DOP-C02 — questions

Page 2 of 22 · 431 total questions.

DOP-C02 Question 21

Topic 1 · Question 21

A company has containerized all of its in-house quality control applications. The company is running Jenkins on Amazon EC2 instances, which require patching and upgrading. The compliance officer has requested a DevOps engineer begin encrypting build artifacts since they contain company intellectual property. What should the DevOps engineer do to accomplish this in the MOST maintainable manner?

AAutomate patching and upgrading using AWS Systems Manager on EC2 instances and encrypt Amazon EBS volumes by default.
BDeploy Jenkins to an Amazon ECS cluster and copy build artifacts to an Amazon S3 bucket with default encryption enabled.
CLeverage AWS CodePipeline with a build action and encrypt the artifacts using AWS Secrets Manager.
DUse AWS CodeBuild with artifact encryption to replace the Jenkins instance running on EC2 instances. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Use AWS CodeBuild with artifact encryption to replace the Jenkins instance running on EC2 instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS CodeBuild compiles, tests and packages code in a managed build service.

DOP-C02 Question 22

Single page →

Topic 1 · Question 22

An IT team has built an AWS CloudFormation template so others in the company can quickly and reliably deploy and terminate an application. The template creates an Amazon EC2 instance with a user data script to install the application and an Amazon S3 bucket that the application uses to serve static webpages while it is running. All resources should be removed when the CloudFormation stack is deleted. However, the team observes that CloudFormation reports an error during stack deletion, and the S3 bucket created by the stack is not deleted. How can the team resolve the error in the MOST efficient manner to ensure that all resources are deleted without errors?

AAdd a DelelionPolicy attribute to the S3 bucket resource, with the value Delete forcing the bucket to be removed when the stack is deleted.
BAdd a custom resource with an AWS Lambda function with the DependsOn attribute specifying the S3 bucket, and an IAM role. Write the Lambda function to delete all objects from the bucket when RequestType is Delete. (correct answer)
CIdentify the resource that was not deleted. Manually empty the S3 bucket and then delete it.
DReplace the EC2 and S3 bucket resources with a single AWS OpsWorks Stacks resource. Define a custom recipe for the stack to create and delete the EC2 instance and the S3 bucket.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Add a custom resource with an AWS Lambda function with the DependsOn attribute specifying the S3 bucket, and an IAM role. Write the Lambda function to delete all objects from the bucket when RequestType is Delete.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials.

DOP-C02 Question 23

Single page →

Topic 1 · Question 23 · Select all that apply

A company has an AWS CodePipeline pipeline that is configured with an Amazon S3 bucket in the eu-west-1 Region. The pipeline deploys an AWS Lambda application to the same Region. The pipeline consists of an AWS CodeBuild project build action and an AWS CloudFormation deploy action. The CodeBuild project uses the aws cloudformation package AWS CLI command to build an artifact that contains the Lambda function code’s .zip file and the CloudFormation template. The CloudFormation deploy action references the CloudFormation template from the output artifact of the CodeBuild project’s build action. The company wants to also deploy the Lambda application to the us-east-1 Region by using the pipeline in eu-west-1. A DevOps engineer has already updated the CodeBuild project to use the aws cloudformation package command to produce an additional output artifact for us-east-1. Which combination of additional steps should the DevOps engineer take to meet these requirements? (Choose two.)

AModify the CloudFormation template to include a parameter for the Lambda function code’s zip file location. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to pass in the us-east-1 artifact location as a parameter override.
BCreate a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the us-east-1 output artifact.
CCreate an S3 bucket in us-east-1. Configure the S3 bucket policy to allow CodePipeline to have read and write access. (correct answer)
DCreate an S3 bucket in us-east-1. Configure S3 Cross-Region Replication (CRR) from the S3 bucket in eu-west-1 to the S3 bucket in us-east-1.
EModify the pipeline to include the S3 bucket for us-east-1 as an artifact store. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation template from the us-east-1 output artifact. (correct answer)

Reveal answer & explanation

Correct answer: C, E

The correct answer is C, E. Option C: Create an S3 bucket in us-east-1. Configure the S3 bucket policy to allow CodePipeline to have read and write access. Option E: Modify the pipeline to include the S3 bucket for us-east-1 as an artifact store. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use the CloudFormation templ...

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance. AWS CloudFormation provisions infrastructure as code repeatably.

DOP-C02 Question 24

Single page →

Topic 1 · Question 24

A company runs an application on one Amazon EC2 instance. Application metadata is stored in Amazon S3 and must be retrieved if the instance is restarted. The instance must restart or relaunch automatically if the instance becomes unresponsive. Which solution will meet these requirements?

ACreate an Amazon CloudWatch alarm for the StatusCheckFailed metric. Use the recover action to stop and start the instance. Use an S3 event notification to push the metadata to the instance when the instance is back up and running.
BConfigure AWS OpsWorks, and use the auto healing feature to stop and start the instance. Use a lifecycle event in OpsWorks to pull the metadata from Amazon S3 and update it on the instance. (correct answer)
CUse EC2 Auto Recovery to automatically stop and start the instance in case of a failure. Use an S3 event notification to push the metadata to the instance when the instance is back up and running.
DUse AWS CloudFormation to create an EC2 instance that includes the UserData property for the EC2 resource. Add a command in UserData to retrieve the application metadata from Amazon S3.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Configure AWS OpsWorks, and use the auto healing feature to stop and start the instance. Use a lifecycle event in OpsWorks to pull the metadata from Amazon S3 and update it on the instance.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 25

Single page →

Topic 1 · Question 25

A company has multiple AWS accounts. The company uses AWS IAM Identity Center (AWS Single Sign-On) that is integrated with AWS Toolkit for Microsoft Azure DevOps. The attributes for access control feature is enabled in IAM Identity Center.

The attribute mapping list contains two entries. The department key is mapped to ${path:enterprise.department}. The costCenter key is mapped to ${path:enterprise.costCenter}.

All existing Amazon EC2 instances have a department tag that corresponds to three company departments (d1, d2, d3). A DevOps engineer must create policies based on the matching attributes. The policies must minimize administrative effort and must grant each Azure AD user access to only the EC2 instances that are tagged with the user’s respective department name.

Which condition key should the DevOps engineer include in the custom permissions policies to meet these requirements?

A
B
C (correct answer)
D

Reveal answer & explanation

Correct answer: C

The correct answer is C. Compare the policy/code shown in each option image.

DOP-C02 Question 26

Single page →

Topic 1 · Question 26

A company hosts a security auditing application in an AWS account. The auditing application uses an IAM role to access other AWS accounts. All the accounts are in the same organization in AWS Organizations. A recent security audit revealed that users in the audited AWS accounts could modify or delete the auditing application's IAM role. The company needs to prevent any modification to the auditing application's IAM role by any entity other than a trusted administrator IAM role. Which solution will meet these requirements?

ACreate an SCP that includes a Deny statement for changes to the auditing application's IAM role. Include a condition that allows the trusted administrator IAM role to make changes. Attach the SCP to the root of the organization. (correct answer)
BCreate an SCP that includes an Allow statement for changes to the auditing application's IAM role by the trusted administrator IAM role. Include a Deny statement for changes by all other IAM principals. Attach the SCP to the IAM service in each AWS account where the auditing application has an IAM role.
CCreate an IAM permissions boundary that includes a Deny statement for changes to the auditing application's IAM role. Include a condition that allows the trusted administrator IAM role to make changes. Attach the permissions boundary to the audited AWS accounts.
DCreate an IAM permissions boundary that includes a Deny statement for changes to the auditing application’s IAM role. Include a condition that allows the trusted administrator IAM role to make changes. Attach the permissions boundary to the auditing application's IAM role in the AWS accounts.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Create an SCP that includes a Deny statement for changes to the auditing application's IAM role. Include a condition that allows the trusted administrator IAM role to make changes. Attach the SCP to the root of the or...

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Service Control Policies set guardrails on what accounts in an organization can do.

DOP-C02 Question 27

Single page →

Topic 1 · Question 27

A company has an on-premises application that is written in Go. A DevOps engineer must move the application to AWS. The company's development team wants to enable blue/green deployments and perform A/B testing. Which solution will meet these requirements?

ADeploy the application on an Amazon EC2 instance, and create an AMI of the instance. Use the AMI to create an automatic scaling launch configuration that is used in an Auto Scaling group. Use Elastic Load Balancing to distribute traffic. When changes are made to the application, a new AMI will be created, which will initiate an EC2 instance refresh.
BUse Amazon Lightsail to deploy the application. Store the application in a zipped format in an Amazon S3 bucket. Use this zipped version to deploy new versions of the application to Lightsail. Use Lightsail deployment options to manage the deployment.
CUse AWS CodeArtifact to store the application code. Use AWS CodeDeploy to deploy the application to a fleet of Amazon EC2 instances. Use Elastic Load Balancing to distribute the traffic to the EC2 instances. When making changes to the application, upload a new version to CodeArtifact and create a new CodeDeploy deployment.
DUse AWS Elastic Beanstalk to host the application. Store a zipped version of the application in Amazon S3. Use that location to deploy new versions of the application. Use Elastic Beanstalk to manage the deployment options. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Use AWS Elastic Beanstalk to host the application. Store a zipped version of the application in Amazon S3. Use that location to deploy new versions of the application. Use Elastic Beanstalk to manage the deployment op...

Explanation

AWS Elastic Beanstalk provisions and manages the underlying environment for you with little operational effort. Amazon S3 provides durable, scalable object storage that is fully managed.

DOP-C02 Question 28

Single page →

Topic 1 · Question 28

A developer is maintaining a fleet of 50 Amazon EC2 Linux servers. The servers are part of an Amazon EC2 Auto Scaling group, and also use Elastic Load Balancing for load balancing. Occasionally, some application servers are being terminated after failing ELB HTTP health checks. The developer would like to perform a root cause analysis on the issue, but before being able to access application logs, the server is terminated. How can log collection be automated?

AUse Auto Scaling lifecycle hooks to put instances in a Pending:Wait state. Create an Amazon CloudWatch alarm for EC2 Instance Terminate Successful and trigger an AWS Lambda function that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.
BUse Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an AWS Config rule for EC2 Instance-terminate Lifecycle Action and trigger a step function that invokes a script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.
CUse Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon CloudWatch subscription filter for EC2 Instance Terminate Successful and trigger a CloudWatch agent that invokes a script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.
DUse Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon EventBridge rule for EC2 Instance-terminate Lifecycle Action and trigger an AWS Lambda function that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon EventBridge rule for EC2 Instance-terminate Lifecycle Action and trigger an AWS Lambda function that invokes an SSM Run C...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

DOP-C02 Question 29

Single page →

Topic 1 · Question 29 · Select all that apply

A company has an organization in AWS Organizations. The organization includes workload accounts that contain enterprise applications. The company centrally manages users from an operations account. No users can be created in the workload accounts. The company recently added an operations team and must provide the operations team members with administrator access to each workload account. Which combination of actions will provide this access? (Choose three.)

ACreate a SysAdmin role in the operations account. Attach the AdministratorAccess policy to the role. Modify the trust relationship to allow the sts:AssumeRole action from the workload accounts.
BCreate a SysAdmin role in each workload account. Attach the AdministratorAccess policy to the role. Modify the trust relationship to allow the sts:AssumeRole action from the operations account. (correct answer)
CCreate an Amazon Cognito identity pool in the operations account. Attach the SysAdmin role as an authenticated role.
DIn the operations account, create an IAM user for each operations team member. (correct answer)
EIn the operations account, create an IAM user group that is named SysAdmins. Add an IAM policy that allows the sts:AssumeRole action for the SysAdmin role in each workload account. Add all operations team members to the group. (correct answer)
FCreate an Amazon Cognito user pool in the operations account. Create an Amazon Cognito user for each operations team member.

Reveal answer & explanation

Correct answer: B, D, E

The correct answer is B, D, E. Option B: Create a SysAdmin role in each workload account. Attach the AdministratorAccess policy to the role. Modify the trust relationship to allow the sts:AssumeRole action from the operations account. Option D: In the operations account, create an IAM user for each operations team member. Option E: In the operations account, create an IAM user group that is named SysAdmins. Add an IAM policy that allows the sts:AssumeRole action for the SysAdmin role in each workload account. Add all operations team members to t...

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

DOP-C02 Question 30

Single page →

Topic 1 · Question 30

A company has multiple accounts in an organization in AWS Organizations. The company's SecOps team needs to receive an Amazon Simple Notification Service (Amazon SNS) notification if any account in the organization turns off the Block Public Access feature on an Amazon S3 bucket. A DevOps engineer must implement this change without affecting the operation of any AWS accounts. The implementation must ensure that individual member accounts in the organization cannot turn off the notification. Which solution will meet these requirements?

ADesignate an account to be the delegated Amazon GuardDuty administrator account. Turn on GuardDuty for all accounts across the organization. In the GuardDuty administrator account, create an SNS topic. Subscribe the SecOps team's email address to the SNS topic. In the same account, create an Amazon EventBridge rule that uses an event pattern for GuardDuty findings and a target of the SNS topic.
BCreate an AWS CloudFormation template that creates an SNS topic and subscribes the SecOps team’s email address to the SNS topic. In the template, include an Amazon EventBridge rule that uses an event pattern of CloudTrail activity for s3:PutBucketPublicAccessBlock and a target of the SNS topic. Deploy the stack to every account in the organization by using CloudFormation StackSets.
CTurn on AWS Config across the organization. In the delegated administrator account, create an SNS topic. Subscribe the SecOps team's email address to the SNS topic. Deploy a conformance pack that uses the s3-bucket-level-public-access-prohibited AWS Config managed rule in each account and uses an AWS Systems Manager document to publish an event to the SNS topic to notify the SecOps team. (correct answer)
DTurn on Amazon Inspector across the organization. In the Amazon Inspector delegated administrator account, create an SNS topic. Subscribe the SecOps team’s email address to the SNS topic. In the same account, create an Amazon EventBridge rule that uses an event pattern for public network exposure of the S3 bucket and publishes an event to the SNS topic to notify the SecOps team.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Turn on AWS Config across the organization. In the delegated administrator account, create an SNS topic. Subscribe the SecOps team's email address to the SNS topic. Deploy a conformance pack that uses the s3-bucket-le...

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 31

Single page →

Topic 1 · Question 31

A company has migrated its container-based applications to Amazon EKS and want to establish automated email notifications. The notifications sent to each email address are for specific activities related to EKS components. The solution will include Amazon SNS topics and an AWS Lambda function to evaluate incoming log events and publish messages to the correct SNS topic. Which logging solution will support these requirements?

AEnable Amazon CloudWatch Logs to log the EKS components. Create a CloudWatch subscription filter for each component with Lambda as the subscription feed destination. (correct answer)
BEnable Amazon CloudWatch Logs to log the EKS components. Create CloudWatch Logs Insights queries linked to Amazon EventBridge events that invoke Lambda.
CEnable Amazon S3 logging for the EKS components. Configure an Amazon CloudWatch subscription filter for each component with Lambda as the subscription feed destination.
DEnable Amazon S3 logging for the EKS components. Configure S3 PUT Object event notifications with AWS Lambda as the destination.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Enable Amazon CloudWatch Logs to log the EKS components. Create a CloudWatch subscription filter for each component with Lambda as the subscription feed destination.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EKS runs managed Kubernetes when you need the Kubernetes ecosystem. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

DOP-C02 Question 32

Single page →

Topic 1 · Question 32 · Select all that apply

A company is implementing an Amazon Elastic Container Service (Amazon ECS) cluster to run its workload. The company architecture will run multiple ECS services on the cluster. The architecture includes an Application Load Balancer on the front end and uses multiple target groups to route traffic. A DevOps engineer must collect application and access logs. The DevOps engineer then needs to send the logs to an Amazon S3 bucket for near-real-time analysis. Which combination of steps must the DevOps engineer take to meet these requirements? (Choose three.)

ADownload the Amazon CloudWatch Logs container instance from AWS. Configure this instance as a task. Update the application service definitions to include the logging task.
BInstall the Amazon CloudWatch Logs agent on the ECS instances. Change the logging driver in the ECS task definition to awslogs. (correct answer)
CUse Amazon EventBridge to schedule an AWS Lambda function that will run every 60 seconds and will run the Amazon CloudWatch Logs create-export-task command. Then point the output to the logging S3 bucket.
DActivate access logging on the ALB. Then point the ALB directly to the logging S3 bucket. (correct answer)
EActivate access logging on the target groups that the ECS services use. Then send the logs directly to the logging S3 bucket.
FCreate an Amazon Kinesis Data Firehose delivery stream that has a destination of the logging S3 bucket. Then create an Amazon CloudWatch Logs subscription filter for Kinesis Data Firehose. (correct answer)

Reveal answer & explanation

Correct answer: B, D, F

The correct answer is B, D, F. Option B: Install the Amazon CloudWatch Logs agent on the ECS instances. Change the logging driver in the ECS task definition to awslogs. Option D: Activate access logging on the ALB. Then point the ALB directly to the logging S3 bucket. Option F: Create an Amazon Kinesis Data Firehose delivery stream that has a destination of the logging S3 bucket. Then create an Amazon CloudWatch Logs subscription filter for Kinesis Data Firehose.

Explanation

Amazon ECS orchestrates containers and integrates natively with AWS networking and IAM. Amazon S3 provides durable, scalable object storage that is fully managed. Kinesis Data Firehose delivers streaming data to destinations like S3/Redshift with no servers to manage. This option meets the real-time / low-latency performance requirement.

DOP-C02 Question 33

Single page →

Topic 1 · Question 33

A company that uses electronic health records is running a fleet of Amazon EC2 instances with an Amazon Linux operating system. As part of patient privacy requirements, the company must ensure continuous compliance for patches for operating system and applications running on the EC2 instances. How can the deployments of the operating system and application patches be automated using a default and custom repository?

AUse AWS Systems Manager to create a new patch baseline including the custom repository. Run the AWS-RunPatchBaseline document using the run command to verify and install patches. (correct answer)
BUse AWS Direct Connect to integrate the corporate repository and deploy the patches using Amazon CloudWatch scheduled events, then use the CloudWatch dashboard to create reports.
CUse yum-config-manager to add the custom repository under /etc/yum.repos.d and run yum-config-manager-enable to activate the repository.
DUse AWS Systems Manager to create a new patch baseline including the corporate repository. Run the AWS-AmazonLinuxDefaultPatchBaseline document using the run command to verify and install patches.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Use AWS Systems Manager to create a new patch baseline including the custom repository. Run the AWS-RunPatchBaseline document using the run command to verify and install patches.

Explanation

AWS Systems Manager operates and automates management of fleets of resources.

DOP-C02 Question 34

Single page →

Topic 1 · Question 34

A company is using AWS CodePipeline to automate its release pipeline. AWS CodeDeploy is being used in the pipeline to deploy an application to Amazon Elastic Container Service (Amazon ECS) using the blue/green deployment model. The company wants to implement scripts to test the green version of the application before shifting traffic. These scripts will complete in 5 minutes or less. If errors are discovered during these tests, the application must be rolled back. Which strategy will meet these requirements?

AAdd a stage to the CodePipeline pipeline between the source and deploy stages. Use AWS CodeBuild to create a runtime environment and build commands in the buildspec file to invoke test scripts. If errors are found, use the aws deploy stop-deployment command to stop the deployment.
BAdd a stage to the CodePipeline pipeline between the source and deploy stages. Use this stage to invoke an AWS Lambda function that will run the test scripts. If errors are found, use the aws deploy stop-deployment command to stop the deployment.
CAdd a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTestTraffic lifecycle event to invoke an AWS Lambda function to run the test scripts. If errors are found, exit the Lambda function with an error to initiate rollback. (correct answer)
DAdd a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTraffic lifecycle event to invoke the test scripts. If errors are found, use the aws deploy stop-deployment CLI command to stop the deployment.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Add a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTestTraffic lifecycle event to invoke an AWS Lambda function to run the test scripts. If errors are found, exit the Lambda function with an error t...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS CodeDeploy automates application deployments to compute services.

DOP-C02 Question 35

Single page →

Topic 1 · Question 35

A company uses AWS Storage Gateway in file gateway mode in front of an Amazon S3 bucket that is used by multiple resources. In the morning when business begins, users do not see the objects processed by a third party the previous evening. When a DevOps engineer looks directly at the S3 bucket, the data is there, but it is missing in Storage Gateway. Which solution ensures that all the updated third-party files are available in the morning?

AConfigure a nightly Amazon EventBridge event to invoke an AWS Lambda function to run the RefreshCache command for Storage Gateway. (correct answer)
BInstruct the third party to put data into the S3 bucket using AWS Transfer for SFTP.
CModify Storage Gateway to run in volume gateway mode.
DUse S3 Same-Region Replication to replicate any changes made directly in the S3 bucket to Storage Gateway.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Configure a nightly Amazon EventBridge event to invoke an AWS Lambda function to run the RefreshCache command for Storage Gateway.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS Storage Gateway bridges on-premises apps to AWS storage with local caching. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

DOP-C02 Question 36

Single page →

Topic 1 · Question 36 · Select all that apply

A DevOps engineer needs to back up sensitive Amazon S3 objects that are stored within an S3 bucket with a private bucket policy using S3 cross-Region replication functionality. The objects need to be copied to a target bucket in a different AWS Region and account. Which combination of actions should be performed to enable this replication? (Choose three.)

ACreate a replication IAM role in the source account (correct answer)
BCreate a replication I AM role in the target account.
CAdd statements to the source bucket policy allowing the replication IAM role to replicate objects.
DAdd statements to the target bucket policy allowing the replication IAM role to replicate objects. (correct answer)
ECreate a replication rule in the source bucket to enable the replication. (correct answer)
FCreate a replication rule in the target bucket to enable the replication.

Reveal answer & explanation

Correct answer: A, D, E

The correct answer is A, D, E. Option A: Create a replication IAM role in the source account Option D: Add statements to the target bucket policy allowing the replication IAM role to replicate objects. Option E: Create a replication rule in the source bucket to enable the replication.

Explanation

DOP-C02 Question 37

Single page →

Topic 1 · Question 37 · Select all that apply

A company has multiple member accounts that are part of an organization in AWS Organizations. The security team needs to review every Amazon EC2 security group and their inbound and outbound rules. The security team wants to programmatically retrieve this information from the member accounts using an AWS Lambda function in the management account of the organization. Which combination of access changes will meet these requirements? (Choose three.)

ACreate a trust relationship that allows users in the member accounts to assume the management account IAM role.
BCreate a trust relationship that allows users in the management account to assume the IAM roles of the member accounts. (correct answer)
CCreate an IAM role in each member account that has access to the AmazonEC2ReadOnlyAccess managed policy. (correct answer)
DCreate an I AM role in each member account to allow the sts:AssumeRole action against the management account IAM role's ARN.
ECreate an I AM role in the management account that allows the sts:AssumeRole action against the member account IAM role's ARN. (correct answer)
FCreate an IAM role in the management account that has access to the AmazonEC2ReadOnlyAccess managed policy.

Reveal answer & explanation

Correct answer: B, C, E

The correct answer is B, C, E. Option B: Create a trust relationship that allows users in the management account to assume the IAM roles of the member accounts. Option C: Create an IAM role in each member account that has access to the AmazonEC2ReadOnlyAccess managed policy. Option E: Create an I AM role in the management account that allows the sts:AssumeRole action against the member account IAM role's ARN.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

DOP-C02 Question 38

Single page →

Topic 1 · Question 38

A space exploration company receives telemetry data from multiple satellites. Small packets of data are received through Amazon API Gateway and are placed directly into an Amazon Simple Queue Service (Amazon SQS) standard queue. A custom application is subscribed to the queue and transforms the data into a standard format. Because of inconsistencies in the data that the satellites produce, the application is occasionally unable to transform the data. In these cases, the messages remain in the SQS queue. A DevOps engineer must develop a solution that retains the failed messages and makes them available to scientists for review and future processing. Which solution will meet these requirements?

AConfigure AWS Lambda to poll the SQS queue and invoke a Lambda function to check whether the queue messages are valid. If validation fails, send a copy of the data that is not valid to an Amazon S3 bucket so that the scientists can review and correct the data. When the data is corrected, amend the message in the SQS queue by using a replay Lambda function with the corrected data.
BConvert the SQS standard queue to an SQS FIFO queue. Configure AWS Lambda to poll the SQS queue every 10 minutes by using an Amazon EventBridge schedule. Invoke the Lambda function to identify any messages with a SentTimestamp value that is older than 5 minutes, push the data to the same location as the application's output location, and remove the messages from the queue.
CCreate an SQS dead-letter queue. Modify the existing queue by including a redrive policy that sets the Maximum Receives setting to 1 and sets the dead-letter queue ARN to the ARN of the newly created queue. Instruct the scientists to use the dead-letter queue to review the data that is not valid. Reprocess this data at a later time. (correct answer)
DConfigure API Gateway to send messages to different SQS virtual queues that are named for each of the satellites. Update the application to use a new virtual queue for any data that it cannot transform, and send the message to the new virtual queue. Instruct the scientists to use the virtual queue to review the data that is not valid. Reprocess this data at a later time.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create an SQS dead-letter queue. Modify the existing queue by including a redrive policy that sets the Maximum Receives setting to 1 and sets the dead-letter queue ARN to the ARN of the newly created queue. Instruct t...

Explanation

Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes.

DOP-C02 Question 39

Single page →

Topic 1 · Question 39

A company wants to use AWS CloudFormation for infrastructure deployment. The company has strict tagging and resource requirements and wants to limit the deployment to two Regions. Developers will need to deploy multiple versions of the same application. Which solution ensures resources are deployed in accordance with company policy?

ACreate AWS Trusted Advisor checks to find and remediate unapproved CloudFormation StackSets.
BCreate a Cloud Formation drift detection operation to find and remediate unapproved CloudFormation StackSets.
CCreate CloudFormation StackSets with approved CloudFormation templates.
DCreate AWS Service Catalog products with approved CloudFormation templates. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Create AWS Service Catalog products with approved CloudFormation templates.

Explanation

AWS CloudFormation provisions infrastructure as code repeatably.

DOP-C02 Question 40

Single page →

Topic 1 · Question 40 · Select all that apply

A company requires that its internally facing web application be highly available. The architecture is made up of one Amazon EC2 web server instance and one NAT instance that provides outbound internet access for updates and accessing public data. Which combination of architecture adjustments should the company implement to achieve high availability? (Choose two.)

AAdd the NAT instance to an EC2 Auto Scaling group that spans multiple Availability Zones. Update the route tables.
BCreate additional EC2 instances spanning multiple Availability Zones. Add an Application Load Balancer to split the load between them. (correct answer)
CConfigure an Application Load Balancer in front of the EC2 instance. Configure Amazon CloudWatch alarms to recover the EC2 instance upon host failure.
DReplace the NAT instance with a NAT gateway in each Availability Zone. Update the route tables. (correct answer)
EReplace the NAT instance with a NAT gateway that spans multiple Availability Zones. Update the route tables.

Reveal answer & explanation

Correct answer: B, D

The correct answer is B, D. Option B: Create additional EC2 instances spanning multiple Availability Zones. Add an Application Load Balancer to split the load between them. Option D: Replace the NAT instance with a NAT gateway in each Availability Zone. Update the route tables.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Showing questions 21–40 of 431 · Page 2 of 22