DOP-C02 practice questions 301–310

1. Question 301 · 427 in bank

   Select 3

   A company is performing vulnerability scanning for all Amazon EC2 instances across many accounts. The accounts are in an organization in AWS Organizations. Each account's VPCs are attached to a shared transit gateway. The VPCs send traffic to the internet through a central egress VPC. The company has enabled Amazon Inspector in a delegated administrator account and has enabled scanning for all member accounts. A DevOps engineer discovers that some EC2 instances are listed in the "not scanning" tab in Amazon Inspector. Which combination of actions should the DevOps engineer take to resolve this issue? (Choose three.)

   • AVerify that AWS Systems Manager Agent is installed and is running on the EC2 instances that Amazon Inspector is not scanning.
   • BAssociate the target EC2 instances with security groups that allow outbound communication on port 443 to the AWS Systems Manager service endpoint.
   • CGrant inspector:StartAssessmentRun permissions to the IAM role that the DevOps engineer is using.
   • DConfigure EC2 Instance Connect for the EC2 instances that Amazon Inspector is not scanning.
   • EAssociate the target EC2 instances with instance profiles that grant permissions to communicate with AWS Systems Manager.
   • FCreate a managed-instance activation. Use the Activation Code and the Activation ID to register the EC2 instances.

   Show answer

   Answer: ABE

   Explanation

   Option C suggests granting inspector:StartAssessmentRun permissions to the IAM role being used by the DevOps engineer. However, this may not be relevant to the issue of instances not being scanned by Amazon Inspector, as the IAM role may already have the necessary permissions by default. Therefore, A, B, E is a better choice in this case as it includes the necessary steps to ensure that the instances can communicate with AWS Systems Manager, which is required for Amazon Inspector to scan the instances.

   Source: Adapted from community discussion — jqso234

   References

   • AWS documentation
   • repost.aws documentation

   Next question

2. Question 302 · 427 in bank

   A development team uses AWS CodeCommit for version control for applications. The development team uses AWS CodePipeline, AWS CodeBuild. and AWS CodeDeploy for CI/CD infrastructure. In CodeCommit, the development team recently merged pull requests that did not pass long-running tests in the code base. The development team needed to perform rollbacks to branches in the codebase, resulting in lost time and wasted effort. A DevOps engineer must automate testing of pull requests in CodeCommit to ensure that reviewers more easily see the results of automated tests as part of the pull request review. What should the DevOps engineer do to meet this requirement?

   • ACreate an Amazon EventBridge rule that reacts to the pullRequestStatusChanged event. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action that runs the tests for the application. Program the Lambda function to post the CodeBuild badge as a comment on the pull request so that developers will see the badge in their code review.
   • BCreate an Amazon EventBridge rule that reacts to the pullRequestCreated event. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action that runs the tests for the application. Program the Lambda function to post the CodeBuild test results as a comment on the pull request when the test results are complete.
   • CCreate an Amazon EventBridge rule that reacts to pullRequestCreated and pullRequestSourceBranchUpdated events. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action that runs the tests for the application. Program the Lambda function to post the CodeBuild badge as a comment on the pull request so that developers will see the badge in their code review.
   • DCreate an Amazon EventBridge rule that reacts to the pullRequestStatusChanged event. Create an AWS Lambda function that invokes a CodePipeline pipeline with a CodeBuild action that runs the tests for the application. Program the Lambda function to post the CodeBuild test results as a comment on the pull request when the test results are complete.

   Show answer

   Answer: C

   Explanation

   "Automated Code Review on Pull Requests using AWS CodeCommit and AWS CodeBuild" "The solution comprises of the following components:" "Amazon EventBridge: AWS service to receive pullRequestCreated and pullRequestSourceBranchUpdated events and trigger Amazon EventBridge rule." https://aws.amazon.com/blogs/devops/automated-code-review-on-pull-requests-using-aws-codecommit-and-aws-codebuild/

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 303 · 427 in bank

   A company has deployed an application in a production VPC in a single AWS account. The application is popular and is experiencing heavy usage. The company’s security team wants to add additional security, such as AWS WAF, to the application deployment. However, the application's product manager is concerned about cost and does not want to approve the change unless the security team can prove that additional security is necessary. The security team believes that some of the application's demand might come from users that have IP addresses that are on a deny list. The security team provides the deny list to a DevOps engineer. If any of the IP addresses on the deny list access the application, the security team wants to receive automated notification in near real time so that the security team can document that the application needs additional security. The DevOps engineer creates a VPC flow log for the production VPC. Which set of additional steps should the DevOps engineer take to meet these requirements MOST cost-effectively?

   • ACreate a log group in Amazon CloudWatch Logs. Configure the VPC flow log to capture accepted traffic and to send the data to the log group. Create an Amazon CloudWatch metric filter for IP addresses on the deny list. Create a CloudWatch alarm with the metric filter as input. Set the period to 5 minutes and the datapoints to alarm to 1. Use an Amazon Simple Notification Service (Amazon SNS) topic to send alarm notices to the security team.
   • BCreate an Amazon S3 bucket for log files. Configure the VPC flow log to capture all traffic and to send the data to the S3 bucket. Configure Amazon Athena to return all log files in the S3 bucket for IP addresses on the deny list. Configure Amazon QuickSight to accept data from Athena and to publish the data as a dashboard that the security team can access. Create a threshold alert of 1 for successful access. Configure the alert to automatically notify the security team as frequently as possible when the alert threshold is met.
   • CCreate an Amazon S3 bucket for log files. Configure the VPC flow log to capture accepted traffic and to send the data to the S3 bucket. Configure an Amazon OpenSearch Service cluster and domain for the log files. Create an AWS Lambda function to retrieve the logs from the S3 bucket, format the logs, and load the logs into the OpenSearch Service cluster. Schedule the Lambda function to run every 5 minutes. Configure an alert and condition in OpenSearch Service to send alerts to the security team through an Amazon Simple Notification Service (Amazon SNS) topic when access from the IP addresses on the deny list is detected.
   • DCreate a log group in Amazon CloudWatch Logs. Create an Amazon S3 bucket to hold query results. Configure the VPC flow log to capture all traffic and to send the data to the log group. Deploy an Amazon Athena CloudWatch connector in AWS Lambda. Connect the connector to the log group. Configure Athena to periodically query for all accepted traffic from the IP addresses on the deny list and to store the results in the S3 bucket. Configure an S3 event notification to automatically notify the security team through an Amazon Simple Notification Service (Amazon SNS) topic when new objects are added to the S3 bucket.

   Show answer

   Answer: A

   Explanation

   To meet the requirements most cost-effectively, the DevOps engineer should create a log group in Amazon CloudWatch Logs and configure the VPC flow log to capture accepted traffic and to send the data to the log group. Then, create an Amazon CloudWatch metric filter for IP addresses on the deny list and create a CloudWatch alarm with the metric filter as input. Set the period to 5 minutes and the datapoints to alarm to 1. Finally, use an Amazon Simple Notification Service (Amazon SNS) topic to send alarm notices to the security team. Option A is the correct answer. It provides a cost-effective solution that meets the requirements. The CloudWatch alarm notifies the security team in near real-time when traffic from an IP address on the deny list is detected. This will help the security team document that the application needs additional security. This solution only requires the use of AWS services that the company is already using, and does not require any additional services or tools.

   Source: Adapted from community discussion — haazybanj

   Next question

4. Question 304 · 427 in bank

   Select 2

   A DevOps engineer has automated a web service deployment by using AWS CodePipeline with the following steps: 1. An AWS CodeBuild project compiles the deployment artifact and runs unit tests. 2. An AWS CodeDeploy deployment group deploys the web service to Amazon EC2 instances in the staging environment. 3. A CodeDeploy deployment group deploys the web service to EC2 instances in the production environment. The quality assurance (QA) team requests permission to inspect the build artifact before the deployment to the production environment occurs. The QA team wants to run an internal penetration testing tool to conduct manual tests. The tool will be invoked by a REST API call. Which combination of actions should the DevOps engineer take to fulfill this request? (Choose two.)

   • AInsert a manual approval action between the test actions and deployment actions of the pipeline.
   • BModify the buildspec.yml file for the compilation stage to require manual approval before completion.
   • CUpdate the CodeDeploy deployment groups so that they require manual approval to proceed.
   • DUpdate the pipeline to directly call the REST API for the penetration testing tool.
   • EUpdate the pipeline to invoke an AWS Lambda function that calls the REST API for the penetration testing tool.

   Show answer

   Answer: AE

   Explanation

   Explanation: The manual approval action (A) will allow the QA team to inspect the build artifact and run their internal penetration testing tool before the deployment to the production environment proceeds. Using an AWS Lambda function (E) would provide an automated way to call the REST API of the penetration testing tool. This would allow for the tests to be conducted automatically within the pipeline. This is beneficial because it ensures consistency in the testing process and could be run programmatically, reducing manual steps.

   Source: Adapted from community discussion — tartarus23

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 305 · 427 in bank

   A company is hosting a web application in an AWS Region. For disaster recovery purposes, a second region is being used as a standby. Disaster recovery requirements state that session data must be replicated between regions in near-real time and 1% of requests should route to the secondary region to continuously verify system functionality. Additionally, if there is a disruption in service in the main region, traffic should be automatically routed to the secondary region, and the secondary region must be able to scale up to handle all traffic. How should a DevOps engineer meet these requirements?

   • AIn both regions, deploy the application on AWS Elastic Beanstalk and use Amazon DynamoDB global tables for session data. Use an Amazon Route 53 weighted routing policy with health checks to distribute the traffic across the regions.
   • BIn both regions, launch the application in Auto Scaling groups and use DynamoDB for session data. Use a Route 53 failover routing policy with health checks to distribute the traffic across the regions.
   • CIn both regions, deploy the application in AWS Lambda, exposed by Amazon API Gateway, and use Amazon RDS for PostgreSQL with cross-region replication for session data. Deploy the web application with client-side logic to call the API Gateway directly.
   • DIn both regions, launch the application in Auto Scaling groups and use DynamoDB global tables for session data. Enable an Amazon CloudFront weighted distribution across regions. Point the Amazon Route 53 DNS record at the CloudFront distribution.

   Show answer

   Answer: A

   Explanation

   I think it is A, We can have failover with CloudFront, but it can't have weighted routing, Here is the link of how auromatic failover works in the CloudFront https://disaster-recovery.workshop.aws/en/services/networking/cloudfront/cloudfront-origin-group.html

   Source: Adapted from community discussion — davdan99

   References

   • AWS documentation

   Next question

6. Question 306 · 427 in bank

   Select 2

   A company runs an application on Amazon EC2 instances. The company uses a series of AWS CloudFormation stacks to define the application resources. A developer performs updates by building and testing the application on a laptop and then uploading the build output and CloudFormation stack templates to Amazon S3. The developer's peers review the changes before the developer performs the CloudFormation stack update and installs a new version of the application onto the EC2 instances. The deployment process is prone to errors and is time-consuming when the developer updates each EC2 instance with the new application. The company wants to automate as much of the application deployment process as possible while retaining a final manual approval step before the modification of the application or resources. The company already has moved the source code for the application and the CloudFormation templates to AWS CodeCommit. The company also has created an AWS CodeBuild project to build and test the application. Which combination of steps will meet the company’s requirements? (Choose two.)

   • ACreate an application group and a deployment group in AWS CodeDeploy. Install the CodeDeploy agent on the EC2 instances.
   • BCreate an application revision and a deployment group in AWS CodeDeploy. Create an environment in CodeDeploy. Register the EC2 instances to the CodeDeploy environment.
   • CUse AWS CodePipeline to invoke the CodeBuild job, run the CloudFormation update, and pause for a manual approval step. After approval, start the AWS CodeDeploy deployment.
   • DUse AWS CodePipeline to invoke the CodeBuild job, create CloudFormation change sets for each of the application stacks, and pause for a manual approval step. After approval, run the CloudFormation change sets and start the AWS CodeDeploy deployment.
   • EUse AWS CodePipeline to invoke the CodeBuild job, create CloudFormation change sets for each of the application stacks, and pause for a manual approval step. After approval, start the AWS CodeDeploy deployment.

   Show answer

   Answer: AD

   Explanation

   (A) This step sets up the environment to use AWS CodeDeploy for application deployments. CodeDeploy uses an agent installed on the EC2 instances to perform the deployment tasks. (D) This option uses CodePipeline to orchestrate the process. CodeBuild is used to build and test the application. CloudFormation is used to prepare the infrastructure updates as change sets. A manual approval step is inserted before applying the changes. After approval, the CloudFormation change sets are applied, and then CodeDeploy is invoked to deploy the new version of the application to the EC2 instances.

   Source: Adapted from community discussion — tartarus23

   References

   • AWS documentation

   Next question

7. Question 307 · 427 in bank

   A DevOps engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2 Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that: Launches a second fleet of instances with the same capacity as the original fleet. Maintains the original fleet unchanged while the second fleet is launched. Transitions traffic to the second fleet when the second fleet is fully deployed. Terminates the original fleet automatically 1 hour after transition. Which solution will satisfy these requirements?

   • AUse an AWS CloudFormation template with a retention policy for the ALB set to 1 hour. Update the Amazon Route 53 record to reflect the new ALB.
   • BUse two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one. Create an application version lifecycle policy to terminate the original environment in 1 hour.
   • CUse AWS CodeDeploy with a deployment group configured with a blue/green deployment configuration Select the option Terminate the original instances in the deployment group with a waiting period of 1 hour.
   • DUse AWS Elastic Beanstalk with the configuration set to Immutable. Create an .ebextension using the Resources key that sets the deletion policy of the ALB to 1 hour, and deploy the application.

   Show answer

   Answer: C

   Explanation

   Option B, using two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one, would not launch a second fleet of instances. Instead, it would create a new environment and deploy the application version to it. It also requires the use of an application version lifecycle policy to terminate the original environment in 1 hour. Option D, using AWS Elastic Beanstalk with the configuration set to Immutable and creating an .ebextension to set the deletion policy of the ALB to 1 hour, would not launch a second fleet of instances, and it would not maintain the original fleet unchanged while the second fleet is launched. Additionally, the .ebextension approach is not the recommended way to delete resources in AWS. Therefore, the correct option is C, using AWS CodeDeploy with a deployment group configured with a blue/green deployment configuration and selecting the option to Terminate the original instances in the deployment group with a waiting period of 1 hour.

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation

   Next question

8. Question 308 · 427 in bank

   Select 3

   A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account. The company has created an AWS Key Management Service (AWS KMS) key in the source account. Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)

   • AIn the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action.
   • BIn the source account, copy the unencrypted AMI to an encrypted AMI. Specify the default Amazon Elastic Block Store (Amazon EBS) encryption key in the copy action.
   • CIn the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account.
   • DIn the source account, modify the key policy to give the target account permissions to create a grant. In the target account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role.
   • EIn the source account, share the unencrypted AMI with the target account.
   • FIn the source account, share the encrypted AMI with the target account.

   Show answer

   Answer: ADF

   Explanation

   A. In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action. The DevOps engineer must first encrypt the unencrypted AMI using the KMS key created in the source account. This creates a new encrypted AMI. D. In the source account, modify the key policy to give the target account permissions to create a grant. In the target account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role. The KMS key policy in the source account must be updated to allow the target account to use the key for decryption. Additionally, the target account needs to create a KMS grant to allow the Auto Scaling group service-linked role to use the KMS key. F. In the source account, share the encrypted AMI with the target account. After encrypting the AMI, the DevOps engineer must share the encrypted AMI with the target account by modifying the AMI's permissions.

   Source: Adapted from community discussion — cmzk

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 309 · 427 in bank

   A video-sharing company stores its videos in Amazon S3. The company has observed a sudden increase in video access requests, but the company does not know which videos are most popular. The company needs to identify the general access pattern for the video files. This pattern includes the number of users who access a certain file on a given day, as well as the number of pull requests for certain files. How can the company meet these requirements with the LEAST amount of effort?

   • AActivate S3 server access logging. Import the access logs into an Amazon Aurora database. Use an Aurora SQL query to analyze the access patterns.
   • BActivate S3 server access logging. Use Amazon Athena to create an external table with the log files. Use Athena to create a SQL query to analyze the access patterns.
   • CInvoke an AWS Lambda function for every S3 object access event. Configure the Lambda function to write the file access information, such as user. S3 bucket, and file key, to an Amazon Aurora database. Use an Aurora SQL query to analyze the access patterns.
   • DRecord an Amazon CloudWatch Logs log message for every S3 object access event. Configure a CloudWatch Logs log stream to write the file access information, such as user, S3 bucket, and file key, to an Amazon Kinesis Data Analytics for SQL application. Perform a sliding window analysis.

   Show answer

   Answer: B

   Explanation

   Bis the Answer because Athena is designed for these type of use cases AWS Athena is a serverless interactive query service that lets you analyze data stored in Amazon Simple Storage Service (S3) using standard SQL.

   Source: Adapted from community discussion — zijo

   References

   • repost.aws documentation

   Next question

10. Question 310 · 427 in bank

    A development team wants to use AWS CloudFormation stacks to deploy an application. However, the developer IAM role does not have the required permissions to provision the resources that are specified in the AWS CloudFormation template. A DevOps engineer needs to implement a solution that allows the developers to deploy the stacks. The solution must follow the principle of least privilege. Which solution will meet these requirements?

    • ACreate an IAM policy that allows the developers to provision the required resources. Attach the policy to the developer IAM role.
    • BCreate an IAM policy that allows full access to AWS CloudFormation. Attach the policy to the developer IAM role.
    • CCreate an AWS CloudFormation service role that has the required permissions. Grant the developer IAM role a cloudformation:* action. Use the new service role during stack deployments.
    • DCreate an AWS CloudFormation service role that has the required permissions. Grant the developer IAM role the iam:PassRole permission. Use the new service role during stack deployments.

    Show answer

    Answer: D

    Explanation

    Option D allows you to create a dedicated AWS CloudFormation service role with the precise permissions required for stack deployments. Then, you grant the developer IAM role the iam:PassRole permission, which enables it to pass the service role to AWS CloudFormation without granting it broad IAM permissions. This approach aligns best with the principle of least privilege and ensures developers can deploy stacks while maintaining control over their permissions.

    Source: Adapted from community discussion — jason7

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 301. 427 questions available.