DOP-C02 practice questions 41–50

1. Question 41 · 427 in bank

   A company is examining its disaster recovery capability and wants the ability to switch over its daily operations to a secondary AWS Region. The company uses AWS CodeCommit as a source control tool in the primary Region. A DevOps engineer must provide the capability for the company to develop code in the secondary Region. If the company needs to use the secondary Region, developers can add an additional remote URL to their local Git configuration. Which solution will meet these requirements?

   • ACreate a CodeCommit repository in the secondary Region. Create an AWS CodeBuild project to perform a Git mirror operation of the primary Region's CodeCommit repository to the secondary Region's CodeCommit repository. Create an AWS Lambda function that invokes the CodeBuild project. Create an Amazon EventBridge rule that reacts to merge events in the primary Region's CodeCommit repository. Configure the EventBridge rule to invoke the Lambda function.
   • BCreate an Amazon S3 bucket in the secondary Region. Create an AWS Fargate task to perform a Git mirror operation of the primary Region's CodeCommit repository and copy the result to the S3 bucket. Create an AWS Lambda function that initiates the Fargate task. Create an Amazon EventBridge rule that reacts to merge events in the CodeCommit repository. Configure the EventBridge rule to invoke the Lambda function.
   • CCreate an AWS CodeArtifact repository in the secondary Region. Create an AWS CodePipeline pipeline that uses the primary Region’s CodeCommit repository for the source action. Create a cross-Region stage in the pipeline that packages the CodeCommit repository contents and stores the contents in the CodeArtifact repository when a pull request is merged into the CodeCommit repository.
   • DCreate an AWS Cloud9 environment and a CodeCommit repository in the secondary Region. Configure the primary Region's CodeCommit repository as a remote repository in the AWS Cloud9 environment. Connect the secondary Region's CodeCommit repository to the AWS Cloud9 environment.

   Show answer

   Answer: A

   Explanation

   Flow: AWS Example: CodeCommit(action) ----------------> Lambda -> Fargate task ("git clone --mirror" local repo, "git remote set-url --push origin" destination repo) -> CodeCommit(remote repo) Solution "B": CodeCommit(action) -> EventBridge -> Lambda -> Fargate task ("git clone --mirror" local repo, "git remote set-url --push origin" destination repo) -> S3(remote bucket) References: https://aws.amazon.com/blogs/devops/replicate-aws-codecommit-repository-between-regions-using-aws-fargate/ https://aws.amazon.com/cloud9/

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 42 · 427 in bank

   A DevOps team is merging code revisions for an application that uses an Amazon RDS Multi-AZ DB cluster for its production database. The DevOps team uses continuous integration to periodically verify that the application works. The DevOps team needs to test the changes before the changes are deployed to the production database. Which solution will meet these requirements?

   • AUse a buildspec file in AWS CodeBuild to restore the DB cluster from a snapshot of the production database, run integration tests, and drop the restored database after verification.
   • BDeploy the application to production. Configure an audit log of data control language (DCL) operations to capture database activities to perform if verification fails.
   • CCreate a snapshot of the DB cluster before deploying the application. Use the Update requires:Replacement property on the DB instance in AWS CloudFormation to deploy the application and apply the changes.
   • DEnsure that the DB cluster is a Multi-AZ deployment. Deploy the application with the updates. Fail over to the standby instance if verification fails.

   Show answer

   Answer: A

   Explanation

   A is correct: This option allow testing before real deployment B: : this would not allow testing before changes are made C: : This means the same as B - would not allow testing before changes are made D: - This deploy the app before testing, so it is incoorect

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

3. Question 43 · 427 in bank

   A company manages a multi-tenant environment in its VPC and has configured Amazon GuardDuty for the corresponding AWS account. The company sends all GuardDuty findings to AWS Security Hub. Traffic from suspicious sources is generating a large number of findings. A DevOps engineer needs to implement a solution to automatically deny traffic across the entire VPC when GuardDuty discovers a new suspicious source. Which solution will meet these requirements?

   • ACreate a GuardDuty threat list. Configure GuardDuty to reference the list. Create an AWS Lambda function that will update the threat list. Configure the Lambda function to run in response to new Security Hub findings that come from GuardDuty.
   • BConfigure an AWS WAF web ACL that includes a custom rule group. Create an AWS Lambda function that will create a block rule in the custom rule group. Configure the Lambda function to run in response to new Security Hub findings that come from GuardDuty.
   • CConfigure a firewall in AWS Network Firewall. Create an AWS Lambda function that will create a Drop action rule in the firewall policy. Configure the Lambda function to run in response to new Security Hub findings that come from GuardDuty.
   • DCreate an AWS Lambda function that will create a GuardDuty suppression rule. Configure the Lambda function to run in response to new Security Hub findings that come from GuardDuty.

   Show answer

   Answer: C

   Explanation

   C is correct . Only Network Firewall can block traffic at VPC level. A only updates the list , no blocking action B- WAF and Web ACL can block only HTTPS traffic for a API/VPC endpoint/ Cloudfron distribution not for enire VPC

   Source: Adapted from community discussion — RVivek

   References

   • AWS documentation

   Next question

4. Question 44 · 427 in bank

   Select 2

   A company uses AWS Secrets Manager to store a set of sensitive API keys that an AWS Lambda function uses. When the Lambda function is invoked the Lambda function retrieves the API keys and makes an API call to an external service. The Secrets Manager secret is encrypted with the default AWS Key Management Service (AWS KMS) key. A DevOps engineer needs to update the infrastructure to ensure that only the Lambda function’s execution role can access the values in Secrets Manager. The solution must apply the principle of least privilege. Which combination of steps will meet these requirements? (Choose two.)

   • AUpdate the default KMS key for Secrets Manager to allow only the Lambda function’s execution role to decrypt
   • BCreate a KMS customer managed key that trusts Secrets Manager and allows the Lambda function's execution role to decrypt. Update Secrets Manager to use the new customer managed key
   • CCreate a KMS customer managed key that trusts Secrets Manager and allows the account's root principal to decrypt. Update Secrets Manager to use the new customer managed key
   • DEnsure that the Lambda function’s execution role has the KMS permissions scoped on the resource level. Configure the permissions so that the KMS key can encrypt the Secrets Manager secret
   • ERemove all KMS permissions from the Lambda function’s execution role

   Show answer

   Answer: BD

   Explanation

   B, D A is incorrect because updating the default KMS key for Secrets Manager to allow only the Lambda function's execution role to decrypt would grant access to all other resources using the default key, which violates the principle of least privilege. C is incorrect because allowing the account's root principal to decrypt the secret would grant unnecessary access to the secret, which violates the principle of least privilege. E is incorrect because removing all KMS permissions from the Lambda function's execution role would prevent the Lambda function from decrypting the secret, which is required for it to function properly.

   Source: Adapted from community discussion — radev

   Next question

5. Question 45 · 427 in bank

   Select 2

   A company's DevOps engineer is creating an AWS Lambda function to process notifications from an Amazon Simple Notification Service (Amazon SNS) topic. The Lambda function will process the notification messages and will write the contents of the notification messages to an Amazon RDS Multi-AZ DB instance. During testing, a database administrator accidentally shut down the DB instance. While the database was down the company lost several of the SNS notification messages that were delivered during that time. The DevOps engineer needs to prevent the loss of notification messages in the future. Which solutions will meet this requirement? (Choose two.)

   • AReplace the RDS Multi-AZ DB instance with an Amazon DynamoDB table.
   • BConfigure an Amazon Simple Queue Service (Amazon SQS) queue as a destination of the Lambda function.
   • CConfigure an Amazon Simple Queue Service (Amazon SQS) dead-letter queue for the SNS topic.
   • DSubscribe an Amazon Simple Queue Service (Amazon SQS) queue to the SNS topic. Configure the Lambda function to process messages from the SQS queue.
   • EReplace the SNS topic with an Amazon EventBridge event bus. Configure an EventBridge rule on the new event bus to invoke the Lambda function for each event.

   Show answer

   Answer: CD

   Explanation

   The two solutions that will meet the requirement of preventing the loss of notification messages in the future are: D. Subscribe an Amazon Simple Queue Service (Amazon SQS) queue to the SNS topic. Configure the Lambda function to process messages from the SQS queue. This solution will ensure that notification messages are delivered to the SQS queue even if the Lambda function is unavailable or the RDS DB instance is down. The Lambda function can then process the messages from the SQS queue at its own pace. C. Configure an Amazon Simple Queue Service (Amazon SQS) dead-letter queue for the SNS topic. This solution will ensure that notification messages that cannot be delivered to the RDS DB instance are not lost. Instead, they will be moved to a dead-letter queue. The DevOps engineer can then manually process the messages from the dead-letter queue.

   Source: Adapted from community discussion — vandergun

   References

   • AWS documentation

   Next question

6. Question 46 · 427 in bank

   A DevOps engineer is building a continuous deployment pipeline for a serverless application that uses AWS Lambda functions. The company wants to reduce the customer impact of an unsuccessful deployment. The company also wants to monitor for issues. Which deploy stage configuration will meet these requirements?

   • AUse an AWS Serverless Application Model (AWS SAM) template to define the serverless application. Use AWS CodeDeploy to deploy the Lambda functions with the Canary10Percent15Minutes Deployment Preference Type. Use Amazon CloudWatch alarms to monitor the health of the functions.
   • BUse AWS CloudFormation to publish a new stack update, and include Amazon CloudWatch alarms on all resources. Set up an AWS CodePipeline approval action for a developer to verify and approve the AWS CloudFormation change set.
   • CUse AWS CloudFormation to publish a new version on every stack update, and include Amazon CloudWatch alarms on all resources. Use the RoutingConfig property of the AWS::Lambda::Alias resource to update the traffic routing during the stack update.
   • DUse AWS CodeBuild to add sample event payloads for testing to the Lambda functions. Publish a new version of the functions, and include Amazon CloudWatch alarms. Update the production alias to point to the new version. Configure rollbacks to occur when an alarm is in the ALARM state.

   Show answer

   Answer: A

   Explanation

   A Reducing Customer Impact: AWS CodeDeploy with Canary deployments (Canary10Percent15Minutes) will incrementally roll out the new version. Initially, 10% of the traffic will be directed to the new version, and if everything goes well, the rest of the traffic will be shifted over the span of 15 minutes. This cautious rollout minimizes the risk and impact on customers. Monitoring: Amazon CloudWatch alarms can be configured to track function errors, latency, and other important metrics. If anything goes awry, you can act promptly.

   Source: Adapted from community discussion — Jonfernz

   References

   • AWS documentation

   Next question

7. Question 47 · 427 in bank

   A company has an application that runs on Amazon EC2 instances. The company uses an AWS CodePipeline pipeline to deploy the application into multiple AWS Regions. The pipeline is configured with a stage for each Region. Each stage contains an AWS CloudFormation action for each Region. When the pipeline deploys the application to a Region, the company wants to confirm that the application is in a healthy state before the pipeline moves on to the next Region. Amazon Route 53 record sets are configured for the application in each Region. A DevOps engineer creates a Route 53 health check that is based on an Amazon CloudWatch alarm for each Region where the application is deployed. What should the DevOps engineer do next to meet the requirements?

   • ACreate an AWS Step Functions workflow to check the state of the CloudWatch alarm. Configure the Step Functions workflow to exit with an error if the alarm is in the ALARM state. Create a new stage in the pipeline between each Region deployment stage. In each new stage, include an action to invoke the Step Functions workflow.
   • BConfigure an AWS CodeDeploy application to deploy a CloudFormation template with automatic rollback. Configure the CloudWatch alarm as the instance health check for the CodeDeploy application. Remove the CloudFormation actions from the pipeline. Create a CodeDeploy action in the pipeline stage for each Region.
   • CCreate a new pipeline stage for each Region where the application is deployed. Configure a CloudWatch alarm action for the new stage to check the state of the CloudWatch alarm and to exit with an error if the alarm is in the ALARM state
   • DConfigure the CloudWatch agent on the EC2 instances to report the application status to the Route 53 health check. Create a new pipeline stage for each Region where the application is deployed. Configure a CloudWatch alarm action to exit with an error if the CloudWatch alarm is in the ALARM state.

   Show answer

   Answer: A

   Explanation

   A - 'If the state machine execution reaches a terminal status of FAILED, TIMED_OUT, or ABORTED, the action execution fails.' https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-StepFunctions.html Can't be D because you can't update a Route53 healhcheck via the Cloudwatch agent

   Source: Adapted from community discussion — TheAWSRhino

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 48 · 427 in bank

   A company plans to use Amazon CloudWatch to monitor its Amazon EC2 instances. The company needs to stop EC2 instances when the average of the NetworkPacketsIn metric is less than 5 for at least 3 hours in a 12-hour time window. The company must evaluate the metric every hour. The EC2 instances must continue to run if there is missing data for the NetworkPacketsIn metric during the evaluation period. A DevOps engineer creates a CloudWatch alarm for the NetworkPacketsIn metric. The DevOps engineer configures a threshold value of 5 and an evaluation period of 1 hour. Which set of additional actions should the DevOps engineer take to meet these requirements?

   • AConfigure the Datapoints to Alarm value to be 3 out of 12. Configure the alarm to treat missing data as breaching the threshold. Add an AWS Systems Manager action to stop the instance when the alarm enters the ALARM state.
   • BConfigure the Datapoints to Alarm value to be 3 out of 12. Configure the alarm to treat missing data as not breaching the threshold. Add an EC2 action to stop the instance when the alarm enters the ALARM state.
   • CConfigure the Datapoints to Alarm value to be 9 out of 12. Configure the alarm to treat missing data as breaching the threshold. Add an EC2 action to stop the instance when the alarm enters the ALARM state.
   • DConfigure the Datapoints to Alarm value to be 9 out of 12. Configure the alarm to treat missing data as not breaching the threshold. Add an AWS Systems Manager action to stop the instance when the alarm enters the ALARM state.

   Show answer

   Answer: B

   References

   • AWS documentation

   Next question

9. Question 49 · 427 in bank

   A company manages 500 AWS accounts that are in an organization in AWS Organizations. The company discovers many unattached Amazon Elastic Block Store (Amazon EBS) volumes in all the accounts. The company wants to automatically tag the unattached EBS volumes for investigation. A DevOps engineer needs to deploy an AWS Lambda function to all the AWS accounts. The Lambda function must run every 30 minutes to tag all the EBS volumes that have been unattached for a period of 7 days or more. Which solution will meet these requirements in the MOST operationally efficient manner?

   • AConfigure a delegated administrator account for the organization. Create an AWS CloudFormation template that contains the Lambda function. Use CloudFormation StackSets to deploy the CloudFormation template from the delegated administrator account to all the member accounts in the organization. Create an Amazon EventBridge event bus in the delegated administrator account to invoke the Lambda function in each member account every 30 minutes.
   • BCreate a cross-account IAM role in the organization's member accounts. Attach the AWSLambda_FullAccess policy and the AWSCloudFormationFullAccess policy to the role. Create an AWS CloudFormation template that contains the Lambda function and an Amazon EventBridge scheduled rule to invoke the Lambda function every 30 minutes. Create a custom script in the organization’s management account that assumes the role and deploys the CloudFormation template to the member accounts.
   • CConfigure a delegated administrator account for the organization. Create an AWS CloudFormation template that contains the Lambda function and an Amazon EventBridge scheduled rule to invoke the Lambda function every 30 minutes. Use CloudFormation StackSets to deploy the CloudFormation template from the delegated administrator account to all the member accounts in the organization
   • DCreate a cross-account IAM role in the organization's member accounts. Attach the AmazonS3FullAccess policy and the AWSCodeDeployDeployerAccess policy to the role. Use AWS CodeDeploy to assume the role to deploy the Lambda function from the organization's management account. Configure an Amazon EventBridge scheduled rule in the member accounts to invoke the Lambda function every 30 minutes.

   Show answer

   Answer: C

   Explanation

   C is correct: : we should use a combination of eventbridge and Lambda A: : event bridge should be in each member account to monitor event, not in the delegated admin's account B and D: These options create an IAM role in every member account, which is incorrect

   Source: Adapted from community discussion — thanhnv142

   Next question

10. Question 50 · 427 in bank

    A company's production environment uses an AWS CodeDeploy blue/green deployment to deploy an application. The deployment incudes Amazon EC2 Auto Scaling groups that launch instances that run Amazon Linux 2. A working appspec.yml file exists in the code repository and contains the following text:

    

    A DevOps engineer needs to ensure that a script downloads and installs a license file onto the instances before the replacement instances start to handle request traffic. The DevOps engineer adds a hooks section to the appspec.yml file. Which hook should the DevOps engineer use to run the script that downloads and installs the license file?

    • AAfterBlockTraffic
    • BBeforeBlockTraffic
    • CBeforeInstall
    • DDownloadBundle

    Show answer

    Answer: C

    Explanation

    A & B are not available for replacement instances - https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html#reference-appspec-file-structure-hooks-availability D - "Reserved for CodeDeploy operations. Cannot be used to run scripts."

    Source: Adapted from community discussion — tom_cat

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 41. 427 questions available.