DOP-C02 practice questions 21–30

1. Question 21 · 427 in bank

   Select 3

   A company is storing 100 GB of log data in .csv format in an Amazon S3 bucket. SQL developers want to query this data and generate graphs to visualize it. The SQL developers also need an efficient, automated way to store metadata from the .csv file. Which combination of steps will meet these requirements with the LEAST amount of effort? (Choose three.)

   • AFilter the data through AWS X-Ray to visualize the data.
   • BFilter the data through Amazon QuickSight to visualize the data.
   • CQuery the data with Amazon Athena.
   • DQuery the data with Amazon Redshift.
   • EUse the AWS Glue Data Catalog as the persistent metadata store.
   • FUse Amazon DynamoDB as the persistent metadata store.

   Show answer

   Answer: BCE

   Explanation

   BCE. Glue Data Catalog can crawl S3 buckets to store table metadata. Then call the data catalog directly in Athena. It will show the partitions of the data. Athena does not deal with DynamoDB directly. Hence F is out.

   Source: Adapted from community discussion — habros

   References

   • AWS documentation

   Next question

2. Question 22 · 427 in bank

   Select 3

   A company deploys its corporate infrastructure on AWS across multiple AWS Regions and Availability Zones. The infrastructure is deployed on Amazon EC2 instances and connects with AWS IoT Greengrass devices. The company deploys additional resources on on-premises servers that are located in the corporate headquarters. The company wants to reduce the overhead involved in maintaining and updating its resources. The company’s DevOps team plans to use AWS Systems Manager to implement automated management and application of patches. The DevOps team confirms that Systems Manager is available in the Regions that the resources are deployed in. Systems Manager also is available in a Region near the corporate headquarters. Which combination of steps must the DevOps team take to implement automated patch and configuration management across the company’s EC2 instances, IoT devices, and on-premises infrastructure? (Choose three.)

   • AApply tags to all the EC2 instances, AWS IoT Greengrass devices, and on-premises servers. Use Systems Manager Session Manager to push patches to all the tagged devices.
   • BUse Systems Manager Run Command to schedule patching for the EC2 instances, AWS IoT Greengrass devices, and on-premises servers.
   • CUse Systems Manager Patch Manager to schedule patching for the EC2 instances, AWS IoT Greengrass devices, and on-premises servers as a Systems Manager maintenance window task.
   • DConfigure Amazon EventBridge to monitor Systems Manager Patch Manager for updates to patch baselines. Associate Systems Manager Run Command with the event to initiate a patch action for all EC2 instances, AWS IoT Greengrass devices, and on-premises servers.
   • ECreate an IAM instance profile for Systems Manager. Attach the instance profile to all the EC2 instances in the AWS account. For the AWS IoT Greengrass devices and on-premises servers, create an IAM service role for Systems Manager.
   • FGenerate a managed-instance activation. Use the Activation Code and Activation ID to install Systems Manager Agent (SSM Agent) on each server in the on-premises environment. Update the AWS IoT Greengrass IAM token exchange role. Use the role to deploy SSM Agent on all the IoT devices.

   Show answer

   Answer: CEF

   Explanation

   I also choose E instead of B. Why E is correct: "Previously in this post, you created and deployed the SSM Agent component which would have created an IAM service role. Suppose the AWS IoT Greengrass documentation was followed to deploy the SSM agent. In that case, the name of the IAM service role should be SSMServiceRole." Why is B wrong: B is redundant given that answer C calls out Systems Manager Patch Manager which itself uses Systems Manager Run Command. Furthermore Run Command is described here to be used to run automated scripts and not to schedule patching: "we’ll demonstrate how to use Session Manager to open remote login to an edge device, patch them using Patch Manager, and run automated scripts through Run Command" Quotes above are from: https://aws.amazon.com/blogs/mt/how-to-centrally-manage-aws-iot-greengrass-devices-using-aws-systems-manager/?force_isolation=true

   Source: Adapted from community discussion — 4bed5ff

   References

   • AWS documentation

   Next question

3. Question 23 · 427 in bank

   A company is testing a web application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The company uses a blue/green deployment process with immutable instances when deploying new software. During testing, users are being automatically logged out of the application at random times. Testers also report that, when a new version of the application is deployed, all users are logged out. The development team needs a solution to ensure users remain logged in across scaling events and application deployments. What is the MOST operationally efficient way to ensure users remain logged in?

   • AEnable smart sessions on the load balancer and modify the application to check for an existing session.
   • BEnable session sharing on the load balancer and modify the application to read from the session store.
   • CStore user session information in an Amazon S3 bucket and modify the application to read session information from the bucket.
   • DModify the application to store user session information in an Amazon ElastiCache cluster.

   Show answer

   Answer: D

   Explanation

   D is correct: : the cause is there is no data storage that stores user's session. We need a session data storage to store user session

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

4. Question 24 · 427 in bank

   Select 2

   An ecommerce company is receiving reports that its order history page is experiencing delays in reflecting the processing status of orders. The order processing system consists of an AWS Lambda function that uses reserved concurrency. The Lambda function processes order messages from an Amazon Simple Queue Service (Amazon SQS) queue and inserts processed orders into an Amazon DynamoDB table. The DynamoDB table has auto scaling enabled for read and write capacity. Which actions should a DevOps engineer take to resolve this delay? (Choose two.)

   • ACheck the ApproximateAgeOfOldestMessage metric for the SQS queue. Increase the Lambda function concurrency limit.
   • BCheck the ApproximateAgeOfOldestMessage metnc for the SQS queue Configure a redrive policy on the SQS queue.
   • CCheck the NumberOfMessagesSent metric for the SQS queue. Increase the SQS queue visibility timeout.
   • DCheck the WriteThrottleEvents metric for the DynamoDB table. Increase the maximum write capacity units (WCUs) for the table's scaling policy.
   • ECheck the Throttles metric for the Lambda function. Increase the Lambda function timeout.

   Show answer

   Answer: AD

   Explanation

   D: This action is important because if the WriteThrottleEvents metric is high, it indicates that DynamoDB is throttling writes due to insufficient write capacity. By increasing the maximum WCUs, you ensure that the table can handle the increased write throughput required by the Lambda function, thus reducing delays in order processing. even though DynamoDB has auto-scaling enabled, it’s still important to monitor the WriteThrottleEvents metric. Auto-scaling adjusts capacity based on the workload, but it may not always keep up with sudden spikes in demand or be configured optimally for this specific use case. Ensuring that the maximum write capacity units (WCUs) are set appropriately can help prevent throttling during peak times.

   Source: Adapted from community discussion — tgv

   Next question

5. Question 25 · 427 in bank

   A DevOps engineer needs to configure a blue/green deployment for an existing three-tier application. The application runs on Amazon EC2 instances and uses an Amazon RDS database. The EC2 instances run behind an Application Load Balancer (ALB) and are in an Auto Scaling group. The DevOps engineer has created a launch template and an Auto Scaling group for the blue environment. The DevOps engineer also has created a launch template and an Auto Scaling group for the green environment. Each Auto Scaling group deploys to a matching blue or green target group. The target group also specifies which software, blue or green, gets loaded on the EC2 instances. The ALB can be configured to send traffic to the blue environment’s target group or the green environment’s target group. An Amazon Route 53 record for www.example.com points to the ALB. The deployment must move traffic all at once between the software on the blue environment’s EC2 instances to the newly deployed software on the green environment’s EC2 instances. What should the DevOps engineer do to meet these requirements?

   • AStart a rolling restart of the Auto Scaling group for the green environment to deploy the new software on the green environment’s EC2 instances. When the rolling restart is complete, use an AWS CLI command to update the ALB to send traffic to the green environment’s target group.
   • BUse an AWS CLI command to update the ALB to send traffic to the green environment’s target group. Then start a rolling restart of the Auto Scaling group for the green environment to deploy the new software on the green environment’s EC2 instances.
   • CUpdate the launch template to deploy the green environment’s software on the blue environment’s EC2 instances. Keep the target groups and Auto Scaling groups unchanged in both environments. Perform a rolling restart of the blue environment’s EC2 instances.
   • DStart a rolling restart of the Auto Scaling group for the green environment to deploy the new software on the green environment’s EC2 instances. When the rolling restart is complete, update the Route 53 DNS to point to the green environment’s endpoint on the ALB.

   Show answer

   Answer: A

   Explanation

   A is correct, cannot be D, as there is only one ALB. The ALB can be configured to send traffic to the blue environment’s target group or the green environment’s target group. Traffic route to blue or green, must be configure at Load balancer, in this case, update the target group.

   Source: Adapted from community discussion — PhuocT

   References

   • AWS documentation

   Next question

6. Question 26 · 427 in bank

   Select 2

   A company is building a new pipeline by using AWS CodePipeline and AWS CodeBuild in a build account. The pipeline consists of two stages. The first stage is a CodeBuild job to build and package an AWS Lambda function. The second stage consists of deployment actions that operate on two different AWS accounts: a development environment account and a production environment account. The deployment stages use the AWS CloudFormation action that CodePipeline invokes to deploy the infrastructure that the Lambda function requires. A DevOps engineer creates the CodePipeline pipeline and configures the pipeline to encrypt build artifacts by using the AWS Key Management Service (AWS KMS) AWS managed key for Amazon S3 (the aws/s3 key). The artifacts are stored in an S3 bucket. When the pipeline runs, the CloudFormation actions fail with an access denied error. Which combination of actions must the DevOps engineer perform to resolve this error? (Choose two.)

   • ACreate an S3 bucket in each AWS account for the artifacts. Allow the pipeline to write to the S3 buckets. Create a CodePipeline S3 action to copy the artifacts to the S3 bucket in each AWS account. Update the CloudFormation actions to reference the artifacts S3 bucket in the production account.
   • BCreate a customer managed KMS key. Configure the KMS key policy to allow the IAM roles used by the CloudFormation action to perform decrypt operations. Modify the pipeline to use the customer managed KMS key to encrypt artifacts.
   • CCreate an AWS managed KMS key. Configure the KMS key policy to allow the development account and the production account to perform decrypt operations. Modify the pipeline to use the KMS key to encrypt artifacts.
   • DIn the development account and in the production account, create an IAM role for CodePipeline. Configure the roles with permissions to perform CloudFormation operations and with permissions to retrieve and decrypt objects from the artifacts S3 bucket. In the CodePipeline account, configure the CodePipeline CloudFormation action to use the roles.
   • EIn the development account and in the production account, create an IAM role for CodePipeline. Configure the roles with permissions to perform CloudFormation operations and with permissions to retrieve and decrypt objects from the artifacts S3 bucket. In the CodePipeline account, modify the artifacts S3 bucket policy to allow the roles access. Configure the CodePipeline CloudFormation action to use the roles.

   Show answer

   Answer: BE

   Explanation

   C = AWS KMS fundamentals. Cannot modify AWS managed KMS key policies. No Cross account access = will not work. Not sure why there is even a discussion on this. Associate level basics.

   Source: Adapted from community discussion — lunt

   References

   • AWS documentation
   • AWS documentation
   • repost.aws documentation
   • AWS documentation

   Next question

7. Question 27 · 427 in bank

   Select 3

   A company is using an organization in AWS Organizations to manage multiple AWS accounts. The company’s development team wants to use AWS Lambda functions to meet resiliency requirements and is rewriting all applications to work with Lambda functions that are deployed in a VPC. The development team is using Amazon Elastic File System (Amazon EFS) as shared storage in Account A in the organization. The company wants to continue to use Amazon EFS with Lambda. Company policy requires all serverless projects to be deployed in Account B. A DevOps engineer needs to reconfigure an existing EFS file system to allow Lambda functions to access the data through an existing EFS access point. Which combination of steps should the DevOps engineer take to meet these requirements? (Choose three.)

   • AUpdate the EFS file system policy to provide Account B with access to mount and write to the EFS file system in Account A.
   • BCreate SCPs to set permission guardrails with fine-grained control for Amazon EFS.
   • CCreate a new EFS file system in Account B. Use AWS Database Migration Service (AWS DMS) to keep data from Account A and Account B synchronized.
   • DUpdate the Lambda execution roles with permission to access the VPC and the EFS file system.
   • ECreate a VPC peering connection to connect Account A to Account B.
   • FConfigure the Lambda functions in Account B to assume an existing IAM role in Account A.

   Show answer

   Answer: ADE

   Explanation

   Initially, I thought of A,E,F. But after reading the docs I came to conclusion A,D,E is correct answer. E: https://docs.aws.amazon.com/lambda/latest/dg/configuration-filesystem.html#configuration-filesystem-cross-account A,D: https://docs.aws.amazon.com/lambda/latest/dg/configuration-filesystem.html#configuration-filesystem-permissions

   Source: Adapted from community discussion — learnwithaniket

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 28 · 427 in bank

   A media company has several thousand Amazon EC2 instances in an AWS account. The company is using Slack and a shared email inbox for team communications and important updates. A DevOps engineer needs to send all AWS-scheduled EC2 maintenance notifications to the Slack channel and the shared inbox. The solution must include the instances’ Name and Owner tags. Which solution will meet these requirements?

   • AIntegrate AWS Trusted Advisor with AWS Config. Configure a custom AWS Config rule to invoke an AWS Lambda function to publish notifications to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe a Slack channel endpoint and the shared inbox to the topic.
   • BUse Amazon EventBridge to monitor for AWS Health events. Configure the maintenance events to target an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe an AWS Lambda function to the SNS topic to send notifications to the Slack channel and the shared inbox.
   • CCreate an AWS Lambda function that sends EC2 maintenance notifications to the Slack channel and the shared inbox. Monitor EC2 health events by using Amazon CloudWatch metrics. Configure a CloudWatch alarm that invokes the Lambda function when a maintenance notification is received.
   • DConfigure AWS Support integration with AWS CloudTrail. Create a CloudTrail lookup event to invoke an AWS Lambda function to pass EC2 maintenance notifications to Amazon Simple Notification Service (Amazon SNS). Configure Amazon SNS to target the Slack channel and the shared inbox.

   Show answer

   Answer: B

   Explanation

   B is correct: means SNS C: no mention of SNS A: AWS trusted advisor has nothing to do here D: AWS Support is support plan. It has nothing to do here. so as AWS cloud trail

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

9. Question 29 · 427 in bank

   An AWS CodePipeline pipeline has implemented a code release process. The pipeline is integrated with AWS CodeDeploy to deploy versions of an application to multiple Amazon EC2 instances for each CodePipeline stage. During a recent deployment, the pipeline failed due to a CodeDeploy issue. The DevOps team wants to improve monitoring and notifications during deployment to decrease resolution times. What should the DevOps engineer do to create notifications when issues are discovered?

   • AImplement Amazon CloudWatch Logs for CodePipeline and CodeDeploy, create an AWS Config rule to evaluate code deployment issues, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.
   • BImplement Amazon EventBridge for CodePipeline and CodeDeploy, create an AWS Lambda function to evaluate code deployment issues, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.
   • CImplement AWS CloudTrail to record CodePipeline and CodeDeploy API call information, create an AWS Lambda function to evaluate code deployment issues, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.
   • DImplement Amazon EventBridge for CodePipeline and CodeDeploy, create an Amazon Inspector assessment target to evaluate code deployment issues, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues.

   Show answer

   Answer: B

   Explanation

   B. Implement Amazon EventBridge for CodePipeline and CodeDeploy, create an AWS Lambda function to evaluate code deployment issues, and create an Amazon Simple Notification Service (Amazon SNS) topic to notify stakeholders of deployment issues. Explanation: Amazon EventBridge provides a serverless event bus that integrates with various AWS services. By implementing EventBridge for CodePipeline and CodeDeploy, the engineer can capture deployment events and trigger actions based on those events. Creating an AWS Lambda function allows for evaluating code deployment issues and performing custom actions. Additionally, creating an Amazon SNS topic provides a means to notify stakeholders of any deployment issues detected.

   Source: Adapted from community discussion — haazybanj

   Next question

10. Question 30 · 427 in bank

    A global company manages multiple AWS accounts by using AWS Control Tower. The company hosts internal applications and public applications. Each application team in the company has its own AWS account for application hosting. The accounts are consolidated in an organization in AWS Organizations. One of the AWS Control Tower member accounts serves as a centralized DevOps account with CI/CD pipelines that application teams use to deploy applications to their respective target AWS accounts. An IAM role for deployment exists in the centralized DevOps account. An application team is attempting to deploy its application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster in an application AWS account. An IAM role for deployment exists in the application AWS account. The deployment is through an AWS CodeBuild project that is set up in the centralized DevOps account. The CodeBuild project uses an IAM service role for CodeBuild. The deployment is failing with an Unauthorized error during attempts to connect to the cross-account EKS cluster from CodeBuild. Which solution will resolve this error?

    • AConfigure the application account’s deployment IAM role to have a trust relationship with the centralized DevOps account. Configure the trust relationship to allow the sts:AssumeRole action. Configure the application account’s deployment IAM role to have the required access to the EKS cluster. Configure the EKS cluster aws-auth ConfigMap to map the role to the appropriate system permissions.
    • BConfigure the centralized DevOps account’s deployment IAM role to have a trust relationship with the application account. Configure the trust relationship to allow the sts:AssumeRole action. Configure the centralized DevOps account’s deployment IAM role to allow the required access to CodeBuild.
    • CConfigure the centralized DevOps account’s deployment IAM role to have a trust relationship with the application account. Configure the trust relationship to allow the sts:AssumeRoleWithSAML action. Configure the centralized DevOps account’s deployment IAM role to allow the required access to CodeBuild.
    • DConfigure the application account’s deployment IAM role to have a trust relationship with the AWS Control Tower management account. Configure the trust relationship to allow the sts:AssumeRole action. Configure the application account’s deployment IAM role to have the required access to the EKS cluster. Configure the EKS cluster aws-auth ConfigMap to map the role to the appropriate system permissions.

    Show answer

    Answer: A

    Explanation

    A. Configure the application account’s deployment IAM role to have a trust relationship with the centralized DevOps account. Configure the trust relationship to allow the sts:AssumeRole action. Configure the application account’s deployment IAM role to have the required access to the EKS cluster. Configure the EKS cluster aws-auth ConfigMap to map the role to the appropriate system permissions. Options B, C, and D are not correct because the centralized DevOps account’s deployment IAM role doesn't need to trust the application account, it's the other way around. The sts:AssumeRoleWithSAML action in option C is used for federation from a SAML 2.0 compliant identity provider and is not necessary in this scenario. Lastly, there's no need to have a trust relationship with the AWS Control Tower management account as in option D, as the interaction is directly between the DevOps account and the application account.

    Source: Adapted from community discussion — Certified101

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 21. 427 questions available.