DOP-C02 practice questions 61–70

1. Question 61 · 427 in bank

   A company is using AWS Organizations to create separate AWS accounts for each of its departments. The company needs to automate the following tasks: • Update the Linux AMIs with new patches periodically and generate a golden image • Install a new version of Chef agents in the golden image, if available • Provide the newly generated AMIs to the department's accounts Which solution meets these requirements with the LEAST management overhead?

   • AWrite a script to launch an Amazon EC2 instance from the previous golden image. Apply the patch updates. Install the new version of the Chef agent, generate a new golden image, and then modify the AMI permissions to share only the new image with the department's accounts.
   • BUse Amazon EC2 Image Builder to create an image pipeline that consists of the base Linux AMI and components to install the Chef agent. Use AWS Resource Access Manager to share EC2 Image Builder images with the department's accounts.
   • CUse an AWS Systems Manager Automation runbook to update the Linux AMI by using the previous image. Provide the URL for the script that will update the Chef agent. Use AWS Organizations to replace the previous golden image in the department's accounts.
   • DUse Amazon EC2 Image Builder to create an image pipeline that consists of the base Linux AMI and components to install the Chef agent. Create a parameter in AWS Systems Manager Parameter Store to store the new AMI ID that can be referenced by the department's accounts.

   Show answer

   Answer: B

   Explanation

   Builder Image to streamline the AMI baking process and use RAM to easily share the AMI among the whole organization or select accounts. https://docs.aws.amazon.com/imagebuilder/latest/userguide/manage-shared-resources.html#manage-shared-resources-using

   Source: Adapted from community discussion — d262e67

   References

   • AWS documentation

   Next question

2. Question 62 · 427 in bank

   A company has a mission-critical application on AWS that uses automatic scaling. The company wants the deployment lifecycle to meet the following parameters: • The application must be deployed one instance at a time to ensure the remaining fleet continues to serve traffic. • The application is CPU intensive and must be closely monitored. • The deployment must automatically roll back if the CPU utilization of the deployment instance exceeds 85%. Which solution will meet these requirements?

   • AUse AWS CloudFormation to create an AWS Step Functions state machine and Auto Scaling lifecycle hooks to move to one instance at a time into a wait state. Use AWS Systems Manager automation to deploy the update to each instance and move it back into the Auto Scaling group using the heartbeat timeout.
   • BUse AWS CodeDeploy with Amazon EC2 Auto Scaling Configure an alarm tied to the CPU utilization metric. Use the CodeDeployDefault OneAtAtime configuration as a deployment strategy. Configure automatic rollbacks within the deployment group to roll back the deployment if the alarm thresholds are breached.
   • CUse AWS Elastic Beanstalk for load balancing and AWS Auto Scaling. Configure an alarm tied to the CPU utilization metric. Configure rolling deployments with a fixed batch size of one instance. Enable enhanced health to monitor the status of the deployment and roll back based on the alarm previously created.
   • DUse AWS Systems Manager to perform a blue/green deployment with Amazon EC2 Auto Scaling. Configure an alarm tied to the CPU utilization metric. Deploy updates one at a time. Configure automatic rollbacks within the Auto Scaling group to roll back the deployment if the alarm thresholds are breached.

   Show answer

   Answer: B

   Explanation

   "B" "You can now monitor and automatically react to changes in your AWS CodeDeploy deployments using Amazon CloudWatch alarms." "Using CloudWatch with CodeDeploy, you can monitor metrics for Amazon EC2 instances or Auto Scaling groups being managed by CodeDeploy and then invoke an action if the metric you are tracking crosses a certain threshold for a defined period of time." "You can monitor metrics such as instance CPU utilization." "If the alarm is activated, CloudWatch initiates actions such as sending a notification to Amazon Simple Notification Service, stopping a CodeDeploy deployment, or changing the state of an instance (e.g. reboot, terminate, recover)." "CodeDeploy now also lets you automatically roll back a deployment when a deployment fails or when a CloudWatch alarm is activated." https://aws.amazon.com/about-aws/whats-new/2016/09/aws-codedeploy-introduces-deployment-monitoring-with-amazon-cloudwatch-alarms-and-automatic-deployment-rollback/

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 63 · 427 in bank

   A company has a single developer writing code for an automated deployment pipeline. The developer is storing source code in an Amazon S3 bucket for each project. The company wants to add more developers to the team but is concerned about code conflicts and lost work. The company also wants to build a test environment to deploy newer versions of code for testing and allow developers to automatically deploy to both environments when code is changed in the repository. What is the MOST efficient way to meet these requirements?

   • ACreate an AWS CodeCommit repository for each project, use the main branch for production code, and create a testing branch for code deployed to testing. Use feature branches to develop new features and pull requests to merge code to testing and main branches.
   • BCreate another S3 bucket for each project for testing code, and use an AWS Lambda function to promote code changes between testing and production buckets. Enable versioning on all buckets to prevent code conflicts.
   • CCreate an AWS CodeCommit repository for each project, and use the main branch for production and test code with different deployment pipelines for each environment. Use feature branches to develop new features.
   • DEnable versioning and branching on each S3 bucket, use the main branch for production code, and create a testing branch for code deployed to testing. Have developers use each branch for developing in each environment.

   Show answer

   Answer: A

   Explanation

   A is correct: and means we need codecommit B and D: no mention of code commnit C: Should not use the main branch for both production and test

   Source: Adapted from community discussion — thanhnv142

   Next question

4. Question 64 · 427 in bank

   Select 2

   A DevOps engineer notices that all Amazon EC2 instances running behind an Application Load Balancer in an Auto Scaling group are failing to respond to user requests. The EC2 instances are also failing target group HTTP health checks. Upon inspection, the engineer notices the application process was not running in any EC2 instances. There are a significant number of out of memory messages in the system logs. The engineer needs to improve the resilience of the application to cope with a potential application memory leak. Monitoring and notifications should be enabled to alert when there is an issue. Which combination of actions will meet these requirements? (Choose two.)

   • AChange the Auto Scaling configuration to replace the instances when they fail the load balancer's health checks.
   • BChange the target group health check HealthCheckIntervalSeconds parameter to reduce the interval between health checks.
   • CChange the target group health checks from HTTP to TCP to check if the port where the application is listening is reachable.
   • DEnable the available memory consumption metric within the Amazon CloudWatch dashboard for the entire Auto Scaling group. Create an alarm when the memory utilization is high. Associate an Amazon SNS topic to the alarm to receive notifications when the alarm goes off.
   • EUse the Amazon CloudWatch agent to collect the memory utilization of the EC2 instances in the Auto Scaling group. Create an alarm when the memory utilization is high and associate an Amazon SNS topic to receive a notification.

   Show answer

   Answer: AE

   Explanation

   We don't have memory metrics for autoscaling, here is the list of metrics https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/appinsights-metrics-ec2.html#appinsights-metrics-ec2-linux Here is the list of metrics from cloudwatch agent https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/appinsights-metrics-ec2.html#appinsights-metrics-ec2-linux

   Source: Adapted from community discussion — davdan99

   References

   • AWS documentation

   Next question

5. Question 65 · 427 in bank

   An ecommerce company uses a large number of Amazon Elastic Block Store (Amazon EBS) backed Amazon EC2 instances. To decrease manual work across all the instances, a DevOps engineer is tasked with automating restart actions when EC2 instance retirement events are scheduled. How can this be accomplished?

   • ACreate a scheduled Amazon EventBridge rule to run an AWS Systems Manager Automation runbook that checks if any EC2 instances are scheduled for retirement once a week. If the instance is scheduled for retirement, the runbook will hibernate the instance.
   • BEnable EC2 Auto Recovery on all of the instances. Create an AWS Config rule to limit the recovery to occur during a maintenance window only.
   • CReboot all EC2 instances during an approved maintenance window that is outside of standard business hours. Set up Amazon CloudWatch alarms to send a notification in case any instance is failing EC2 instance status checks.
   • DSet up an AWS Health Amazon EventBridge rule to run AWS Systems Manager Automation runbooks that stop and start the EC2 instance when a retirement scheduled event occurs.

   Show answer

   Answer: D

   Explanation

   D is correct: : these even occurs when the underlying infra that runs the instances needs to be repaired. To deal with this, just need to stop and start the instance to re-locate the instance to a different physical machine A: Hibernate would not work for this scenario B: This would also bring back the instance. However, AWS config rule cannot limit the recovery. It only reports, not actions C: This option is a manual work, not automated one

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

6. Question 66 · 427 in bank

   A company manages AWS accounts for application teams in AWS Control Tower. Individual application teams are responsible for securing their respective AWS accounts. A DevOps engineer needs to enable Amazon GuardDuty for all AWS accounts in which the application teams have not already enabled GuardDuty. The DevOps engineer is using AWS CloudFormation StackSets from the AWS Control Tower management account. How should the DevOps engineer configure the CloudFormation template to prevent failure during the StackSets deployment?

   • ACreate a CloudFormation custom resource that invokes an AWS Lambda function. Configure the Lambda function to conditionally enable GuardDuty if GuardDuty is not already enabled in the accounts.
   • BUse the Conditions section of the CloudFormation template to enable GuardDuty in accounts where GuardDuty is not already enabled.
   • CUse the CloudFormation Fn::GetAtt intrinsic function to check whether GuardDuty is already enabled. If GuardDuty is not already enabled, use the Resources section of the CloudFormation template to enable GuardDuty.
   • DManually discover the list of AWS account IDs where GuardDuty is not enabled. Use the CloudFormation Fn::ImportValue intrinsic function to import the list of account IDs into the CloudFormation template to skip deployment for the listed AWS accounts.

   Show answer

   Answer: A

   Explanation

   A is correct: is the requirement of the question. By default, cloudformation doesnot support turning on Guarduty. To turn it on, need to use ACF template in combination with lambda. A: perfectly correct B: no mention of lambda C: Fn::GetAtt intrinsic: This is used to check only. No mention of using lambda to enable Guarduty D: This might work. However, a manual approach is not recommeded

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

7. Question 67 · 427 in bank

   A development team is using AWS CodeCommit to version control application code and AWS CodePipeline to orchestrate software deployments. The team has decided to use a remote main branch as the trigger for the pipeline to integrate code changes. A developer has pushed code changes to the CodeCommit repository, but noticed that the pipeline had no reaction, even after 10 minutes. Which of the following actions should be taken to troubleshoot this issue?

   • ACheck that an Amazon EventBridge rule has been created for the main branch to trigger the pipeline.
   • BCheck that the CodePipeline service role has permission to access the CodeCommit repository.
   • CCheck that the developer’s IAM role has permission to push to the CodeCommit repository.
   • DCheck to see if the pipeline failed to start because of CodeCommit errors in Amazon CloudWatch Logs.

   Show answer

   Answer: A

   Explanation

   A - EventBridge rule is one of the recommended ways to configure CodePipeline to automatically trigger based on changes in a CodeCommit repository B - if "Permission denied", the error message should prompt immediately, rather than no reaction for 10 minutes for the pipeline. Mean the pipeline not even start Reference: https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-about-starting.html#change-detection-methods https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-simple-codecommit.html

   Source: Adapted from community discussion — jamesf

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 68 · 427 in bank

   Select 2

   A company has an AWS Control Tower landing zone. The company's DevOps team creates a workload OU. A development OU and a production OU are nested under the workload OU. The company grants users full access to the company's AWS accounts to deploy applications. The DevOps team needs to allow only a specific management IAM role to manage the IAM roles and policies of any AWS accounts in only the production OU. Which combination of steps will meet these requirements? (Choose two.)

   • ACreate an SCP that denies full access with a condition to exclude the management IAM role for the organization root.
   • BEnsure that the FullAWSAccess SCP is applied at the organization root.
   • CCreate an SCP that allows IAM related actions. Attach the SCP to the development OU.
   • DCreate an SCP that denies IAM related actions with a condition to exclude the management IAM role. Attach the SCP to the workload OU.
   • ECreate an SCP that denies IAM related actions with a condition to exclude the management IAM role. Attach the SCP to the production OU.

   Show answer

   Answer: BE

   Explanation

   You need to understand how SCP inheritance works in AWS. The way it works for Deny policies is different that allow policies. Allow polices are passing down to children ONLY if they don't have an allow policy. Deny policies always pass down to children. That's why there is always an SCP set to the Root to allow everything by default. If you limit this policy, the whole organization will be limited, not matter what other policies are saying for the other OUs. So it's not A. It's not D because it restricts the wrong OU.

   Source: Adapted from community discussion — d262e67

   Next question

9. Question 69 · 427 in bank

   A company hired a penetration tester to simulate an internal security breach. The tester performed port scans on the company's Amazon EC2 instances. The company's security measures did not detect the port scans. The company needs a solution that automatically provides notification when port scans are performed on EC2 instances. The company creates and subscribes to an Amazon Simple Notification Service (Amazon SNS) topic. What should the company do next to meet the requirement?

   • AEnsure that Amazon GuardDuty is enabled. Create an Amazon CloudWatch alarm for detected EC2 and port scan findings. Connect the alarm to the SNS topic.
   • BEnsure that Amazon Inspector is enabled. Create an Amazon EventBridge event for detected network reachability findings that indicate port scans. Connect the event to the SNS topic.
   • CEnsure that Amazon Inspector is enabled. Create an Amazon EventBridge event for detected CVEs that cause open port vulnerabilities. Connect the event to the SNS topic.
   • DEnsure that AWS CloudTrail is enabled. Create an AWS Lambda function to analyze the CloudTrail logs for unusual amounts of traffic from an IP address range. Connect the Lambda function to the SNS topic.

   Show answer

   Answer: A

   Explanation

   Inspector is designed to find vulnerabilities across EC2 servers and detect open ports. It doesn't detect port scans against EC2 servers. The reachability analyzer mentioned below is the port scanner itself. I doesn't detect other port scanners. https://aws.amazon.com/blogs/security/amazon-inspector-assess-network-exposure-ec2-instances-aws-network-reachability-assessments/ GuardDuty on the other hand draws upon traffic logs to find specious activities such as port scans in a form of a finding.

   Source: Adapted from community discussion — d262e67

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 70 · 427 in bank

    A company runs applications in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster uses an Application Load Balancer to route traffic to the applications that run in the cluster. A new application that was migrated to the EKS cluster is performing poorly. All the other applications in the EKS cluster maintain appropriate operation. The new application scales out horizontally to the preconfigured maximum number of pods immediately upon deployment, before any user traffic routes to the web application. Which solution will resolve the scaling behavior of the web application in the EKS cluster?

    • AImplement the Horizontal Pod Autoscaler in the EKS cluster.
    • BImplement the Vertical Pod Autoscaler in the EKS cluster.
    • CImplement the Cluster Autoscaler.
    • DImplement the AWS Load Balancer Controller in the EKS cluster.

    Show answer

    Answer: B

    Explanation

    In my opinion A is incorrect because "The new application scales out horizontally to the preconfigured maximum number of pods immediately upon deployment" means that the Horizontal Pod Autoscaler is already implemented but doesn't resolve the issue with poor performance. This may indicate inappropriate resource allocation. But Vertical Pod Autoscaler will help us "right size" our application. So, for me it's B.

    Source: Adapted from community discussion — vmahilevskyi

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 61. 427 questions available.