DOP-C02 practice questions 331–340

1. Question 331 · 427 in bank

   An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wants the instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control. Which solution will accomplish this?

   • AIn the CloudFormation template, add an AWS Config rule. Place the configuration file content in the rule’s InputParameters property, and set the Scope property to the EC2 Auto Scaling group. Add an AWS Systems Manager Resource Data Sync resource to the template to poll for updates to the configuration.
   • BIn the CloudFormation template, add an EC2 launch template resource. Place the configuration file content in the launch template. Configure the cfn-init script to run when the instance is launched, and configure the cfn-hup script to poll for updates to the configuration.
   • CIn the CloudFormation template, add an EC2 launch template resource. Place the configuration file content in the launch template. Add an AWS Systems Manager Resource Data Sync resource to the template to poll for updates to the configuration.
   • DIn the CloudFormation template, add CloudFormation init metadata. Place the configuration file content in the metadata. Configure the cfn-init script to run when the instance is launched, and configure the cfn-hup script to poll for updates to the configuration.

   Show answer

   Answer: D

   Explanation

   Use the AWS::CloudFormation::Init type to include metadata on an Amazon EC2 instance for the cfn-init helper script. If your template calls the cfn-init script, the script looks for resource metadata rooted in the AWS::CloudFormation::Init metadata key. Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-init.html

   Source: Adapted from community discussion — 4555894

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 332 · 427 in bank

   Select 2

   A company manages an application that stores logs in Amazon CloudWatch Logs. The company wants to archive the logs to an Amazon S3 bucket. Logs are rarely accessed after 90 days and must be retained for 10 years. Which combination of steps should a DevOps engineer take to meet these requirements? (Choose two.)

   • AConfigure a CloudWatch Logs subscription filter to use AWS Glue to transfer all logs to an S3 bucket.
   • BConfigure a CloudWatch Logs subscription filter to use Amazon Kinesis Data Firehose to stream all logs to an S3 bucket.
   • CConfigure a CloudWatch Logs subscription filter to stream all logs to an S3 bucket.
   • DConfigure the S3 bucket lifecycle policy to transition logs to S3 Glacier after 90 days and to expire logs after 3.650 days.
   • EConfigure the S3 bucket lifecycle policy to transition logs to Reduced Redundancy after 90 days and to expire logs after 3.650 days.

   Show answer

   Answer: BD

   Explanation

   You can absolutly directly "export log data from your log groups to an Amazon S3 bucket" However, this is a one time export, and NOT an ongoing stream. If you want to steam continuously you have to use "subscription filter with Kinesis Data Streams, Lambda, or Firehose." https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3Export.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html https://dev.to/aws-builders/automate-export-of-cloudwatch-logs-to-s3-bucket-using-lambda-with-eventbridge-trigger-2ieg

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 333 · 427 in bank

   Select 3

   A company is developing a new application. The application uses AWS Lambda functions for its compute tier. The company must use a canary deployment for any changes to the Lambda functions. Automated rollback must occur if any failures are reported. The company’s DevOps team needs to create the infrastructure as code (IaC) and the CI/CD pipeline for this solution. Which combination of steps will meet these requirements? (Choose three.)

   • ACreate an AWS CloudFormation template for the application. Define each Lambda function in the template by using the AWS::Lambda::Function resource type. In the template, include a version for the Lambda function by using the AWS::Lambda::Version resource type. Declare the CodeSha256 property. Configure an AWS::Lambda::Alias resource that references the latest version of the Lambda function.
   • BCreate an AWS Serverless Application Model (AWS SAM) template for the application. Define each Lambda function in the template by using the AWS::Serverless::Function resource type. For each function, include configurations for the AutoPublishAlias property and the DeploymentPreference property. Configure the deployment configuration type to LambdaCanary10Percent10Minutes.
   • CCreate an AWS CodeCommit repository. Create an AWS CodePipeline pipeline. Use the CodeCommit repository in a new source stage that starts the pipeline. Create an AWS CodeBuild project to deploy the AWS Serverless Application Model (AWS SAM) template. Upload the template and source code to the CodeCommit repository. In the CodeCommit repository, create a buildspec.yml file that includes the commands to build and deploy the SAM application.
   • DCreate an AWS CodeCommit repository. Create an AWS CodePipeline pipeline. Use the CodeCommit repository in a new source stage that starts the pipeline. Create an AWS CodeDeploy deployment group that is configured for canary deployments with a DeploymentPreference type of Canary10Percent10Minutes. Upload the AWS CloudFormation template and source code to the CodeCommit repository. In the CodeCommit repository, create an appspec.yml file that includes the commands to deploy the CloudFormation template.
   • ECreate an Amazon CloudWatch composite alarm for all the Lambda functions. Configure an evaluation period and dimensions for Lambda. Configure the alarm to enter the ALARM state if any errors are detected or if there is insufficient data.
   • FCreate an Amazon CloudWatch alarm for each Lambda function. Configure the alarms to enter the ALARM state if any errors are detected. Configure an evaluation period, dimensions for each Lambda function and version, and the namespace as AWS/Lambda on the Errors metric.

   Show answer

   Answer: BCF

   Explanation

   A is wrong beacuse of AWS::Lambda::Function B - Can work C: is correct D: SAM or Lambda deployment in Codedeploy cannot be canary deployment. canaray deployment should be included in the Lambda code as mentioned in option B. E: Composite Alram is not required. if any Lambda fails , it should generate alarm F: works Basically select B from AB which is for lambda coding, Select C from CD for deploying and F from EF for monitoring and alerting

   Source: Adapted from community discussion — RVivek

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 334 · 427 in bank

   Select 2

   A DevOps engineer is deploying a new version of a company’s application in an AWS CodeDeploy deployment group associated with its Amazon EC2 instances. After some time, the deployment fails. The engineer realizes that all the events associated with the specific deployment ID are in a Skipped status, and code was not deployed in the instances associated with the deployment group. What are valid reasons for this failure? (Choose two.)

   • AThe networking configuration does not allow the EC2 instances to reach the internet via a NAT gateway or internet gateway, and the CodeDeploy endpoint cannot be reached.
   • BThe IAM user who triggered the application deployment does not have permission to interact with the CodeDeploy endpoint.
   • CThe target EC2 instances were not properly registered with the CodeDeploy endpoint.
   • DAn instance profile with proper permissions was not attached to the target EC2 instances.
   • EThe appspec.yml file was not included in the application revision.

   Show answer

   Answer: AD

   Explanation

   A. Explanation: For CodeDeploy to work, the EC2 instances need to reach the CodeDeploy endpoint to download the deployment artifacts. If the networking configuration of the EC2 instances does not allow them to access the internet via a NAT gateway or internet gateway, they won't be able to reach the CodeDeploy endpoint, leading to deployment failure. D Explanation: When EC2 instances are part of a CodeDeploy deployment group, they need to have an associated IAM instance profile with the necessary permissions to interact with CodeDeploy and download the deployment artifacts. If the instance profile with proper permissions is not attached to the target EC2 instances, the deployment will fail as the instances won't have the required permissions to complete the deployment process.

   Source: Adapted from community discussion — haazybanj

   References

   • AWS documentation

   Next question

5. Question 335 · 427 in bank

   A company has a guideline that every Amazon EC2 instance must be launched from an AMI that the company’s security team produces. Every month, the security team sends an email message with the latest approved AMIs to all the development teams. The development teams use AWS CloudFormation to deploy their applications. When developers launch a new service, they have to search their email for the latest AMIs that the security department sent. A DevOps engineer wants to automate the process that the security team uses to provide the AMI IDs to the development teams. What is the MOST scalable solution that meets these requirements?

   • ADirect the security team to use CloudFormation to create new versions of the AMIs and to list the AMI ARNs in an encrypted Amazon S3 object as part of the stack’s Outputs section. Instruct the developers to use a cross-stack reference to load the encrypted S3 object and obtain the most recent AMI ARNs.
   • BDirect the security team to use a CloudFormation stack to create an AWS CodePipeline pipeline that builds new AMIs and places the latest AMI ARNs in an encrypted Amazon S3 object as part of the pipeline output. Instruct the developers to use a cross-stack reference within their own CloudFormation template to obtain the S3 object location and the most recent AMI ARNs.
   • CDirect the security team to use Amazon EC2 Image Builder to create new AMIs and to place the AMI ARNs as parameters in AWS Systems Manager Parameter Store. Instruct the developers to specify a parameter of type SSM in their CloudFormation stack to obtain the most recent AMI ARNs from Parameter Store.
   • DDirect the security team to use Amazon EC2 Image Builder to create new AMIs and to create an Amazon Simple Notification Service (Amazon SNS) topic so that every development team can receive notifications. When the development teams receive a notification, instruct them to write an AWS Lambda function that will update their CloudFormation stack with the most recent AMI ARNs.

   Show answer

   Answer: C

   Explanation

   C is correct: and means we need a pipeline (imange builder) to build AMI and to automate sharing A and B: no mention of EC2 Imange builder, which is better than codepipeline in building Ec2 image D: They have to do this manually

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

6. Question 336 · 427 in bank

   An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). A DevOps engineer is using AWS CodeDeploy to release a new version. The deployment fails during the AllowTraffic lifecycle event, but a cause for the failure is not indicated in the deployment logs. What would cause this?

   • AThe appspec.yml file contains an invalid script that runs in the AllowTraffic lifecycle hook.
   • BThe user who initiated the deployment does not have the necessary permissions to interact with the ALB.
   • CThe health checks specified for the ALB target group are misconfigured.
   • DThe CodeDeploy agent was not installed in the EC2 instances that are part of the ALB target group.

   Show answer

   Answer: C

   Explanation

   C is correct: means there are problems with ALB. A: no mention of the ALB B: The user who init the deployment does not need necessary permission D: If agent was not installed, it would fail from the start

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

7. Question 337 · 427 in bank

   A company has 20 service teams. Each service team is responsible for its own microservice. Each service team uses a separate AWS account for its microservice and a VPC with the 192.168.0.0/22 CIDR block. The company manages the AWS accounts with AWS Organizations. Each service team hosts its microservice on multiple Amazon EC2 instances behind an Application Load Balancer. The microservices communicate with each other across the public internet. The company’s security team has issued a new guideline that all communication between microservices must use HTTPS over private network connections and cannot traverse the public internet. A DevOps engineer must implement a solution that fulfills these obligations and minimizes the number of changes for each service team. Which solution will meet these requirements?

   • ACreate a new AWS account in AWS Organizations. Create a VPC in this account, and use AWS Resource Access Manager to share the private subnets of this VPC with the organization. Instruct the service teams to launch a new Network Load Balancer (NLB) and EC2 instances that use the shared private subnets. Use the NLB DNS names for communication between microservices.
   • BCreate a Network Load Balancer (NLB) in each of the microservice VPCs. Use AWS PrivateLink to create VPC endpoints in each AWS account for the NLBs. Create subscriptions to each VPC endpoint in each of the other AWS accounts. Use the VPC endpoint DNS names for communication between microservices.
   • CCreate a Network Load Balancer (NLB) in each of the microservice VPCs. Create VPC peering connections between each of the microservice VPCs. Update the route tables for each VPC to use the peering links. Use the NLB DNS names for communication between microservices.
   • DCreate a new AWS account in AWS Organizations. Create a transit gateway in this account, and use AWS Resource Access Manager to share the transit gateway with the organization. In each of the microservice VPCs, create a transit gateway attachment to the shared transit gateway. Update the route tables of each VPC to use the transit gateway. Create a Network Load Balancer (NLB) in each of the microservice VPCs. Use the NLB DNS names for communication between microservices.

   Show answer

   Answer: B

   Explanation

   B is correct because all 20 services team in different separate AWS accounts are using the same CIDR block, which means they are overlapping CIDR. D state that to update the route tables of each VPC to use the transit gateway but they are all having the same CIDR block so this cannot proceed, as shared by Arnaud92 link the pre-requisite of using the transit gateway is "No-overlapping CIDR block between VPCs."

   Source: Adapted from community discussion — Blueee

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 338 · 427 in bank

   Select 2

   An Amazon EC2 instance is running in a VPC and needs to download an object from a restricted Amazon S3 bucket. When the DevOps engineer tries to download the object, an AccessDenied error is received. What are the possible causes for this error? (Choose two.)

   • AThe S3 bucket default encryption is enabled.
   • BThere is an error in the S3 bucket policy.
   • CThe object has been moved to S3 Glacier.
   • DThere is an error in the IAM role configuration.
   • ES3 Versioning is enabled.

   Show answer

   Answer: BD

   Next question

9. Question 339 · 427 in bank

   A company wants to use a grid system for a proprietary enterprise in-memory data store on top of AWS. This system can run in multiple server nodes in any Linux-based distribution. The system must be able to reconfigure the entire cluster every time a node is added or removed. When adding or removing nodes, an /etc/cluster/nodes.config file must be updated, listing the IP addresses of the current node members of that cluster. The company wants to automate the task of adding new nodes to a cluster. What can a DevOps engineer do to meet these requirements?

   • AUse AWS OpsWorks Stacks to layer the server nodes of that cluster. Create a Chef recipe that populates the content of the /etc/cluster/nodes.config file and restarts the service by using the current members of the layer. Assign that recipe to the Configure lifecycle event.
   • BPut the file nodes.config in version control. Create an AWS CodeDeploy deployment configuration and deployment group based on an Amazon EC2 tag value for the cluster nodes. When adding a new node to the cluster, update the file with all tagged instances, and make a commit in version control. Deploy the new file and restart the services.
   • CCreate an Amazon S3 bucket and upload a version of the /etc/cluster/nodes.config file. Create a crontab script that will poll for that S3 file and download it frequently. Use a process manager, such as Monit or systemd, to restart the cluster services when it detects that the new file was modified. When adding a node to the cluster, edit the file’s most recent members. Upload the new file to the S3 bucket.
   • DCreate a user data script that lists all members of the current security group of the cluster and automatically updates the /etc/cluster/nodes.config file whenever a new instance is added to the cluster.

   Show answer

   Answer: A

   Explanation

   A is correct. This event occurs on all of the stack's instances when one of the following occurs: An instance enters or leaves the online state. You associate an Elastic IP address with an instance or disassociate one from an instance. You attach an Elastic Load Balancing load balancer to a layer, or detach one from a layer. https://docs.aws.amazon.com/opsworks/latest/userguide/workingcookbook-events.html

   Source: Adapted from community discussion — rhinozD

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 340 · 427 in bank

    Select 2

    A DevOps engineer is working on a data archival project that requires the migration of on-premises data to an Amazon S3 bucket. The DevOps engineer develops a script that incrementally archives on-premises data that is older than 1 month to Amazon S3. Data that is transferred to Amazon S3 is deleted from the on-premises location. The script uses the S3 PutObject operation. During a code review, the DevOps engineer notices that the script does not verify whether the data was successfully copied to Amazon S3. The DevOps engineer must update the script to ensure that data is not corrupted during transmission. The script must use MD5 checksums to verify data integrity before the on-premises data is deleted. Which solutions for the script will meet these requirements? (Choose two.)

    • ACheck the returned response for the VersionId. Compare the returned VersionId against the MD5 checksum.
    • BInclude the MD5 checksum within the Content-MD5 parameter. Check the operation call’s return status to find out if an error was returned.
    • CInclude the checksum digest within the tagging parameter as a URL query parameter.
    • DCheck the returned response for the ETag. Compare the returned ETag against the MD5 checksum.
    • EInclude the checksum digest within the Metadata parameter as a name-value pair. After upload, use the S3 HeadObject operation to retrieve metadata from the object.

    Show answer

    Answer: BD

    Explanation

    B. Explanation: When using the S3 PutObject operation, you can include the MD5 checksum of the object in the Content-MD5 parameter of the request. Amazon S3 will calculate the MD5 checksum of the object and compare it to the provided checksum. If the checksums do not match, Amazon S3 will return an error response, indicating that the data integrity check failed. This way, you can ensure that the data was successfully copied to Amazon S3 without corruption. D. Explanation: When you use the S3 PutObject operation, it returns an ETag in the response, which is the MD5 checksum of the object that was stored in Amazon S3. After performing the upload, you can check the returned ETag against the MD5 checksum you have locally calculated. If they match, it means the data was transferred successfully without corruption. If they don't match, it indicates a data integrity issue, and you can take appropriate actions.

    Source: Adapted from community discussion — haazybanj

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 331. 427 questions available.