DOP-C02 practice questions 341–350

1. Question 341 · 427 in bank

   A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet regulatory compliance requirements. The security team wants to be notified when any keys have not been rotated after 90 days. Which solution will accomplish this?

   • AConfigure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
   • BConfigure an Amazon EventBridge event to launch an AWS Lambda function to call the AWS Trusted Advisor API and publish to an Amazon Simple Notification Service (Amazon SNS) topic.
   • CDevelop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
   • DConfigure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.

   Show answer

   Answer: C

   Explanation

   Looks like C, actually there is a managed rule for this: https://docs.aws.amazon.com/config/latest/developerguide/access-keys-rotated.html anyway trusted advisor cannot be used as there is no such check, also KMS does not have this action, security hub is not conducting any active checks just react to events

   Source: Adapted from community discussion — asfsdfsdf

   References

   • AWS documentation

   Next question

2. Question 342 · 427 in bank

   A company deploys updates to its Amazon API Gateway API several times a week by using an AWS CodePipeline pipeline. As part of the update process, the company exports the JavaScript SDK for the API from the API Gateway console and uploads the SDK to an Amazon S3 bucket. The company has configured an Amazon CloudFront distribution that uses the S3 bucket as an origin. Web clients then download the SDK by using the CloudFront distribution’s endpoint. A DevOps engineer needs to implement a solution to make the new SDK available automatically during new API deployments. Which solution will meet these requirements?

   • ACreate a CodePipeline action immediately after the deployment stage of the API. Configure the action to invoke an AWS Lambda function. Configure the Lambda function to download the SDK from API Gateway, upload the SDK to the S3 bucket, and create a CloudFront invalidation for the SDK path.
   • BCreate a CodePipeline action immediately after the deployment stage of the API. Configure the action to use the CodePipeline integration with API Gateway to export the SDK to Amazon S3. Create another action that uses the CodePipeline integration with Amazon S3 to invalidate the cache for the SDK path.
   • CCreate an Amazon EventBridge rule that reacts to UpdateStage events from aws.apigateway. Configure the rule to invoke an AWS Lambda function to download the SDK from API Gateway, upload the SDK to the S3 bucket, and call the CloudFront API to create an invalidation for the SDK path.
   • DCreate an Amazon EventBridge rule that reacts to CreateDeployment events from aws.apigateway. Configure the rule to invoke an AWS Lambda function to download the SDK from API Gateway, upload the SDK to the S3 bucket, and call the S3 API to invalidate the cache for the SDK path.

   Show answer

   Answer: A

   Explanation

   Vote A. Reasons: C: No. "aws.apigateway needs API Gateway AWS integration to send events to EventBridge without using compute service, such as Lambda or Amazon EC2." https://aws.amazon.com/blogs/compute/capturing-client-events-using-amazon-api-gateway-and-amazon-eventbridge/ B&D: No. S3 API doesn't contain invalidate cache call, whereas CloudFront does. Search "invalidat" in https://docs.aws.amazon.com/cli/latest/reference/s3api/ https://docs.aws.amazon.com/cli/latest/reference/cloudfront/

   Source: Adapted from community discussion — zanhsieh

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 343 · 427 in bank

   A company has developed an AWS Lambda function that handles orders received through an API. The company is using AWS CodeDeploy to deploy the Lambda function as the final stage of a CI/CD pipeline. A DevOps engineer has noticed there are intermittent failures of the ordering API for a few seconds after deployment. After some investigation, the DevOps engineer believes the failures are due to database changes not having fully propagated before the Lambda function is invoked. How should the DevOps engineer overcome this?

   • AAdd a BeforeAllowTraffic hook to the AppSpec file that tests and waits for any necessary database changes before traffic can flow to the new version of the Lambda function.
   • BAdd an AfterAllowTraffic hook to the AppSpec file that forces traffic to wait for any pending database changes before allowing the new version of the Lambda function to respond.
   • CAdd a BeforeInstall hook to the AppSpec file that tests and waits for any necessary database changes before deploying the new version of the Lambda function.
   • DAdd a ValidateService hook to the AppSpec file that inspects incoming traffic and rejects the payload if dependent services, such as the database, are not yet ready.

   Show answer

   Answer: A

   Explanation

   In my research, there are only TWO CodeDeploy AppSpec ifecycle event hooks for Lambda deployment: BeforeAllowTraffic # Use to run tasks before traffic is shifted to the deployed Lambda function version. AfterAllowTraffic # Use to run tasks after all traffic is shifted to the deployed Lambda function version. A: (YES) Don't redirect traffic untill ready B: (NO) Block traffic until ready C: (NO) Event hook N/A for Lambda D: (NO) Event hook N/A for Lambda

   Source: Adapted from community discussion — Gomer

   Next question

4. Question 344 · 427 in bank

   A company uses a single AWS account to test applications on Amazon EC2 instances. The company has turned on AWS Config in the AWS account and has activated the restricted-ssh AWS Config managed rule. The company needs an automated monitoring solution that will provide a customized notification in real time if any security group in the account is not compliant with the restricted-ssh rule. The customized notification must contain the name and ID of the noncompliant security group. A DevOps engineer creates an Amazon Simple Notification Service (Amazon SNS) topic in the account and subscribes the appropriate personnel to the topic. What should the DevOps engineer do next to meet these requirements?

   • ACreate an Amazon EventBridge rule that matches an AWS Config evaluation result of NON_COMPLIANT for the restricted-ssh rule. Configure an input transformer for the EventBridge rule. Configure the EventBridge rule to publish a notification to the SNS topic.
   • BConfigure AWS Config to send all evaluation results for the restricted-ssh rule to the SNS topic. Configure a filter policy on the SNS topic to send only notifications that contain the text of NON_COMPLIANT in the notification to subscribers.
   • CCreate an Amazon EventBridge rule that matches an AWS Config evaluation result of NON_COMPLIANT for the restricted-ssh rule. Configure the EventBridge rule to invoke AWS Systems Manager Run Command on the SNS topic to customize a notification and to publish the notification to the SNS topic.
   • DCreate an Amazon EventBridge rule that matches all AWS Config evaluation results of NON_COMPLIANT. Configure an input transformer for the restricted-ssh rule. Configure the EventBridge rule to publish a notification to the SNS topic.

   Show answer

   Answer: A

   Explanation

   A is correct: and means they have already have SNS. we need to trigger alarm with eventbridge and send noti to SNS B: no mention of event bride C: AWS Systems Manager Run Command on the SNS topic to customize a notification: this step is unnecessary D: : we need to match NON_COMPLIANT for the restricted-ssh rule only

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation
   • repost.aws documentation

   Next question

5. Question 345 · 427 in bank

   Select 2

   A company requires an RPO of 2 hours and an RTO of 10 minutes for its data and application at all times. An application uses a MySQL database and Amazon EC2 web servers. The development team needs a strategy for failover and disaster recovery. Which combination of deployment strategies will meet these requirements? (Choose two.)

   • ACreate an Amazon Aurora cluster in one Availability Zone across multiple Regions as the data store. Use Aurora’s automatic recovery capabilities in the event of a disaster.
   • BCreate an Amazon Aurora global database in two Regions as the data store. In the event of a failure, promote the secondary Region as the primary for the application.
   • CCreate an Amazon Aurora multi-master cluster across multiple Regions as the data store. Use a Network Load Balancer to balance the database traffic in different Regions.
   • DSet up the application in two Regions and use Amazon Route 53 failover-based routing that points to the Application Load Balancers in both Regions. Use health checks to determine the availability in a given Region. Use Auto Scaling groups in each Region to adjust capacity based on demand.
   • ESet up the application in two Regions and use a multi-Region Auto Scaling group behind Application Load Balancers to manage the capacity based on demand. In the event of a disaster, adjust the Auto Scaling group’s desired instance count to increase baseline capacity in the failover Region.

   Show answer

   Answer: BD

   Explanation

   B and D are correct: means global table or db cluster and route53 fail-over policy A and C: These options mention spanning an Amazon Aurora cluster across multiple region. This is not true. A cluster can span across multiple AZs, not regions. The only Aurora solution that can span multiple regions is global table, which includes multiple clusters. E: No mention of Route 53 failover-based routing

   Source: Adapted from community discussion — thanhnv142

   Next question

6. Question 346 · 427 in bank

   A business has an application that consists of five independent AWS Lambda functions. The DevOps engineer has built a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild that builds, tests, packages, and deploys each Lambda function in sequence. The pipeline uses an Amazon EventBridge rule to ensure the pipeline starts as quickly as possible after a change is made to the application source code. After working with the pipeline for a few months, the DevOps engineer has noticed the pipeline takes too long to complete. What should the DevOps engineer implement to BEST improve the speed of the pipeline?

   • AModify the CodeBuild projects within the pipeline to use a compute type with more available network throughput.
   • BCreate a custom CodeBuild execution environment that includes a symmetric multiprocessing configuration to run the builds in parallel.
   • CModify the CodePipeline configuration to run actions for each Lambda function in parallel by specifying the same runOrder.
   • DModify each CodeBuild project to run within a VPC and use dedicated instances to increase throughput.

   Show answer

   Answer: C

   Explanation

   Parallel Execution: By modifying the CodePipeline configuration to run actions for each Lambda function in parallel with the same runOrder, you allow multiple Lambda functions to be built and deployed simultaneously, which significantly improves the overall speed of the pipeline. RunOrder: The runOrder parameter in CodePipeline allows you to specify the order in which actions run. If multiple actions have the same runOrder, they can run in parallel.

   Source: Adapted from community discussion — Dushank

   Next question

7. Question 347 · 427 in bank

   A company uses AWS CloudFormation stacks to deploy updates to its application. The stacks consist of different resources. The resources include AWS Auto Scaling groups, Amazon EC2 instances, Application Load Balancers (ALBs), and other resources that are necessary to launch and maintain independent stacks. Changes to application resources outside of CloudFormation stack updates are not allowed. The company recently attempted to update the application stack by using the AWS CLI. The stack failed to update and produced the following error message: “ERROR: both the deployment and the CloudFormation stack rollback failed. The deployment failed because the following resource(s) failed to update: [AutoScalingGroup].” The stack remains in a status of UPDATE_ROLLBACK_FAILED. Which solution will resolve this issue?

   • AUpdate the subnet mappings that are configured for the ALBs. Run the aws cloudformation update-stack-set AWS CLI command.
   • BUpdate the IAM role by providing the necessary permissions to update the stack. Run the aws cloudformation continue-update-rollback AWS CLI command.
   • CSubmit a request for a quota increase for the number of EC2 instances for the account. Run the aws cloudformation cancel-update-stack AWS CLI command.
   • DDelete the Auto Scaling group resource. Run the aws cloudformation rollback-stack AWS CLI command.

   Show answer

   Answer: B

   Explanation

   https://repost.aws/knowledge-center/cloudformation-update-rollback-failed If your stack is stuck in the UPDATE_ROLLBACK_FAILED state after a failed update, then the only actions that you can perform on the stack are the ContinueUpdateRollback or DeleteStack operations. So only B has ContinueUpdateRollback

   Source: Adapted from community discussion — Blueee

   References

   • repost.aws documentation

   Next question

8. Question 348 · 427 in bank

   A company is deploying a new application that uses Amazon EC2 instances. The company needs a solution to query application logs and AWS account API activity. Which solution will meet these requirements?

   • AUse the Amazon CloudWatch agent to send logs from the EC2 instances to Amazon CloudWatch Logs. Configure AWS CloudTrail to deliver the API logs to Amazon S3. Use CloudWatch to query both sets of logs.
   • BUse the Amazon CloudWatch agent to send logs from the EC2 instances to Amazon CloudWatch Logs. Configure AWS CloudTrail to deliver the API logs to CloudWatch Logs. Use CloudWatch Logs Insights to query both sets of logs.
   • CUse the Amazon CloudWatch agent to send logs from the EC2 instances to Amazon Kinesis. Configure AWS CloudTrail to deliver the API logs to Kinesis. Use Kinesis to load the data into Amazon Redshift. Use Amazon Redshift to query both sets of logs.
   • DUse the Amazon CloudWatch agent to send logs from the EC2 instances to Amazon S3. Use AWS CloudTrail to deliver the API logs to Amazon S3. Use Amazon Athena to query both sets of logs in Amazon S3.

   Show answer

   Answer: B

   Explanation

   Explanation: Option B provides a comprehensive solution for querying application logs and AWS account API activity. The Amazon CloudWatch agent is used to send logs from the EC2 instances to Amazon CloudWatch Logs, allowing easy access to application logs. AWS CloudTrail is configured to deliver the API logs to CloudWatch Logs, enabling monitoring and analysis of AWS account activity. Finally, CloudWatch Logs Insights is utilized to query and analyze both sets of logs efficiently.

   Source: Adapted from community discussion — haazybanj

   Next question

9. Question 349 · 427 in bank

   A company wants to ensure that their EC2 instances are secure. They want to be notified if any new vulnerabilities are discovered on their instances, and they also want an audit trail of all login activities on the instances. Which solution will meet these requirements?

   • AUse AWS Systems Manager to detect vulnerabilities on the EC2 instances. Install the Amazon Kinesis Agent to capture system logs and deliver them to Amazon S3.
   • BUse AWS Systems Manager to detect vulnerabilities on the EC2 instances. Install the Systems Manager Agent to capture system logs and view login activity in the CloudTrail console.
   • CConfigure Amazon CloudWatch to detect vulnerabilities on the EC2 instances. Install the AWS Config daemon to capture system logs and view them in the AWS Config console.
   • DConfigure Amazon Inspector to detect vulnerabilities on the EC2 instances. Install the Amazon CloudWatch Agent to capture system logs and record them via Amazon CloudWatch Logs.

   Show answer

   Answer: D

   Explanation

   Aamzon Inspector detect software vulnerabilities and unintended network exposure in near real time in AWS workloads such as Amazon EC2, AWS Lambda functions, and Amazon ECR.

   Source: Adapted from community discussion — ProfXsamson

   Next question

10. Question 350 · 427 in bank

    A company is running an application on Amazon EC2 instances in an Auto Scaling group. Recently, an issue occurred that prevented EC2 instances from launching successfully, and it took several hours for the support team to discover the issue. The support team wants to be notified by email whenever an EC2 instance does not start successfully. Which action will accomplish this?

    • AAdd a health check to the Auto Scaling group to invoke an AWS Lambda function whenever an instance status is impaired.
    • BConfigure the Auto Scaling group to send a notification to an Amazon SNS topic whenever a failed instance launch occurs.
    • CCreate an Amazon CloudWatch alarm that invokes an AWS Lambda function when a failed AttachInstances Auto Scaling API call is made.
    • DCreate a status check alarm on Amazon EC2 to send a notification to an Amazon SNS topic whenever a status check fail occurs.

    Show answer

    Answer: B

    Explanation

    i think B is correct , but Option A is incorrect because, this would only be triggered if an instance was already running and experiencing issues. It would not provide notification when an instance fails to launch.

    Source: Adapted from community discussion — 2pk

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 341. 427 questions available.