service Version 2 (IMDSv2). The company needs to block AWS API calls that originate from EC2 instances that do not use IMDSv2. Which solution will meet these requirements?

    • ACreate a new SCP statement that denies the ec2:RunInstances action when the ec2:MetadataHttpTokens condition key is not equal to the value of required. Attach the SCP to the root of the organization.
    • BCreate a new SCP statement that denies the ec2:RunInstances action when the ec2:MetadataHttpPutResponseHopLimit condition key value is greater than two. Attach the SCP to the root of the organization.
    • CCreate a new SCP statement that denies "*" when the ec2:RoleDelivery condition key value is less than two. Attach the SCP to the root of the organization.
    • DCreate a new SCP statement that denies when the ec2:MetadataHttpTokens condition key value is not equal to required. Attach the SCP to the root of the organization.

    Show answer

    Answer: D

    Explanation

    I think it's D. It must indeed use the ec2:MetadataHttpTokens condition key, but if we only deny the ec2:RunInstances, then the already running EC2 instances can still do AWS API calls. Even if they are not using IMDSv2.

    Source: Adapted from community discussion — Impromptu

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 261. 427 questions available.