DOP-C02 practice questions 311–320

1. Question 311 · 427 in bank

   A production account has a requirement that any Amazon EC2 instance that has been logged in to manually must be terminated within 24 hours. All applications in the production account are using Auto Scaling groups with the Amazon CloudWatch Logs agent configured. How can this process be automated?

   • ACreate a CloudWatch Logs subscription to an AWS Step Functions application. Configure an AWS Lambda function to add a tag to the EC2 instance that produced the login event and mark the instance to be decommissioned. Create an Amazon EventBridge rule to invoke a second Lambda function once a day that will terminate all instances with this tag.
   • BCreate an Amazon CloudWatch alarm that will be invoked by the login event. Send the notification to an Amazon Simple Notification Service (Amazon SNS) topic that the operations team is subscribed to, and have them terminate the EC2 instance within 24 hours.
   • CCreate an Amazon CloudWatch alarm that will be invoked by the login event. Configure the alarm to send to an Amazon Simple Queue Service (Amazon SQS) queue. Use a group of worker instances to process messages from the queue, which then schedules an Amazon EventBridge rule to be invoked.
   • DCreate a CloudWatch Logs subscription to an AWS Lambda function. Configure the function to add a tag to the EC2 instance that produced the login event and mark the instance to be decommissioned. Create an Amazon EventBridge rule to invoke a daily Lambda function that terminates all instances with this tag.

   Show answer

   Answer: D

   Explanation

   D. Create a CloudWatch Logs subscription to an AWS Lambda function. Configure the function to add a tag to the EC2 instance that produced the login event and mark the instance to be decommissioned. Create an Amazon EventBridge rule to invoke a daily Lambda function that terminates all instances with this tag.

   Source: Adapted from community discussion — haazybanj

   Next question

2. Question 312 · 427 in bank

   A company has enabled all features for its organization in AWS Organizations. The organization contains 10 AWS accounts. The company has turned on AWS CloudTrail in all the accounts. The company expects the number of AWS accounts in the organization to increase to 500 during the next year. The company plans to use multiple OUs for these accounts. The company has enabled AWS Config in each existing AWS account in the organization. A DevOps engineer must implement a solution that enables AWS Config automatically for all future AWS accounts that are created in the organization. Which solution will meet this requirement?

   • AIn the organization's management account, create an Amazon EventBridge rule that reacts to a CreateAccount API call. Configure the rule to invoke an AWS Lambda function that enables trusted access to AWS Config for the organization.
   • BIn the organization's management account, create an AWS CloudFormation stack set to enable AWS Config. Configure the stack set to deploy automatically when an account is created through Organizations.
   • CIn the organization's management account, create an SCP that allows the appropriate AWS Config API calls to enable AWS Config. Apply the SCP to the root-level OU.
   • DIn the organization's management account, create an Amazon EventBridge rule that reacts to a CreateAccount API call. Configure the rule to invoke an AWS Systems Manager Automation runbook to enable AWS Config for the account.

   Show answer

   Answer: B

   Explanation

   The correct solution to enable AWS Config automatically for all future AWS accounts created in the organization is Option B: In the organization's management account, create an AWS CloudFormation stack set to enable AWS Config. Configure the stack set to deploy automatically when an account is created through Organizations. Option C is incorrect because although it suggests creating an SCP that allows the appropriate AWS Config API calls to enable AWS Config and applying the SCP to the root-level OU, it does not specifically enable AWS Config automatically for all future AWS accounts that are created in the organization.

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 313 · 427 in bank

   A company has many applications. Different teams in the company developed the applications by using multiple languages and frameworks. The applications run on premises and on different servers with different operating systems. Each team has its own release protocol and process. The company wants to reduce the complexity of the release and maintenance of these applications. The company is migrating its technology stacks, including these applications, to AWS. The company wants centralized control of source code, a consistent and automatic delivery pipeline, and as few maintenance tasks as possible on the underlying infrastructure. What should a DevOps engineer do to meet these requirements?

   • ACreate one AWS CodeCommit repository for all applications. Put each application's code in a different branch. Merge the branches, and use AWS CodeBuild to build the applications. Use AWS CodeDeploy to deploy the applications to one centralized application server.
   • BCreate one AWS CodeCommit repository for each of the applications. Use AWS CodeBuild to build the applications one at a time. Use AWS CodeDeploy to deploy the applications to one centralized application server.
   • CCreate one AWS CodeCommit repository for each of the applications. Use AWS CodeBuild to build the applications one at a time and to create one AMI for each server. Use AWS CloudFormation StackSets to automatically provision and decommission Amazon EC2 fleets by using these AMIs.
   • DCreate one AWS CodeCommit repository for each of the applications. Use AWS CodeBuild to build one Docker image for each application in Amazon Elastic Container Registry (Amazon ECR). Use AWS CodeDeploy to deploy the applications to Amazon Elastic Container Service (Amazon ECS) on infrastructure that AWS Fargate manages.

   Show answer

   Answer: D

   Explanation

   Option D is the best choice to meet the requirements of centralized control of source code, a consistent and automatic delivery pipeline, and minimal maintenance tasks. Option D is the best choice because it allows each application to have its own repository and build process, but uses containerization to create a consistent and automatic delivery pipeline that can be easily deployed to Amazon ECS on infrastructure that AWS Fargate manages. This approach also provides scalability and ease of maintenance.

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation

   Next question

4. Question 314 · 427 in bank

   Select 3

   A company's application is currently deployed to a single AWS Region. Recently, the company opened a new office on a different continent. The users in the new office are experiencing high latency. The company's application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) and uses Amazon DynamoDB as the database layer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones. A DevOps engineer is tasked with minimizing application response times and improving availability for users in both Regions. Which combination of actions should be taken to address the latency issues? (Choose three.)

   • ACreate a new DynamoDB table in the new Region with cross-Region replication enabled.
   • BCreate new ALB and Auto Scaling group global resources and configure the new ALB to direct traffic to the new Auto Scaling group.
   • CCreate new ALB and Auto Scaling group resources in the new Region and configure the new ALB to direct traffic to the new Auto Scaling group.
   • DCreate Amazon Route 53 records, health checks, and latency-based routing policies to route to the ALB.
   • ECreate Amazon Route 53 aliases, health checks, and failover routing policies to route to the ALB.
   • FConvert the DynamoDB table to a global table.

   Show answer

   Answer: CDF

   Explanation

   C. Create new ALB and Auto Scaling group resources in the new Region and configure the new ALB to direct traffic to the new Auto Scaling group. This will allow users in the new Region to access the application with lower latency by reducing the network hops between the user and the application servers. D. Create Amazon Route 53 records, health checks, and latency-based routing policies to route to the ALB. This will enable Route 53 to route user traffic to the nearest healthy ALB, based on the latency between the user and the ALBs. F. Convert the DynamoDB table to a global table. This will enable reads and writes to the table in both Regions with low latency, improving the overall response time of the application

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation

   Next question

5. Question 315 · 427 in bank

   A DevOps engineer needs to apply a core set of security controls to an existing set of AWS accounts. The accounts are in an organization in AWS Organizations. Individual teams will administer individual accounts by using the AdministratorAccess AWS managed policy. For all accounts. AWS CloudTrail and AWS Config must be turned on in all available AWS Regions. Individual account administrators must not be able to edit or delete any of the baseline resources. However, individual account administrators must be able to edit or delete their own CloudTrail trails and AWS Config rules. Which solution will meet these requirements in the MOST operationally efficient way?

   • ACreate an AWS CloudFormation template that defines the standard account resources. Deploy the template to all accounts from the organization's management account by using CloudFormation StackSets. Set the stack policy to deny Update:Delete actions.
   • BEnable AWS Control Tower. Enroll the existing accounts in AWS Control Tower. Grant the individual account administrators access to CloudTrail and AWS Config.
   • CDesignate an AWS Config management account. Create AWS Config recorders in all accounts by using AWS CloudFormation StackSets. Deploy AWS Config rules to the organization by using the AWS Config management account. Create a CloudTrail organization trail in the organization’s management account. Deny modification or deletion of the AWS Config recorders by using an SCP.
   • DCreate an AWS CloudFormation template that defines the standard account resources. Deploy the template to all accounts from the organization's management account by using Cloud Formation StackSets Create an SCP that prevents updates or deletions to CloudTrail resources or AWS Config resources unless the principal is an administrator of the organization's management account.

   Show answer

   Answer: D

   Explanation

   C. Designate Config Management Account, SCP, and StackSets: Deploys AWS Config recorders and rules using CloudFormation StackSets. Utilizes an SCP to prevent modification or deletion of AWS Config recorders. However, this solution lacks clarity on allowing individual account administrators control over their CloudTrail trails. option D appears to be the most operationally efficient. It employs CloudFormation for deployment and an SCP to control access to baseline resources while ensuring that only administrators of the management account can modify or delete the baseline resources. This ensures the core security controls and allows individual account administrators control over their own CloudTrail trails and AWS Config rules.

   Source: Adapted from community discussion — koenigParas2324

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 316 · 427 in bank

   Select 2

   A company has its AWS accounts in an organization in AWS Organizations. AWS Config is manually configured in each AWS account. The company needs to implement a solution to centrally configure AWS Config for all accounts in the organization The solution also must record resource changes to a central account. Which combination of actions should a DevOps engineer perform to meet these requirements? (Choose two.)

   • AConfigure a delegated administrator account for AWS Config. Enable trusted access for AWS Config in the organization.
   • BConfigure a delegated administrator account for AWS Config. Create a service-linked role for AWS Config in the organization’s management account.
   • CCreate an AWS CloudFormation template to create an AWS Config aggregator. Configure a CloudFormation stack set to deploy the template to all accounts in the organization.
   • DCreate an AWS Config organization aggregator in the organization's management account. Configure data collection from all AWS accounts in the organization and from all AWS Regions.
   • ECreate an AWS Config organization aggregator in the delegated administrator account. Configure data collection from all AWS accounts in the organization and from all AWS Regions.

   Show answer

   Answer: AE

   Explanation

   AE https://aws.amazon.com/blogs/mt/org-aggregator-delegated-admin/ A - When enabling trust - the service-linked role will be created but not the other way around. E - the delegated account will be the account that manages AWS config so it should collect all data centrally.

   Source: Adapted from community discussion — asfsdfsdf

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 317 · 427 in bank

   A company wants to migrate its content sharing web application hosted on Amazon EC2 to a serverless architecture. The company currently deploys changes to its application by creating a new Auto Scaling group of EC2 instances and a new Elastic Load Balancer, and then shifting the traffic away using an Amazon Route 53 weighted routing policy. For its new serverless application, the company is planning to use Amazon API Gateway and AWS Lambda. The company will need to update its deployment processes to work with the new application. It will also need to retain the ability to test new features on a small number of users before rolling the features out to the entire user base. Which deployment strategy will meet these requirements?

   • AUse AWS CDK to deploy API Gateway and Lambda functions. When code needs to be changed, update the AWS CloudFormation stack and deploy the new version of the APIs and Lambda functions. Use a Route 53 failover routing policy for the canary release strategy.
   • BUse AWS CloudFormation to deploy API Gateway and Lambda functions using Lambda function versions. When code needs to be changed, update the CloudFormation stack with the new Lambda code and update the API versions using a canary release strategy. Promote the new version when testing is complete.
   • CUse AWS Elastic Beanstalk to deploy API Gateway and Lambda functions. When code needs to be changed, deploy a new version of the API and Lambda functions. Shift traffic gradually using an Elastic Beanstalk blue/green deployment.
   • DUse AWS OpsWorks to deploy API Gateway in the service layer and Lambda functions in a custom layer. When code needs to be changed, use OpsWorks to perform a blue/green deployment and shift traffic gradually.

   Show answer

   Answer: B

   Explanation

   The deployment strategy that will meet the company's requirements is B. Use AWS CloudFormation to deploy API Gateway and Lambda functions using Lambda function versions. When code needs to be changed, update the CloudFormation stack with the new Lambda code and update the API versions using a canary release strategy. Promote the new version when testing is complete. Explanation: Option B provides a deployment strategy for the company's new serverless architecture, allowing the company to retain the ability to test new features on a small number of users before rolling the features out to the entire user base. Using AWS CloudFormation, the company can deploy API Gateway and Lambda functions using Lambda function versions. When code needs to be changed, the company can update the CloudFormation stack with the new Lambda code and update the API versions using a canary release strategy. Once testing is complete, the new version can be promoted.

   Source: Adapted from community discussion — haazybanj

   Next question

8. Question 318 · 427 in bank

   A development team uses AWS CodeCommit, AWS CodePipeline, and AWS CodeBuild to develop and deploy an application. Changes to the code are submitted by pull requests. The development team reviews and merges the pull requests, and then the pipeline builds and tests the application. Over time, the number of pull requests has increased. The pipeline is frequently blocked because of failing tests. To prevent this blockage, the development team wants to run the unit and integration tests on each pull request before it is merged. Which solution will meet these requirements?

   • ACreate a CodeBuild project to run the unit and integration tests. Create a CodeCommit approval rule template. Configure the template to require the successful invocation of the CodeBuild project. Attach the approval rule to the project's CodeCommit repository.
   • BCreate an Amazon EventBridge rule to match pullRequestCreated events from CodeCommit Create a CodeBuild project to run the unit and integration tests. Configure the CodeBuild project as a target of the EventBridge rule that includes a custom event payload with the CodeCommit repository and branch information from the event.
   • CCreate an Amazon EventBridge rule to match pullRequestCreated events from CodeCommit. Modify the existing CodePipeline pipeline to not run the deploy steps if the build is started from a pull request. Configure the EventBridge rule to run the pipeline with a custom payload that contains the CodeCommit repository and branch information from the event.
   • DCreate a CodeBuild project to run the unit and integration tests. Create a CodeCommit notification rule that matches when a pull request is created or updated. Configure the notification rule to invoke the CodeBuild project.

   Show answer

   Answer: B

   Explanation

   To run the unit and integration tests on each pull request before it is merged, a solution that listens to pullRequestCreated events and runs a CodeBuild project to execute tests would be the most appropriate option. Option B describes a solution that creates an Amazon EventBridge rule to match pullRequestCreated events from CodeCommit and configures a CodeBuild project to run the unit and integration tests, passing the CodeCommit repository and branch information from the event as a custom payload. Therefore, option B is the correct answer.

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation

   Next question

9. Question 319 · 427 in bank

   Select 2

   A company uses AWS CodePipeline pipelines to automate releases of its application A typical pipeline consists of three stages build, test, and deployment. The company has been using a separate AWS CodeBuild project to run scripts for each stage. However, the company now wants to use AWS CodeDeploy to handle the deployment stage of the pipelines. The company has packaged the application as an RPM package and must deploy the application to a fleet of Amazon EC2 instances. The EC2 instances are in an EC2 Auto Scaling group and are launched from a common AMI. Which combination of steps should a DevOps engineer perform to meet these requirements? (Choose two.)

   • ACreate a new version of the common AMI with the CodeDeploy agent installed. Update the IAM role of the EC2 instances to allow access to CodeDeploy.
   • BCreate a new version of the common AMI with the CodeDeploy agent installed. Create an AppSpec file that contains application deployment scripts and grants access to CodeDeploy.
   • CCreate an application in CodeDeploy. Configure an in-place deployment type. Specify the Auto Scaling group as the deployment target. Add a step to the CodePipeline pipeline to use EC2 Image Builder to create a new AMI. Configure CodeDeploy to deploy the newly created AMI.
   • DCreate an application in CodeDeploy. Configure an in-place deployment type. Specify the Auto Scaling group as the deployment target. Update the CodePipeline pipeline to use the CodeDeploy action to deploy the application.
   • ECreate an application in CodeDeploy. Configure an in-place deployment type. Specify the EC2 instances that are launched from the common AMI as the deployment target. Update the CodePipeline pipeline to use the CodeDeploy action to deploy the application.

   Show answer

   Answer: AD

   Explanation

   A and D are the correct ones. E is wrong because it says that the instances are on an ASG. C is qrong. You deploy the new RPM on the AMI, you do not create a new AMI every time to install the RPM. B is wrong, the appspec has nothing to do with permissions

   Source: Adapted from community discussion — bcx

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 320 · 427 in bank

    A company has an application that runs on a fleet of Amazon EC2 instances. The application requires frequent restarts. The application logs contain error messages when a restart is required. The application logs are published to a log group in Amazon CloudWatch Logs. An Amazon CloudWatch alarm notifies an application engineer through an Amazon Simple Notification Service (Amazon SNS) topic when the logs contain a large number of restart-related error messages. The application engineer manually restarts the application on the instances after the application engineer receives a notification from the SNS topic. A DevOps engineer needs to implement a solution to automate the application restart on the instances without restarting the instances. Which solution will meet these requirements in the MOST operationally efficient manner?

    • AConfigure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances. Configure the SNS topic to invoke the runbook.
    • BCreate an AWS Lambda function that restarts the application on the instances. Configure the Lambda function as an event destination of the SNS topic.
    • CConfigure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances. Create an AWS Lambda function to invoke the runbook. Configure the Lambda function as an event destination of the SNS topic.
    • DConfigure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances. Configure an Amazon EventBridge rule that reacts when the CloudWatch alarm enters ALARM state. Specify the runbook as a target of the rule.

    Show answer

    Answer: D

    Explanation

    It is debatable, as both C and D are correct and simple in their own ways, however, take a look at the number of components in each approach: C: CW -> SNS -> LAMBDA -> SSM (4) D: CW -> EVENTBRIDGE -> SSM (3) There is an extra component (SNS) to maintain on C, also, there is some coding involved on this option, which also needs to be maintained. Even if we already have the SNS created on option C, we still have to go there to remove the notification and configure the lambda invocation. Option D has fewer components, and require less customization.

    Source: Adapted from community discussion — daburahjail

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 311. 427 questions available.