DOP-C02 practice questions 31–40

1. Question 31 · 427 in bank

   A highly regulated company has a policy that DevOps engineers should not log in to their Amazon EC2 instances except in emergencies. If a DevOps engineer does log in, the security team must be notified within 15 minutes of the occurrence. Which solution will meet these requirements?

   • AInstall the Amazon Inspector agent on each EC2 instance. Subscribe to Amazon EventBridge notifications. Invoke an AWS Lambda function to check if a message is about user logins. If it is, send a notification to the security team using Amazon SNS.
   • BInstall the Amazon CloudWatch agent on each EC2 instance. Configure the agent to push all logs to Amazon CloudWatch Logs and set up a CloudWatch metric filter that searches for user logins. If a login is found, send a notification to the security team using Amazon SNS.
   • CSet up AWS CloudTrail with Amazon CloudWatch Logs. Subscribe CloudWatch Logs to Amazon Kinesis. Attach AWS Lambda to Kinesis to parse and determine if a log contains a user login. If it does, send a notification to the security team using Amazon SNS.
   • DSet up a script on each Amazon EC2 instance to push all logs to Amazon S3. Set up an S3 event to invoke an AWS Lambda function, which invokes an Amazon Athena query to run. The Athena query checks for logins and sends the output to the security team using Amazon SNS.

   Show answer

   Answer: B

   Explanation

   Cloud Trail will track calls to AWS API, but not the OS login in an EC2. That can be checked only using Cloud watch logs

   Source: Adapted from community discussion — RVivek

   References

   • AWS documentation

   Next question

2. Question 32 · 427 in bank

   Select 2

   A company updated the AWS CloudFormation template for a critical business application. The stack update process failed due to an error in the updated template, and AWS CloudFormation automatically began the stack rollback process. Later, a DevOps engineer discovered that the application was still unavailable and that the stack was in the UPDATE_ROLLBACK_FAILED state. Which combination of actions should the DevOps engineer perform so that the stack rollback can complete successfully? (Choose two.)

   • AAttach the AWSCloudFormationFullAccess IAM policy to the AWS CloudFormation role.
   • BAutomatically recover the stack resources by using AWS CloudFormation drift detection.
   • CIssue a ContinueUpdateRollback command from the AWS CloudFormation console or the AWS CLI.
   • DManually adjust the resources to match the expectations of the stack.
   • EUpdate the existing AWS CloudFormation stack by using the original template.

   Show answer

   Answer: CD

   Explanation

   yes C & D C. Issue a ContinueUpdateRollback command from the AWS CloudFormation console or the AWS CLI: This command allows CloudFormation to continue the rollback process from the point where it was paused. By using this command, CloudFormation will attempt to restore the resources to their previous state and delete any resources that were created during the update. D. Manually adjust the resources to match the expectations of the stack: This involves identifying and correcting the root cause of the update failure, which could involve changing the resource configuration or resolving any dependencies or inconsistencies in the stack.

   Source: Adapted from community discussion — 2pk

   References

   • AWS documentation

   Next question

3. Question 33 · 427 in bank

   Select 3

   A development team manually builds an artifact locally and then places it in an Amazon S3 bucket. The application has a local cache that must be cleared when a deployment occurs. The team runs a command to do this, downloads the artifact from Amazon S3, and unzips the artifact to complete the deployment. A DevOps team wants to migrate to a CI/CD process and build in checks to stop and roll back the deployment when a failure occurs. This requires the team to track the progression of the deployment. Which combination of actions will accomplish this? (Choose three.)

   • AAllow developers to check the code into a code repository. Using Amazon EventBridge, on every pull into the main branch, invoke an AWS Lambda function to build the artifact and store it in Amazon S3.
   • BCreate a custom script to clear the cache. Specify the script in the BeforeInstall lifecycle hook in the AppSpec file.
   • CCreate user data for each Amazon EC2 instance that contains the clear cache script. Once deployed, test the application. If it is not successful, deploy it again.
   • DSet up AWS CodePipeline to deploy the application. Allow developers to check the code into a code repository as a source for the pipeline.
   • EUse AWS CodeBuild to build the artifact and place it in Amazon S3. Use AWS CodeDeploy to deploy the artifact to Amazon EC2 instances.
   • FUse AWS Systems Manager to fetch the artifact from Amazon S3 and deploy it to all the instances.

   Show answer

   Answer: BDE

   Explanation

   (B) This would help ensure that the local cache is cleared before the new version of the application is installed. AppSpec (Application Specification) file is a unique file to AWS CodeDeploy. It defines the deployment actions you want AWS CodeDeploy to execute. (D) This would allow you to automate the build and deployment processes. AWS CodePipeline is a fully managed continuous delivery service that helps you automate your release pipelines for fast and reliable application and infrastructure updates. (E) This would allow you to automate the build process and ensure that the application is built in a consistent environment. AWS CodeBuild is a fully managed build service that compiles source code, runs tests, and produces software packages that are ready to deploy. AWS CodeDeploy automates software deployments to a variety of compute services including Amazon EC2, AWS Fargate, AWS Lambda, and your on-premises servers.

   Source: Adapted from community discussion — tartarus23

   Next question

4. Question 34 · 427 in bank

   Select 3

   A DevOps engineer is working on a project that is hosted on Amazon Linux and has failed a security review. The DevOps manager has been asked to review the company buildspec.yaml file for an AWS CodeBuild project and provide recommendations. The buildspec.yaml file is configured as follows:

   

   What changes should be recommended to comply with AWS security best practices? (Choose three.)

   • AAdd a post-build command to remove the temporary files from the container before termination to ensure they cannot be seen by other CodeBuild users.
   • BUpdate the CodeBuild project role with the necessary permissions and then remove the AWS credentials from the environment variable.
   • CStore the DB_PASSWORD as a SecureString value in AWS Systems Manager Parameter Store and then remove the DB_PASSWORD from the environment variables.
   • DMove the environment variables to the ‘db-deploy-bucket’ Amazon S3 bucket, add a prebuild stage to download, then export the variables.
   • EUse AWS Systems Manager run command versus scp and ssh commands directly to the instance.
   • FScramble the environment variables using XOR followed by Base64, add a section to install, and then run XOR and Base64 to the build phase.

   Show answer

   Answer: BCE

   Explanation

   BCE is correct A is WRONG. CodeBuild does not keep files for next builds in that way, once the build is done, the files will be deleted.

   Source: Adapted from community discussion — WhyIronMan

   Next question

5. Question 35 · 427 in bank

   A company has a single AWS account that runs hundreds of Amazon EC2 instances in a single AWS Region. New EC2 instances are launched and terminated each hour in the account. The account also includes existing EC2 instances that have been running for longer than a week. The company's security policy requires all running EC2 instances to use an EC2 instance profile. If an EC2 instance does not have an instance profile attached, the EC2 instance must use a default instance profile that has no IAM permissions assigned. A DevOps engineer reviews the account and discovers EC2 instances that are running without an instance profile. During the review, the DevOps engineer also observes that new EC2 instances are being launched without an instance profile. Which solution will ensure that an instance profile is attached to all existing and future EC2 instances in the Region?

   • AConfigure an Amazon EventBridge rule that reacts to EC2 RunInstances API calls. Configure the rule to invoke an AWS Lambda function to attach the default instance profile to the EC2 instances.
   • BConfigure the ec2-instance-profile-attached AWS Config managed rule with a trigger type of configuration changes. Configure an automatic remediation action that invokes an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instances.
   • CConfigure an Amazon EventBridge rule that reacts to EC2 StartInstances API calls. Configure the rule to invoke an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instances
   • DConfigure the iam-role-managed-policy-check AWS Config managed rule with a trigger type of configuration changes. Configure an automatic remediation action that invokes an AWS Lambda function to attach the default instance profile to the EC2 instances.

   Show answer

   Answer: B

   Explanation

   WS Config, specifically utilizing the "ec2-instance-profile-attached" managed rule with the configuration change trigger type. This rule helps monitor the attachment of instance profiles to EC2 instances. An automatic remediation action can be configured within AWS Config to respond when instances are found without an instance profile attached. The remediation action would execute an AWS Systems Manager Automation runbook to attach the default instance profile to those instances.

   Source: Adapted from community discussion — koenigParas2324

   References

   • AWS documentation

   Next question

6. Question 36 · 427 in bank

   A company has a legacy application. A DevOps engineer needs to automate the process of building the deployable artifact for the legacy application. The solution must store the deployable artifact in an existing Amazon S3 bucket for future deployments to reference. Which solution will meet these requirements in the MOST operationally efficient way?

   • ACreate a custom Docker image that contains all the dependencies for the legacy application. Store the custom Docker image in a new Amazon Elastic Container Registry (Amazon ECR) repository. Configure a new AWS CodeBuild project to use the custom Docker image to build the deployable artifact and to save the artifact to the S3 bucket.
   • BLaunch a new Amazon EC2 instance. Install all the dependencies for the legacy application on the EC2 instance. Use the EC2 instance to build the deployable artifact and to save the artifact to the S3 bucket.
   • CCreate a custom EC2 Image Builder image. Install all the dependencies for the legacy application on the image. Launch a new Amazon EC2 instance from the image. Use the new EC2 instance to build the deployable artifact and to save the artifact to the S3 bucket.
   • DCreate an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with an AWS Fargate profile that runs in multiple Availability Zones. Create a custom Docker image that contains all the dependencies for the legacy application. Store the custom Docker image in a new Amazon Elastic Container Registry (Amazon ECR) repository. Use the custom Docker image inside the EKS cluster to build the deployable artifact and to save the artifact to the S3 bucket.

   Show answer

   Answer: A

   Explanation

   The most operationally efficient solution for automating the process of building the deployable artifact for the legacy application and storing it in an existing Amazon S3 bucket is: A. This solution leverages containerization with Docker, which allows for consistent and isolated builds, making it easier to manage application dependencies. The use of AWS CodeBuild allows for scalable and automated builds using the custom Docker image, making the process efficient and reliable. The deployable artifact can then be saved to the existing S3 bucket for future reference and deployments.

   Source: Adapted from community discussion — haazybanj

   Next question

7. Question 37 · 427 in bank

   A company builds a container image in an AWS CodeBuild project by running Docker commands. After the container image is built, the CodeBuild project uploads the container image to an Amazon S3 bucket. The CodeBuild project has an IAM service role that has permissions to access the S3 bucket. A DevOps engineer needs to replace the S3 bucket with an Amazon Elastic Container Registry (Amazon ECR) repository to store the container images. The DevOps engineer creates an ECR private image repository in the same AWS Region of the CodeBuild project. The DevOps engineer adjusts the IAM service role with the permissions that are necessary to work with the new ECR repository. The DevOps engineer also places new repository information into the docker build command and the docker push command that are used in the buildspec.yml file. When the CodeBuild project runs a build job, the job fails when the job tries to access the ECR repository. Which solution will resolve the issue of failed access to the ECR repository?

   • AUpdate the buildspec.yml file to log in to the ECR repository by using the aws ecr get-login-password AWS CLI command to obtain an authentication token. Update the docker login command to use the authentication token to access the ECR repository.
   • BAdd an environment variable of type SECRETS_MANAGER to the CodeBuild project. In the environment variable, include the ARN of the CodeBuild project's IAM service role. Update the buildspec.yml file to use the new environment variable to log in with the docker login command to access the ECR repository.
   • CUpdate the ECR repository to be a public image repository. Add an ECR repository policy that allows the IAM service role to have access.
   • DUpdate the buildspec.yml file to use the AWS CLI to assume the IAM service role for ECR operations. Add an ECR repository policy that allows the IAM service role to have access.

   Show answer

   Answer: A

   Explanation

   (A) When Docker communicates with an Amazon Elastic Container Registry (ECR) repository, it requires authentication. You can authenticate your Docker client to the Amazon ECR registry with the help of the AWS CLI (Command Line Interface). Specifically, you can use the "aws ecr get-login-password" command to get an authorization token and then use Docker's "docker login" command with that token to authenticate to the registry. You would need to perform these steps in your buildspec.yml file before attempting to push or pull images from/to the ECR repository.

   Source: Adapted from community discussion — tartarus23

   Next question

8. Question 38 · 427 in bank

   A company manually provisions IAM access for its employees. The company wants to replace the manual process with an automated process. The company has an existing Active Directory system configured with an external SAML 2.0 identity provider (IdP). The company wants employees to use their existing corporate credentials to access AWS. The groups from the existing Active Directory system must be available for permission management in AWS Identity and Access Management (IAM). A DevOps engineer has completed the initial configuration of AWS IAM Identity Center (AWS Single Sign-On) in the company’s AWS account. What should the DevOps engineer do next to meet the requirements?

   • AConfigure an external IdP as an identity source. Configure automatic provisioning of users and groups by using the SCIM protocol.
   • BConfigure AWS Directory Service as an identity source. Configure automatic provisioning of users and groups by using the SAML protocol.
   • CConfigure an AD Connector as an identity source. Configure automatic provisioning of users and groups by using the SCIM protocol.
   • DConfigure an external IdP as an identity source Configure automatic provisioning of users and groups by using the SAML protocol.

   Show answer

   Answer: A

   Explanation

   (A) AWS SSO (Single Sign-On) integrates with external identity providers using SAML 2.0, and it can automatically synchronize users and groups from a connected directory using the SCIM (System for Cross-domain Identity Management) protocol. Thus, the DevOps engineer should configure the external IdP as an identity source and then configure automatic provisioning of users and groups by using the SCIM protocol. This will ensure the groups from the existing Active Directory system are available for permission management in AWS Identity and Access Management (IAM) and that employees can use their existing corporate credentials to access AWS.

   Source: Adapted from community discussion — tartarus23

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 39 · 427 in bank

   A company is using AWS to run digital workloads. Each application team in the company has its own AWS account for application hosting. The accounts are consolidated in an organization in AWS Organizations. The company wants to enforce security standards across the entire organization. To avoid noncompliance because of security misconfiguration, the company has enforced the use of AWS CloudFormation. A production support team can modify resources in the production environment by using the AWS Management Console to troubleshoot and resolve application-related issues. A DevOps engineer must implement a solution to identify in near real time any AWS service misconfiguration that results in noncompliance. The solution must automatically remediate the issue within 15 minutes of identification. The solution also must track noncompliant resources and events in a centralized dashboard with accurate timestamps. Which solution will meet these requirements with the LEAST development overhead?

   • AUse CloudFormation drift detection to identify noncompliant resources. Use drift detection events from CloudFormation to invoke an AWS Lambda function for remediation. Configure the Lambda function to publish logs to an Amazon CloudWatch Logs log group. Configure an Amazon CloudWatch dashboard to use the log group for tracking.
   • BTurn on AWS CloudTrail in the AWS accounts. Analyze CloudTrail logs by using Amazon Athena to identify noncompliant resources. Use AWS Step Functions to track query results on Athena for drift detection and to invoke an AWS Lambda function for remediation. For tracking, set up an Amazon QuickSight dashboard that uses Athena as the data source.
   • CTurn on the configuration recorder in AWS Config in all the AWS accounts to identify noncompliant resources. Enable AWS Security Hub with the --no-enable-default-standards option in all the AWS accounts. Set up AWS Config managed rules and custom rules. Set up automatic remediation by using AWS Config conformance packs. For tracking, set up a dashboard on Security Hub in a designated Security Hub administrator account.
   • DTurn on AWS CloudTrail in the AWS accounts. Analyze CloudTrail logs by using Amazon CloudWatch Logs to identify noncompliant resources. Use CloudWatch Logs filters for drift detection. Use Amazon EventBridge to invoke the Lambda function for remediation. Stream filtered CloudWatch logs to Amazon OpenSearch Service. Set up a dashboard on OpenSearch Service for tracking.

   Show answer

   Answer: C

   Explanation

   (C) This solution meets all of the requirements. AWS Config can monitor resource configurations for compliance with defined rules. The use of AWS Security Hub allows for centralized management of security alerts and compliance checks across all accounts. AWS Config conformance packs allow for automated remediation of non-compliant resources. AWS Security Hub provides a comprehensive view of high-priority security alerts and compliance status across AWS accounts. This solution is also the one with the least development overhead as it uses built-in AWS services specifically designed for configuration management and compliance tracking.

   Source: Adapted from community discussion — tartarus23

   References

   • AWS documentation

   Next question

10. Question 40 · 427 in bank

    A company uses AWS Organizations to manage its AWS accounts. The organization root has an OU that is named Environments. The Environments OU has two child OUs that are named Development and Production, respectively. The Environments OU and the child OUs have the default FullAWSAccess policy in place. A DevOps engineer plans to remove the FullAWSAccess policy from the Development OU and replace the policy with a policy that allows all actions on Amazon EC2 resources. What will be the outcome of this policy replacement?

    • AAll users in the Development OU will be allowed all API actions on all resources.
    • BAll users in the Development OU will be allowed all API actions on EC2 resources. All other API actions will be denied.
    • CAll users in the Development OU will be denied all API actions on all resources.
    • DAll users in the Development OU will be denied all API actions on EC2 resources. All other API actions will be allowed.

    Show answer

    Answer: B

    Explanation

    The key point is that "SCP inheritance works differently for Allow and Deny policies". Allowed policies are only inherited if the children don't have any Allow policy. Once they have an allow policy, only actions defined in that policy will be allowed and no "Allow" policy will be inherited from the parent(s) OUs. What inherits is the implicit Deny policy which is a hidden policy sitting above all. Check the tables in this link: https://aws.amazon.com/blogs/security/get-more-out-of-service-control-policies-in-a-multi-account-environment/

    Source: Adapted from community discussion — d262e67

    References

    • AWS documentation
    • AWS documentation
    • repost.aws documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 31. 427 questions available.