🔍

DOP-C02 — questions

Page 12 of 22 · 431 total questions.

DOP-C02 Question 221

Single page →
Topic 1 · Question 221

A company manages multiple AWS accounts by using AWS Organizations with OUs for the different business divisions. The company is updating their corporate network to use new IP address ranges. The company has 10 Amazon S3 buckets in different AWS accounts. The S3 buckets store reports for the different divisions. The S3 bucket configurations allow only private corporate network IP addresses to access the S3 buckets. A DevOps engineer needs to change the range of IP addresses that have permission to access the contents of the S3 buckets. The DevOps engineer also needs to revoke the permissions of two OUs in the company. Which solution will meet these requirements?

  • ACreate a new SCP that has two statements, one that allows access to the new range of IP addresses for all the S3 buckets and one that denies access to the old range of IP addresses for all the S3 buckets. Set a permissions boundary for the OrganizationAccountAccessRole role in the two OUs to deny access to the S3 buckets.
  • BCreate a new SCP that has a statement that allows only the new range of IP addresses to access the S3 buckets. Create another SCP that denies access to the S3 buckets. Attach the second SCP to the two OUs.
  • COn all the S3 buckets, configure resource-based policies that allow only the new range of IP addresses to access the S3 buckets. Create a new SCP that denies access to the S3 buckets. Attach the SCP to the two OUs. (correct answer)
  • DOn all the S3 buckets, configure resource-based policies that allow only the new range of IP addresses to access the S3 buckets. Set a permissions boundary for the OrganizationAccountAccessRole role in the two OUs to deny access to the S3 buckets.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: On all the S3 buckets, configure resource-based policies that allow only the new range of IP addresses to access the S3 buckets. Create a new SCP that denies access to the S3 buckets. Attach the SCP to the two OUs.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Service Control Policies set guardrails on what accounts in an organization can do. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 222

Single page →
Topic 1 · Question 222

A company has started using AWS across several teams. Each team has multiple accounts and unique security profiles. The company manages the accounts in an organization in AWS Organizations. Each account has its own configuration and security controls. The company's DevOps team wants to use preventive and detective controls to govern all accounts. The DevOps team needs to ensure the security of accounts now and in the future as the company creates new accounts in the organization. Which solution will meet these requirements?

  • AUse Organizations to create OUs that have appropriate SCPs attached for each team. Place team accounts in the appropriate OUs to apply security controls. Create any new team accounts in the appropriate OUs.
  • BCreate an AWS Control Tower landing zone. Configure OUs and appropriate controls in AWS Control Tower for the existing teams. Configure trusted access for AWS Control Tower. Enroll the existing accounts in the appropriate OUs that match the appropriate security policies for each team. Use AWS Control Tower to provision any new accounts. (correct answer)
  • CCreate AWS CloudFormation stack sets in the organization's management account. Configure a stack set that deploys AWS Config with configuration rules and remediation actions for all controls to each account in the organization. Update the stack sets to deploy to new accounts as the accounts are created.
  • DConfigure AWS Config to manage the AWS Config rules across all AWS accounts in the organization. Deploy conformance packs that provide AWS Config rules and remediation actions across the organization.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an AWS Control Tower landing zone. Configure OUs and appropriate controls in AWS Control Tower for the existing teams. Configure trusted access for AWS Control Tower. Enroll the existing accounts in the appropr...

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. AWS Control Tower sets up and governs a secure multi-account landing zone.

DOP-C02 Question 223

Single page →
Topic 1 · Question 223

A company uses an AWS CodeCommit repository to store its source code and corresponding unit tests. The company has configured an AWS CodePipeline pipeline that includes an AWS CodeBuild project that runs when code is merged to the main branch of the repository. The company wants the CodeBuild project to run the unit tests. If the unit tests pass, the CodeBuild project must tag the most recent commit. How should the company configure the CodeBuild project to meet these requirements?

  • AConfigure the CodeBuild project to use native Git to done the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use native Git to create a tag and to push the Git tag to the repository if the code passes the unit tests. (correct answer)
  • BConfigure the CodeBuild projed to use native Git to done the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use AWS CLI commands to create a new repository tag in the repository if the code passes the unit tests.
  • CConfigure the CodeBuild project to use AWS CLI commands to copy the code from the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use AWS CLI commands to create a new Git tag in the repository if the code passes the unit tests.
  • DConfigure the CodeBuild project to use AWS CLI commands to copy the code from the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use AWS CLI commands to create a new repository tag in the repository if the code passes the unit tests.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure the CodeBuild project to use native Git to done the CodeCommit repository. Configure the project to run the unit tests. Configure the project to use native Git to create a tag and to push the Git tag to the...

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. AWS CodeBuild compiles, tests and packages code in a managed build service. AWS CodeCommit hosts private Git repositories.

DOP-C02 Question 224

Single page →
Topic 1 · Question 224

A DevOps engineer manages a company's Amazon Elastic Container Service (Amazon ECS) cluster. The cluster runs on several Amazon EC2 instances that are in an Auto Scaling group. The DevOps engineer must implement a solution that logs and reviews all stopped tasks for errors. Which solution will meet these requirements?

  • ACreate an Amazon EventBridge rule to capture task state changes. Send the event to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to investigate stopped tasks. (correct answer)
  • BConfigure tasks to write log data in the embedded metric format. Store the logs in Amazon CloudWatch Logs. Monitor the ContainerInstanceCount metric for changes.
  • CConfigure the EC2 instances to store logs in Amazon CloudWatch Logs. Create a CloudWatch Contributor Insights rule that uses the EC2 instance log data. Use the Contributor Insights rule to investigate stopped tasks.
  • DConfigure an EC2 Auto Scaling lifecycle hook for the EC2_INSTANCE_TERMINATING scale-in event. Write the SystemEventLog file to Amazon S3. Use Amazon Athena to query the log file for errors.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an Amazon EventBridge rule to capture task state changes. Send the event to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to investigate stopped tasks.

Explanation

Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

DOP-C02 Question 225

Single page →
Topic 1 · Question 225 · Select all that apply

A company wants to deploy a workload on several hundred Amazon EC2 instances. The company will provision the EC2 instances in an Auto Scaling group by using a launch template. The workload will pull files from an Amazon S3 bucket, process the data, and put the results into a different S3 bucket. The EC2 instances must have least-privilege permissions and must use temporary security credentials. Which combination of steps will meet these requirements? (Choose two.)

  • ACreate an IAM role that has the appropriate permissions for S3 buckets Add the IAM role to an instance profile. (correct answer)
  • BUpdate the launch template to include the IAM instance profile. (correct answer)
  • CCreate an IAM user that has the appropriate permissions for Amazon S3 Generate a secret key and token.
  • DCreate a trust anchor and profile Attach the IAM role to the profile.
  • EUpdate the launch template Modify the user data to use the new secret key and token.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Create an IAM role that has the appropriate permissions for S3 buckets Add the IAM role to an instance profile. Option B: Update the launch template to include the IAM instance profile.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

DOP-C02 Question 226

Single page →
Topic 1 · Question 226

A company is using AWS CodeDeploy to automate software deployment. The deployment must meet these requirements: • A number of instances must be available to serve traffic during the deployment. Traffic must be balanced across those instances, and the instances must automatically heal in the event of failure. • A new fleet of instances must be launched for deploying a new revision automatically, with no manual provisioning. • Traffic must be rerouted to the new environment to half of the new instances at a time. The deployment should succeed if traffic is rerouted to at least half of the instances: otherwise, it should fail. • Before routing traffic to the new fleet of instances, the temporary files generated during the deployment process must be deleted. • At the end of a successful deployment, the original instances in the deployment group must be deleted immediately to reduce costs. How can a DevOps engineer meet these requirements?

  • AUse an Application Load Balancer and an in-place deployment. Associate the Auto Scaling group with the deployment group. Use the Automatically copy Auto Scaling group option, and use CodeDeployDefault.OneAtAtime as the deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the AllowTraffic hook within appspec.yml to delete the temporary files.
  • BUse an Application Load Balancer and a blue/green deployment. Associate the Auto Scaling group and Application Load Balancer target group with the deployment group. Use the Automatically copy Auto Scaling group option, create a custom deployment configuration with minimum healthy hosts defined as 50%, and assign the configuration to the deployment group. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the BeforeBlockTraffic hook within appspec.yml to delete the temporary files.
  • CUse an Application Load Balancer and a blue/green deployment. Associate the Auto Scaling group and the Application Load Balancer target group with the deployment group. Use the Automatically copy Auto Scaling group option, and use CodeDeployDefault.HalfAtAtime as the deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the BeforeAllowTraffic hook within appspec.yml to delete the temporary files. (correct answer)
  • DUse an Application Load Balancer and an in-place deployment. Associate the Auto Scaling group and Application Load Balancer target group with the deployment group. Use the Automatically copy Auto Scaling group option, and use CodeDeployDefault.AllatOnce as a deployment configuration. Instruct AWS CodeDeploy to terminate the original instances in the deployment group, and use the BlockTraffic hook within appspec.yml to delete the temporary files.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use an Application Load Balancer and a blue/green deployment. Associate the Auto Scaling group and the Application Load Balancer target group with the deployment group. Use the Automatically copy Auto Scaling group op...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale. This option delivers the requirement at the lowest cost.

DOP-C02 Question 227

Single page →
Topic 1 · Question 227

A company needs to adopt a multi-account strategy to deploy its applications and the associated CI/CD infrastructure. The company has created an organization in AWS Organizations that has all features enabled. The company has configured AWS Control Tower and has set up a landing zone. The company needs to use AWS Control Tower controls (guardrails) in all AWS accounts in the organization. The company must create the accounts for a multi-environment application and must ensure that all accounts are configured to an initial baseline. Which solution will meet these requirements with the LEAST operational overhead?

  • ACreate an AWS Control Tower Account Factory Customization (AFC) blueprint that uses the baseline configuration. Use AWS Control Tower Account Factory to provision a dedicated AWS account for each environment and a CI/CD account by using the blueprint. (correct answer)
  • BUse AWS Control Tower Account Factory to provision a dedicated AWS account for each environment and a CI/CD account. Use AWS CloudFormation StackSets to apply the baseline configuration to the new accounts.
  • CUse Organizations to provision a multi-environment AWS account and a CI/CD account. In the Organizations management account, create an AWS Lambda function that assumes the Organizations access role to apply the baseline configuration to the new accounts.
  • DUse Organizations to provision a dedicated AWS account for each environment, an audit account, and a CI/CD account. Use AWS CloudFormation StackSets to apply the baseline configuration to the new accounts.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an AWS Control Tower Account Factory Customization (AFC) blueprint that uses the baseline configuration. Use AWS Control Tower Account Factory to provision a dedicated AWS account for each environment and a CI/...

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. AWS Control Tower sets up and governs a secure multi-account landing zone.

DOP-C02 Question 228

Single page →
Topic 1 · Question 228

A DevOps team has created a Custom Lambda rule in AWS Config. The rule monitors Amazon Elastic Container Repository (Amazon ECR) policy statements for ecr:* actions. When a noncompliant repository is detected, Amazon EventBridge uses Amazon Simple Notification Service (Amazon SNS) to route the notification to a security team. When the custom AWS Config rule is evaluated, the AWS Lambda function fails to run. Which solution will resolve the issue?

  • AModify the Lambda function's resource policy to grant AWS Config permission to invoke the function. (correct answer)
  • BModify the SNS topic policy to include configuration changes for EventBridge to publish to the SNS topic.
  • CModify the Lambda function's execution role to include configuration changes for custom AWS Config rules.
  • DModify all the ECR repository policies to grant AWS Config access to the necessary ECR API actions.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Modify the Lambda function's resource policy to grant AWS Config permission to invoke the function.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 229

Single page →
Topic 1 · Question 229

A developer is creating a proof of concept for a new software as a service (SaaS) application. The application is in a shared development AWS account that is part of an organization in AWS Organizations. The developer needs to create service-linked IAM roles for the AWS services that are being considered for the proof of concept. The solution needs to give the developer the ability to create and configure the service-linked roles only. Which solution will meet these requirements?

  • ACreate an IAM user for the developer in the organization's management account. Configure a cross-account role in the development account for the developer to use. Limit the scope of the cross-account role to common services.
  • BAdd the developer to an IAM group. Attach the PowerUserAccess managed policy to the IAM group. Enforce multi-factor authentication (MFA) on the user account.
  • CAdd an SCP to the development account in Organizations. Configure the SCP with a Deny rule for iam:* to limit the developer's access.
  • DCreate an IAM role that has the necessary IAM access to allow the developer to create policies and roles. Create and attach a permissions boundary to the role. Grant the developer access to assume the role. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create an IAM role that has the necessary IAM access to allow the developer to create policies and roles. Create and attach a permissions boundary to the role. Grant the developer access to assume the role.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

DOP-C02 Question 230

Single page →
Topic 1 · Question 230 · Select all that apply

A company uses AWS Organizations to manage its AWS accounts. The company wants its monitoring system to receive an alert when a root user logs in. The company also needs a dashboard to display any log activity that the root user generates. Which combination of steps will meet these requirements? (Choose three.)

  • AEnable AWS Config with a multi-account aggregator. Configure log forwarding to Amazon CloudWatch Logs.
  • BCreate an Amazon QuickSight dashboard that uses an Amazon CloudWatch Logs query.
  • CCreate an Amazon CloudWatch Logs metric filter to match root user login events. Configure a CloudWatch alarm and an Amazon Simple Notification Service (Amazon SNS) topic to send alerts to the company's monitoring system. (correct answer)
  • DCreate an Amazon CloudWatch Logs subscription filter to match root user login events. Configure the filter to forward events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure the SNS topic to send alerts to the company's monitoring system.
  • ECreate an AWS CloudTrail organization trail. Configure the organization trail to send events to Amazon CloudWatch Logs. (correct answer)
  • FCreate an Amazon CloudWatch dashboard that uses a CloudWatch Logs Insights query. (correct answer)
Reveal answer & explanation
Correct answer: C, E, F

The correct answer is C, E, F. Option C: Create an Amazon CloudWatch Logs metric filter to match root user login events. Configure a CloudWatch alarm and an Amazon Simple Notification Service (Amazon SNS) topic to send alerts to the company's monitoring system. Option E: Create an AWS CloudTrail organization trail. Configure the organization trail to send events to Amazon CloudWatch Logs. Option F: Create an Amazon CloudWatch dashboard that uses a CloudWatch Logs Insights query.

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS CloudTrail records API activity for auditing and governance.

DOP-C02 Question 231

Single page →
Topic 1 · Question 231 · Select all that apply

A company uses AWS Organizations to manage its AWS accounts. A DevOps engineer must ensure that all users who access the AWS Management Console are authenticated through the company’s corporate identity provider (IdP). Which combination of steps will meet these requirements? (Choose two.)

  • AUse Amazon GuardDuty with a delegated administrator account Use GuardDuty to enforce denial of IAM user logins.
  • BUse AWS IAM Identity Center to configure identity federation with SAML 2.0. (correct answer)
  • CCreate a permissions boundary in AWS IAM Identity Center to deny password logins for IAM users.
  • DCreate IAM groups in the Organizations management account to apply consistent permissions for all IAM users.
  • ECreate an SCP in Organizations to deny password creation for IAM users. (correct answer)
Reveal answer & explanation
Correct answer: B, E

The correct answer is B, E. Option B: Use AWS IAM Identity Center to configure identity federation with SAML 2.0. Option E: Create an SCP in Organizations to deny password creation for IAM users.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Organizations centrally governs and secures multiple AWS accounts. Service Control Policies set guardrails on what accounts in an organization can do.

DOP-C02 Question 232

Single page →
Topic 1 · Question 232 · Select all that apply

A company has deployed a new platform that runs on Amazon Elastic Kubernetes Service (Amazon EKS). The new platform hosts web applications that users frequently update. The application developers build the Docker images for the applications and deploy the Docker images manually to the platform. The platform usage has increased to more than 500 users every day. Frequent updates, building the updated Docker images for the applications, and deploying the Docker images on the platform manually have all become difficult to manage. The company needs to receive an Amazon Simple Notification Service (Amazon SNS) notification if Docker image scanning returns any HIGH or CRITICAL findings for operating system or programming language package vulnerabilities. Which combination of steps will meet these requirements? (Choose two.)

  • ACreate an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon S3 event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project.
  • BCreate an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon EventBridge event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project. (correct answer)
  • CCreate an AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Turn on basic scanning for the ECR repository. Create an Amazon EventBridge rule that monitors Amazon GuardDuty events. Configure the EventBridge rule to send an event to an SNS topic when the finding-severity-counts parameter is more than 0 at a CRITICAL or HIGH level.
  • DCreate an AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Turn on enhanced scanning for the ECR repository. Create an Amazon EventBridge rule that monitors ECR image scan events. Configure the EventBridge rule to send an event to an SNS topic when the finding-severity-counts parameter is more than 0 at a CRITICAL or HIGH level. (correct answer)
  • ECreate an AWS CodeBuild project that scans the Dockerfile. Configure the project to build the Docker images and store the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository if the scan is successful. Configure an SNS topic to provide notification if the scan returns any vulnerabilities.
Reveal answer & explanation
Correct answer: B, D

The correct answer is B, D. Option B: Create an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon EventBridge event to invoke the pipeline when a newer version of the Do... Option D: Create an AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Turn on enhanced scanning for the ECR repository. Create an A...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 233

Single page →
Topic 1 · Question 233 · Select all that apply

A company groups its AWS accounts in OUs in an organization in AWS Organizations. The company has deployed a set of Amazon API Gateway APIs in one of the Organizations accounts. The APIs are bound to the account's VPC and have no existing authentication mechanism. Only principals in a specific OU can have permissions to invoke the APIs. The company applies the following policy to the API Gateway interface VPC endpoint: The company also updates the API Gateway resource policies to deny invocations that do not come through the interface VPC endpoint. After the updates, the following error message appears during attempts to use the interface VPC endpoint URL to invoke an API: "User: anonymous is not authorized." Which combination of steps will solve this problem? (Choose two.)

Exhibit 1 for question 233
  • AEnable IAM authentication on all API methods by setting AWS JAM as the authorization method. (correct answer)
  • BCreate a token-based AWS Lambda authorizer that passes the caller's identity in a bearer token.
  • CCreate a request parameter-based AWS Lambda authorizer that passes the caller's identity in a combination of headers, query string parameters, stage variables, and $cortext variables.
  • DUse Amazon Cognito user pools as the authorizer to control access to the API.
  • EVerify the identity of the requester by using Signature Version 4 to sign client requests by using AWS credentials. (correct answer)
Reveal answer & explanation
Correct answer: A, E

The correct answer is A, E. Option A: Enable IAM authentication on all API methods by setting AWS JAM as the authorization method. Option E: Verify the identity of the requester by using Signature Version 4 to sign client requests by using AWS credentials.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

DOP-C02 Question 234

Single page →
Topic 1 · Question 234

A company wants to decrease the time it takes to develop new features. The company uses AWS CodeBuild and AWS CodeDeploy to build and deploy its applications. The company uses AWS CodePipeline to deploy each microservice with its own CI/CD pipeline. The company needs more visibility into the average time between the release of new features and the average time to recover after a failed deployment. Which solution will provide this visibility with the LEAST configuration effort?

  • AProgram an AWS Lambda function that creates Amazon CloudWatch custom metrics with information about successful runs and failed runs for each pipeline. Create an Amazon EventBridge rule to invoke the Lambda function every 5 minutes. Use the metrics to build a CloudWatch dashboard.
  • BProgram an AWS Lambda function that creates Amazon CloudWatch custom metrics with information about successful runs and failed runs for each pipeline. Create an Amazon EventBridge rule to invoke the Lambda function after every successful run and after every failed run. Use the metrics to build a CloudWatch dashboard. (correct answer)
  • CProgram an AWS Lambda function that writes information about successful runs and failed runs to Amazon DynamoDB. Create an Amazon EventBridge rule to invoke the Lambda function after every successful run and after every failed run. Build an Amazon QuickSight dashboard to show the information from DynamoDB.
  • DProgram an AWS Lambda function that writes information about successful runs and failed runs to Amazon DynamoDB. Create an Amazon EventBridge rule to invoke the Lambda function every 5 minutes. Build an Amazon QuickSight dashboard to show the information from DynamoDB.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Program an AWS Lambda function that creates Amazon CloudWatch custom metrics with information about successful runs and failed runs for each pipeline. Create an Amazon EventBridge rule to invoke the Lambda function af...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

DOP-C02 Question 235

Single page →
Topic 1 · Question 235

A company has developed a static website hosted on an Amazon S3 bucket. The website is deployed using AWS CloudFormation. The CloudFormation template defines an S3 bucket and a custom resource that copies content into the bucket from a source location. The company has decided that it needs to move the website to a new location, so the existing CloudFormation stack must be deleted and re-created. However, CloudFormation reports that the stack could not be deleted cleanly. What is the MOST likely cause and how can the DevOps engineer mitigate this problem for this and future versions of the website?

  • ADeletion has failed because the S3 bucket has an active website configuration. Modify the CloudFormation template to remove the WebsiteConfiguration property from the S3 bucket resource.
  • BDeletion has failed because the S3 bucket is not empty. Modify the custom resource's AWS Lambda function code to recursively empty the bucket when RequestType is Delete. (correct answer)
  • CDeletion has failed because the custom resource does not define a deletion policy. Add a DeletionPolicy property to the custom resource definition with a value of RemoveOnDeletion.
  • DDeletion has failed because the S3 bucket is not empty. Modify the S3 bucket resource in the CloudFormation template to add a DeletionPolicy property with a value of Empty.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Deletion has failed because the S3 bucket is not empty. Modify the custom resource's AWS Lambda function code to recursively empty the bucket when RequestType is Delete.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed.

DOP-C02 Question 236

Single page →
Topic 1 · Question 236

A company uses Amazon EC2 as its primary compute platform. A DevOps team wants to audit the company's EC2 instances to check whether any prohibited applications have been installed on the EC2 instances. Which solution will meet these requirements with the MOST operational efficiency?

  • AConfigure AWS Systems Manager on each instance. Use AWS Systems Manager Inventory. Use Systems Manager resource data sync to synchronize and store findings in an Amazon S3 bucket. Create an AWS Lambda function that runs when new objects are added to the S3 bucket. Configure the Lambda function to identify prohibited applications.
  • BConfigure AWS Systems Manager on each instance. Use Systems Manager Inventory Create AWS Config rules that monitor changes from Systems Manager Inventory to identify prohibited applications. (correct answer)
  • CConfigure AWS Systems Manager on each instance. Use Systems Manager Inventory. Filter a trail in AWS CloudTrail for Systems Manager Inventory events to identify prohibited applications.
  • DDesignate Amazon CloudWatch Logs as the log destination for all application instances. Run an automated script across all instances to create an inventory of installed applications. Configure the script to forward the results to CloudWatch Logs. Create a CloudWatch alarm that uses filter patterns to search log data to identify prohibited applications.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure AWS Systems Manager on each instance. Use Systems Manager Inventory Create AWS Config rules that monitor changes from Systems Manager Inventory to identify prohibited applications.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. AWS Systems Manager operates and automates management of fleets of resources.

DOP-C02 Question 237

Single page →
Topic 1 · Question 237 · Select all that apply

A company has an event-driven JavaScript application. The application uses decoupled AWS managed services that publish, consume, and route events. During application testing, events are not delivered to the target that is specified by an Amazon EventBridge rule. A DevOps team must provide application testers with additional functionality to view, troubleshoot, and prevent the loss of events without redeployment of the application. Which combination of steps should the DevOps team take to meet these requirements? (Choose three.)

  • ALaunch AWS Device Farm with a standard test environment and project to run a specific build of the application.
  • BCreate an Amazon S3 bucket. Enable AWS CloudTrail. Create a CloudTrail trail that specifies the S3 bucket as the storage location. (correct answer)
  • CConfigure the EventBridge rule to use an Amazon Simple Queue Service (Amazon SQS) standard queue as a dead-letter queue. (correct answer)
  • DConfigure the EventBridge rule to use an Amazon Simple Queue Service (Amazon SQS) FIFO queue as a dead-letter queue.
  • ECreate a log group in Amazon CloudWatch Logs Specify the log group as an additional target of the EventBridge rule. (correct answer)
  • FUpdate the application code base to use the AWS X-Ray SDK tracing feature to instrument the code with support for the X-Amzn-Trace-Id header.
Reveal answer & explanation
Correct answer: B, C, E

The correct answer is B, C, E. Option B: Create an Amazon S3 bucket. Enable AWS CloudTrail. Create a CloudTrail trail that specifies the S3 bucket as the storage location. Option C: Configure the EventBridge rule to use an Amazon Simple Queue Service (Amazon SQS) standard queue as a dead-letter queue. Option E: Create a log group in Amazon CloudWatch Logs Specify the log group as an additional target of the EventBridge rule.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. This option decouples the components so they scale independently and absorb load spikes.

DOP-C02 Question 238

Single page →
Topic 1 · Question 238 · Select all that apply

A company is migrating its container-based workloads to an AWS Organizations multi-account environment. The environment consists of application workload accounts that the company uses to deploy and run the containerized workloads. The company has also provisioned a shared services account for shared workloads in the organization. The company must follow strict compliance regulations. All container images must receive security scanning before they are deployed to any environment. Images can be consumed by downstream deployment mechanisms after the images pass a scan with no critical vulnerabilities. Pre-scan and post-scan images must be isolated from one another so that a deployment can never use pre-scan images. A DevOps engineer needs to create a strategy to centralize this process. Which combination of steps will meet these requirements with the LEAST administrative overhead? (Choose two.)

  • ACreate Amazon Elastic Container Registry (Amazon ECR) repositories in the shared services account: one repository for each pre-scan image and one repository for each post-scan image. Configure Amazon ECR image scanning to run on new image pushes to the pre-scan repositories. Use resource-based policies to grant the organization write access to the pre-scan repositories and read access to the post-scan repositories. (correct answer)
  • BCreate pre-scan Amazon Elastic Container Registry (Amazon ECR) repositories in each account that publishes container images. Create repositories for post-scan images in the shared services account. Configure Amazon ECR image scanning to run on new image pushes to the pre-scan repositories. Use resource-based policies to grant the organization read access to the post-scan repositories.
  • CConfigure image replication for each image from the image's pre-scan repository to the image's post-scan repository.
  • DCreate a pipeline in AWS CodePipeline for each pre-scan repository. Create a source stage that runs when new images are pushed to the pre-scan repositories. Create a stage that uses AWS CodeBuild as the action provider. Write a buildspec.yaml definition that determines the image scanning status and pushes images without critical vulnerabilities to the post-scan repositories.
  • ECreate an AWS Lambda function. Create an Amazon EventBridge rule that reacts to image scanning completed events and invokes the Lambda function. Write function code that determines the image scanning status and pushes images without critical vulnerabilities to the post-scan repositories. (correct answer)
Reveal answer & explanation
Correct answer: A, E

The correct answer is A, E. Option A: Create Amazon Elastic Container Registry (Amazon ECR) repositories in the shared services account: one repository for each pre-scan image and one repository for each post-scan image. Configure Amazon ECR image scannin... Option E: Create an AWS Lambda function. Create an Amazon EventBridge rule that reacts to image scanning completed events and invokes the Lambda function. Write function code that determines the image scanning status and pushes...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 239

Single page →
Topic 1 · Question 239

A company uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to deploy its web applications on containers. The web applications contain confidential data that cannot be decrypted without specific credentials. A DevOps engineer has stored the credentials in AWS Secrets Manager. The secrets are encrypted by an AWS Key Management Service (AWS KMS) customer managed key. A Kubernetes service account for a third-party tool makes the secrets available to the applications. The service account assumes an IAM role that the company created to access the secrets. The service account receives an Access Denied (403 Forbidden) error while trying to retrieve the secrets from Secrets Manager. What is the root cause of this issue?

  • AThe IAM role that is attached to the EKS cluster does not have access to retrieve the secrets from Secrets Manager.
  • BThe key policy for the customer managed key does not allow the Kubernetes service account IAM role to use the key. (correct answer)
  • CThe key policy for the customer managed key does not allow the EKS cluster IAM role to use the key.
  • DThe IAM role that is assumed by the Kubernetes service account does not have permission to access the EKS cluster.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: The key policy for the customer managed key does not allow the Kubernetes service account IAM role to use the key.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

DOP-C02 Question 240

Single page →
Topic 1 · Question 240

A company is migrating its product development teams from an on-premises data center to a hybrid environment. The new environment will add four AWS Regions and will give the developers the ability to use the Region that is geographically closest to them. All the development teams use a shared set of Linux applications. The on-premises data center stores the applications on a NetApp ONTAP storage device. The storage volume is mounted read-only on the development on-premises VMs. The company updates the applications on the shared volume once a week. A DevOps engineer needs to replicate the data to all the new Regions. The DevOps engineer must ensure that the data is always up to date with deduplication. The data also must not be dependent on the availability of the on-premises storage device. Which solution will meet these requirements?

  • ACreate an Amazon S3 File Gateway in the on-premises data center. Create S3 buckets in each Region. Set up a cron job to copy the data from the storage device to the S3 File Gateway. Set up S3 Cross-Region Replication (CRR) to the S3 buckets in each Region.
  • BCreate an Amazon FSx File Gateway in one Region. Create file servers in Amazon FSx for Windows File Server in each Region. Set up a cron job to copy the data from the storage device to the FSx File Gateway.
  • CCreate Multi-AZ Amazon FSx for NetApp ONTAP instances and volumes in each Region. Configure a scheduled SnapMirror relationship between the on-premises storage device and the FSx for ONTAP instances. (correct answer)
  • DCreate an Amazon Elastic File System (Amazon EFS) file system in each Region. Deploy an AWS DataSync agent in the on-premises data center. Configure a schedule for DataSync to copy the data to Amazon EFS daily.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create Multi-AZ Amazon FSx for NetApp ONTAP instances and volumes in each Region. Configure a scheduled SnapMirror relationship between the on-premises storage device and the FSx for ONTAP instances.

Explanation

Amazon FSx provides fully managed third-party file systems. AWS Config tracks resource configuration changes and evaluates compliance.

Showing questions 221–240 of 431 · Page 12 of 22