🔍

DOP-C02 — questions

Page 20 of 22 · 431 total questions.

DOP-C02 Question 381

Single page →
Topic 1 · Question 381 · Select all that apply

A company uses Amazon API Gateway and AWS Lambda functions to implement an API. The company uses a pipeline in AWS CodePipeline to build and deploy the API. The pipeline contains a source stage, build stage, and deployment stage. The company deploys the API without performing smoke tests. Soon after the deployment, the company observes multiple issues with the API. A security audit finds security vulnerabilities in the production code. The company wants to prevent these issues from happening in the future. Which combination of steps will meet this requirement? (Choose two.)

  • ACreate a smoke test script that returns an error code if the API code fails the test. Add an action in the deployment stage to run the smoke test script after deployment. Configure the deployment stage for automatic rollback.
  • BCreate a smoke test script that returns an error code if the API code fails the test. Add an action in the deployment stage to run the smoke test script after deployment. Configure the deployment stage to fail if the smoke test script returns an error code. (correct answer)
  • CAdd an action in the build stage that uses Amazon Inspector to scan the Lambda function code after the code is built. Configure the build stage to fail if the scan returns any security findings.
  • DAdd an action in the build stage to run an Amazon CodeGuru code scan after the code is built. Configure the build stage to fail if the scan returns any security findings. (correct answer)
  • EAdd an action in the deployment stage to run an Amazon CodeGuru code scan after deployment. Configure the deployment stage to fail if the scan returns any security findings.
Reveal answer & explanation
Correct answer: B, D

The correct answer is B, D. Option B: Create a smoke test script that returns an error code if the API code fails the test. Add an action in the deployment stage to run the smoke test script after deployment. Configure the deployment stage to fail if the... Option D: Add an action in the build stage to run an Amazon CodeGuru code scan after the code is built. Configure the build stage to fail if the scan returns any security findings.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 382

Single page →
Topic 1 · Question 382

A company is implementing a standardized security baseline across its AWS accounts. The accounts are in an organization in AWS Organizations. The company must deploy consistent IAM roles and policies across all existing and future accounts in the organization. Which solution will meet these requirements with the MOST operational efficiency?

  • AEnable AWS Control Tower in the management account. Configure AWS Control Tower Account Factory customization to deploy the required IAM roles and policies to all accounts.
  • BActivate trusted access for AWS CloudFormation StackSets in Organizations. In the management account, create a stack set that has service-managed permissions to deploy the required IAM roles and policies to all accounts. Enable automatic deployment for the stack set. (correct answer)
  • CIn each member account, create IAM roles that have permissions to create and manage resources. In the management account, create an AWS CloudFormation stack set that has self-managed permissions to deploy the required IAM roles and policies to all accounts. Enable automatic deployment for the stack set.
  • DIn the management account, create an AWS CodePipeline pipeline. Configure the pipeline to use AWS CloudFormation to automate the deployment of the required IAM roles and policies. Set up cross-account IAM roles to allow CodePipeline to deploy resources in the member accounts.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Activate trusted access for AWS CloudFormation StackSets in Organizations. In the management account, create a stack set that has service-managed permissions to deploy the required IAM roles and policies to all accoun...

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Organizations centrally governs and secures multiple AWS accounts.

DOP-C02 Question 383

Single page →
Topic 1 · Question 383

A company is migrating its web application to AWS. The application uses WebSocket connections for real-time updates and requires sticky sessions. A DevOps engineer must implement a highly available architecture for the application. The application must be accessible to users worldwide with the least possible latency. Which solution will meet these requirements with the LEAST operational overhead?

  • ADeploy an Application Load Balancer (ALB). Deploy another ALB in a different AWS Region. Enable cross-zone load balancing and sticky sessions on the ALBs. Integrate the ALBs with Amazon Route 53 latency-based routing. (correct answer)
  • BDeploy a Network Load Balancer (NLB). Deploy another NLB in a different AWS Region. Enable cross-zone load balancing and sticky sessions on the NLBs. Integrate the NLBs with Amazon Route 53 geolocation routing.
  • CDeploy a Network Load Balancer (NLB) with cross-zone load balancing enabled. Configure the NLB with IP-based targets in multiple Availability Zones. Use Amazon CloudFront for global content delivery. Implement sticky sessions by using source IP address preservation on the NLB.
  • DDeploy an Application Load Balancer (ALB) for HTTP traffic. Deploy a Network Load Balancer (NLB) in each of the company’s AWS Regions for WebSocket connections. Enable sticky sessions on the ALB. Configure the ALB to forward requests to the NLB.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deploy an Application Load Balancer (ALB). Deploy another ALB in a different AWS Region. Enable cross-zone load balancing and sticky sessions on the ALBs. Integrate the ALBs with Amazon Route 53 latency-based routing.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale.

DOP-C02 Question 384

Single page →
Topic 1 · Question 384

A company has a workflow that generates a file for each of the company's products and stores the files in a production environment Amazon S3 bucket. The company's users can access the S3 bucket. Each file contains a product ID. Product IDs for products that have not been publicly announced are prefixed with a specific UUID. Product IDs are 12 characters long. IDs for products that have not been publicly announces begin with the letter P. The company does not want information about products that have not been publicly announced to be available in the production environment S3 bucket. Which solution will meet these requirements?

  • ACreate a new staging S3 bucket. Generate all files in the new staging bucket. Create an Amazon Macie custom data identifier to identify product IDs in the new bucket that begin with the specific UUID. Launch an Amazon Macie sensitive data discovery job with the custom data identifier. Copy all files that do not have a Macie finding to the production S3 bucket. (correct answer)
  • BCreate an Amazon Macie custom data identifier to identify product IDs in the production bucket that begin with the specific UUID. Launch an Amazon Macie sensitive data discovery job with the custom data identifier. Remove all files that have a Macie finding from the production S3 bucket.
  • CCreate a new staging S3 bucket. Generate all files in the new staging bucket. Launch an Amazon Macie sensitive data discovery job with a managed data identifier. Copy all files that do not have a Macie finding to the production S3 bucket.
  • DCreate an Amazon Macie sensitive data discovery job with a managed data identifier. Remove all files that have a Macie finding from the production S3 bucket.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a new staging S3 bucket. Generate all files in the new staging bucket. Create an Amazon Macie custom data identifier to identify product IDs in the new bucket that begin with the specific UUID. Launch an Amazon...

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Macie discovers and protects sensitive data such as PII in S3.

DOP-C02 Question 385

Single page →
Topic 1 · Question 385

A company uses Amazon RDS for Microsoft SQL Server as its primary database for applications. The company needs to ensure high availability within and across AWS Regions. An Amazon Route 53 CNAME record is configured for the database endpoint. The applications connect to the database endpoint. The company must redirect application traffic to a standby database during a failover event. The company must maintain an RPO of less than 1 minute and an RTO of less than 10 minutes. Which solution will meet these requirements?

  • ADeploy an Amazon RDS for SQL Server Multi-AZ DB cluster deployment that uses cross-Region read replicas. Use automation to promote the read replica to a standalone instance and to update the Route 53 record. (correct answer)
  • BDeploy an Amazon RDS for SQL Server Multi-AZ DB cluster deployment. Set up automated snapshots to be copied to another Region every 5 minutes. Use AWS Lambda to restore the latest snapshot in the secondary Region during failover.
  • CDeploy an Amazon RDS for SQL Server Single-AZ DB instance. Use AWS Database Migration Service (AWS DMS) to replicate data continuously to an RDS DB instance in another Region. Use Amazon CloudWatch alarms to notify the company about failover events.
  • DDeploy an Amazon RDS for SQL Server Single-AZ DB instance. Configure AWS Backup to create cross-Region backups every 30 seconds. Use automation to restore the latest backup and to update the Route 53 record during failover.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deploy an Amazon RDS for SQL Server Multi-AZ DB cluster deployment that uses cross-Region read replicas. Use automation to promote the read replica to a standalone instance and to update the Route 53 record.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency.

DOP-C02 Question 386

Single page →
Topic 1 · Question 386

A company wants to build a pipeline to update the standard AMI monthly. The AMI must be updated to use the most recent patches to ensure that launched Amazon EC2 instances are up to date. Each new AMI must be available to all AWS accounts in the company's organization in AWS Organizations. The company needs to configure an automated pipeline to build the AMI. Which solution will meet these requirements with the MOST operational efficiency?

  • ACreate an AWS CodePipeline pipeline that uses AWS CodeBuild. Create an AWS Lambda function to run the pipeline every month. Create an AWS CloudFormation template. Share the template with all AWS accounts in the organization.
  • BCreate an AMI pipeline by using EC2 Image Builder. Configure the pipeline to distribute the AMI to the AWS accounts in the organization. Configure the pipeline to run monthly. (correct answer)
  • CCreate an AWS CodePipeline pipeline that runs an AWS Lambda function to build the AMI. Configure the pipeline to share the AMI with the AWS accounts in the organization. Configure Amazon EventBridge Scheduler to invoke the pipeline every month.
  • DCreate an AWS Systems Manager Automation runbook. Configure the automation to run in all AWS accounts in the organization. Create an AWS Lambda function to run the automation every month.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an AMI pipeline by using EC2 Image Builder. Configure the pipeline to distribute the AMI to the AWS accounts in the organization. Configure the pipeline to run monthly.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 387

Single page →
Topic 1 · Question 387 · Select all that apply

A company has an application that uses an Amazon API Gateway REST API, AWS Lambda functions, and an Amazon DynamoDB table. The application currently runs in a single AWS Region. The company wants to make the application highly available across two Regions. User traffic must be routed to the Region that provides the least latency. Which combination of steps will meet these requirements? (Choose three.)

  • ACreate a replica of the DynamoDB table in a second Region. (correct answer)
  • BCreate a global secondary index for the DynamoDB table.
  • CCreate copies of the REST API and the Lambda functions in a second Region. (correct answer)
  • DCreate health checks in Amazon Route 53. Create DNS records that include a failover routing policy.
  • ECreate health checks in Amazon Route 53. Create DNS records that include a latency routing policy. (correct answer)
  • FCreate DNS records in Amazon Route 53 that include a multivalue answer routing policy.
Reveal answer & explanation
Correct answer: A, C, E

The correct answer is A, C, E. Option A: Create a replica of the DynamoDB table in a second Region. Option C: Create copies of the REST API and the Lambda functions in a second Region. Option E: Create health checks in Amazon Route 53. Create DNS records that include a latency routing policy.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. Amazon RDS is a managed relational database that handles patching, backups and failover. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

DOP-C02 Question 388

Single page →
Topic 1 · Question 388

A company has a web application that is hosted on Amazon EC2 instances. The company is deploying the application into multiple AWS Regions. The application consists of dynamic content such as WebSocket-based real-time product updates. The company uses Amazon Route 53 to manage all DNS records. Which solution will provide multi-Region access to the application with the LEAST latency?

  • ADeploy an Application Load Balancer (ALB) in front of the EC2 instances in each Region. Create a Route 53 A record with a latency-based routing policy. Add IP addresses of the ALBs as the value of the record.
  • BDeploy an Application Load Balancer (ALB) in front of the EC2 instances in each Region. Deploy an Amazon CloudFront distribution with an origin group that contains the ALBs as origins. Create a Route 53 alias record that points to the CloudFront distribution's DNS address.
  • CDeploy a Network Load Balancer (NLB) in front of the EC2 instances in each Region. Create a Route 53 A record with a multivalue answer routing policy. Add IP addresses of the NLBs as the value of the record.
  • DDeploy a Network Load Balancer (NLB) in front of the EC2 instances in each Region. Deploy an AWS Global Accelerator standard accelerator with an endpoint group for each NLB. Create a Route 53 alias record that points to the accelerator's DNS address. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Deploy a Network Load Balancer (NLB) in front of the EC2 instances in each Region. Deploy an AWS Global Accelerator standard accelerator with an endpoint group for each NLB. Create a Route 53 alias record that points...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Global Accelerator routes users over the AWS backbone to the optimal endpoint for lower latency and fast failover. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. This option meets the real-time / low-latency performance requirement.

DOP-C02 Question 389

Single page →
Topic 1 · Question 389

A company manages its multi-account environment by using AWS Organizations and AWS Control Tower. The company must deploy standardized security controls and compliance policies across all of its AWS accounts and AWS Regions. Any changes to these controls must be automatically applied to all accounts simultaneously. The company has the required security controls and compliance policies defined in AWS Cloud Development Kit (AWS CDK) as a security controls construct. Which solution will deploy these controls across all accounts and Regions with the LEAST operational overhead?

  • ACreate an AWS CDK app that includes an AWS CloudFormation StackSets construct. Configure the StackSets construct to use the security controls construct as its template. Specify the target accounts and Regions. Create automation to deploy the CDK app to create and manage the CloudFormation stack set.
  • BCreate an AWS CDK app that synthesizes an AWS CloudFormation template from the security controls construct. Use Amazon EventBridge to invoke an AWS Lambda function to update a CloudFormation stack set when changes are made to the security controls construct.
  • CConvert the security controls construct to an AWS CloudFormation macro. Create a CloudFormation stack set that references the macro and deploys the macro to all target accounts. Use Organizations to automatically add new accounts to the stack set’s list of target accounts.
  • DUse AWS Control Tower to create a customized landing zone that includes configurations from the security controls construct. Configure AWS Control Tower to automatically enroll new accounts and to apply the landing zone template. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use AWS Control Tower to create a customized landing zone that includes configurations from the security controls construct. Configure AWS Control Tower to automatically enroll new accounts and to apply the landing zo...

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. AWS Control Tower sets up and governs a secure multi-account landing zone.

DOP-C02 Question 390

Single page →
Topic 1 · Question 390

A company needs to manage shared libraries for various projects across its development AWS account and production AWS account. The company has configured IAM roles for developers and has defined an AWS CodePipeline pipeline by using the AWS Cloud Development Kit (AWS CDK). A DevOps engineer must implement a solution to ensure that only developers can access the latest versions of the libraries. The solution must test shared packages independently before the shared packages are consumed by other applications and before they go to production. Which solution will meet these requirements?

  • ACreate a single AWS CodeArtifact repository for development and production in a central account. Use IAM policies for the developer roles to allow only developers to access the shared libraries. Create an Amazon EventBridge role to start an AWS CodeBuild project and to test each package before the package is copied to the production repository.
  • BCreate an AWS CodeArtifact repository in the development account. Create another CodeArtifact repository in the production account. For the development repository, add a repository policy that allows only developers to access the shared libraries. Create an Amazon EventBridge rule to start the CodePipeline pipeline and to test each package before the package is copied to the production repository. (correct answer)
  • CCreate a single Amazon S3 bucket with versioning enabled for development and production in a central account. Use IAM policies for the developer roles to allow only the developers to access the shared libraries. Create an Amazon EventBridge rule to start an AWS CodeBuild project and to test each package before the package is copied to production.
  • DCreate an Amazon S3 bucket with versioning enabled in the development account. Create another S3 bucket with versioning enabled in the production account. For the development S3 bucket, add a bucket policy that allows only developers to access the shared libraries. Create an Amazon EventBridge role to start the CodePipeline pipeline. Configure the role to test each package when the package is copied to production and to revert the changes if the tests fail.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an AWS CodeArtifact repository in the development account. Create another CodeArtifact repository in the production account. For the development repository, add a repository policy that allows only developers t...

Explanation

Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS CodePipeline automates continuous delivery pipelines.

DOP-C02 Question 391

Single page →
Topic 1 · Question 391

A company manages environments for its application in multiple AWS accounts. Each environment account is in a different OU in AWS Organizations. A DevOps team is responsible for the application deployment process across the environments. The deployment process uses an AWS CodePipeline pipeline in a Shared Services account. The DevOps team members are in the same user group. The team members have administrative access to all accounts through AWS IAM Identity Center. A recent deployment problem in the development environment required the DevOps team to perform manual steps. The deployment to the production environment then resulted in an incident that caused the pipeline to fail, which blocked new deployments for several hours. A DevOps engineer needs to ensure that only the pipeline can perform deployments in the production environment. The DevOps engineer must have access to the environment in case of an emergency. Which solution will meet these requirements with the MOST operational efficiency?

  • AUpdate the DevOps group to have the ReadOnlyAccess permission set for the production accounts. Configure the DevOps engineer user with a new permission set that has AdministratorAccess permissions and that allows the user to assume the pipeline role. Add an SCP that denies modification of resources by any entity other than the pipeline role. (correct answer)
  • BCreate an SCP that denies all write actions for the DevOps team members on the production OU. Configure a new user in IAM Identity Center for the DevOps engineer with a new permission set that has AdministratorAccess permissions. Add an SCP that denies modification of resources by any entity other than the pipeline role.
  • CUpdate the DevOps group to be able to assume the pipeline role for the production accounts. Configure a new user in IAM Identity Center for the DevOps engineer with a new permission set that has AdministratorAccess permissions. Add an SCP that denies modification of resources by any entity other than the DevOps engineer.
  • DCreate an SCP that denies all write actions for the DevOps team members on the production OU. Use a specific tag to tag the resources that CodePipeline provisions. Add an SCP that denies modification of tagged resources by any entity other than the DevOps engineer.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Update the DevOps group to have the ReadOnlyAccess permission set for the production accounts. Configure the DevOps engineer user with a new permission set that has AdministratorAccess permissions and that allows the...

Explanation

Service Control Policies set guardrails on what accounts in an organization can do. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 392

Single page →
Topic 1 · Question 392

A company builds container images and stores them on Amazon Elastic Container Registry (Amazon ECR) in the company's primary AWS Region. A DevOps engineer wants to replicate all the company's ECR repository images to a secondary Region. The DevOps engineer creates a new ECR repository in the secondary Region and configures permission on the new repository to allow replication. Which solution will meet these requirements with the MOST operational efficiency?

  • APull the existing primary ECR images and then push the images to the secondary ECR repository. Create a replication rule on the primary ECR registry to replicate the images to the secondary ECR registry. (correct answer)
  • BPull the existing primary ECR images and then push the images to the secondary ECR repository. Configure permission on the primary ECR registry to allow access from the secondary Region.
  • CConfigure permission on the primary ECR registry to allow access from the secondary Region. Create a replication rule on the primary ECR registry to replicate the images to the secondary ECR registry.
  • DConfigure an AWS Lambda function to automatically save the ECR images to an Amazon S3 bucket. Configure cross-Region replication for the S3 bucket. Configure a second Lambda function to push the images to ECR repositories in the replication destination Region when images are replicated to the S3 bucket.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Pull the existing primary ECR images and then push the images to the secondary ECR repository. Create a replication rule on the primary ECR registry to replicate the images to the secondary ECR registry.

DOP-C02 Question 393

Single page →
Topic 1 · Question 393

A company is experiencing failures in its AWS CodeDeploy deployments for a critical application. The application is deployed on Amazon EC2 instances. A DevOps engineer must analyze the failed deployments to identify the root cause of the failures. Which solution will provide the appropriate information to troubleshoot the deployment issues?

  • AConfigure VPC Flow Logs to monitor network traffic. Use Amazon Inspector to detect non-network deployment issues. Use Amazon Detective to analyze the findings.
  • BEnable detailed monitoring on the EC2 instances. Use AWS Systems Manager Run Command to run troubleshooting scripts on all the EC2 instances simultaneously. Analyze the results in AWS CloudTrail logs.
  • CUse Amazon CloudWatch Logs to review application logs. Analyze CodeDeploy deployment logs in the /opt/codedeploy-agent/deployment-root/ directory on the EC2 instances. Use AWS X-Ray to trace requests through the application components. (correct answer)
  • DExamine AWS Trusted Advisor checks for the CodeDeploy deployments. Use the AWS Health Dashboard to monitor application health. Analyze performance metrics in Amazon CloudWatch dashboards.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use Amazon CloudWatch Logs to review application logs. Analyze CodeDeploy deployment logs in the /opt/codedeploy-agent/deployment-root/ directory on the EC2 instances. Use AWS X-Ray to trace requests through the appli...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS CodeDeploy automates application deployments to compute services.

DOP-C02 Question 394

Single page →
Topic 1 · Question 394 · Select all that apply

A company has developed a web application that conducts seasonal sales on public holidays. The web application is deployed on AWS and uses AWS services for storage, database, computing, and encryption. During seasonal sales, the company expects high network traffic from a large number of users. The company must receive insights regarding any unexpected behavior during the sale. A DevOps team wants to review the insights upon detecting anomalous behaviors during the sale. The DevOps team wants to receive recommended actions to resolve the anomalous behaviors. The recommendations must be provided on the provisioned infrastructure to address the issues that might occur in the future. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)

  • AEnable Amazon DevOps Guru in the AWS account. Determine the coverage for DevOps Guru for all supported AWS resources in the account. Use the DevOps Guru dashboard to find the analysis, recommendations, and related metrics. (correct answer)
  • BCreate an Amazon Simple Notification Service (Amazon SNS) topic. Configure Amazon DevOps Guru to send notifications about important events to the company when anomalies are identified. (correct answer)
  • CCreate an Amazon S3 bucket. Store Amazon CloudWatch logs, AWS CloudTrail data, and AWS Config data in the S3 bucket. Use Amazon Athena to generate insights on the data. Create a dashboard by using Amazon QuickSight.
  • DConfigure email message reports for an Amazon QuickSight dashboard. Schedule and send the email reports to the company.
  • ECreate an Amazon Simple Notification Service (Amazon SNS) topic. Configure Amazon Athena to send query results about important events to the company when anomalies are identified.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Enable Amazon DevOps Guru in the AWS account. Determine the coverage for DevOps Guru for all supported AWS resources in the account. Use the DevOps Guru dashboard to find the analysis, recommendations, and related met... Option B: Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure Amazon DevOps Guru to send notifications about important events to the company when anomalies are identified.

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 395

Single page →
Topic 1 · Question 395

A DevOps engineer needs to design a cloud-based solution to standardize deployment artifacts for AWS Cloud deployments and on-premises deployments. There is currently no routing traffic between the on-premises data center and the AWS environment. The solution must be able to consume downstream packages from public repositories and must be highly available. Data must be encrypted in transit and at rest. The solution must store the deployment artifacts in object storage and deploy the deployment artifacts into Amazon Elastic Container Service (Amazon ECS). The deployment artifacts must be encrypted in transit if the deployment artifacts travel across the public internet. The DevOps engineer needs to deploy this solution in less than two weeks. Which solution will meet these requirements?

  • BUse an AWS Direct Connect connection and a VPN connection to connect the on-premises data center to AWS. Deploy third-party artifact management software on Amazon EC2 instances.
  • CUse two AWS VPN connections to connect the on-premises data center to AWS. Use AWS CodeArtifact to store the deployment artifacts. (correct answer)
  • DUse parallel AWS Direct Connect connections to connect the on-premises data center to AWS. Deploy third-party artifact management software on Amazon EC2 instances.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use two AWS VPN connections to connect the on-premises data center to AWS. Use AWS CodeArtifact to store the deployment artifacts. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

DOP-C02 Question 396

Single page →
Topic 1 · Question 396

A DevOps engineer successfully creates an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that includes managed node groups. When the DevOps engineer tries to add node groups to the cluster, the cluster returns an error that states, "NodeCreationFailure: Instances failed to join the Kubernetes cluster." The DevOps engineer confirms that the EC2 worker nodes are running and that the EKS cluster is in an active state. How should the DevOps engineer troubleshoot this issue?

  • AEnsure that the EKS cluster's VPC subnets do not overlap with the 172.17.0.0/16 CIDR range.
  • BUse kubectl to update the kubeconfig file to use the credentials that created the cluster.
  • CRun the AWSSupport-TroubleshootEKSWorkerNode runbook. (correct answer)
  • DCreate an AWS Identity and Access Management (IAM) OpenID Connect (OIDC) provider for the cluster.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Run the AWSSupport-TroubleshootEKSWorkerNode runbook.

Explanation

Amazon EKS runs managed Kubernetes when you need the Kubernetes ecosystem.

DOP-C02 Question 397

Single page →
Topic 1 · Question 397

A company is developing an ecommerce application that has a backend that runs on Amazon EC2 instances. The application has a static frontend website that is hosted in an Amazon S3 bucket. The company uses a GitHub repository for version control and must automate builds and deployments whenever code is pushed to the main branch. The company must deploy changes to the frontend and backend independently of each other. Which solution will meet these requirements?

  • ACreate a single AWS CodePipeline pipeline to use for the frontend and the backend. Specify the GitHub repository as the source. Configure two build stages that use AWS CodeBuild as the action provider to build the frontend components and backend components, respectively. Configure two deployment stages that use AWS CodeDeploy as the action provider to deploy the frontend and backend, respectively.
  • BCreate a single AWS CodePipeline pipeline to use for the frontend and the backend. Specify the GitHub repository as the source. Configure two build stages that use AWS CodeBuild as the action provider to build the frontend components and backend components, respectively. Configure two deployment stages. For the backend stage, use AWS CodeDeploy as the action provider to deploy the backend to the EC2 instances. For the frontend stage, use Amazon S3 as the action provider to deploy the frontend to the S3 bucket.
  • CCreate two AWS CodePipeline pipelines: one for the frontend and one for the backend. Specify the GitHub repository as the source. Configure a build stage that uses AWS CodeBuild as the action provider for each pipeline to build the frontend and the backend. Configure a deployment stage that uses AWS CodeDeploy as the action provider for each pipeline to deploy the frontend and the backend.
  • DCreate two AWS CodePipeline pipelines: one for the frontend and one for the backend. Specify the GitHub repository as the source. Configure a build stage that uses AWS CodeBuild as the action provider for each pipeline to build the frontend and the backend. For the backend pipeline, use AWS CodeDeploy as the action provider to deploy the backend to the EC2 instances. For the frontend pipeline, use Amazon S3 as the action provider to deploy the frontend to the S3 bucket. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create two AWS CodePipeline pipelines: one for the frontend and one for the backend. Specify the GitHub repository as the source. Configure a build stage that uses AWS CodeBuild as the action provider for each pipelin...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

DOP-C02 Question 398

Single page →
Topic 1 · Question 398

A company has an RPO of 24 hours and an RTO of 10 minutes for a critical web application that runs on Amazon EC2 instances. The company uses AWS Organizations to manage its AWS account. The company wants to set up AWS Backup for its AWS environment. A DevOps engineer configures AWS Organizations for AWS Backup. The DevOps engineer creates a new centralized AWS account to store the backups. Each EC2 instance has four Amazon Elastic Block Store (Amazon EBS) volumes attached. Which solution will meet this requirement MOST securely?

  • ACreate encrypted backup vaults and customer managed AWS KMS keys in both accounts. Configure AWS Backup to create full EC2 backups as AMIs. Copy the backups to the centralized vault. (correct answer)
  • BCreate encrypted vaults in both accounts by using the source account's AWS KMS key. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.
  • CCreate backup vaults in both accounts. Use AWS managed keys for encryption. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.
  • DCreate encrypted vaults in both accounts. Use a customer managed KMS key in the source account. Use an AWS managed key in the centralized account. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create encrypted backup vaults and customer managed AWS KMS keys in both accounts. Configure AWS Backup to create full EC2 backups as AMIs. Copy the backups to the centralized vault.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Backup centrally automates and manages backups across AWS services. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

DOP-C02 Question 399

Single page →
Topic 1 · Question 399

A company wants to proactively monitor and respond to AWS service issues that might affect an application. The company must correlate AWS Health events with application performance metrics and must set up automated alerts. The solution must give the company the ability to archive events, test the application's latency in different scenarios, and create custom metrics. Which solution will meet these requirements?

  • AUse AWS CloudTrail to log all AWS Health events. Use Amazon Athena to query the logs and to correlate the logs with application metrics stored in Amazon Timestream for LiveAnalytics. Set up AWS Chatbot for real-time notifications.
  • BUse Amazon EventBridge to route AWS Health events to Amazon CloudWatch Logs. Create a metric filter for AWS Health events. Create custom metrics in CloudWatch that are based on application performance data. Set up CloudWatch alarms that correlate AWS Health events with the custom metrics. (correct answer)
  • CConfigure the AWS Health Dashboard to send notifications to Amazon Simple Notification Service (Amazon SNS). Use AWS Lambda to correlate the notifications with metrics and to update custom metrics in Amazon CloudWatch. Set up CloudWatch alarms for the custom metrics. Use AWS Systems Manager for automated remediation.
  • DConfigure AWS X-Ray to trace AWS Health events and application performance. Use Amazon QuickSight to visualize the correlations between events and metrics. Use Amazon GuardDuty to detect anomalies in the application's behavior and to provide alerts.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use Amazon EventBridge to route AWS Health events to Amazon CloudWatch Logs. Create a metric filter for AWS Health events. Create custom metrics in CloudWatch that are based on application performance data. Set up Clo...

Explanation

Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

DOP-C02 Question 400

Single page →
Topic 1 · Question 400 · Select all that apply

A company uses a CI/CD pipeline to deploy its workload in the ap-southeast-2 Region. The company receives images through a Network Load Balancer (NLB) and processes the images in AWS Fargate tasks on an Amazon Elastic Container Service (Amazon ECS) cluster. An Amazon Elastic Container Registry (Amazon ECR) repository stores the images as Docker images. The company uses Amazon Route 53 to configure DNS. The company saves the images in an Amazon S3 bucket and saves the metadata from the images in an Amazon DynamoDB table. The company wants to expand the workload to a second Region. A DevOps engineer needs to build a highly available and resilient design to expand the workload to the eu-west-2 Region. Which combination of steps will meet these requirements with the FEWEST configuration changes? (Choose three.)

  • AConfigure ECR replication to eu-west-2 on the repository. Configure an NLB in eu-west-2 that resolves to Fargate tasks in an ECS cluster in eu-west-2. Configure a latency routing policy in Route 53 for the two workloads. (correct answer)
  • BConfigure the DynamoDB table as a global table with a replica in eu-west-2. Configure the Fargate tasks to interact with the DynamoDB table in ap-southeast-2.
  • CConfigure the DynamoDB table as a global table with a replica in eu-west-2. Configure the Fargate tasks to interact with the DynamoDB table in the same Region that the tasks run in. (correct answer)
  • DConfigure a new S3 bucket in eu-west-2. Configure data replication between the S3 bucket in ap-southeast-2 and the S3 bucket in eu-west-2. Configure the Fargate tasks to use the S3 bucket in the same Region that the tasks run in to perform S3 PUT operations and GET operations.
  • EConfigure an S3 Multi-Region Access Point for the S3 bucket in ap-southeast-2 and a new S3 bucket in eu-west-2. Configure two-way replication on the S3 buckets. Configure the workloads to use the Multi-Region Access Point for S3 PUT operations and GET operations. (correct answer)
  • FConfigure the CI/CD pipeline to deploy ECR images to both Regions. Configure an NLB in eu-west-2 that resolves to Fargate tasks in an ECS cluster in eu-west-2. Configure a failover routing policy in Route 53 for the two workloads.
Reveal answer & explanation
Correct answer: A, C, E

The correct answer is A, C, E. Option A: Configure ECR replication to eu-west-2 on the repository. Configure an NLB in eu-west-2 that resolves to Fargate tasks in an ECS cluster in eu-west-2. Configure a latency routing policy in Route 53 for the two workloads. Option C: Configure the DynamoDB table as a global table with a replica in eu-west-2. Configure the Fargate tasks to interact with the DynamoDB table in the same Region that the tasks run in. Option E: Configure an S3 Multi-Region Access Point for the S3 bucket in ap-southeast-2 and a new S3 bucket in eu-west-2. Configure two-way replication on the S3 buckets. Configure the workloads to use the Multi-Region Access P...

Explanation

AWS Fargate runs containers serverlessly so there are no EC2 hosts to manage or patch. Amazon ECS orchestrates containers and integrates natively with AWS networking and IAM. Amazon S3 provides durable, scalable object storage that is fully managed. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Showing questions 381–400 of 431 · Page 20 of 22