DOP-C02 practice questions 291–300

1. Question 291 · 427 in bank

   A company has an application that is using a MySQL-compatible Amazon Aurora Multi-AZ DB cluster as the database. A cross-Region read replica has been created for disaster recovery purposes. A DevOps engineer wants to automate the promotion of the replica so it becomes the primary database instance in the event of a failure. Which solution will accomplish this?

   • AConfigure a latency-based Amazon Route 53 CNAME with health checks so it points to both the primary and replica endpoints. Subscribe an Amazon SNS topic to Amazon RDS failure notifications from AWS CloudTrail and use that topic to invoke an AWS Lambda function that will promote the replica instance as the primary.
   • BCreate an Aurora custom endpoint to point to the primary database instance. Configure the application to use this endpoint. Configure AWS CloudTrail to run an AWS Lambda function to promote the replica instance and modify the custom endpoint to point to the newly promoted instance.
   • CCreate an AWS Lambda function to modify the application's AWS CloudFormation template to promote the replica, apply the template to update the stack, and point the application to the newly promoted instance. Create an Amazon CloudWatch alarm to invoke this Lambda function after the failure event occurs.
   • DStore the Aurora endpoint in AWS Systems Manager Parameter Store. Create an Amazon EventBridge event that detects the database failure and runs an AWS Lambda function to promote the replica instance and update the endpoint URL stored in AWS Systems Manager Parameter Store. Code the application to reload the endpoint from Parameter Store if a database connection fails.

   Show answer

   Answer: D

   Explanation

   D is the correct answer. Explanation: To automate the promotion of a read replica to the primary instance in the event of a failure, we need to detect the failure and then invoke an AWS Lambda function to promote the replica instance. This can be achieved using Amazon EventBridge. Option A is incorrect because using a CNAME with health checks doesn't provide an automated way to promote the read replica. Additionally, subscribing an Amazon SNS topic to Amazon RDS failure notifications from AWS CloudTrail doesn't help to promote the replica. Option B is incorrect because a custom endpoint is not required to promote the read replica. Additionally, using AWS CloudTrail to run an AWS Lambda function to promote the replica instance doesn't provide an automated way to update the application endpoint to point to the newly promoted instance.

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 292 · 427 in bank

   A company hosts its staging website using an Amazon EC2 instance backed with Amazon EBS storage. The company wants to recover quickly with minimal data losses in the event of network connectivity issues or power failures on the EC2 instance. Which solution will meet these requirements?

   • AAdd the instance to an EC2 Auto Scaling group with the minimum, maximum, and desired capacity set to 1.
   • BAdd the instance to an EC2 Auto Scaling group with a lifecycle hook to detach the EBS volume when the EC2 instance shuts down or terminates.
   • CCreate an Amazon CloudWatch alarm for the StatusCheckFailed System metric and select the EC2 action to recover the instance.
   • DCreate an Amazon CloudWatch alarm for the StatusCheckFailed Instance metric and select the EC2 action to reboot the instance.

   Show answer

   Answer: C

   Explanation

   Explanation: Amazon CloudWatch provides system-wide visibility into resource utilization, application performance, and operational health. If a system status check fails, this implies there's a problem with the underlying EC2 system that may require AWS involvement to repair. The "Recover this instance" action for the system status check automatically recovers the instance if it becomes impaired due to an underlying issue.

   Source: Adapted from community discussion — tartarus23

   References

   • AWS documentation
   • repost.aws documentation

   Next question

3. Question 293 · 427 in bank

   A company wants to use AWS development tools to replace its current bash deployment scripts. The company currently deploys a LAMP application to a group of Amazon EC2 instances behind an Application Load Balancer (ALB). During the deployments, the company unit tests the committed application, stops and starts services, unregisters and re-registers instances with the load balancer, and updates file permissions. The company wants to maintain the same deployment functionality through the shift to using AWS services. Which solution will meet these requirements?

   • AUse AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy's appspec.yml file to restart services, and deregister and register instances with the ALB. Use the appspec.yml file to update file permissions without a custom script.
   • BUse AWS CodePipeline to move the application from the AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy's deployment group to test the application, unregister and re-register instances with the ALand restart services. Use the appspec.yml file to update file permissions without a custom script.
   • CUse AWS CodePipeline to move the application source code from the AWS CodeCommit repository to AWS CodeDeploy. Use CodeDeploy to test the application. Use CodeDeploy's appspec.yml file to restart services and update permissions without a custom script. Use AWS CodeBuild to unregister and re-register instances with the ALB.
   • DUse AWS CodePipeline to trigger AWS CodeBuild to test the application. Use bash scripts invoked by AWS CodeDeploy's appspec.yml file to restart services. Unregister and re-register the instances in the AWS CodeDeploy deployment group with the ALB. Update the appspec.yml file to update file permissions without a custom script.

   Show answer

   Answer: D

   Explanation

   Option D is also a viable solution. It suggests using AWS CodePipeline to trigger AWS CodeBuild to test the application, and then use bash scripts invoked by AWS CodeDeploy's appspec.yml file to restart services, unregister and re-register instances with the ALB, and update file permissions. This approach also covers all the deployment functionality required by the company

   Source: Adapted from community discussion — haazybanj

   Next question

4. Question 294 · 427 in bank

   Select 3

   A company runs an application with an Amazon EC2 and on-premises configuration. A DevOps engineer needs to standardize patching across both environments. Company policy dictates that patching only happens during non-business hours. Which combination of actions will meet these requirements? (Choose three.)

   • AAdd the physical machines into AWS Systems Manager using Systems Manager Hybrid Activations.
   • BAttach an IAM role to the EC2 instances, allowing them to be managed by AWS Systems Manager.
   • CCreate IAM access keys for the on-premises machines to interact with AWS Systems Manager.
   • DRun an AWS Systems Manager Automation document to patch the systems every hour
   • EUse Amazon EventBridge scheduled events to schedule a patch window.
   • FUse AWS Systems Manager Maintenance Windows to schedule a patch window.

   Show answer

   Answer: ABF

   Explanation

   ABF are the right answers: A: enable hybrid on AWS system manager B: create IAM role for System manager to manage EC2 instances F: use maintenance windows to schedule patching on non-business hours C: incorrect because there is no IAM access keys for on-prem D: should not run patching every hour E: should not use Eventbridge because AWS has its own service to schedule patching

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

5. Question 295 · 427 in bank

   A company has chosen AWS to host a new application. The company needs to implement a multi-account strategy. A DevOps engineer creates a new AWS account and an organization in AWS Organizations. The DevOps engineer also creates the OU structure for the organization and sets up a landing zone by using AWS Control Tower. The DevOps engineer must implement a solution that automatically deploys resources for new accounts that users create through AWS Control Tower Account Factory. When a user creates a new account, the solution must apply AWS CloudFormation templates and SCPs that are customized for the OU or the account to automatically deploy all the resources that are attached to the account. All the OUs are enrolled in AWS Control Tower. Which solution will meet these requirements in the MOST automated way?

   • AUse AWS Service Catalog with AWS Control Tower. Create portfolios and products in AWS Service Catalog. Grant granular permissions to provision these resources. Deploy SCPs by using the AWS CLI and JSON documents.
   • BDeploy CloudFormation stack sets by using the required templates. Enable automatic deployment. Deploy stack instances to the required accounts. Deploy a CloudFormation stack set to the organization’s management account to deploy SCPs.
   • CCreate an Amazon EventBridge rule to detect the CreateManagedAccount event. Configure AWS Service Catalog as the target to deploy resources to any new accounts. Deploy SCPs by using the AWS CLI and JSON documents.
   • DDeploy the Customizations for AWS Control Tower (CfCT) solution. Use an AWS CodeCommit repository as the source. In the repository, create a custom package that includes the CloudFormation templates and the SCP JSON documents.

   Show answer

   Answer: D

   Explanation

   The CfCT solution is designed for the exact purpose stated in the question. It extends the capabilities of AWS Control Tower by providing you with a way to automate resource provisioning and apply custom configurations across all AWS accounts created in the Control Tower environment. This enables the company to implement additional account customizations when new accounts are provisioned via the Control Tower Account Factory. The CloudFormation templates and SCPs can be added to a CodeCommit repository and will be automatically deployed to new accounts when they are created. This provides a highly automated solution that does not require manual intervention to deploy resources and SCPs to new accounts.

   Source: Adapted from community discussion — tartarus23

   References

   • AWS documentation

   Next question

6. Question 296 · 427 in bank

   An online retail company based in the United States plans to expand its operations to Europe and Asia in the next six months. Its product currently runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. All data is stored in an Amazon Aurora database instance. When the product is deployed in multiple regions, the company wants a single product catalog across all regions, but for compliance purposes, its customer information and purchases must be kept in each region. How should the company meet these requirements with the LEAST amount of application changes?

   • AUse Amazon Redshift for the product catalog and Amazon DynamoDB tables for the customer information and purchases.
   • BUse Amazon DynamoDB global tables for the product catalog and regional tables for the customer information and purchases.
   • CUse Aurora with read replicas for the product catalog and additional local Aurora instances in each region for the customer information and purchases.
   • DUse Aurora for the product catalog and Amazon DynamoDB global tables for the customer information and purchases.

   Show answer

   Answer: C

   Explanation

   C. Using Aurora with read replicas for the product catalog allows for a single product catalog across all regions. Aurora read replicas can be set up in different regions to provide low-latency access to the product catalog from each region. Additionally, by deploying additional local Aurora instances in each region for customer information and purchases, the company can comply with the requirement of keeping customer data and purchases in each region.

   Source: Adapted from community discussion — Bassel

   Next question

7. Question 297 · 427 in bank

   A company is using an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured with a single DB instance. The application performs read and write operations on the database by using the cluster's instance endpoint. The company has scheduled an update to be applied to the cluster during an upcoming maintenance window. The cluster must remain available with the least possible interruption during the maintenance window. What should a DevOps engineer do to meet these requirements?

   • AAdd a reader instance to the Aurora cluster. Update the application to use the Aurora cluster endpoint for write operations. Update the Aurora cluster's reader endpoint for reads.
   • BAdd a reader instance to the Aurora cluster. Create a custom ANY endpoint for the cluster. Update the application to use the Aurora cluster's custom ANY endpoint for read and write operations.
   • CTurn on the Multi-AZ option on the Aurora cluster. Update the application to use the Aurora cluster endpoint for write operations. Update the Aurora cluster’s reader endpoint for reads.
   • DTurn on the Multi-AZ option on the Aurora cluster. Create a custom ANY endpoint for the cluster. Update the application to use the Aurora cluster's custom ANY endpoint for read and write operations

   Show answer

   Answer: A

   Explanation

   B and D are incorrect because Aurora cluster provides cluster and read endpoints, but does not support creating custom ANY endpoints. C and D are incorrect because Amazon Aurora's multi-AZ option must be set when the DB instance is created. Therefore, A is correct.

   Source: Adapted from community discussion — junrun3

   References

   • AWS documentation
   • repost.aws documentation
   • AWS documentation
   • repost.aws documentation

   Next question

8. Question 298 · 427 in bank

   A company is implementing a well-architected design for its globally accessible API stack. The design needs to ensure both high reliability and fast response times for users located in North America and Europe. The API stack contains the following three tiers: Amazon API Gateway - AWS Lambda - Amazon DynamoDB - Which solution will meet the requirements?

   • AConfigure Amazon Route 53 to point to API Gateway APIs in North America and Europe using health checks. Configure the APIs to forward requests to a Lambda function in that Region. Configure the Lambda functions to retrieve and update the data in a DynamoDB table in the same Region as the Lambda function.
   • BConfigure Amazon Route 53 to point to API Gateway APIs in North America and Europe using latency-based routing and health checks. Configure the APIs to forward requests to a Lambda function in that Region. Configure the Lambda functions to retrieve and update the data in a DynamoDB global table.
   • CConfigure Amazon Route 53 to point to API Gateway in North America, create a disaster recovery API in Europe, and configure both APIs to forward requests to the Lambda functions in that Region. Retrieve the data from a DynamoDB global table. Deploy a Lambda function to check the North America API health every 5 minutes. In the event of a failure, update Route 53 to point to the disaster recovery API.
   • DConfigure Amazon Route 53 to point to API Gateway API in North America using latency-based routing. Configure the API to forward requests to the Lambda function in the Region nearest to the user. Configure the Lambda function to retrieve and update the data in a DynamoDB table.

   Show answer

   Answer: B

   Explanation

   B is the correct solution. The requirement is to ensure both high reliability and fast response times for users located in North America and Europe. To meet this requirement, we can use Amazon Route 53 with latency-based routing to direct users to the closest API Gateway endpoint. Additionally, we can use health checks to monitor the health of each endpoint and direct traffic away from unhealthy endpoints. To maintain high reliability, we can use AWS Lambda to handle the API requests. Since Lambda scales automatically, we don't need to worry about provisioning or maintaining infrastructure. We can also use DynamoDB as the database since it provides low latency access and automatic scaling.

   Source: Adapted from community discussion — haazybanj

   Next question

9. Question 299 · 427 in bank

   A rapidly growing company wants to scale for developer demand for AWS development environments. Development environments are created manually in the AWS Management Console. The networking team uses AWS CloudFormation to manage the networking infrastructure, exporting stack output values for the Amazon VPC and all subnets. The development environments have common standards, such as Application Load Balancers, Amazon EC2 Auto Scaling groups, security groups, and Amazon DynamoDB tables. To keep up with demand, the DevOps engineer wants to automate the creation of development environments. Because the infrastructure required to support the application is expected to grow, there must be a way to easily update the deployed infrastructure. CloudFormation will be used to create a template for the development environments. Which approach will meet these requirements and quickly provide consistent AWS environments for developers?

   • AUse Fn::ImportValue intrinsic functions in the Resources section of the template to retrieve Virtual Private Cloud (VPC) and subnet values. Use CloudFormation StackSets for the development environments, using the Count input parameter to indicate the number of environments needed. Use the UpdateStackSet command to update existing development environments.
   • BUse nested stacks to define common infrastructure components. To access the exported values, use TemplateURL to reference the networking team’s template. To retrieve Virtual Private Cloud (VPC) and subnet values, use Fn::ImportValue intrinsic functions in the Parameters section of the root template. Use the CreateChangeSet and ExecuteChangeSet commands to update existing development environments.
   • CUse nested stacks to define common infrastructure components. Use Fn::ImportValue intrinsic functions with the resources of the nested stack to retrieve Virtual Private Cloud (VPC) and subnet values. Use the CreateChangeSet and ExecuteChangeSet commands to update existing development environments.
   • DUse Fn::ImportValue intrinsic functions in the Parameters section of the root template to retrieve Virtual Private Cloud (VPC) and subnet values. Define the development resources in the order they need to be created in the CloudFormation nested stacks. Use the CreateChangeSet. and ExecuteChangeSet commands to update existing development environments.

   Show answer

   Answer: C

   Explanation

   You can use intrinsic functions only in specific parts of a template. Currently, you can use intrinsic functions in resource properties, outputs, metadata attributes, and update policy attributes Refer https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference.html

   Source: Adapted from community discussion — aksliveswithaws

   References

   • repost.aws documentation
   • AWS documentation

   Next question

10. Question 300 · 427 in bank

    A company uses AWS Organizations to manage multiple accounts. Information security policies require that all unencrypted Amazon EBS volumes be marked as non-compliant. A DevOps engineer needs to automatically deploy the solution and ensure that this compliance check is always present. Which solution will accomplish this?

    • ACreate an AWS CloudFormation template that defines an AWS Inspector rule to check whether EBS encryption is enabled. Save the template to an Amazon S3 bucket that has been shared with all accounts within the company. Update the account creation script pointing to the CloudFormation template in Amazon S3.
    • BCreate an AWS Config organizational rule to check whether EBS encryption is enabled and deploy the rule using the AWS CLI. Create and apply an SCP to prohibit stopping and deleting AWS Config across the organization.
    • CCreate an SCP in Organizations. Set the policy to prevent the launch of Amazon EC2 instances without encryption on the EBS volumes using a conditional expression. Apply the SCP to all AWS accounts. Use Amazon Athena to analyze the AWS CloudTrail output, looking for events that deny an ec2:RunInstances action.
    • DDeploy an IAM role to all accounts from a single trusted account. Build a pipeline with AWS CodePipeline with a stage in AWS Lambda to assume the IAM role, and list all EBS volumes in the account. Publish a report to Amazon S3.

    Show answer

    Answer: B

    Explanation

    B. Create an AWS Config organizational rule to check whether EBS encryption is enabled and deploy the rule using the AWS CLI. Create and apply an SCP to prohibit stopping and deleting AWS Config across the organization, will accomplish the compliance check on all accounts. Option A is incorrect because an AWS Inspector rule is used to analyze the behavior of the application on the EC2 instance, not to check the encryption of the EBS volume.

    Source: Adapted from community discussion — haazybanj

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 291. 427 questions available.