DOP-C02 practice questions 321–330

1. Question 321 · 427 in bank

   Select 3

   A DevOps engineer at a company is supporting an AWS environment in which all users use AWS IAM Identity Center (AWS Single Sign-On). The company wants to immediately disable credentials of any new IAM user and wants the security team to receive a notification. Which combination of steps should the DevOps engineer take to meet these requirements? (Choose three.)

   • ACreate an Amazon EventBridge rule that reacts to an IAM CreateUser API call in AWS CloudTrail.
   • BCreate an Amazon EventBridge rule that reacts to an IAM GetLoginProfile API call in AWS CloudTrail.
   • CCreate an AWS Lambda function that is a target of the EventBridge rule. Configure the Lambda function to disable any access keys and delete the login profiles that are associated with the IAM user.
   • DCreate an AWS Lambda function that is a target of the EventBridge rule. Configure the Lambda function to delete the login profiles that are associated with the IAM user.
   • ECreate an Amazon Simple Notification Service (Amazon SNS) topic that is a target of the EventBridge rule. Subscribe the security team's group email address to the topic.
   • FCreate an Amazon Simple Queue Service (Amazon SQS) queue that is a target of the Lambda function. Subscribe the security team's group email address to the queue.

   Show answer

   Answer: ACE

   Explanation

   ACE are correct: means disable all access key and profile related to the user. means SNS B: GetLoginProfile API is not equal to creating new user D: we should delete all access key and profile related to the user, not just profile F: we need SNS, not SQS

   Source: Adapted from community discussion — thanhnv142

   Next question

2. Question 322 · 427 in bank

   A company wants to set up a continuous delivery pipeline. The company stores application code in a private GitHub repository. The company needs to deploy the application components to Amazon Elastic Container Service (Amazon ECS). Amazon EC2, and AWS Lambda. The pipeline must support manual approval actions. Which solution will meet these requirements?

   • AUse AWS CodePipeline with Amazon ECS. Amazon EC2, and Lambda as deploy providers.
   • BUse AWS CodePipeline with AWS CodeDeploy as the deploy provider.
   • CUse AWS CodePipeline with AWS Elastic Beanstalk as the deploy provider.
   • DUse AWS CodeDeploy with GitHub integration to deploy the application.

   Show answer

   Answer: B

   Explanation

   The solution for deploy ECS by codePipeline and codeDeploy Create your CodeDeploy application and deployment group (ECS compute platform https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-ecs-ecr-codedeploy.html#tutorials-ecs-ecr-codedeploy-deployment

   Source: Adapted from community discussion — due

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 323 · 427 in bank

   A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up. the application needs to process data from an Amazon S3 bucket before the application can start to serve requests. The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests. Which solution is the MOST cost-effective way to reduce the application startup time?

   • AConfigure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state. Configure an autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when the application is ready to serve requests.
   • BIncrease the maximum instance count of the Auto Scaling group. Configure an autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when the application is ready to serve requests.
   • CConfigure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state. Configure an autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook when the application is ready to serve requests.
   • DIncrease the maximum instance count of the Auto Scaling group. Configure an autoscaling:EC2_INSTANCE_LAUNCHING lifecycle hook on the Auto Scaling group. Modify the application to complete the lifecycle hook and to place the new instance in the Standby state when the application is ready to serve requests.

   Show answer

   Answer: A

   Explanation

   Option A is the most cost-effective solution. By configuring a warm pool of EC2 instances in the Stopped state, the company can reduce the time it takes for new instances to be ready to serve requests. When the Auto Scaling group launches a new instance, it can attach the stopped EC2 instance from the warm pool. The instance can then be started up immediately, rather than having to wait for the data to be downloaded and processed. This reduces the overall startup time for the application. Option C is also a solution that involves a warm pool of EC2 instances, but the instances are in the Running state. This means that they are already running and incurring costs, even though they are not currently serving requests. This is not a cost-effective solution.

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 324 · 427 in bank

   A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts. The buildspec.yml file contains the following:

   

   The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts. What steps should the DevOps engineer take to stop this?

   • AModify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only.
   • BConfigure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access.
   • CCreate an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal “*”.
   • DModify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only.

   Show answer

   Answer: D

   Explanation

   "--acl authenticated-read" means any authenticated users can read the S3 bucket. We should remove it and configure the bucket policy to explicitly grant access

   Source: Adapted from community discussion — jamesf

   Next question

5. Question 325 · 427 in bank

   A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code. A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets. What is the MOST secure solution that meets these requirements?

   • AEnable Amazon CodeGuru Profiler. Decorate the handler function with @with_lambda_profiler(). Manually review the recommendation report. Write the secret to AWS Systems Manager Parameter Store as a secure string. Update the SAM templates and the Python code to pull the secret from Parameter Store.
   • BAssociate the CodeCommit repository with Amazon CodeGuru Reviewer. Manually check the code review for any recommendations. Choose the option to protect the secret. Update the SAM templates and the Python code to pull the secret from AWS Secrets Manager.
   • CEnable Amazon CodeGuru Profiler. Decorate the handler function with @with_lambda_profiler(). Manually review the recommendation report. Choose the option to protect the secret. Update the SAM templates and the Python code to pull the secret from AWS Secrets Manager.
   • DAssociate the CodeCommit repository with Amazon CodeGuru Reviewer. Manually check the code review for any recommendations. Write the secret to AWS Systems Manager Parameter Store as a string. Update the SAM templates and the Python code to pull the secret from Parameter Store.

   Show answer

   Answer: B

   Explanation

   B The MOST secure solution that meets the requirement of automatically detecting and preventing hardcoded secrets is to use AWS CodeGuru Reviewer to check the code for any hardcoded secrets, and then update the SAM templates and Python code to retrieve the secrets from AWS Secrets Manager. Option B is the correct answer. By associating the CodeCommit repository with Amazon CodeGuru Reviewer, the code can be checked for any hardcoded secrets during code reviews. When a hardcoded secret is detected, CodeGuru Reviewer will recommend updating the code to retrieve the secret from a secure storage service like AWS Secrets Manager. The DevOps engineer can choose the option to protect the secret and then update the SAM templates and Python code to retrieve the secret from AWS Secrets Manager instead of hardcoding it in the code.

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation

   Next question

6. Question 326 · 427 in bank

   A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company’s IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted. A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256). Which solution will meet these requirements?

   • ACreate an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule. Program the Lambda function to scan all current S3 buckets for encryption status and to set AES-256 as the default encryption for any S3 bucket that does not have an encryption configuration.
   • BSet up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule. Configure the rule to use the AWS-EnableS3BucketEncryption AWS Systems Manager Automation runbook as the remediation action. Manually run the re-evaluation process to ensure that existing S3 buckets are compliant.
   • CCreate an AWS Lambda function that is invoked by an Amazon EventBridge event rule. Define the rule with an event pattern that matches the creation of new S3 buckets. Program the Lambda function to parse the EventBridge event, check the configuration of the S3 buckets from the event, and set AES-256 as the default encryption.
   • DConfigure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256. Create an IAM group for all the company’s IAM users. Associate the IAM policy with the IAM group.

   Show answer

   Answer: B

   Explanation

   B caters to both existing and new buckets. C is triggered on when new bucket is created, existing buckets are not handled by the event.

   Source: Adapted from community discussion — paali

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 327 · 427 in bank

   A DevOps engineer is architecting a continuous development strategy for a company’s software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets. Which architecture will meet these requirements with the LEAST amount of configuration?

   • ACreate a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair.
   • BCreate a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group.
   • CCreate a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair.
   • DCreate an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair.

   Show answer

   Answer: C

   Explanation

   C is correct: means deployment in parallel B and D: no mention of deployment in parallel A: means there are multiple AWS CodeDeploy applications and deployment groups for each site, which is unnecessary

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

8. Question 328 · 427 in bank

   A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances. On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com. How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

   • ADelete all objects, including previous versions, from the S3 bucket that contains the static website content.
   • BUpdate the weighted DNS record entry that points to the S3 bucket. Apply a weight of 0. Specify the domain reset option to propagate changes immediately.
   • CConfigure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB.
   • DRemove the weighted DNS record entry that points to the S3 bucket from the example.com hosted zone. Wait for DNS propagation to become complete.

   Show answer

   Answer: D

   Explanation

   D is the answer B wrong because Route 53 initially considers only the nonzero weighted records, if any. If all the records that have a weight greater than 0 are unhealthy, then Route 53 considers the zero-weighted records.

   Source: Adapted from community discussion — 2pk

   References

   • AWS documentation

   Next question

9. Question 329 · 427 in bank

   A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:

   

   Which type of events will match this event pattern?

   • AFailed deploy and build actions across all the pipelines
   • BAll rejected or failed approval actions across all the pipelines
   • CAll the events across all pipelines
   • DApproval actions across all the pipelines

   Show answer

   Answer: B

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 330 · 427 in bank

    Select 2

    A company’s security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are included in a single organization in AWS Organizations. The company has configured AWS Config for the organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS WAF web ACLs. Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)

    • ADelegate AWS Firewall Manager to a security account.
    • BDelegate Amazon GuardDuty to a security account.
    • CCreate an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
    • DCreate an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
    • EConfigure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.

    Show answer

    Answer: AC

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 321. 427 questions available.