DOP-C02 practice questions 71–80

1. Question 71 · 427 in bank

   Select 3

   A company has an AWS Control Tower landing zone that manages its organization in AWS Organizations. The company created an OU structure that is based on the company's requirements. The company's DevOps team has established the core accounts for the solution and an account for all centralized AWS CloudFormation and AWS Service Catalog solutions. The company wants to offer a series of customizations that an account can request through AWS Control Tower. Which combination of steps will meet these requirements? (Choose three.)

   • AEnable trusted access for CloudFormation with Organizations by using service-managed permissions.
   • BCreate an IAM role that is named AWSControlTowerBlueprintAccess. Configure the role with a trust policy that allows the AWSControlTowerAdmin role in the management account to assume the role. Attach the AWSServiceCatalogAdminFullAccess IAM policy to the AWSControlTowerBlueprintAccess role.
   • CCreate a Service Catalog product for each CloudFormation template.
   • DCreate a CloudFormation stack set for each CloudFormation template. Enable automatic deployment for each stack set. Create a CloudFormation stack instance that targets specific OUs.
   • EDeploy the Customizations for AWS Control Tower (CfCT) CloudFormation stack.
   • FCreate a CloudFormation template that contains the resources for each customization.

   Show answer

   Answer: BCF

   Explanation

   "Steps to set up Account Factory for the customization process": 1. "Create the required role...." - "The role must be named AWSControlTowerBlueprintAccess." - "The AWSControlTowerBlueprintAccess role must be set up to grant trust to" [...] - "The role named AWSControlTowerAdmin in the AWS Control Tower management account." - AWS Control Tower requires that the managed policy named AWSServiceCatalogAdminFullAccess must be attached to the AWSControlTowerBlueprintAccess role. (Required permissions policy) 2. "Create the AWS Service Catalog product..." [...] https://docs.aws.amazon.com/controltower/latest/userguide/af-customization-page.html https://docs.aws.amazon.com/controltower/latest/userguide/afc-setup-steps.html

   Source: Adapted from community discussion — Gomer

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 72 · 427 in bank

   A company runs a workload on Amazon EC2 instances. The company needs a control that requires the use of Instance Metadata Service Version 2 (IMDSv2) on all EC2 instances in the AWS account. If an EC2 instance does not prevent the use of Instance Metadata Service Version 1 (IMDSv1), the EC2 instance must be terminated. Which solution will meet these requirements?

   • ASet up AWS Config in the account. Use a managed rule to check EC2 instances. Configure the rule to remediate the findings by using AWS Systems Manager Automation to terminate the instance.
   • BCreate a permissions boundary that prevents the ec2:RunInstance action if the ec2:MetadataHttpTokens condition key is not set to a value of required. Attach the permissions boundary to the IAM role that was used to launch the instance.
   • CSet up Amazon Inspector in the account. Configure Amazon Inspector to activate deep inspection for EC2 instances. Create an Amazon EventBridge rule for an Inspector2 finding. Set an AWS Lambda function as the target to terminate the instance.
   • DCreate an Amazon EventBridge rule for the EC2 instance launch successful event. Send the event to an AWS Lambda function to inspect the EC2 metadata and to terminate the instance.

   Show answer

   Answer: A

   Explanation

   AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It provides managed rules that you can use to evaluate the configuration settings of your resources against desired configurations. In this case, you can use the AWS Config managed rule "ec2-imdsv2-check" to evaluate whether your EC2 instances are using the Instance Metadata Service Version 2 (IMDSv2) or not. This rule checks if the EC2 instances have the HTTP token request enabled for the Instance Metadata Service (IMDS), which is a requirement for using IMDSv2. If an EC2 instance is found to be non-compliant with the rule (i.e., not using IMDSv2), AWS Config can be configured to automatically remediate the non-compliant resource. You can set up AWS Systems Manager Automation to terminate the non-compliant EC2 instance as the remediation action.

   Source: Adapted from community discussion — c3518fc

   References

   • AWS documentation

   Next question

3. Question 73 · 427 in bank

   Select 3

   A company builds an application that uses an Application Load Balancer in front of Amazon EC2 instances that are in an Auto Scaling group. The application is stateless. The Auto Scaling group uses a custom AMI that is fully prebuilt. The EC2 instances do not have a custom bootstrapping process. The AMI that the Auto Scaling group uses was recently deleted. The Auto Scaling group's scaling activities show failures because the AMI ID does not exist. Which combination of steps should a DevOps engineer take to meet these requirements? (Choose three.)

   • ACreate a new launch template that uses the new AMI.
   • BUpdate the Auto Scaling group to use the new launch template.
   • CReduce the Auto Scaling group's desired capacity to 0.
   • DIncrease the Auto Scaling group's desired capacity by 1.
   • ECreate a new AMI from a running EC2 instance in the Auto Scaling group.
   • FCreate a new AMI by copying the most recent public AMI of the operating system that the EC2 instances use.

   Show answer

   Answer: ABE

   Explanation

   To address the issue of the deleted AMI in the Auto Scaling group, you can follow these steps: Create a new AMI from a running EC2 instance in the Auto Scaling group. (Option E) This will ensure that you have a new AMI based on the current state of one of the running instances in the group. Create a new launch template that uses the new AMI. (Option A) After creating the new AMI, update the launch template to use this new AMI. Launch templates provide a versioned and more structured way to define the launch configuration for your Auto Scaling group. Update the Auto Scaling group to use the new launch template. (Option B) Update the Auto Scaling group to use the new launch template that includes the new AMI. This will ensure that new instances launched by the Auto Scaling group will use the updated configuration.

   Source: Adapted from community discussion — promo286

   Next question

4. Question 74 · 427 in bank

   Select 2

   A company deploys a web application on Amazon EC2 instances that are behind an Application Load Balancer (ALB). The company stores the application code in an AWS CodeCommit repository. When code is merged to the main branch, an AWS Lambda function invokes an AWS CodeBuild project. The CodeBuild project packages the code, stores the packaged code in AWS CodeArtifact, and invokes AWS Systems Manager Run Command to deploy the packaged code to the EC2 instances. Previous deployments have resulted in defects, EC2 instances that are not running the latest version of the packaged code, and inconsistencies between instances. Which combination of actions should a DevOps engineer take to implement a more reliable deployment solution? (Choose two.)

   • ACreate a pipeline in AWS CodePipeline that uses the CodeCommit repository as a source provider. Configure pipeline stages that run the CodeBuild project in parallel to build and test the application. In the pipeline, pass the CodeBuild project output artifact to an AWS CodeDeploy action.
   • BCreate a pipeline in AWS CodePipeline that uses the CodeCommit repository as a source provider. Create separate pipeline stages that run a CodeBuild project to build and then test the application. In the pipeline, pass the CodeBuild project output artifact to an AWS CodeDeploy action.
   • CCreate an AWS CodeDeploy application and a deployment group to deploy the packaged code to the EC2 instances. Configure the ALB for the deployment group.
   • DCreate individual Lambda functions that use AWS CodeDeploy instead of Systems Manager to run build, test, and deploy actions.
   • ECreate an Amazon S3 bucket. Modify the CodeBuild project to store the packages in the S3 bucket instead of in CodeArtifact. Use deploy actions in CodeDeploy to deploy the artifact to the EC2 instances.

   Show answer

   Answer: BC

   Explanation

   B and C are correct: We need to use codedeploy to build instead of using codebuild A: - this is in correct. Should run the pipiline respectedly D: Should not use lambda E: Codeartifact is good, no need to change to S3

   Source: Adapted from community discussion — thanhnv142

   Next question

5. Question 75 · 427 in bank

   A company uses an organization in AWS Organizations to manage its AWS accounts. The company's automation account contains a CI/CD pipeline that creates and configures new AWS accounts. The company has a group of internal service teams that provide services to accounts in the organization. The service teams operate out of a set of services accounts. The service teams want to receive an AWS CloudTrail event in their services accounts when the CreateAccount API call creates a new account. How should the company share this CloudTrail event with the service accounts?

   • ACreate an Amazon EventBridge rule in the automation account to send account creation events to the default event bus in the services accounts. Update the default event bus in the services accounts to allow events from the automation account.
   • BCreate a custom Amazon EventBridge event bus in the services accounts. Update the custom event bus to allow events from the automation account. Create an EventBridge rule in the services account that directly listens to CloudTrail events from the automation account.
   • CCreate a custom Amazon EventBridge event bus in the automation account and the services accounts. Create an EventBridge rule and policy that connects the custom event buses that are in the automation account and the services accounts.
   • DCreate a custom Amazon EventBridge event bus in the automation account. Create an EventBridge rule and policy that connects the custom event bus to the default event buses in the services accounts.

   Show answer

   Answer: A

   Explanation

   A is right. "Create an Amazon EventBridge rule in the automation account to send account creation events to the default event bus in the services accounts": propagation of provision events to the service accounts. "Update the default event bus in the services accounts to allow events from the automation account.": correct B. "Create a custom Amazon EventBridge event bus in the services accounts. Update the custom event bus to allow events from the automation account.": correct however "Create an EventBridge rule in the services account that directly listens to CloudTrail events from the automation account.": Why do you create a rule in the services account listening the events from automation account, in opposite, the rule should be created in the automation account to push the events to the bus in the services account.

   Source: Adapted from community discussion — ozansenturk

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 76 · 427 in bank

   A DevOps engineer is building a solution that uses Amazon Simple Queue Service (Amazon SQS) standard queues. The solution also includes an AWS Lambda function and an Amazon DynamoDB table. The Lambda function pulls content from an SQS queue event source and writes the content to the DynamoDB table. The solution must maximize the scalability of Lambda and must prevent successfully processed SQS messages from being processed multiple times. Which solution will meet these requirements?

   • ADecrease the batch window to 1 second when configuring the Lambda function's event source mapping.
   • BDecrease the batch size to 1 when configuring the Lambda function's event source mapping.
   • CInclude the ReportBatchItemFailures value in the FunctionResponseTypes list in the Lambda function's event source mapping.
   • DSet the queue visibility timeout on the Lambda function's event source mapping to account for invocation throttling of the Lambda function.

   Show answer

   Answer: C

   Explanation

   Lambda process messages in batches. If one message in the batch fails the whole batch considered failed and all messages in the batch return to the queue. For example if batch has 10 messages and message 5 and 7 failed to get processed, all 10 messages will return to the queue. So, successfully processed messages can get processed again. Now to prevent this to happen you have two ways (used to be one) 1. Write your code in a way to identify processed messages and delete them manually from SQS. 2. Partial batch response that returns only the messages that were failed to be processed (supported since Dec 2021). References: https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#services-sqs-batchfailurereporting

   Source: Adapted from community discussion — d262e67

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 77 · 427 in bank

   Select 2

   A company has a new AWS account that teams will use to deploy various applications. The teams will create many Amazon S3 buckets for application-specific purposes and to store AWS CloudTrail logs. The company has enabled Amazon Macie for the account. A DevOps engineer needs to optimize the Macie costs for the account without compromising the account's functionality. Which solutions will meet these requirements? (Choose two.)

   • AExclude S3 buckets that contain CloudTrail logs from automated discovery.
   • BExclude S3 buckets that have public read access from automated discovery.
   • CConfigure scheduled daily discovery jobs for all S3 buckets in the account.
   • DConfigure discovery jobs to include S3 objects based on the last modified criterion.
   • EConfigure discovery jobs to include S3 objects that are tagged as production only.

   Show answer

   Answer: AD

   Explanation

   https://aws.amazon.com/blogs/security/how-to-use-amazon-macie-to-reduce-the-cost-of-discovering-sensitive-data/ Options to make discovery jobs more targeted include: Include objects by using the “last modified” criterion — Consider using random object sampling — Include objects with specific extensions, tags, or storage size —

   Source: Adapted from community discussion — devakram

   References

   • AWS documentation

   Next question

8. Question 78 · 427 in bank

   A company's developers use Amazon EC2 instances as remote workstations. The company is concerned that users can create or modify EC2 security groups to allow unrestricted inbound access. A DevOps engineer needs to develop a solution to detect when users create unrestricted security group rules. The solution must detect changes to security group rules in near real time, remove unrestricted rules, and send email notifications to the security team. The DevOps engineer has created an AWS Lambda function that checks for security group ID from input, removes rules that grant unrestricted access, and sends notifications through Amazon Simple Notification Service (Amazon SNS). What should the DevOps engineer do next to meet the requirements?

   • AConfigure the Lambda function to be invoked by the SNS topic. Create an AWS CloudTrail subscription for the SNS topic. Configure a subscription filter for security group modification events.
   • BCreate an Amazon EventBridge scheduled rule to invoke the Lambda function. Define a schedule pattern that runs the Lambda function every hour.
   • CCreate an Amazon EventBridge event rule that has the default event bus as the source. Define the rule’s event pattern to match EC2 security group creation and modification events. Configure the rule to invoke the Lambda function.
   • DCreate an Amazon EventBridge custom event bus that subscribes to events from all AWS services. Configure the Lambda function to be invoked by the custom event bus.

   Show answer

   Answer: C

   Explanation

   C. Create an Amazon EventBridge event rule that has the default event bus as the source. Define the rule’s event pattern to match EC2 security group creation and modification events. Configure the rule to invoke the Lambda function. The solution requires near real-time detection of changes to security group rules and immediate action to remove unrestricted rules and send email notifications to the security team. The AWS Lambda function created by the DevOps engineer can perform these actions, but it needs to be invoked whenever a security group rule is modified. Amazon EventBridge is a serverless event bus service that can receive and process events from various AWS services, including Amazon EC2 and Amazon SNS. An EventBridge event rule with the default event bus as the source can be created to match EC2 security group creation and modification events. This rule can then be configured to invoke the Lambda function, which can remove unrestricted rules and send email notifications to the security team.

   Source: Adapted from community discussion — 5aga

   References

   • AWS documentation
   • repost.aws documentation

   Next question

9. Question 79 · 427 in bank

   Select 2

   A company uses an organization in AWS Organizations to manage its AWS accounts. The company recently acquired another company that has standalone AWS accounts. The acquiring company's DevOps team needs to consolidate the administration of the AWS accounts for both companies and retain full administrative control of the accounts. The DevOps team also needs to collect and group findings across all the accounts to implement and maintain a security posture. Which combination of steps should the DevOps team take to meet these requirements? (Choose two.)

   • AInvite the acquired company's AWS accounts to join the organization. Create an SCP that has full administrative privileges. Attach the SCP to the management account.
   • BInvite the acquired company's AWS accounts to join the organization. Create the OrganizationAccountAccessRole IAM role in the invited accounts. Grant permission to the management account to assume the role.
   • CUse AWS Security Hub to collect and group findings across all accounts. Use Security Hub to automatically detect new accounts as the accounts are added to the organization.
   • DUse AWS Firewall Manager to collect and group findings across all accounts. Enable all features for the organization. Designate an account in the organization as the delegated administrator account for Firewall Manager.
   • EUse Amazon Inspector to collect and group findings across all accounts. Designate an account in the organization as the delegated administrator account for Amazon Inspector.

   Show answer

   Answer: BC

   Explanation

   B and C are correct: means we need to invite the new accounts to the existing AWS organization. means security hub A: : this is incorrect D: Firewall manager is use to centrally manage all FWs, not to collect and group findings E: Inspector is used for vulnerability scanning only

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 80 · 427 in bank

    A company has an application and a CI/CD pipeline. The CI/CD pipeline consists of an AWS CodePipeline pipeline and an AWS CodeBuild project. The CodeBuild project runs tests against the application as part of the build process and outputs a test report. The company must keep the test reports for 90 days. Which solution will meet these requirements?

    • AAdd a new stage in the CodePipeline pipeline after the stage that contains the CodeBuild project. Create an Amazon S3 bucket to store the reports. Configure an S3 deploy action type in the new CodePipeline stage with the appropriate path and format for the reports.
    • BAdd a report group in the CodeBuild project buildspec file with the appropriate path and format for the reports. Create an Amazon S3 bucket to store the reports. Configure an Amazon EventBridge rule that invokes an AWS Lambda function to copy the reports to the S3 bucket when a build is completed. Create an S3 Lifecycle rule to expire the objects after 90 days.
    • CAdd a new stage in the CodePipeline pipeline. Configure a test action type with the appropriate path and format for the reports. Configure the report expiration time to be 90 days in the CodeBuild project buildspec file.
    • DAdd a report group in the CodeBuild project buildspec file with the appropriate path and format for the reports. Create an Amazon S3 bucket to store the reports. Configure the report group as an artifact in the CodeBuild project buildspec file. Configure the S3 bucket as the artifact destination. Set the object expiration to 90 days.

    Show answer

    Answer: B

    Explanation

    "B. Add a report group in the CodeBuild project buildspec file with the appropriate path and format for the reports. Create an Amazon S3 bucket to store the reports. Configure an Amazon EventBridge rule that invokes an AWS Lambda function to copy the reports to the S3 bucket when a build is completed. Create an S3 Lifecycle rule to expire the objects after 90 days.": A test report expires 30 days after it is created. You cannot view an expired test report, but you can export the test results to raw test result files in an S3 bucket. Exported raw test files do not expire. https://docs.aws.amazon.com/codebuild/latest/userguide/test-report.html when you export a test group to s3, it is zipped https://docs.aws.amazon.com/codebuild/latest/userguide/test-report-group-create-cli.html

    Source: Adapted from community discussion — ozansenturk

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 71. 427 questions available.