DOP-C02 — questions

Page 14 of 22 · 431 total questions.

DOP-C02 Question 261

Single page →

Topic 1 · Question 261

A company has an organization in AWS Organizations. A DevOps engineer needs to maintain multiple AWS accounts that belong to different OUs in the organization. All resources, including IAM policies and Amazon S3 policies within an account, are deployed through AWS CloudFormation. All templates and code are maintained in an AWS CodeCommit repository. Recently, some developers have not been able to access an S3 bucket from some accounts in the organization. The following policy is attached to the S3 bucket: What should the DevOps engineer do to resolve this access issue?

AModify the S3 bucket policy. Turn off the S3 Block Public Access setting on the S3 bucket. In the S3 policy, add the aws:SourceAccount condition. Add the AWS account IDs of all developers who are experiencing the issue.
BVerify that no IAM permissions boundaries are denying developers access to the S3 bucket. Make the necessary changes to IAM permissions boundaries. Use an AWS Config recorder in the individual developer accounts that are experiencing the issue to revert any changes that are blocking access. Commit the fix back into the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes.
CConfigure an SCP that stops anyone from modifying IAM resources in developer OUs. In the S3 policy, add the aws:SourceAccount condition. Add the AWS account IDs of all developers who are experiencing the issue. Commit the fix back into the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes.
DEnsure that no SCP is blocking access for developers to the S3 bucket. Ensure that no IAM policy permissions boundaries are denying access to developer IAM users. Make the necessary changes to the SCP and IAM policy permissions boundaries in the CodeCommit repository. Invoke deployment through CloudFormation to apply the changes. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Ensure that no SCP is blocking access for developers to the S3 bucket. Ensure that no IAM policy permissions boundaries are denying access to developer IAM users. Make the necessary changes to the SCP and IAM policy p...

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Service Control Policies set guardrails on what accounts in an organization can do.

DOP-C02 Question 262

Single page →

Topic 1 · Question 262 · Select all that apply

A company has an organization in AWS Organizations for its multi-account environment. A DevOps engineer is developing an AWS CodeArtifact based strategy for application package management across the organization. Each application team at the company has its own account in the organization. Each application team also has limited access to a centralized shared services account. Each application team needs full access to download, publish, and grant access to its own packages. Some common library packages that the application teams use must also be shared with the entire organization. Which combination of steps will meet these requirements with the LEAST administrative overhead? (Choose three.)

ACreate a domain in each application team's account. Grant each application team's account full read access and write access to the application team's domain.
BCreate a domain in the shared services account. Grant the organization read access and CreateRepository access. (correct answer)
CCreate a repository in each application team’s account. Grant each application team’s account full read access and write access to its own repository. (correct answer)
DCreate a repository in the shared services account. Grant the organization read access to the repository in the shared services account Set the repository as the upstream repository in each application team's repository. (correct answer)
EFor teams that require shared packages, create resource-based policies that allow read access to the repository from other application teams' accounts.
FSet the other application teams' repositories as upstream repositories.

Reveal answer & explanation

Correct answer: B, C, D

The correct answer is B, C, D. Option B: Create a domain in the shared services account. Grant the organization read access and CreateRepository access. Option C: Create a repository in each application team’s account. Grant each application team’s account full read access and write access to its own repository. Option D: Create a repository in the shared services account. Grant the organization read access to the repository in the shared services account Set the repository as the upstream repository in each application team's repository.

DOP-C02 Question 263

Single page →

Topic 1 · Question 263

A company deploys an application to Amazon EC2 instances. The application runs Amazon Linux 2 and uses AWS CodeDeploy. The application has the following file structure for its code repository: The appspec.yml file has the following contents in the files section: What will the result be for the deployment of the config.txt file?

AThe config.txt file will be deployed to only /var/www/html/config/config.txt.
BThe config.txt file will be deployed to /usr/local/src/config.txt and to /var/www/html/config/config.txt. (correct answer)
CThe config.txt file will be deployed to only /usr/local/src/config.txt.
DThe config.txt file will be deployed to /usr/local/src/config.txt and to /var/www/html/application/web/config.txt.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: The config.txt file will be deployed to /usr/local/src/config.txt and to /var/www/html/config/config.txt.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 264

Single page →

Topic 1 · Question 264 · Select all that apply

A company has set up AWS CodeArtifact repositories with public upstream repositories. The company's development team consumes open source dependencies from the repositories in the company's internal network. The company's security team recently discovered a critical vulnerability in the most recent version of a package that the development team consumes. The security team has produced a patched version to fix the vulnerability. The company needs to prevent the vulnerable version from being downloaded. The company also needs to allow the security team to publish the patched version. Which combination of steps will meet these requirements? (Choose two.)

AUpdate the status of the affected CodeArtifact package version to unlisted.
BUpdate the status of the affected CodeArtifact package version to deleted.
CUpdate the status of the affected CodeArtifact package version to archived. (correct answer)
DUpdate the CodeArtifact package origin control settings to allow direct publishing and to block upstream operations. (correct answer)
EUpdate the CodeArtifact package origin control settings to block direct publishing and to allow upstream operations.

Reveal answer & explanation

Correct answer: C, D

The correct answer is C, D. Option C: Update the status of the affected CodeArtifact package version to archived. Option D: Update the CodeArtifact package origin control settings to allow direct publishing and to block upstream operations.

DOP-C02 Question 265

Single page →

Topic 1 · Question 265

A company is running a custom-built application that processes records. All the components run on Amazon EC2 instances that run in an Auto Scaling group. Each record's processing is a multistep sequential action that is compute-intensive. Each step is always completed in 5 minutes or less. A limitation of the current system is that if any steps fail, the application has to reprocess the record from the beginning. The company wants to update the architecture so that the application must reprocess only the failed steps. What is the MOST operationally efficient solution that meets these requirements?

ACreate a web application to write records to Amazon S3. Use S3 Event Notifications to publish to an Amazon Simple Notification Service (Amazon SNS) topic. Use an EC2 instance to poll Amazon SNS and start processing. Save intermediate results to Amazon S3 to pass on to the next step.
BPerform the processing steps by using logic in the application. Convert the application code to run in a container. Use AWS Fargate to manage the container instances. Configure the container to invoke itself to pass the state from one step to the next.
CCreate a web application to pass records to an Amazon Kinesis data stream. Decouple the processing by using the Kinesis data stream and AWS Lambda functions.
DCreate a web application to pass records to AWS Step Functions. Decouple the processing into Step Functions tasks and AWS Lambda functions. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Create a web application to pass records to AWS Step Functions. Decouple the processing into Step Functions tasks and AWS Lambda functions.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon RDS is a managed relational database that handles patching, backups and failover. AWS Step Functions coordinates multi-step workflows as a managed state machine.

DOP-C02 Question 266

Single page →

Topic 1 · Question 266

A company is migrating its on-premises Windows applications and Linux applications to AWS. The company will use automation to launch Amazon EC2 instances to mirror the on-premises configurations. The migrated applications require access to shared storage that uses SMB for Windows and NFS for Linux. The company is also creating a pilot light disaster recovery (DR) environment in another AWS Region. The company will use automation to launch and configure the EC2 instances in the DR Region. The company needs to replicate the storage to the DR Region. Which storage solution will meet these requirements?

AUse Amazon S3 for the application storage. Create an S3 bucket in the primary Region and an S3 bucket in the DR Region. Configure S3 Cross-Region Replication (CRR) from the primary Region to the DR Region.
BUse Amazon Elastic Block Store (Amazon EBS) for the application storage. Create a backup plan in AWS Backup that creates snapshots of the EBS volumes that are in the primary Region and replicates the snapshots to the DR Region.
CUse a Volume Gateway in AWS Storage Gateway for the application storage. Configure Cross-Region Replication (CRR) of the Volume Gateway from the primary Region to the DR Region.
DUse Amazon FSx for NetApp ONTAP for the application storage. Create an FSx for ONTAP instance in the DR Region. Configure NetApp SnapMirror replication from the primary Region to the DR Region. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Use Amazon FSx for NetApp ONTAP for the application storage. Create an FSx for ONTAP instance in the DR Region. Configure NetApp SnapMirror replication from the primary Region to the DR Region.

Explanation

Amazon FSx provides fully managed third-party file systems. AWS Config tracks resource configuration changes and evaluates compliance. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

DOP-C02 Question 267

Single page →

Topic 1 · Question 267 · Select all that apply

A company's application uses a fleet of Amazon EC2 On-Demand Instances to analyze and process data. The EC2 instances are in an Auto Scaling group. The Auto Scaling group is a target group for an Application Load Balancer (ALB). The application analyzes critical data that cannot tolerate interruption. The application also analyzes noncritical data that can withstand interruption. The critical data analysis requires quick scalability in response to real-time application demand. The noncritical data analysis involves memory consumption. A DevOps engineer must implement a solution that reduces scale-out latency for the critical data. The solution also must process the noncritical data. Which combination of steps will meet these requirements? (Choose two.)

AFor the critical data, modify the existing Auto Scaling group. Create a warm pool instance in the stopped state. Define the warm pool size. Create a new version of the launch template that has detailed monitoring enabled. Use Spot Instances.
BFor the critical data, modify the existing Auto Scaling group. Create a warm pool instance in the stopped state. Define the warm pool size. Create a new version of the launch template that has detailed monitoring enabled. Use On-Demand Instances. (correct answer)
CFor the critical data, modify the existing Auto Scaling group. Create a lifecycle hook to ensure that bootstrap scripts are completed successfully. Ensure that the application on the instances is ready to accept traffic before the instances are registered. Create a new version of the launch template that has detailed monitoring enabled.
DFor the noncritical data, create a second Auto Scaling group that uses a launch template. Configure the launch template to install the unified Amazon CloudWatch agent and to configure the CloudWatch agent with a custom memory utilization metric. Use Spot Instances. Add the new Auto Scaling group as the target group for the ALB. Modify the application to use two target groups for critical data and noncritical data. (correct answer)
EFor the noncritical data, create a second Auto Scaling group. Choose the predefined memory utilization metric type for the target tracking scaling policy. Use Spot Instances. Add the new Auto Scaling group as the target group for the ALB. Modify the application to use two target groups for critical data and noncritical data.

Reveal answer & explanation

Correct answer: B, D

The correct answer is B, D. Option B: For the critical data, modify the existing Auto Scaling group. Create a warm pool instance in the stopped state. Define the warm pool size. Create a new version of the launch template that has detailed monitoring enab... Option D: For the noncritical data, create a second Auto Scaling group that uses a launch template. Configure the launch template to install the unified Amazon CloudWatch agent and to configure the CloudWatch agent with a custo...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Spot Instances use spare capacity at a large discount, ideal for fault-tolerant or interruptible workloads. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. This option meets the real-time / low-latency performance requirement.

DOP-C02 Question 268

Single page →

Topic 1 · Question 268 · Select all that apply

A company recently migrated its application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that uses Amazon EC2 instances. The company configured the application to automatically scale based on CPU utilization. The application produces memory errors when it experiences heavy loads. The application also does not scale out enough to handle the increased load. The company needs to collect and analyze memory metrics for the application over time. Which combination of steps will meet these requirements? (Choose three.)

AAttach the CloudWatchAgentServerPolicy managed IAM policy to the IAM instance profile that the cluster uses. (correct answer)
BAttach the CloudWatchAgentServerPolicy managed IAM policy to a service account role for the cluster.
CCollect performance metrics by deploying the unified Amazon CloudWatch agent to the existing EC2 instances in the cluster. Add the agent to the AMI for any new EC2 instances that are added to the cluster. (correct answer)
DCollect performance logs by deploying the AWS Distro for OpenTelemetry collector as a DaemonSet.
EAnalyze the pod_memory_utilization Amazon CloudWatch metric in the ContainerInsights namespace by using the Service dimension. (correct answer)
FAnalyze the node_memory_utilization Amazon CloudWatch metric in the ContainerInsights namespace by using the ClusterName dimension.

Reveal answer & explanation

Correct answer: A, C, E

The correct answer is A, C, E. Option A: Attach the CloudWatchAgentServerPolicy managed IAM policy to the IAM instance profile that the cluster uses. Option C: Collect performance metrics by deploying the unified Amazon CloudWatch agent to the existing EC2 instances in the cluster. Add the agent to the AMI for any new EC2 instances that are added to the cluster. Option E: Analyze the pod_memory_utilization Amazon CloudWatch metric in the ContainerInsights namespace by using the Service dimension.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

DOP-C02 Question 269

Single page →

Topic 1 · Question 269

A company's video streaming platform usage has increased from 10,000 users each day to 50,000 users each day in multiple countries. The company deploys the streaming platform on Amazon Elastic Kubernetes Service (Amazon EKS). The EKS workload scales up to thousands of nodes during peak viewing time. The company's users report occurrences of unauthorized logins. Users also report sudden interruptions and logouts from the platform. The company wants additional security measures for the entire platform. The company also needs a summarized view of the resource behaviors and interactions across the company's entire AWS environment. The summarized view must show login attempts, API calls, and network traffic. The solution must permit network traffic analysis while minimizing the overhead of managing logs. The solution must also quickly investigate any potential malicious behavior that is associated with the EKS workload. Which solution will meet these requirements?

AEnable Amazon GuardDuty for EKS Audit Log Monitoring. Enable AWS CloudTrail logs. Store the EKS audit logs and CloudTrail log files in an Amazon S3 bucket. Use Amazon Athena to create an external table. Use Amazon QuickSight to create a dashboard.
BEnable Amazon GuardDuty for EKS Audit Log Monitoring. Enable Amazon Detective in the company's AWS account. Enable EKS audit logs from optional source packages in Detective. (correct answer)
CEnable Amazon CloudWatch Container Insights. Enable AWS CloudTrail logs. Store the EKS audit logs and CloudTrail log files in an Amazon S3 bucket. Use Amazon Athena to create an external table. Use Amazon QuickSight to create a dashboard.
DEnable Amazon GuardDuty for EKS Audit Log Monitoring. Enable Amazon CloudWatch Container Insights and VPC Flow Logs. Enable AWS CloudTrail logs.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Enable Amazon GuardDuty for EKS Audit Log Monitoring. Enable Amazon Detective in the company's AWS account. Enable EKS audit logs from optional source packages in Detective.

Explanation

Amazon EKS runs managed Kubernetes when you need the Kubernetes ecosystem. Amazon GuardDuty continuously monitors for threats and malicious activity. Amazon Detective analyzes and visualizes security data to investigate issues. This option meets the real-time / low-latency performance requirement.

DOP-C02 Question 270

Single page →

Topic 1 · Question 270 · Select all that apply

A company uses AWS Organizations to manage hundreds of AWS accounts. The company has a team that is responsible for AWS Identity and Access Management (IAM). The IAM team wants to implement AWS IAM Identity Center (AWS Single Sign-On). The IAM team must have only the minimum needed permissions to manage IAM Identity Center. The IAM team must not be able to gain unneeded access to the Organizations management account. The IAM team must be able to provision new IAM Identity Center permission sets and assignments for existing and new member accounts. Which combination of steps will meet these requirements? (Choose three.)

ACreate a new AWS account for the IAM team. In the new account, enable IAM Identity Center. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center. (correct answer)
BCreate a new AWS account for the IAM team. In the Organizations management account, enable IAM Identity Center. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center.
CIn IAM Identity Center, create users and a group for the IAM team. Add the users to the group. Create a new permission set. Attach the AWSSSODirectoryAdministrator managed IAM policy to the group.
DIn IAM Identity Center, create users and a group for the IAM team. Add the users to the group. Create a new permission set. Attach the AWSSSOMemberAccountAdministrator managed IAM policy to the group. (correct answer)
EAssign the permission set to the Organizations management account. Allow the IAM team group to use the permission set.
FAssign the permission set to the new AWS account. Allow the IAM team group to use the permission set. (correct answer)

Reveal answer & explanation

Correct answer: A, D, F

The correct answer is A, D, F. Option A: Create a new AWS account for the IAM team. In the new account, enable IAM Identity Center. In the Organizations management account, register the new account as a delegated administrator for IAM Identity Center. Option D: In IAM Identity Center, create users and a group for the IAM team. Add the users to the group. Create a new permission set. Attach the AWSSSOMemberAccountAdministrator managed IAM policy to the group. Option F: Assign the permission set to the new AWS account. Allow the IAM team group to use the permission set.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Organizations centrally governs and secures multiple AWS accounts. AWS IAM Identity Center (SSO) centrally manages workforce access to multiple accounts and apps.

DOP-C02 Question 271

Single page →

Topic 1 · Question 271 · Select all that apply

A company uses an organization in AWS Organizations that has all features enabled. The company uses AWS Backup in a primary account and uses an AWS Key Management Service (AWS KMS) key to encrypt the backups. The company needs to automate a cross-account backup of the resources that AWS Backup backs up in the primary account. The company configures cross-account backup in the Organizations management account. The company creates a new AWS account in the organization and configures an AWS Backup backup vault in the new account. The company creates a KMS key in the new account to encrypt the backups. Finally, the company configures a new backup plan in the primary account. The destination for the new backup plan is the backup vault in the new account. When the AWS Backup job in the primary account is invoked, the job creates backups in the primary account. However, the backups are not copied to the new account's backup vault. Which combination of steps must the company take so that backups can be copied to the new account's backup vault? (Choose two.)

AEdit the backup vault access policy in the new account to allow access to the primary account. (correct answer)
BEdit the backup vault access policy in the primary account to allow access to the new account.
CEdit the backup vault access policy in the primary account to allow access to the KMS key in the new account.
DEdit the key policy of the KMS key in the primary account to share the key with the new account. (correct answer)
EEdit the key policy of the KMS key in the new account to share the key with the primary account.

Reveal answer & explanation

Correct answer: A, D

The correct answer is A, D. Option A: Edit the backup vault access policy in the new account to allow access to the primary account. Option D: Edit the key policy of the KMS key in the primary account to share the key with the new account.

Explanation

AWS Backup centrally automates and manages backups across AWS services. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

DOP-C02 Question 272

Single page →

Topic 1 · Question 272 · Select all that apply

A company runs an application that uses an Amazon S3 bucket to store images. A DevOps engineer needs to implement a multi-Region strategy for the objects that are stored in the S3 bucket. The company needs to be able to fail over to an S3 bucket in another AWS Region. When an image is added to either S3 bucket, the image must be replicated to the other S3 bucket within 15 minutes. The DevOps engineer enables two-way replication between the S3 buckets. Which combination of steps should the DevOps engineer take next to meet the requirements? (Choose three.)

AEnable S3 Replication Time Control (S3 RTC) on each replication rule. (correct answer)
BCreate an S3 Multi-Region Access Point in an active-passive configuration. (correct answer)
CCall the SubmitMultiRegionAccessPointRoutes operation in the AWS API when the company needs to fail over to the S3 bucket in the other Region. (correct answer)
DEnable S3 Transfer Acceleration on both S3 buckets.
EConfigure a routing control in Amazon Route 53 Recovery Controller. Add the S3 buckets in an active-passive configuration.
FCall the UpdateRoutingControlStates operation in the AWS API when the company needs to fail over to the S3 bucket in the other Region.

Reveal answer & explanation

Correct answer: A, B, C

The correct answer is A, B, C. Option A: Enable S3 Replication Time Control (S3 RTC) on each replication rule. Option B: Create an S3 Multi-Region Access Point in an active-passive configuration. Option C: Call the SubmitMultiRegionAccessPointRoutes operation in the AWS API when the company needs to fail over to the S3 bucket in the other Region.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 273

Single page →

Topic 1 · Question 273 · Select all that apply

A company uses the AWS Cloud Development Kit (AWS CDK) to define its application. The company uses a pipeline that consists of AWS CodePipeline and AWS CodeBuild to deploy the CDK application. The company wants to introduce unit tests to the pipeline to test various infrastructure components. The company wants to ensure that a deployment proceeds if no unit tests result in a failure. Which combination of steps will enforce the testing requirement in the pipeline? (Choose two.)

AUpdate the CodeBuild build phase commands to run the tests then to deploy the application. Set the OnFailure phase property to ABORT. (correct answer)
BUpdate the CodeBuild build phase commands to run the tests then to deploy the application. Add the --rollback true flag to the cdk deploy command.
CUpdate the CodeBuild build phase commands to run the tests then to deploy the application. Add the --require-approval any-change flag to the cdk deploy command.
DCreate a test that uses the AWS CDK assertions module. Use the template.hasResourceProperties assertion to test that resources have the expected properties. (correct answer)
ECreate a test that uses the cdk diff command. Configure the test to fail if any resources have changed.

Reveal answer & explanation

Correct answer: A, D

The correct answer is A, D. Option A: Update the CodeBuild build phase commands to run the tests then to deploy the application. Set the OnFailure phase property to ABORT. Option D: Create a test that uses the AWS CDK assertions module. Use the template.hasResourceProperties assertion to test that resources have the expected properties.

Explanation

The AWS CDK defines cloud infrastructure as code using familiar programming languages. AWS CodeBuild compiles, tests and packages code in a managed build service.

DOP-C02 Question 274

Single page →

Topic 1 · Question 274

A company has an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are in multiple Availability Zones. The application was misconfigured in a single Availability Zone, which caused a partial outage of the application. A DevOps engineer made changes to ensure that the unhealthy EC2 instances in one Availability Zone do not affect the healthy EC2 instances in the other Availability Zones. The DevOps engineer needs to test the application's failover and shift where the ALB sends traffic. During failover, the ALB must avoid sending traffic to the Availability Zone where the failure has occurred. Which solution will meet these requirements?

ATurn off cross-zone load balancing on the ALB. Use Amazon Route 53 Application Recovery Controller to start a zonal shift away from the Availability Zone. (correct answer)
BTurn off cross-zone load balancing on the ALB’s target group. Use Amazon Route 53 Application Recovery Controller to start a zonal shift away from the Availability Zone.
CCreate an Amazon Route 53 Application Recovery Controller resource set that uses the DNS hostname of the ALB. Start a zonal shift for the resource set away from the Availability Zone.
DCreate an Amazon Route 53 Application Recovery Controller resource set that uses the ARN of the ALB’s target group. Create a readiness check that uses the ElbV2TargetGroupsCanServeTraffic rule.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Turn off cross-zone load balancing on the ALB. Use Amazon Route 53 Application Recovery Controller to start a zonal shift away from the Availability Zone.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

DOP-C02 Question 275

Single page →

Topic 1 · Question 275

A company sends its AWS Network Firewall flow logs to an Amazon S3 bucket. The company then analyzes the flow logs by using Amazon Athena. The company needs to transform the flow logs and add additional data before the flow logs are delivered to the existing S3 bucket. Which solution will meet these requirements?

ACreate an AWS Lambda function to transform the data and to write a new object to the existing S3 bucket. Configure the Lambda function with an S3 trigger for the existing S3 bucket. Specify all object create events for the event type. Acknowledge the recursive invocation.
BEnable Amazon EventBridge notifications on the existing S3 bucket. Create a custom EventBridge event bus. Create an EventBridge rule that is associated with the custom event bus. Configure the rule to react to all object create events for the existing S3 bucket and to invoke an AWS Step Functions workflow. Configure a Step Functions task to transform the data and to write the data into a new S3 bucket.
CCreate an Amazon EventBridge rule that is associated with the default EventBridge event bus. Configure the rule to react to all object create events for the existing S3 bucket. Define a new S3 bucket as the target for the rule. Create an EventBridge input transformation to customize the event before passing the event to the rule target.
DCreate an Amazon Kinesis Data Firehose delivery stream that is configured with an AWS Lambda transformer. Specify the existing S3 bucket as the destination. Change the Network Firewall logging destination from Amazon S3 to Kinesis Data Firehose. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Create an Amazon Kinesis Data Firehose delivery stream that is configured with an AWS Lambda transformer. Specify the existing S3 bucket as the destination. Change the Network Firewall logging destination from Amazon...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. Kinesis Data Firehose delivers streaming data to destinations like S3/Redshift with no servers to manage.

DOP-C02 Question 276

Single page →

Topic 1 · Question 276 · Select all that apply

A DevOps engineer needs to implement integration tests into an existing AWS CodePipeline CI/CD workflow for an Amazon Elastic Container Service (Amazon ECS) service. The CI/CD workflow retrieves new application code from an AWS CodeCommit repository and builds a container image. The Cl/CD workflow then uploads the container image to Amazon Elastic Container Registry (Amazon ECR) with a new image tag version. The integration tests must ensure that new versions of the service endpoint are reachable and that various API methods return successful response data. The DevOps engineer has already created an ECS cluster to test the service. Which combination of steps will meet these requirements with the LEAST management overhead? (Choose three.)

AAdd a deploy stage to the pipeline. Configure Amazon ECS as the action provider. (correct answer)
BAdd a deploy stage to the pipeline. Configure AWS CodeDeploy as the action provider.
CAdd an appspec.yml file to the CodeCommit repository.
DUpdate the image build pipeline stage to output an imagedefinitions.json file that references the new image tag. (correct answer)
ECreate an AWS Lambda function that runs connectivity checks and API calls against the service. Integrate the Lambda function with CodePipeline by using a Lambda action stage. (correct answer)
FWrite a script that runs integration tests against the service. Upload the script to an Amazon S3 bucket. Integrate the script in the S3 bucket with CodePipeline by using an S3 action stage.

Reveal answer & explanation

Correct answer: A, D, E

The correct answer is A, D, E. Option A: Add a deploy stage to the pipeline. Configure Amazon ECS as the action provider. Option D: Update the image build pipeline stage to output an imagedefinitions.json file that references the new image tag. Option E: Create an AWS Lambda function that runs connectivity checks and API calls against the service. Integrate the Lambda function with CodePipeline by using a Lambda action stage.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon ECS orchestrates containers and integrates natively with AWS networking and IAM. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 277

Single page →

Topic 1 · Question 277 · Select all that apply

A company runs applications on Windows and Linux Amazon EC2 instances. The instances run across multiple Availability Zones in an AWS Region. The company uses Auto Scaling groups for each application. The company needs a durable storage solution for the instances. The solution must use SMB for Windows and must use NFS for Linux. The solution must also have sub-millisecond latencies. All instances will read and write the data. Which combination of steps will meet these requirements? (Choose three.)

ACreate an Amazon Elastic File System (Amazon EFS) file system that has targets in multiple Availability Zones.
BCreate an Amazon FSx for NetApp ONTAP Multi-AZ file system. (correct answer)
CCreate a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume to use for shared storage.
DUpdate the user data for each application’s launch template to mount the file system. (correct answer)
EPerform an instance refresh on each Auto Scaling group. (correct answer)
FUpdate the EC2 instances for each application to mount the file system when new instances are launched.

Reveal answer & explanation

Correct answer: B, D, E

The correct answer is B, D, E. Option B: Create an Amazon FSx for NetApp ONTAP Multi-AZ file system. Option D: Update the user data for each application’s launch template to mount the file system. Option E: Perform an instance refresh on each Auto Scaling group.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon FSx provides fully managed third-party file systems. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

DOP-C02 Question 278

Single page →

Topic 1 · Question 278

A company uses an organization in AWS Organizations that a security team and a DevOps team manage. Both teams access the accounts by using AWS IAM Identity Center. A dedicated group has been created for each team. The DevOps team's group has been assigned a permission set named DevOps. The permission set has the AdministratorAccess managed IAM policy attached. The permission set has been applied to all accounts in the organization. The security team wants to ensure that the DevOps team does not have access to IAM Identity Center in the organization's management account. The security team has attached the following SCP to the organization root: After implementing the policy, the security team discovers that the DevOps team can still access IAM Identity Center. Which solution will fix the problem?

AIn the organization's management account, create a new OU. Move the organization's management account to the new OU. Detach the SCP from the organization root. Attach the SCP to the new OU.
BIn the organization's management account, update the SCP condition reference to the ARN of the DevOps team's group role to include the AWS account ID of the organization's management account.
CIn IAM Identity Center, create a new permission set. Ensure that the assigned policy has full access but explicitly denies permission for the sso:* action and the sso-directory:* action. Update the assigned permission set for the DevOps team's group role in the organization's management account. Delete the SCP.
DIn IAM Identity Center, update the DevOps permission set. Ensure that the assigned policy has full access but explicitly denies permission for the sso:* action and the sso-directory:* action. In the Deny statement, add a StringEquals condition that compares the aws:SourceAccount global condition context key with the organization's management account IDelete the SCP. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: In IAM Identity Center, update the DevOps permission set. Ensure that the assigned policy has full access but explicitly denies permission for the sso:* action and the sso-directory:* action. In the Deny statement, ad...

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Service Control Policies set guardrails on what accounts in an organization can do. AWS IAM Identity Center (SSO) centrally manages workforce access to multiple accounts and apps.

DOP-C02 Question 279

Single page →

Topic 1 · Question 279

An Amazon EC2 Auto Scaling group manages EC2 instances that were created from an AMI. The AMI has the AWS Systems Manager Agent installed. When an EC2 instance is launched into the Auto Scaling group, tags are applied to the EC2 instance. EC2 instances that are launched by the Auto Scaling group must have the correct operating system configuration. Which solution will meet these requirements?

ACreate a Systems Manager Run Command document that configures the desired instance configuration. Set up Systems Manager Compliance to invoke the Run Command document when the EC2 instances are not in compliance with the most recent patches.
BCreate a Systems Manager State Manager association that links to the Systems Manager command document. Create a tag query that runs immediately. (correct answer)
CCreate a Systems Manager Run Command task that specifies the desired instance configuration. Create a maintenance window in Systems Manager Maintenance Windows that runs daily. Register the Run Command task against the maintenance window. Designate the targets.
DCreate a Systems Manager Patch Manager patch baseline and a patch group that use the same tags that the Auto Scaling group applies. Register the patch group with the patch baseline. Define a Systems Manager command document to patch the instances Invoke the document by using Systems Manager Run Command.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Create a Systems Manager State Manager association that links to the Systems Manager command document. Create a tag query that runs immediately.

Explanation

AWS Systems Manager operates and automates management of fleets of resources.

DOP-C02 Question 280

Single page →

Topic 1 · Question 280

A company uses AWS Organizations to manage its AWS accounts. The organization root has a child OU that is named Department. The Department OU has a child OU that is named Engineering. The default FullAWSAccess policy is attached to the root, the Department OU, and the Engineering OU. The company has many AWS accounts in the Engineering OU. Each account has an administrative IAM role with the AdministratorAccess IAM policy attached. The default FullAWSAccessPolicy is also attached to each account. A DevOps engineer plans to remove the FullAWSAccess policy from the Department OU. The DevOps engineer will replace the policy with a policy that contains an Allow statement for all Amazon EC2 API operations. What will happen to the permissions of the administrative 1AM roles as a result of this change?

AAll API actions on all resources will be allowed.
BAll API actions on EC2 resources will be allowed. All other API actions will be denied. (correct answer)
CAll API actions on all resources will be denied.
DAll API actions on EC2 resources will be denied. All other API actions will be allowed.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: All API actions on EC2 resources will be allowed. All other API actions will be denied.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

Showing questions 261–280 of 431 · Page 14 of 22