🔍

DOP-C02 — questions

Page 9 of 22 · 431 total questions.

DOP-C02 Question 161

Single page →
Topic 1 · Question 161

A company hired a penetration tester to simulate an internal security breach. The tester performed port scans on the company's Amazon EC2 instances. The company's security measures did not detect the port scans. The company needs a solution that automatically provides notification when port scans are performed on EC2 instances. The company creates and subscribes to an Amazon Simple Notification Service (Amazon SNS) topic. What should the company do next to meet the requirement?

  • AEnsure that Amazon GuardDuty is enabled. Create an Amazon CloudWatch alarm for detected EC2 and port scan findings. Connect the alarm to the SNS topic. (correct answer)
  • BEnsure that Amazon Inspector is enabled. Create an Amazon EventBridge event for detected network reachability findings that indicate port scans. Connect the event to the SNS topic.
  • CEnsure that Amazon Inspector is enabled. Create an Amazon EventBridge event for detected CVEs that cause open port vulnerabilities. Connect the event to the SNS topic.
  • DEnsure that AWS CloudTrail is enabled. Create an AWS Lambda function to analyze the CloudTrail logs for unusual amounts of traffic from an IP address range. Connect the Lambda function to the SNS topic.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Ensure that Amazon GuardDuty is enabled. Create an Amazon CloudWatch alarm for detected EC2 and port scan findings. Connect the alarm to the SNS topic.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon GuardDuty continuously monitors for threats and malicious activity.

DOP-C02 Question 162

Single page →
Topic 1 · Question 162

A company runs applications in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster uses an Application Load Balancer to route traffic to the applications that run in the cluster. A new application that was migrated to the EKS cluster is performing poorly. All the other applications in the EKS cluster maintain appropriate operation. The new application scales out horizontally to the preconfigured maximum number of pods immediately upon deployment, before any user traffic routes to the web application. Which solution will resolve the scaling behavior of the web application in the EKS cluster?

  • AImplement the Horizontal Pod Autoscaler in the EKS cluster.
  • BImplement the Vertical Pod Autoscaler in the EKS cluster. (correct answer)
  • CImplement the Cluster Autoscaler.
  • DImplement the AWS Load Balancer Controller in the EKS cluster.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Implement the Vertical Pod Autoscaler in the EKS cluster.

Explanation

Amazon EKS runs managed Kubernetes when you need the Kubernetes ecosystem.

DOP-C02 Question 163

Single page →
Topic 1 · Question 163 · Select all that apply

A company has an AWS Control Tower landing zone that manages its organization in AWS Organizations. The company created an OU structure that is based on the company's requirements. The company's DevOps team has established the core accounts for the solution and an account for all centralized AWS CloudFormation and AWS Service Catalog solutions. The company wants to offer a series of customizations that an account can request through AWS Control Tower. Which combination of steps will meet these requirements? (Choose three.)

  • AEnable trusted access for CloudFormation with Organizations by using service-managed permissions.
  • BCreate an IAM role that is named AWSControlTowerBlueprintAccess. Configure the role with a trust policy that allows the AWSControlTowerAdmin role in the management account to assume the role. Attach the AWSServiceCatalogAdminFullAccess IAM policy to the AWSControlTowerBlueprintAccess role. (correct answer)
  • CCreate a Service Catalog product for each CloudFormation template. (correct answer)
  • DCreate a CloudFormation stack set for each CloudFormation template. Enable automatic deployment for each stack set. Create a CloudFormation stack instance that targets specific OUs.
  • EDeploy the Customizations for AWS Control Tower (CfCT) CloudFormation stack.
  • FCreate a CloudFormation template that contains the resources for each customization. (correct answer)
Reveal answer & explanation
Correct answer: B, C, F

The correct answer is B, C, F. Option B: Create an IAM role that is named AWSControlTowerBlueprintAccess. Configure the role with a trust policy that allows the AWSControlTowerAdmin role in the management account to assume the role. Attach the AWSServiceCata... Option C: Create a Service Catalog product for each CloudFormation template. Option F: Create a CloudFormation template that contains the resources for each customization.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 164

Single page →
Topic 1 · Question 164

A company runs a workload on Amazon EC2 instances. The company needs a control that requires the use of Instance Metadata Service Version 2 (IMDSv2) on all EC2 instances in the AWS account. If an EC2 instance does not prevent the use of Instance Metadata Service Version 1 (IMDSv1), the EC2 instance must be terminated. Which solution will meet these requirements?

  • ASet up AWS Config in the account. Use a managed rule to check EC2 instances. Configure the rule to remediate the findings by using AWS Systems Manager Automation to terminate the instance. (correct answer)
  • BCreate a permissions boundary that prevents the ec2:RunInstance action if the ec2:MetadataHttpTokens condition key is not set to a value of required. Attach the permissions boundary to the IAM role that was used to launch the instance.
  • CSet up Amazon Inspector in the account. Configure Amazon Inspector to activate deep inspection for EC2 instances. Create an Amazon EventBridge rule for an Inspector2 finding. Set an AWS Lambda function as the target to terminate the instance.
  • DCreate an Amazon EventBridge rule for the EC2 instance launch successful event. Send the event to an AWS Lambda function to inspect the EC2 metadata and to terminate the instance.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Set up AWS Config in the account. Use a managed rule to check EC2 instances. Configure the rule to remediate the findings by using AWS Systems Manager Automation to terminate the instance.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Config tracks resource configuration changes and evaluates compliance. AWS Systems Manager operates and automates management of fleets of resources.

DOP-C02 Question 165

Single page →
Topic 1 · Question 165 · Select all that apply

A company builds an application that uses an Application Load Balancer in front of Amazon EC2 instances that are in an Auto Scaling group. The application is stateless. The Auto Scaling group uses a custom AMI that is fully prebuilt. The EC2 instances do not have a custom bootstrapping process. The AMI that the Auto Scaling group uses was recently deleted. The Auto Scaling group's scaling activities show failures because the AMI ID does not exist. Which combination of steps should a DevOps engineer take to meet these requirements? (Choose three.)

  • ACreate a new launch template that uses the new AMI. (correct answer)
  • BUpdate the Auto Scaling group to use the new launch template. (correct answer)
  • CReduce the Auto Scaling group's desired capacity to 0.
  • DIncrease the Auto Scaling group's desired capacity by 1.
  • ECreate a new AMI from a running EC2 instance in the Auto Scaling group. (correct answer)
  • FCreate a new AMI by copying the most recent public AMI of the operating system that the EC2 instances use.
Reveal answer & explanation
Correct answer: A, B, E

The correct answer is A, B, E. Option A: Create a new launch template that uses the new AMI. Option B: Update the Auto Scaling group to use the new launch template. Option E: Create a new AMI from a running EC2 instance in the Auto Scaling group.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

DOP-C02 Question 166

Single page →
Topic 1 · Question 166 · Select all that apply

A company deploys a web application on Amazon EC2 instances that are behind an Application Load Balancer (ALB). The company stores the application code in an AWS CodeCommit repository. When code is merged to the main branch, an AWS Lambda function invokes an AWS CodeBuild project. The CodeBuild project packages the code, stores the packaged code in AWS CodeArtifact, and invokes AWS Systems Manager Run Command to deploy the packaged code to the EC2 instances. Previous deployments have resulted in defects, EC2 instances that are not running the latest version of the packaged code, and inconsistencies between instances. Which combination of actions should a DevOps engineer take to implement a more reliable deployment solution? (Choose two.)

  • ACreate a pipeline in AWS CodePipeline that uses the CodeCommit repository as a source provider. Configure pipeline stages that run the CodeBuild project in parallel to build and test the application. In the pipeline, pass the CodeBuild project output artifact to an AWS CodeDeploy action.
  • BCreate a pipeline in AWS CodePipeline that uses the CodeCommit repository as a source provider. Create separate pipeline stages that run a CodeBuild project to build and then test the application. In the pipeline, pass the CodeBuild project output artifact to an AWS CodeDeploy action. (correct answer)
  • CCreate an AWS CodeDeploy application and a deployment group to deploy the packaged code to the EC2 instances. Configure the ALB for the deployment group. (correct answer)
  • DCreate individual Lambda functions that use AWS CodeDeploy instead of Systems Manager to run build, test, and deploy actions.
  • ECreate an Amazon S3 bucket. Modify the CodeBuild project to store the packages in the S3 bucket instead of in CodeArtifact. Use deploy actions in CodeDeploy to deploy the artifact to the EC2 instances.
Reveal answer & explanation
Correct answer: B, C

The correct answer is B, C. Option B: Create a pipeline in AWS CodePipeline that uses the CodeCommit repository as a source provider. Create separate pipeline stages that run a CodeBuild project to build and then test the application. In the pipeline, pas... Option C: Create an AWS CodeDeploy application and a deployment group to deploy the packaged code to the EC2 instances. Configure the ALB for the deployment group.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Config tracks resource configuration changes and evaluates compliance. AWS CodePipeline automates continuous delivery pipelines.

DOP-C02 Question 167

Single page →
Topic 1 · Question 167

A company uses an organization in AWS Organizations to manage its AWS accounts. The company's automation account contains a CI/CD pipeline that creates and configures new AWS accounts. The company has a group of internal service teams that provide services to accounts in the organization. The service teams operate out of a set of services accounts. The service teams want to receive an AWS CloudTrail event in their services accounts when the CreateAccount API call creates a new account. How should the company share this CloudTrail event with the service accounts?

  • ACreate an Amazon EventBridge rule in the automation account to send account creation events to the default event bus in the services accounts. Update the default event bus in the services accounts to allow events from the automation account. (correct answer)
  • BCreate a custom Amazon EventBridge event bus in the services accounts. Update the custom event bus to allow events from the automation account. Create an EventBridge rule in the services account that directly listens to CloudTrail events from the automation account.
  • CCreate a custom Amazon EventBridge event bus in the automation account and the services accounts. Create an EventBridge rule and policy that connects the custom event buses that are in the automation account and the services accounts.
  • DCreate a custom Amazon EventBridge event bus in the automation account. Create an EventBridge rule and policy that connects the custom event bus to the default event buses in the services accounts.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an Amazon EventBridge rule in the automation account to send account creation events to the default event bus in the services accounts. Update the default event bus in the services accounts to allow events from...

Explanation

Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

DOP-C02 Question 168

Single page →
Topic 1 · Question 168

A DevOps engineer is building a solution that uses Amazon Simple Queue Service (Amazon SQS) standard queues. The solution also includes an AWS Lambda function and an Amazon DynamoDB table. The Lambda function pulls content from an SQS queue event source and writes the content to the DynamoDB table. The solution must maximize the scalability of Lambda and must prevent successfully processed SQS messages from being processed multiple times. Which solution will meet these requirements?

  • ADecrease the batch window to 1 second when configuring the Lambda function's event source mapping.
  • BDecrease the batch size to 1 when configuring the Lambda function's event source mapping.
  • CInclude the ReportBatchItemFailures value in the FunctionResponseTypes list in the Lambda function's event source mapping. (correct answer)
  • DSet the queue visibility timeout on the Lambda function's event source mapping to account for invocation throttling of the Lambda function.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Include the ReportBatchItemFailures value in the FunctionResponseTypes list in the Lambda function's event source mapping.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS Batch schedules and runs batch computing jobs at any scale without managing clusters.

DOP-C02 Question 169

Single page →
Topic 1 · Question 169 · Select all that apply

A company has a new AWS account that teams will use to deploy various applications. The teams will create many Amazon S3 buckets for application-specific purposes and to store AWS CloudTrail logs. The company has enabled Amazon Macie for the account. A DevOps engineer needs to optimize the Macie costs for the account without compromising the account's functionality. Which solutions will meet these requirements? (Choose two.)

  • AExclude S3 buckets that contain CloudTrail logs from automated discovery. (correct answer)
  • BExclude S3 buckets that have public read access from automated discovery.
  • CConfigure scheduled daily discovery jobs for all S3 buckets in the account.
  • DConfigure discovery jobs to include S3 objects based on the last modified criterion. (correct answer)
  • EConfigure discovery jobs to include S3 objects that are tagged as production only.
Reveal answer & explanation
Correct answer: A, D

The correct answer is A, D. Option A: Exclude S3 buckets that contain CloudTrail logs from automated discovery. Option D: Configure discovery jobs to include S3 objects based on the last modified criterion.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS CloudTrail records API activity for auditing and governance. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 170

Single page →
Topic 1 · Question 170 · Select all that apply

A company uses an organization in AWS Organizations to manage its AWS accounts. The company recently acquired another company that has standalone AWS accounts. The acquiring company's DevOps team needs to consolidate the administration of the AWS accounts for both companies and retain full administrative control of the accounts. The DevOps team also needs to collect and group findings across all the accounts to implement and maintain a security posture. Which combination of steps should the DevOps team take to meet these requirements? (Choose two.)

  • AInvite the acquired company's AWS accounts to join the organization. Create an SCP that has full administrative privileges. Attach the SCP to the management account.
  • BInvite the acquired company's AWS accounts to join the organization. Create the OrganizationAccountAccessRole IAM role in the invited accounts. Grant permission to the management account to assume the role. (correct answer)
  • CUse AWS Security Hub to collect and group findings across all accounts. Use Security Hub to automatically detect new accounts as the accounts are added to the organization. (correct answer)
  • DUse AWS Firewall Manager to collect and group findings across all accounts. Enable all features for the organization. Designate an account in the organization as the delegated administrator account for Firewall Manager.
  • EUse Amazon Inspector to collect and group findings across all accounts. Designate an account in the organization as the delegated administrator account for Amazon Inspector.
Reveal answer & explanation
Correct answer: B, C

The correct answer is B, C. Option B: Invite the acquired company's AWS accounts to join the organization. Create the OrganizationAccountAccessRole IAM role in the invited accounts. Grant permission to the management account to assume the role. Option C: Use AWS Security Hub to collect and group findings across all accounts. Use Security Hub to automatically detect new accounts as the accounts are added to the organization.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Security Hub centralizes security findings and compliance checks.

DOP-C02 Question 171

Single page →
Topic 1 · Question 171

A company has an application and a CI/CD pipeline. The CI/CD pipeline consists of an AWS CodePipeline pipeline and an AWS CodeBuild project. The CodeBuild project runs tests against the application as part of the build process and outputs a test report. The company must keep the test reports for 90 days. Which solution will meet these requirements?

  • AAdd a new stage in the CodePipeline pipeline after the stage that contains the CodeBuild project. Create an Amazon S3 bucket to store the reports. Configure an S3 deploy action type in the new CodePipeline stage with the appropriate path and format for the reports.
  • BAdd a report group in the CodeBuild project buildspec file with the appropriate path and format for the reports. Create an Amazon S3 bucket to store the reports. Configure an Amazon EventBridge rule that invokes an AWS Lambda function to copy the reports to the S3 bucket when a build is completed. Create an S3 Lifecycle rule to expire the objects after 90 days. (correct answer)
  • CAdd a new stage in the CodePipeline pipeline. Configure a test action type with the appropriate path and format for the reports. Configure the report expiration time to be 90 days in the CodeBuild project buildspec file.
  • DAdd a report group in the CodeBuild project buildspec file with the appropriate path and format for the reports. Create an Amazon S3 bucket to store the reports. Configure the report group as an artifact in the CodeBuild project buildspec file. Configure the S3 bucket as the artifact destination. Set the object expiration to 90 days.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Add a report group in the CodeBuild project buildspec file with the appropriate path and format for the reports. Create an Amazon S3 bucket to store the reports. Configure an Amazon EventBridge rule that invokes an AW...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. S3 Lifecycle policies automatically transition or expire objects to control storage cost. Amazon S3 provides durable, scalable object storage that is fully managed.

DOP-C02 Question 172

Single page →
Topic 1 · Question 172 · Select all that apply

A company uses an Amazon API Gateway regional REST API to host its application API. The REST API has a custom domain. The REST API's default endpoint is deactivated. The company's internal teams consume the API. The company wants to use mutual TLS between the API and the internal teams as an additional layer of authentication. Which combination of steps will meet these requirements? (Choose two.)

  • AUse AWS Certificate Manager (ACM) to create a private certificate authority (CA). Provision a client certificate that is signed by the private CA. (correct answer)
  • BProvision a client certificate that is signed by a public certificate authority (CA). Import the certificate into AWS Certificate Manager (ACM).
  • CUpload the provisioned client certificate to an Amazon S3 bucket. Configure the API Gateway mutual TLS to use the client certificate that is stored in the S3 bucket as the trust store.
  • DUpload the provisioned client certificate private key to an Amazon S3 bucket. Configure the API Gateway mutual TLS to use the private key that is stored in the S3 bucket as the trust store.
  • EUpload the root private certificate authority (CA) certificate to an Amazon S3 bucket. Configure the API Gateway mutual TLS to use the private CA certificate that is stored in the S3 bucket as the trust store. (correct answer)
Reveal answer & explanation
Correct answer: A, E

The correct answer is A, E. Option A: Use AWS Certificate Manager (ACM) to create a private certificate authority (CA). Provision a client certificate that is signed by the private CA. Option E: Upload the root private certificate authority (CA) certificate to an Amazon S3 bucket. Configure the API Gateway mutual TLS to use the private CA certificate that is stored in the S3 bucket as the trust store.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon API Gateway is a fully managed front door for creating and securing APIs at scale. AWS Certificate Manager provisions and renews TLS certificates automatically.

DOP-C02 Question 173

Single page →
Topic 1 · Question 173

A company uses AWS Directory Service for Microsoft Active Directory as its identity provider (IdP). The company requires all infrastructure to be defined and deployed by AWS CloudFormation. A DevOps engineer needs to create a fleet of Windows-based Amazon EC2 instances to host an application. The DevOps engineer has created a CloudFormation template that contains an EC2 launch template, IAM role, EC2 security group, and EC2 Auto Scaling group. The DevOps engineer must implement a solution that joins all EC2 instances to the domain of the AWS Managed Microsoft AD directory. Which solution will meet these requirements with the MOST operational efficiency?

  • AIn the CloudFormation template, create an AWS::SSM::Document resource that joins the EC2 instance to the AWS Managed Microsoft AD domain by using the parameters for the existing directory. Update the launch template to include the SSMAssociation property to use the new SSM document. Attach the AmazonSSMManagedInstanceCore and AmazonSSMDirectoryServiceAccess AWS managed policies to the IAM role that the EC2 instances use.
  • BIn the CloudFormation template, update the launch template to include specific tags that propagate on launch. Create an AWS::SSM::Association resource to associate the AWS-JoinDirectoryServiceDomain Automation runbook with the EC2 instances that have the specified tags. Define the required parameters to join the AWS Managed Microsoft AD directory. Attach the AmazonSSMManagedInstanceCore and AmazonSSMDirectoryServiceAccess AWS managed policies to the IAM role that the EC2 instances use. (correct answer)
  • CStore the existing AWS Managed Microsoft AD domain connection details in AWS Secrets Manager. In the CloudFormation template, create an AWS::SSM::Association resource to associate the AWS-CreateManagedWindowsInstanceWithApproval Automation runbook with the EC2 Auto Scaling group. Pass the ARNs for the parameters from Secrets Manager to join the domain. Attach the AmazonSSMDirectoryServiceAccess and SecretsManagerReadWrite AWS managed policies to the IAM role that the EC2 instances use.
  • DStore the existing AWS Managed Microsoft AD domain administrator credentials in AWS Secrets Manager. In the CloudFormation template, update the EC2 launch template to include user data. Configure the user data to pull the administrator credentials from Secrets Manager and to join the AWS Managed Microsoft AD domain. Attach the AmazonSSMManagedInstanceCore and SecretsManagerReadWrite AWS managed policies to the IAM role that the EC2 instances use.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: In the CloudFormation template, update the launch template to include specific tags that propagate on launch. Create an AWS::SSM::Association resource to associate the AWS-JoinDirectoryServiceDomain Automation runbook...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

DOP-C02 Question 174

Single page →
Topic 1 · Question 174

A company uses AWS Organizations to manage its AWS accounts. The company has a root OU that has a child OU. The root OU has an SCP that allows all actions on all resources. The child OU has an SCP that allows all actions for Amazon DynamoDB and AWS Lambda, and denies all other actions. The company has an AWS account that is named vendor-data in the child OU. A DevOps engineer has an IAM user that is attached to the Administrator Access IAM policy in the vendor-data account. The DevOps engineer attempts to launch an Amazon EC2 instance in the vendor-data account but receives an access denied error. Which change should the DevOps engineer make to launch the EC2 instance in the vendor-data account?

  • AAttach the AmazonEC2FullAccess IAM policy to the IAM user.
  • BCreate a new SCP that allows all actions for Amazon EC2. Attach the SCP to the vendor-data account.
  • CUpdate the SCP in the child OU to allow all actions for Amazon EC2. (correct answer)
  • DCreate a new SCP that allows all actions for Amazon EC2. Attach the SCP to the root OU.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Update the SCP in the child OU to allow all actions for Amazon EC2.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Service Control Policies set guardrails on what accounts in an organization can do.

DOP-C02 Question 175

Single page →
Topic 1 · Question 175

A company's security policies require the use of security hardened AMIs in production environments. A DevOps engineer has used EC2 Image Builder to create a pipeline that builds the AMIs on a recurring schedule. The DevOps engineer needs to update the launch templates of the company's Auto Scaling groups. The Auto Scaling groups must use the newest AMIs during the launch of Amazon EC2 instances. Which solution will meet these requirements with the MOST operational efficiency?

  • AConfigure an Amazon EventBridge rule to receive new AMI events from Image Builder. Target an AWS Systems Manager Run Command document that updates the launch templates of the Auto Scaling groups with the newest AMI ID.
  • BConfigure an Amazon EventBridge rule to receive new AMI events from Image Builder. Target an AWS Lambda function that updates the launch templates of the Auto Scaling groups with the newest AMI ID.
  • CConfigure the launch template to use a value from AWS Systems Manager Parameter Store for the AMI ID. Configure the Image Builder pipeline to update the Parameter Store value with the newest AMI ID.
  • DConfigure the Image Builder distribution settings to update the launch templates with the newest AMI IConfigure the Auto Scaling groups to use the newest version of the launch template. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure the Image Builder distribution settings to update the launch templates with the newest AMI IConfigure the Auto Scaling groups to use the newest version of the launch template.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 176

Single page →
Topic 1 · Question 176

A company has configured an Amazon S3 event source on an AWS Lambda function. The company needs the Lambda function to run when a new object is created or an existing object is modified in a particular S3 bucket. The Lambda function will use the S3 bucket name and the S3 object key of the incoming event to read the contents of the created or modified S3 object. The Lambda function will parse the contents and save the parsed contents to an Amazon DynamoDB table. The Lambda function's execution role has permissions to read from the S3 bucket and to write to the DynamoDB table. During testing, a DevOps engineer discovers that the Lambda function does not run when objects are added to the S3 bucket or when existing objects are modified. Which solution will resolve this problem?

  • AIncrease the memory of the Lambda function to give the function the ability to process large files from the S3 bucket.
  • BCreate a resource policy on the Lambda function to grant Amazon S3 the permission to invoke the Lambda function for the S3 bucket. (correct answer)
  • CConfigure an Amazon Simple Queue Service (Amazon SQS) queue as an OnFailure destination for the Lambda function.
  • DProvision space in the /tmp folder of the Lambda function to give the function the ability to process large files from the S3 bucket.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a resource policy on the Lambda function to grant Amazon S3 the permission to invoke the Lambda function for the S3 bucket.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed.

DOP-C02 Question 177

Single page →
Topic 1 · Question 177

A company has deployed a critical application in two AWS Regions. The application uses an Application Load Balancer (ALB) in both Regions. The company has Amazon Route 53 alias DNS records for both ALBs. The company uses Amazon Route 53 Application Recovery Controller to ensure that the application can fail over between the two Regions. The Route 53 ARC configuration includes a routing control for both Regions. The company uses Route 53 ARC to perform quarterly disaster recovery (DR) tests. During the most recent DR test, a DevOps engineer accidentally turned off both routing controls. The company needs to ensure that at least one routing control is turned on at all times. Which solution will meet these requirements?

  • AIn Route 53 ARC, create a new assertion safety rule. Apply the assertion safety rule to the two routing controls. Configure the rule with the ATLEAST type with a threshold of 1. (correct answer)
  • BIn Route 53 ARC, create a new gating safety rule. Apply the assertion safety rule to the two routing controls. Configure the rule with the OR type with a threshold of 1.
  • CIn Route 53 ARC, create a new resource set. Configure the resource set with an AWS::Route53::HealthCheck resource type. Specify the ARNs of the two routing controls as the target resource. Create a new readiness check for the resource set.
  • DIn Route 53 ARC, create a new resource set. Configure the resource set with an AWS::Route53RecoveryReadiness::DNSTargetResource resource type. Add the domain names of the two Route 53 alias DNS records as the target resource. Create a new readiness check for the resource set.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: In Route 53 ARC, create a new assertion safety rule. Apply the assertion safety rule to the two routing controls. Configure the rule with the ATLEAST type with a threshold of 1.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS Config tracks resource configuration changes and evaluates compliance. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

DOP-C02 Question 178

Single page →
Topic 1 · Question 178

A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps engineer must create a workflow to audit the application to ensure compliance. What steps should the engineer take to meet this requirement with the LEAST administrative overhead?

  • AUse AWS Systems Manager Configuration Compliance. Use calls to the put-compliance-items API action to scan and build a database of noncompliant EC2 instances based on their host placement configuration. Use an Amazon DynamoDB table to store these instance IDs for fast access. Generate a report through Systems Manager by calling the list-compliance-summaries API action.
  • BUse custom Java code running on an EC2 instance. Set up EC2 Auto Scaling for the instance depending on the number of instances to be checked. Send the list of noncompliant EC2 instance IDs to an Amazon SQS queue. Set up another worker instance to process instance IDs from the SQS queue and write them to Amazon DynamoDUse an AWS Lambda function to terminate noncompliant instance IDs obtained from the queue, and send them to an Amazon SNS email topic for distribution.
  • CUse AWS Config. Identify all EC2 instances to be audited by enabling Config Recording on all Amazon EC2 resources for the region. Create a custom AWS Config rule that triggers an AWS Lambda function by using the "config-rule-change -triggered" blueprint. Modify the Lambda evaluateCompliance() function to verify host placement to return a NON_COMPLIANT result if the instance is not running on an EC2 Dedicated Host. Use the AWS Config report to address noncompliant instances. (correct answer)
  • DUse AWS CloudTrail. Identify all EC2 instances to be audited by analyzing all calls to the EC2 RunCommand API action. Invoke an AWS Lambda function that analyzes the host placement of the instance. Store the EC2 instance ID of noncompliant resources in an Amazon RDS for MySQL DB instance. Generate a report by querying the RDS instance and exporting the query results to a CSV text file.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use AWS Config. Identify all EC2 instances to be audited by enabling Config Recording on all Amazon EC2 resources for the region. Create a custom AWS Config rule that triggers an AWS Lambda function by using the "conf...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 179

Single page →
Topic 1 · Question 179 · Select all that apply

A DevOps engineer is planning to deploy a Ruby-based application to production. The application needs to interact with an Amazon RDS for MySQL database and should have automatic scaling and high availability. The stored data in the database is critical and should persist regardless of the state of the application stack. The DevOps engineer needs to set up an automated deployment strategy for the application with automatic rollbacks. The solution also must alert the application team when a deployment fails. Which combination of steps will meet these requirements? (Choose three.)

  • ADeploy the application on AWS Elastic Beanstalk. Deploy an Amazon RDS for MySQL DB instance as part of the Elastic Beanstalk configuration.
  • BDeploy the application on AWS Elastic Beanstalk. Deploy a separate Amazon RDS for MySQL DB instance outside of Elastic Beanstalk. (correct answer)
  • CConfigure a notification email address that alerts the application team in the AWS Elastic Beanstalk configuration. (correct answer)
  • DConfigure an Amazon EventBridge rule to monitor AWS Health events. Use an Amazon Simple Notification Service (Amazon SNS) topic as a target to alert the application team.
  • EUse the immutable deployment method to deploy new application versions. (correct answer)
  • FUse the rolling deployment method to deploy new application versions.
Reveal answer & explanation
Correct answer: B, C, E

The correct answer is B, C, E. Option B: Deploy the application on AWS Elastic Beanstalk. Deploy a separate Amazon RDS for MySQL DB instance outside of Elastic Beanstalk. Option C: Configure a notification email address that alerts the application team in the AWS Elastic Beanstalk configuration. Option E: Use the immutable deployment method to deploy new application versions.

Explanation

AWS Elastic Beanstalk provisions and manages the underlying environment for you with little operational effort. Amazon RDS is a managed relational database that handles patching, backups and failover. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 180

Single page →
Topic 1 · Question 180 · Select all that apply

A company is using AWS CodePipeline to deploy an application. According to a new guideline, a member of the company's security team must sign off on any application changes before the changes are deployed into production. The approval must be recorded and retained. Which combination of actions will meet these requirements? (Choose two.)

  • AConfigure CodePipeline to write actions to Amazon CloudWatch Logs.
  • BConfigure CodePipeline to write actions to an Amazon S3 bucket at the end of each pipeline stage.
  • CCreate an AWS CloudTrail trail to deliver logs to Amazon S3. (correct answer)
  • DCreate a CodePipeline custom action to invoke an AWS Lambda function for approval. Create a policy that gives the security team access to manage CodePipeline custom actions.
  • ECreate a CodePipeline manual approval action before the deployment step. Create a policy that grants the security team access to approve manual approval stages. (correct answer)
Reveal answer & explanation
Correct answer: C, E

The correct answer is C, E. Option C: Create an AWS CloudTrail trail to deliver logs to Amazon S3. Option E: Create a CodePipeline manual approval action before the deployment step. Create a policy that grants the security team access to approve manual approval stages.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS CloudTrail records API activity for auditing and governance. AWS CodePipeline automates continuous delivery pipelines.

Showing questions 161–180 of 431 · Page 9 of 22