DOP-C02 practice questions 81–90

1. Question 81 · 427 in bank

   Select 2

   A company uses an Amazon API Gateway regional REST API to host its application API. The REST API has a custom domain. The REST API's default endpoint is deactivated. The company's internal teams consume the API. The company wants to use mutual TLS between the API and the internal teams as an additional layer of authentication. Which combination of steps will meet these requirements? (Choose two.)

   • AUse AWS Certificate Manager (ACM) to create a private certificate authority (CA). Provision a client certificate that is signed by the private CA.
   • BProvision a client certificate that is signed by a public certificate authority (CA). Import the certificate into AWS Certificate Manager (ACM).
   • CUpload the provisioned client certificate to an Amazon S3 bucket. Configure the API Gateway mutual TLS to use the client certificate that is stored in the S3 bucket as the trust store.
   • DUpload the provisioned client certificate private key to an Amazon S3 bucket. Configure the API Gateway mutual TLS to use the private key that is stored in the S3 bucket as the trust store.
   • EUpload the root private certificate authority (CA) certificate to an Amazon S3 bucket. Configure the API Gateway mutual TLS to use the private CA certificate that is stored in the S3 bucket as the trust store.

   Show answer

   Answer: AE

   Explanation

   A. Because it's only for internal teams. E. Because the truststore dictates which CAs to trust. If you have intermediate CAs those also need to be present in the S3 bucket.

   Source: Adapted from community discussion — d262e67

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 82 · 427 in bank

   A company uses AWS Directory Service for Microsoft Active Directory as its identity provider (IdP). The company requires all infrastructure to be defined and deployed by AWS CloudFormation. A DevOps engineer needs to create a fleet of Windows-based Amazon EC2 instances to host an application. The DevOps engineer has created a CloudFormation template that contains an EC2 launch template, IAM role, EC2 security group, and EC2 Auto Scaling group. The DevOps engineer must implement a solution that joins all EC2 instances to the domain of the AWS Managed Microsoft AD directory. Which solution will meet these requirements with the MOST operational efficiency?

   • AIn the CloudFormation template, create an AWS::SSM::Document resource that joins the EC2 instance to the AWS Managed Microsoft AD domain by using the parameters for the existing directory. Update the launch template to include the SSMAssociation property to use the new SSM document. Attach the AmazonSSMManagedInstanceCore and AmazonSSMDirectoryServiceAccess AWS managed policies to the IAM role that the EC2 instances use.
   • BIn the CloudFormation template, update the launch template to include specific tags that propagate on launch. Create an AWS::SSM::Association resource to associate the AWS-JoinDirectoryServiceDomain Automation runbook with the EC2 instances that have the specified tags. Define the required parameters to join the AWS Managed Microsoft AD directory. Attach the AmazonSSMManagedInstanceCore and AmazonSSMDirectoryServiceAccess AWS managed policies to the IAM role that the EC2 instances use.
   • CStore the existing AWS Managed Microsoft AD domain connection details in AWS Secrets Manager. In the CloudFormation template, create an AWS::SSM::Association resource to associate the AWS-CreateManagedWindowsInstanceWithApproval Automation runbook with the EC2 Auto Scaling group. Pass the ARNs for the parameters from Secrets Manager to join the domain. Attach the AmazonSSMDirectoryServiceAccess and SecretsManagerReadWrite AWS managed policies to the IAM role that the EC2 instances use.
   • DStore the existing AWS Managed Microsoft AD domain administrator credentials in AWS Secrets Manager. In the CloudFormation template, update the EC2 launch template to include user data. Configure the user data to pull the administrator credentials from Secrets Manager and to join the AWS Managed Microsoft AD domain. Attach the AmazonSSMManagedInstanceCore and SecretsManagerReadWrite AWS managed policies to the IAM role that the EC2 instances use.

   Show answer

   Answer: B

   Explanation

   B is correct: we need to use AWS:SSM::Document with the AWS-JoinDirectoryServiceDomain automation runbook for this task A: no mention of the name of runbook to join domain C: AWS-CreateManagedWindowsInstanceWithApproval Automation runbook is used for creating a windows instance, not to join domain D: no mention of AWS::SSM::Document

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 83 · 427 in bank

   A company uses AWS Organizations to manage its AWS accounts. The company has a root OU that has a child OU. The root OU has an SCP that allows all actions on all resources. The child OU has an SCP that allows all actions for Amazon DynamoDB and AWS Lambda, and denies all other actions. The company has an AWS account that is named vendor-data in the child OU. A DevOps engineer has an IAM user that is attached to the Administrator Access IAM policy in the vendor-data account. The DevOps engineer attempts to launch an Amazon EC2 instance in the vendor-data account but receives an access denied error. Which change should the DevOps engineer make to launch the EC2 instance in the vendor-data account?

   • AAttach the AmazonEC2FullAccess IAM policy to the IAM user.
   • BCreate a new SCP that allows all actions for Amazon EC2. Attach the SCP to the vendor-data account.
   • CUpdate the SCP in the child OU to allow all actions for Amazon EC2.
   • DCreate a new SCP that allows all actions for Amazon EC2. Attach the SCP to the root OU.

   Show answer

   Answer: C

   Explanation

   It's C - Allow must be explicit from root all the way down to the account level. Since it's not specified in the OU the only way to make it available to vendor-account is to change the OU policy.

   Source: Adapted from community discussion — csG13

   Next question

4. Question 84 · 427 in bank

   A company's security policies require the use of security hardened AMIs in production environments. A DevOps engineer has used EC2 Image Builder to create a pipeline that builds the AMIs on a recurring schedule. The DevOps engineer needs to update the launch templates of the company's Auto Scaling groups. The Auto Scaling groups must use the newest AMIs during the launch of Amazon EC2 instances. Which solution will meet these requirements with the MOST operational efficiency?

   • AConfigure an Amazon EventBridge rule to receive new AMI events from Image Builder. Target an AWS Systems Manager Run Command document that updates the launch templates of the Auto Scaling groups with the newest AMI ID.
   • BConfigure an Amazon EventBridge rule to receive new AMI events from Image Builder. Target an AWS Lambda function that updates the launch templates of the Auto Scaling groups with the newest AMI ID.
   • CConfigure the launch template to use a value from AWS Systems Manager Parameter Store for the AMI ID. Configure the Image Builder pipeline to update the Parameter Store value with the newest AMI ID.
   • DConfigure the Image Builder distribution settings to update the launch templates with the newest AMI IConfigure the Auto Scaling groups to use the newest version of the launch template.

   Show answer

   Answer: D

   Explanation

   D is correct: Image builder has a built-in that allow updating EC2 launch template A: AWS Systems Manager Run Command document is used for running scripts on EC2, not to update B: Lambda is used for other tasks, not this one C: This seems to be a feasible option, but we can update the launch template directly without using parameter store

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation

   Next question

5. Question 85 · 427 in bank

   A company has configured an Amazon S3 event source on an AWS Lambda function. The company needs the Lambda function to run when a new object is created or an existing object is modified in a particular S3 bucket. The Lambda function will use the S3 bucket name and the S3 object key of the incoming event to read the contents of the created or modified S3 object. The Lambda function will parse the contents and save the parsed contents to an Amazon DynamoDB table. The Lambda function's execution role has permissions to read from the S3 bucket and to write to the DynamoDB table. During testing, a DevOps engineer discovers that the Lambda function does not run when objects are added to the S3 bucket or when existing objects are modified. Which solution will resolve this problem?

   • AIncrease the memory of the Lambda function to give the function the ability to process large files from the S3 bucket.
   • BCreate a resource policy on the Lambda function to grant Amazon S3 the permission to invoke the Lambda function for the S3 bucket.
   • CConfigure an Amazon Simple Queue Service (Amazon SQS) queue as an OnFailure destination for the Lambda function.
   • DProvision space in the /tmp folder of the Lambda function to give the function the ability to process large files from the S3 bucket.

   Show answer

   Answer: B

   Explanation

   B: is correct: Need to add a permission in lambda resource-based policy, which allow S3 to invode lambda A: If there is insufficient memory, lambda still runs. This case is about lambda not running at all C: We dont need SQS for dead-letter queue here D: Lambda does not run in a test, which proves that the problem does not lie in disk space because in tests, testers usually wont use large objects

   Source: Adapted from community discussion — thanhnv142

   Next question

6. Question 86 · 427 in bank

   A company has deployed a critical application in two AWS Regions. The application uses an Application Load Balancer (ALB) in both Regions. The company has Amazon Route 53 alias DNS records for both ALBs. The company uses Amazon Route 53 Application Recovery Controller to ensure that the application can fail over between the two Regions. The Route 53 ARC configuration includes a routing control for both Regions. The company uses Route 53 ARC to perform quarterly disaster recovery (DR) tests. During the most recent DR test, a DevOps engineer accidentally turned off both routing controls. The company needs to ensure that at least one routing control is turned on at all times. Which solution will meet these requirements?

   • AIn Route 53 ARC, create a new assertion safety rule. Apply the assertion safety rule to the two routing controls. Configure the rule with the ATLEAST type with a threshold of 1.
   • BIn Route 53 ARC, create a new gating safety rule. Apply the assertion safety rule to the two routing controls. Configure the rule with the OR type with a threshold of 1.
   • CIn Route 53 ARC, create a new resource set. Configure the resource set with an AWS::Route53::HealthCheck resource type. Specify the ARNs of the two routing controls as the target resource. Create a new readiness check for the resource set.
   • DIn Route 53 ARC, create a new resource set. Configure the resource set with an AWS::Route53RecoveryReadiness::DNSTargetResource resource type. Add the domain names of the two Route 53 alias DNS records as the target resource. Create a new readiness check for the resource set.

   Show answer

   Answer: A

   Explanation

   A is correct: assertion rule to make sure that atleast on gate is always open. This rules are basically things that users cannot do or only allow to do B: This gating rule is basically an on-off swith for a set of ARCs. If there is a controller that we dont want to turn off, specify this rule. This rule might help us achive the goal of the question. However, this requires we specify the exact name of the controller that should not be turned off. Meanwhile, the question requires that any controller can be turned off but at least one must be up and running. Therefore, this is not the right option

   Source: Adapted from community discussion — thanhnv142

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 87 · 427 in bank

   A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps engineer must create a workflow to audit the application to ensure compliance. What steps should the engineer take to meet this requirement with the LEAST administrative overhead?

   • AUse AWS Systems Manager Configuration Compliance. Use calls to the put-compliance-items API action to scan and build a database of noncompliant EC2 instances based on their host placement configuration. Use an Amazon DynamoDB table to store these instance IDs for fast access. Generate a report through Systems Manager by calling the list-compliance-summaries API action.
   • BUse custom Java code running on an EC2 instance. Set up EC2 Auto Scaling for the instance depending on the number of instances to be checked. Send the list of noncompliant EC2 instance IDs to an Amazon SQS queue. Set up another worker instance to process instance IDs from the SQS queue and write them to Amazon DynamoDUse an AWS Lambda function to terminate noncompliant instance IDs obtained from the queue, and send them to an Amazon SNS email topic for distribution.
   • CUse AWS Config. Identify all EC2 instances to be audited by enabling Config Recording on all Amazon EC2 resources for the region. Create a custom AWS Config rule that triggers an AWS Lambda function by using the "config-rule-change -triggered" blueprint. Modify the Lambda evaluateCompliance() function to verify host placement to return a NON_COMPLIANT result if the instance is not running on an EC2 Dedicated Host. Use the AWS Config report to address noncompliant instances.
   • DUse AWS CloudTrail. Identify all EC2 instances to be audited by analyzing all calls to the EC2 RunCommand API action. Invoke an AWS Lambda function that analyzes the host placement of the instance. Store the EC2 instance ID of noncompliant resources in an Amazon RDS for MySQL DB instance. Generate a report by querying the RDS instance and exporting the query results to a CSV text file.

   Show answer

   Answer: C

   Explanation

   C is correct: Using Config is the right way A: DynamoDB is used primarily for storing web section data, not to store these IDs B: Should not use custom Java code on Ec2. Additionally, This option mention terminating non-compliance ones, which is incorrect. We only need an audit workflow D: Cloud trail is for auditing user activities, not to check non-compliance EC2 instacnes

   Source: Adapted from community discussion — thanhnv142

   Next question

8. Question 88 · 427 in bank

   Select 3

   A DevOps engineer is planning to deploy a Ruby-based application to production. The application needs to interact with an Amazon RDS for MySQL database and should have automatic scaling and high availability. The stored data in the database is critical and should persist regardless of the state of the application stack. The DevOps engineer needs to set up an automated deployment strategy for the application with automatic rollbacks. The solution also must alert the application team when a deployment fails. Which combination of steps will meet these requirements? (Choose three.)

   • ADeploy the application on AWS Elastic Beanstalk. Deploy an Amazon RDS for MySQL DB instance as part of the Elastic Beanstalk configuration.
   • BDeploy the application on AWS Elastic Beanstalk. Deploy a separate Amazon RDS for MySQL DB instance outside of Elastic Beanstalk.
   • CConfigure a notification email address that alerts the application team in the AWS Elastic Beanstalk configuration.
   • DConfigure an Amazon EventBridge rule to monitor AWS Health events. Use an Amazon Simple Notification Service (Amazon SNS) topic as a target to alert the application team.
   • EUse the immutable deployment method to deploy new application versions.
   • FUse the rolling deployment method to deploy new application versions.

   Show answer

   Answer: BCE

   Explanation

   BCE Immutable deployments perform an immutable update to launch a full set of new instances running the new version of the application in a separate Auto Scaling group, alongside the instances running the old version. Immutable deployments can prevent issues caused by partially completed rolling deployments. If the new instances don't pass health checks, Elastic Beanstalk terminates them, leaving the original instances untouched.

   Source: Adapted from community discussion — dkp

   References

   • AWS documentation

   Next question

9. Question 89 · 427 in bank

   A DevOps engineer is creating an AWS CloudFormation template to deploy a web service. The web service will run on Amazon EC2 instances in a private subnet behind an Application Load Balancer (ALB). The DevOps engineer must ensure that the service can accept requests from clients that have IPv6 addresses. What should the DevOps engineer do with the CloudFormation template so that IPv6 clients can access the web service?

   • AAdd an IPv6 CIDR block to the VPC and the private subnet for the EC2 instances. Create route table entries for the IPv6 network, use EC2 instance types that support IPv6, and assign IPv6 addresses to each EC2 instance.
   • BAssign each EC2 instance an IPv6 Elastic IP address. Create a target group, and add the EC2 instances as targets. Create a listener on port 443 of the ALB, and associate the target group with the ALB.
   • CReplace the ALB with a Network Load Balancer (NLB). Add an IPv6 CIDR block to the VPC and subnets for the NLB, and assign the NLB an IPv6 Elastic IP address.
   • DAdd an IPv6 CIDR block to the VPC and subnets for the ALB. Create a listener on port 443. and specify the dualstack IP address type on the ALB. Create a target group, and add the EC2 instances as targets. Associate the target group with the ALB.

   Show answer

   Answer: D

   Explanation

   D "To support IPv6, configure your Application Load Balancers or Network Load Balancers with the “dualstack” IP address type. This means that clients can communicate with the load balancers using both IPv4 and IPv6 addresses. In a dual-stack IP address type, the DNS name of the load balancer provides both IPv4 and IPv6 addresses, and creates A and AAAA records respectively. " https://docs.aws.amazon.com/whitepapers/latest/ipv6-on-aws/scaling-the-dual-stack-network-design-in-aws.html

   Source: Adapted from community discussion — levster

   References

   • AWS documentation
   • repost.aws documentation

   Next question

10. Question 90 · 427 in bank

    Select 2

    A company is using AWS CodePipeline to deploy an application. According to a new guideline, a member of the company's security team must sign off on any application changes before the changes are deployed into production. The approval must be recorded and retained. Which combination of actions will meet these requirements? (Choose two.)

    • AConfigure CodePipeline to write actions to Amazon CloudWatch Logs.
    • BConfigure CodePipeline to write actions to an Amazon S3 bucket at the end of each pipeline stage.
    • CCreate an AWS CloudTrail trail to deliver logs to Amazon S3.
    • DCreate a CodePipeline custom action to invoke an AWS Lambda function for approval. Create a policy that gives the security team access to manage CodePipeline custom actions.
    • ECreate a CodePipeline manual approval action before the deployment step. Create a policy that grants the security team access to approve manual approval stages.

    Show answer

    Answer: CE

    Explanation

    CE: AWS CodePipeline is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in CodePipeline;. CloudTrail captures all API calls for CodePipeline as events. The calls captured include calls from the CodePipeline console and code calls to the CodePipeline API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for CodePipeline. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. Using the information collected by CloudTrail, you can determine the request that was made to CodePipeline, the IP address from which the request was made, who made the request, when it was made, and additional details. https://docs.aws.amazon.com/codepipeline/latest/userguide/monitoring-cloudtrail-logs.html

    Source: Adapted from community discussion — ozansenturk

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DOP-C02 practice, question 81. 427 questions available.