AWS DevOps Practise Test (DOP-C02) Practise Test – 3

September 6, 2024

Are you ready to elevate your AWS DevOps skills? Our comprehensive practice test quiz is designed to help you prepare for AWS DevOps certification exams and enhance your understanding of essential DevOps concepts and practices.

What’s Inside:

Realistic Questions: Test your knowledge with questions that closely mirror those found on the AWS DevOps certification exams.
Detailed Explanations: Gain deeper insights with explanations for each question, helping you understand the rationale behind correct answers.
Diverse Topics: Cover a broad range of topics including continuous integration and continuous deployment (CI/CD), infrastructure as code (IaC), monitoring, and automation.
Instant Feedback: Receive immediate feedback on your performance to identify strengths and areas for improvement.

Why Take This Quiz?

Boost Confidence: Build confidence in your AWS DevOps skills and improve your exam readiness.
Practice Flexibly: Test your knowledge anytime, anywhere with our online quiz format.
Track Progress: Monitor your progress over time and see how your skills are advancing.

Whether you’re aiming for certification or simply looking to refine your DevOps expertise, our practice test quiz is a valuable tool for achieving your goals. Start your practice now and take the next step towards AWS DevOps mastery!

AWS DevOps Practise Test - (DOP-C02)

Practise Test-3

1 / 25

A project has two AWS accounts, a development account and a production account, in the us-east-1 Region. A DevOps engineer has to deploy artifacts from the development account's S3 bucket to the production account's S3 bucket using AWS CodePipeline with Amazon S3 deploy action.

What configurations are mandatory for this cross-account deployment? (Select two)

Configure a cross-account role in the production account. Attach a policy to your CodePipeline service role in the development account that allows it to assume the cross-account role that you created

You need to use an AWS KMS multi-Region key with multiple replicas

Create an AWS KMS key to use with CodePipeline in the development account. Also, the input bucket from the development account must have versioning activated to work with CodePipeline

Create Secrets Manager key to use with CodePipeline in the development account

Configure a cross-account role in the development account. Attach a policy to the S3 bucket in the production account that allows access to the cross-account role that you created

2 / 25

A company uses AWS CodeDeploy to deploy an AWS Lambda function as the final step of a CI/CD pipeline. The company has developed the Lambda function to handle incoming orders through an order-processing API. The DevOps team has noticed intermittent failures in the API occurring for a brief period after deploying the Lambda function. Upon investigation, the team suspects that the failures are a result of incomplete propagation of database changes before the Lambda function gets invoked.

What measures can help resolve this issue?

Add a BeforeInstall hook to the AppSpec file that tests and waits for any necessary database changes before deploying a new version of the Lambda function

Add a BeforeAllowTraffic hook to the AppSpec file that tests and waits for any necessary database changes before traffic can flow to the new version of the Lambda function

Add an AfterAllowTestTraffic hook to the AppSpec file that tests and waits for any necessary database changes after allowing a test traffic

Add a ValidateService hook to the AppSpec file that validates that any necessary database changes are propagated

3 / 25

The DevOps team for an e-commerce company wants to implement a patching plan on AWS Cloud for a large mixed fleet of Windows and Linux servers. The patching plan has to be auditable and must be implemented securely to ensure compliance with the company's business requirements.

Which of the following options would you recommend to address these requirements with MINIMAL effort? (Select two)

Set up an OS-native patching service to manage the update frequency and release approval for all instances. Set up AWS Config to provide audit and compliance reporting

Apply patch baselines using the AWS-ApplyPatchBaseline SSM document

Configure CloudFormation automatic patching support for all applications which will keep the OS up-to-date following the initial installation. Set up AWS Config to provide audit and compliance reporting

Apply patch baselines using the AWS-RunPatchBaseline SSM document

Set up Systems Manager Agent on all instances to manage patching. Test patches in pre-production and then deploy as a maintenance window task with the appropriate approval

4 / 25

An Aurora cluster is configured with a single DB instance for a web application. The application uses the instance endpoint to read/write data to the database. The operations team has scheduled an update on the cluster during the upcoming maintenance window. The application support team has requested help to ensure uninterrupted access to the application during the maintenance window.

Which step should a DevOps Engineer take so that the users experience the least possible interruption during the maintenance window?

Turn on the Multi-AZ option on the Aurora cluster write operations. Update the application configuration to use the Aurora cluster endpoint for write operations. Read operations will automatically be served since its a Multi-AZ cluster configuration

Add a reader instance to the Aurora cluster. Update the application configuration to use the Aurora cluster endpoint for write operations. Update the Aurora cluster reader endpoint for read operations

Turn on the Multi-AZ option on the Aurora cluster. Update the application configuration to use the Aurora cluster Multi-AZ instance endpoint for read/write operations

Add a reader instance to the Aurora cluster. Update the application configuration to use the Aurora cluster custom endpoints by creating two groups of DB instances, one for read and the other for write requests. Update the Aurora cluster's reader endpoint to point to the read DB group of instances

5 / 25

A video-sharing application stores its files on an Amazon S3 bucket. During the last year, the user traffic has multiplied by thousands and the company is planning on introducing subscription services for its video sharing application. The company needs the access pattern of the video files to identify the most viewed and downloaded videos.

Which of the following would you identify as the MOST cost-effective solution that can be implemented at the earliest?

Enable server access logging on the S3 bucket. Configure Amazon Athena to create an external table with the log files. Use SQL query to analyze the access patterns from Athena

Enable server access logging on the S3 bucket. Use Amazon Redshift Spectrum to efficiently query large datasets leveraging the massive parallelism offered by dedicated Amazon Redshift servers

Leverage Amazon S3 request metrics from CloudWatch for analysis via an AWS Lambda function. The AWS/S3 namespace includes the request metrics GetRequests and BytesDownloaded that can be passed to the Lambda function for analyzing the access pattern of the S3 bucket. The output of the Lambda function can be stored in an S3 bucket and visually analyzed using Amazon QuickSight

Enable server access logging on the S3 bucket. Configure file create event notification on Access log S3 bucket to trigger an AWS Lambda function. Configure Lambda to write the data to Kinesis Firehose which then writes the log data to Amazon OpenSearch Service. Use Elasticsearch search and analytics engine for analyzing usage patterns of the S3 access logs

6 / 25

A company wants to enforce regulations to prevent frequent logins by DevOps engineers to the Amazon EC2 instances, with the added condition that immediate notification must be sent to the security team if any login occurs.

What solution would you suggest to meet these requirements?

Configure AWS CloudTrail to track AWS API calls and log them to Amazon CloudWatch Logs. Subscribe CloudWatch Logs to Amazon Kinesis. Set up an AWS Lambda function as a consumer for the Kinesis stream to process the logs and detect any user logins. Use Amazon SNS to send notifications to the security team upon detecting a login event

Set up the Amazon CloudWatch Agent on each Amazon EC2 instance with the configuration to push all logs to Amazon CloudWatch Logs. Create a CloudWatch subscription filter to detect user logins. Use Amazon SNS to notify the security team when a login is detected

Set up the Amazon CloudWatch Agent on each Amazon EC2 instance with the configuration to push all logs to Amazon CloudWatch Logs. Create a CloudWatch metric filter to detect user logins. Use Amazon SNS to notify the security team when a login is detected

Set up the Amazon Inspector Agent on each Amazon EC2 instance with the configuration to push all logs to Amazon CloudWatch Logs. Create a CloudWatch metric filter to detect user logins. Use Amazon SNS to notify the security team when a login is detected

7 / 25

A company implements access control by creating different policies for different job functions. These policies are attached to IAM roles/groups with minimum permissions necessary for the job function. Up until this point, the solution has been functioning effectively. However, with business expansion, the administrator has to frequently update the existing policies to allow access to new resources.

Which of the following solutions can make the access control applicable to all new resources without the need to update the policies?

Create a Resource-based policy on the newly created resources to add to the existing permissions of the IAM roles accessing the created resources

Configure Access control lists (ACLs) to allow access to certain principals in the account. Add the ACLs to a session policy to dynamically add permissions to the IAM role that the user already has

Configure Attribute-based access control by use of tags. Create tags for IAM roles based on their function. Whenever a new resource is created, add these tag(s) to the resource for immediate access to the resource created

Create an AWS Organization and enable all the features. Attach identity-based IAM roles for newly created resources and share them using Service control policies (SCPs) with all member accounts of the organization

8 / 25

A media company extensively uses Amazon S3 buckets for storing images files, documents, and other business-specific data. The company has mandated enabling logging for all Amazon S3 buckets. The audit team publishes the reports of all AWS resources failing company security standards. Until recently, the security team would pick the list of noncompliant Amazon S3 buckets from the audit list and execute remediation actions manually for each resource. This process is not only time-consuming but also leaves noncompliant resources vulnerable for a long duration.

Which combination of steps should a DevOps Engineer take to meet these requirements using an automated solution? (Select two)

Configure AWS Config Auto Remediation for the AWS Config rule s3-bucket-logging-enabled. From the remediation action list choose AWS-ConfigureS3BucketLogging

The AutomationAssumeRole in the remediation action parameters should be assumable by SSM. The user must have pass-role permissions for that role when they create the remediation action in AWS Config

Configure AWS Config Auto Remediation for the AWS Config rule s3-logging-enabled. Create your own custom remediation action using AWS Systems Manager Automation documents to enable logging on the S3 bucket

Configure AWS Config Auto Remediation for the AWS Config rule s3-bucket-logging-enabled. From the remediation action list choose AWS Lambda to implement a custom function that will enable S3 logging for the S3 bucket ID passed

While setting up remediation action, pass the resource ID of non-compliant resources to the remediation action. This configuration is mandatory for auto-remediation to work

9 / 25

A social media company has its web application hosted on Amazon EC2 instances that are deployed in a single AWS Region. The company has now expanded its operations into new geographies and the company wants to offer low-latency access for the application to its customers. To comply with different financial regulations of each geography, the application needs to operate in silos and the underlying instances in one region should not interact with instances running in other regions.

Which of the following represents the most optimal solution to automate the application deployment to different AWS regions?

Create a shell script that uses the AWS CLI to query the current state in one region and output an AWS CloudFormation template. Create a CloudFormation stack from the template by using the AWS CLI, specifying the --region parameter to deploy the application to other regions

Create a CloudFormation template describing the application infrastructure in the Resources section. Use CloudFormation stack set from an administrator account to launch stack instances that deploy the application to various other regions

Create a CloudFormation template describing the application infrastructure in the Resources section. Create a CloudFormation stack from the template by using the AWS CLI, specify multiple regions using the --regions parameter to deploy the application

Create a CloudFormation template describing the application infrastructure in the Resources section. Use CloudFormation change set from an administrator account to launch stack instances that deploy the application to various other regions

10 / 25

A company wants to create an automated monitoring solution to generate real-time customized notifications regarding unrestricted security groups in the company's production AWS account. The notification must contain the name and ID of the noncompliant security group. The DevOps team at the company has already activated the restricted-ssh AWS Config managed rule. The team has also set up an Amazon Simple Notification Service (Amazon SNS) topic and subscribed relevant personnel to it.

Which of the following options represents the BEST solution for the given scenario?

Set up an Amazon EventBridge rule that matches all AWS Config evaluation results for the restricted-ssh rule. Create an input transformer for the EventBridge rule. Set up the EventBridge rule to publish a notification to the SNS topic. Set up a filter policy on the SNS topic to send only notifications that contain the text of NON_COMPLIANT in the notification to subscribers

Set up an Amazon EventBridge rule that matches an AWS Config evaluation result of NON_COMPLIANT for the restricted-ssh rule. Create an input transformer for the EventBridge rule. Set up the EventBridge rule to publish a notification to the SNS topic

Set up an Amazon EventBridge rule that matches an AWS Config evaluation result of NON_COMPLIANT for all AWS Config managed rules. Create an input transformer for the EventBridge rule. Set up the EventBridge rule to publish a notification to the SNS topic. Set up a filter policy on the SNS topic to send only notifications that contain the text of NON_COMPLIANT in the notification to subscribers

Set up an Amazon EventBridge rule that matches an AWS Config evaluation result of ERROR for the restricted-ssh rule. Create an input transformer for the EventBridge rule. Set up the EventBridge rule to publish a notification to the SNS topic

11 / 25

A DevOps Engineer needs to use the AWS CloudFormation stack to deploy an application. But the DevOps Engineer does not have the required permissions to provision the resources specified in the AWS CloudFormation template.

Which solution will allow the DevOps Engineer to deploy the stack while providing the least privileges possible?

Create an AWS CloudFormation service role with full permissions and associate this service role to the stack. Grant the developer iam:PassRole permissions. Limit the permissions to pass a role based on tags attached to the role using the ResourceTag/key-name condition key

Create an AWS CloudFormation service role with required permissions and associate this service role to the stack. Grant the developer iam:PassRole permissions to pass the role to the service. Use this newly created service role during stack deployments

Create an AWS CloudFormation service role with required permissions and associate this service role to the stack. Use this newly created service role during stack deployments

Create an AWS CloudFormation service role with necessary permissions and use aws:SourceIp AWS-wide condition to specify the IP addresses of the developers. Associate this service role to the stack. Grant the developer iam:PassRole permissions to pass the role to the service. Use this newly created service role during stack deployments

12 / 25

A company has hundreds of AWS accounts and has also created an organization in AWS Organizations to manage the accounts. The company wants a dashboard to seamlessly search, visualize, and analyze CloudWatch metrics data, logs data, and traces (from AWS X-Ray) from all the linked accounts into a single security and operations account. The solution should automatically onboard any new AWS accounts created later in the organization.

As a DevOps Engineer, what solution do you suggest to address the given requirements?

Configure CloudWatch Metric Streams to stream real-time metrics data to Kinesis Data Firehose. Firehose will push the metrics data to Amazon Simple Storage Service (Amazon S3) bucket. configure Amazon Athena to create a dashboard with the metrics data

Create a CloudWatch alarm for the CloudWatch metrics and trigger an event on Amazon EventBridge. Write the metrics data to the Amazon S3 bucket. Use Amazon Athena to create visualizations and dashboards from CloudWatch metrics data, logs data, and traces

Use Amazon CloudWatch cross-account observability to set up security and operations account as the monitoring account and link it with rest of the member accounts of the organization using AWS Organizations

Use the Amazon CloudWatch cross-account observability feature from the CloudWatch console to create the monitoring account and connect the individual AWS accounts to the monitoring account

13 / 25

A DevOps engineer is currently involved in a data archival project where the task is to migrate on-premises data to an Amazon S3 bucket. The engineer has created a script that handles the incremental archiving of on-premises data, specifically transferring data older than 6 months to Amazon S3. As part of the process, the data is removed from the on-premises location after being successfully transferred using the S3 PutObject operation.

During a thorough code review, the DevOps engineer identified a crucial issue in the script. The script does not include any validation to confirm whether the data is copied to Amazon S3 without any corruption. To ensure data integrity throughout the transmission, the DevOps engineer needs to update the script accordingly. The new solution must use MD5 checksums to verify the data integrity before allowing the deletion of the on-premises data.

Considering these requirements, what modifications or solutions should the DevOps engineer implement in the script to ensure successful data transfer and integrity validation? (Select two)

Provide the MD5 digest as a custom name-value pair in the metadata of the object. Examine the Amazon S3's call return status to check for an error

Provide the MD5 digest as a trailing checksum of the object. Examine the Amazon S3's call return status to check for an error

Examine the returned response for the ETag. Compare the ETag value of the object with a calculated or previously stored Content-MD5 digest

Provide the MD5 digest within the Content-MD5 parameter of the PUT command. Examine the Amazon S3's call return status to check for an error

Examine the returned response for the version ID. Compare the version ID value of the object with a calculated or previously stored Content-MD5 digest

14 / 25

A company uses multiple AWS accounts to help isolate and manage business applications. This multi-account environment consists of an AWS Transit Gateway to route all outbound traffic through a common network account. A firewall appliance inspects all traffic before it is forwarded to an internet gateway. The firewall appliance is configured to send logs to Amazon CloudWatch Logs for all events generated.

Recently, the security team has advised about probable illegal access of resources. As DevOps Engineer, you have been advised to configure an alert to the security team if the firewall appliance generates an event of Critical severity.

How should a DevOps engineer configure this requirement?

Create a metric filter on Amazon CloudWatch by filtering the log data to match the term Critical from log events. Publish a custom metric for the finding. Use CloudWatch Lambda Insights to filter out the Critical event and send a notification using an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the email address of the security team to the SNS topic

Create a metric filter on Amazon CloudWatch by filtering the log data to match the term Critical from log events. Configure a metric stream using Kinesis Data Firehose delivery stream and AWS Lambda as the destination. Process the stream data with Lambda and send notification to an Amazon Simple Notification Service (Amazon SNS) topic if Critical event is detected. Subscribe the email address of the security team to the SNS topic

Create a metric filter on Amazon CloudWatch by filtering the log data to match the term Critical from log events. Publish a custom metric for the finding and configure a CloudWatch alarm on this custom metric to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the email address of the security team to the SNS topic

Create a Transit Gateway Flow Log to capture all the information sent by the firewall appliance. Publish the flow log data to Amazon CloudWatch logs. Create a metric filter on Amazon CloudWatch by filtering the log data to match the term Critical from log events. Publish a custom metric for the finding and configure a CloudWatch alarm on this custom metric to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the email address of the security team to the SNS topic

15 / 25

A company hosts all its web applications on Amazon EC2 instances. The company is looking for a security solution that will proactively detect software vulnerabilities and unintended network exposure of the instances. The solution should also include an audit trail of all login activities on the instances.

Which solution will meet these requirements?

Configure Amazon GuardDuty to detect vulnerabilities and threats on the EC2 instances. Integrate with a workflow system to review the findings and trigger an AWS Lambda function to automate the remediation process

Configure AWS Systems Manager's Systems Manager (SSM) agent to collect software vulnerabilities of the Amazon EC2 instances. Configure a Systems Manager Automation runbook to automatically patch the vulnerabilities identified by the SSM agent

Configure Amazon ECR image scanning to scan for vulnerabilities on the EC2 instances. Amazon ECR sends an event to Amazon EventBridge when an image scan is completed. Configure CloudTrail to send its trail data to Amazon EventBridge for further processing/notification

Configure Amazon Inspector to detect vulnerabilities on the EC2 instances. Install the Amazon CloudWatch Agent to capture system logs and record them via Amazon CloudWatch Logs. Configure your trail to send log events to CloudWatch Logs

16 / 25

Consider a multi-account setup within AWS Organizations where a company is running a data ingestion application on Amazon EC2 instances through several Auto Scaling groups. These instances lack internet access due to sensitive data handling, and VPC endpoints have been deployed accordingly. The application operates on a custom AMI designed specifically for its needs.

To effectively manage and troubleshoot the application, system administrators require automated and centralized login access to the EC2 instances. Additionally, the company's security team needs to be notified whenever such instances are accessed.

As an AWS Certified DevOps Engineer - Professional, what solution will you suggest to satisfy these requirements?

Utilize EC2 Image Builder to rebuild the custom AMI that includes the latest AWS Systems Manager Agent version. Set up the Auto Scaling group to attach the AmazonSSMManagedInstanceCore role to EC2 instances. Leverage EC2 Instance Connect for centralized access and automated login. Configure logging of session details to Amazon S3. Set up an S3 event notification for new file uploads to notify the security team via an Amazon Simple Notification Service (Amazon SNS) topic

Set up a NAT gateway and a bastion host with internet access. Configure a security group that permits incoming traffic from the bastion host to all EC2 instances. Set up AWS Systems Manager Agent on the EC2 instances for monitoring and troubleshooting. Leverage Auto Scaling group lifecycle hooks for monitoring access. Utilize Systems Manager Session Manager for centralized login. Direct EC2 instance logs to an Amazon CloudWatch Logs log group. For auditing purposes, export data to Amazon S3 and notify the security team through S3 event notifications

Utilize EC2 Image Builder to rebuild the custom AMI that includes the latest AWS Systems Manager Agent version. Set up the Auto Scaling group to attach the AmazonSSMManagedInstanceCore role to EC2 instances. Leverage Systems Manager Session Manager for centralized and automated login. Configure logging of session details to Amazon S3. Set up an S3 event notification for new file uploads to notify the security team via an Amazon Simple Notification Service (Amazon SNS) topic

Utilize AWS Systems Manager Automation to rebuild the custom AMI that includes the latest AWS Systems Manager Agent version. Configure AWS Config to attach an SCP to the root organization account to allow the EC2 instances to connect to Systems Manager and grant access to centralized and automated login. Configure logging of session details to Amazon S3. Set up an S3 event notification for new file uploads to notify the security team via an Amazon Simple Notification Service (Amazon SNS) topic

17 / 25

A support team wants to be notified via an Amazon Simple Notification Service (Amazon SNS) notification when an AWS Glue job fails a retry.

As a DevOps Engineer, how will you implement this requirement?

Amazon Simple Notification Service (Amazon SNS) cannot retry failures, leverage Amazon Simple Queue Service (Amazon SQS) dead-letter queues to retry the failed Glue jobs

Check the AWS Personal Health Dashboard for failed AWS Glue jobs. Schedule an AWS Lambda function to pick the failed event from the service health dashboard and trigger an Amazon Simple Notification Service (Amazon SNS) notification when a retry fails

Configure Amazon EventBridge events for AWS Glue. Define the AWS Lambda function as a target to the EventBridge. The Lambda function will have the logic to process the events and filter the AWS Glue job retry failure event. Publish a message to Amazon Simple Notification Service (Amazon SNS) notification if such an event is found

Configure Amazon EventBridge events for AWS Glue. Configure an Amazon Simple Notification Service (Amazon SNS) notification when the Glue job fails a retry

18 / 25

The flagship application at a company is deployed on Amazon EC2 instances running behind an Application Load Balancer (ALB) within an Auto Scaling group. A DevOps Engineer wants to configure a Blue/Green deployment for this application and has already created launch templates and Auto Scaling groups for both blue and green environments, each deploying to their respective target groups. The ALB can direct traffic to either environment's target group, and an Amazon Route 53 record points to the ALB. The goal is to enable an all-at-once transition of traffic from the software running on the blue environment's EC2 instances to the newly deployed software on the green environment's EC2 instances.

What steps should the DevOps Engineer take to fulfill these requirements?

Set up an all-at-once deployment to the blue environment's EC2 instances. Perform a Route 53 DNS update to point to the green environment's endpoint on the ALB

Initiate a rolling restart of the Auto Scaling group for the green environment to deploy the new software on the green environment's EC2 instances. Once the rolling restart is complete, leverage an AWS CLI command to update the ALB and direct traffic to the green environment's target group

Leverage an AWS CLI command to update the ALB and direct traffic to the green environment's target group. Then initiate a rolling restart of the Auto Scaling group for the green environment to deploy the new software on the green environment's EC2 instances

Initiate a rolling restart of the Auto Scaling group for the green environment to deploy the new software on the green environment's EC2 instances. Perform a Route 53 DNS update to point to the green environment's endpoint on the ALB

19 / 25

A DevOps Engineer is working on multiple applications that need to be configured for Application Auto scaling, however, there are some application constraints to be addressed:

a) A serverless application is built on AWS Lambda with the following traffic pattern - The traffic for the application starts to increase on Wednesday, remains high on Thursday, and starts to decrease on Friday. b) Another flagship application runs on Spot Fleet. The CPU utilization of the fleet has to stay at around 50 percent when the load on the application changes.

Which of the following solutions can address these requirements? (Select two)

Create an Amazon CloudWatch metric to track the utilization of the AWS Lambda function. Setup step scaling policy by configuring the upper bound, lower bound, and breach threshold values for the Lambda function

Create an Amazon CloudWatch metric to track average CPU utilization of 50 percent for the Spot Fleet. Create a target tracking auto-scaling policy CloudWatch alarm against the CloudWatch metric created from the AWS console

Use Scheduled scaling Auto Scaling policy, and create a scheduled action with Spot instances as a scalable target. Specify the minimum and maximum capacity based on the requirements

Create a target tracking auto-scaling policy that targets an average CPU utilization of 50 percent for an application that runs on Spot Fleet. You can create and manage target tracking using the AWS CLI, SDKs, or CloudFormation

Use Scheduled scaling Auto Scaling policy, and create a scheduled action with AWS Lambda function as a scalable target. Specify the minimum and maximum capacity based on the requirements. AWS CLI, SDKs, or CloudFormation can be used for configuring the schedule scaling

20 / 25

A multi-national company with hundreds of AWS accounts has slowly adopted AWS Organizations with all features enabled. The company has also configured a few Organization Units (OUs) to serve its business objectives. The company has some AWS Identity and Access Management (IAM) roles that need to be configured for every new AWS account created for the company. Also, the security policy mandates enabling AWS CloudTrail for all AWS accounts. The company is looking for an automated solution that can add the mandatory IAM Roles and CloudTrail configurations to all newly created accounts and also delete the resources/configurations when an account leaves the organization without manual intervention.

What should a DevOps engineer do to meet these requirements with the minimal overhead?

From the management account of AWS Organizations, create an AWS CloudFormation stack set to enable AWS Config and deploy your centralized AWS Identity and Access Management (IAM) roles. Configure the stack set to deploy automatically when an account is created through AWS Organizations

From the management account of AWS Organizations, enable AWS CloudTrail logs for all member accounts. Similarly, create an IAM role and share it across accounts and OUs of the AWS Organization

Run automation across multiple accounts using AWS System Manager Automation. Create an AWS resource group from the management account (or any centralized account) and name it exactly the same for all accounts and OUs and add the account ID or OU as a prefix as per standard naming convention. Include the CloudTrail configuration and the IAM role to be created

From the management account of AWS Organizations, create an Amazon EventBridge rule that is triggered by AWS account creation API call. Configure an AWS Lambda function to enable CloudTrail logging and to attach the necessary IAM roles to the account

21 / 25

An application runs on a fleet of Amazon EC2 Windows instances configured with an Auto Scaling group (ASG). When scaling-in takes place in the ASG, the instances are terminated without notification. The application team wants to create an AMI and remove the Amazon EC2 Windows instance from its domain before terminating the scaled-in instances.

As a DevOps Engineer, which combination of steps will you choose to implement this requirement? (Select two)

Add an AWS Systems Manager Patch Manager as a CloudWatch Event target. The automation document runs a Windows PowerShell script to remove the computer from the domain and creates an AMI of the EC2 instance

Add a lifecycle hook that puts the instance in Terminating:Wait status and setup an Amazon CloudWatch event to monitor the Terminating:Wait status

Add an AWS Systems Manager automation document as a CloudWatch Event target. The automation document runs a Windows PowerShell script to remove the computer from the domain and creates an AMI of the EC2 instance

Add a lifecycle hook that puts the instance in Terminating:Pending status and setup an Amazon CloudWatch event to monitor the Terminating:Pending status

Configure an AWS Systems Manager Maintenance Window to schedule an action to run a Windows PowerShell script to remove the computer from the domain and creates an AMI of the EC2 instance

22 / 25

A CloudFormation stack consists of the following AWS resources - Amazon Simple Storage Service (Amazon S3) bucket, Amazon Amazon Elastic Compute Cloud (Amazon EC2) instance, and an Amazon EBS Volume. Due to a high-impact security issue, the DevOps team has been asked to rename the AWS CloudFormation stack. However, the resources created by the stack cannot be deleted for business purposes.

What steps will you take to rename the CloudFormation stack without deleting the resources created?

Launch a CloudFormation stack that deploys all the resources of the stack. Add a Retain attribute to the deletion policy of the S3 bucket and EC2 instance. Add a 'Snapshot' attribute to the deletion policy of Amazon EBS Volume. Delete the original stack. Create a new stack with a different name and import the resources that were retained from the original stack. Remove the Retain and 'Snapshot' attribute from the stack to revert to the original template

Launch a new CloudFormation stack that deploys all the resources of the stack. Launch another CloudFormation stack that deploys all the resources of the stack with a new name. In the second CloudFormation stack use, the DependsOn attribute to create the resource dependency on the first stack. Delete both the stacks while retaining the resources

Launch a CloudFormation stack that deploys all the resources of the stack. Add a Retain attribute to the deletion policy of each of these resources. Delete the original stack. Create a new stack with a different name and import the resources that were retained from the original stack. Remove the Retain attribute from the stack to revert to the original template

Use CloudFormation registry to create custom hooks for all the resources of the CloudFormation stack. Then, delete the original CloudFormation stack and recreate a new one with the updated name. Using the hooks created earlier, import the resources back into the newly created stack

23 / 25

A company is implementing AWS serverless architecture with Amazon API Gateway, AWS Lambda, and Amazon DynamoDB services. The company's existing users are primarily located in Europe and Asia-Pacific regions. The company is now looking for a quick-start solution that offers high reliability and low latency for a global user base across regions as its offerings are getting popular worldwide.

How will you implement this requirement?

Configure Amazon Route 53 to point to API Gateway APIs in Europe and Asia-Pacific regions. Use failover routing and Application Recovery Controller health checks in Route 53. Configure the APIs to forward requests to an AWS Lambda function in the respective Regions. Setup the Lambda function to retrieve and update the data in a DynamoDB global table

Configure Amazon Route 53 to point to API Gateway APIs in Europe and Asia-Pacific regions. Use latency-based routing and health checks in Route 53. Configure the APIs to forward requests to an AWS Lambda function in the respective Regions. Setup the Lambda function to retrieve and update the data in a DynamoDB global table

Configure Amazon Route 53 to point to AWS Global Accelerator. Configure Global Accelerator to point to API Gateway API endpoint(s) of both regions via an Application Load Balancer(ALB). Configure the APIs to forward requests to an AWS Lambda function in the respective Regions. Setup the Lambda function to retrieve and update the data in a DynamoDB global table

Configure Amazon Route 53 to point to API Gateway APIs in Europe and Asia-Pacific regions. Use geolocation routing and health checks in Route 53. Configure the APIs to forward requests to an AWS Lambda function in the respective Regions. Setup the Lambda function to retrieve and update the data in a DynamoDB global table

24 / 25

A DevOps Engineer has been asked to chalk out a disaster recovery (DR) plan for a workload in production. The workload runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are configured with an Auto Scaling group across multiple Availability Zones. Amazon Route 53 is configured to point to the ALB using an alias record. Amazon RDS for PostgreSQL DB instance is the database service. The draft DR plan mandates an RTO of three hours and an RPO of around 15 minutes.

Which Disaster Recovery (DR) strategy should the DevOps Engineer opt for a cost-effective solution?

Opt for a pilot light DR strategy. Provision a copy of your core workload infrastructure to a different AWS Region. Create an RDS read replica in the new Region, and configure the new environment to point to the local RDS PostgreSQL DB instance. Configure Amazon Route 53 health checks to automatically initiate DNS failover to a new Region. Promote the read replica to the primary DB instance in case of a disaster

Opt for a pilot light DR strategy. Provision a copy of your entire workload infrastructure to a different AWS Region. Copy the first backup that consists of a full instance backup to the new RDS instance. In case of disaster, apply the incremental backup to the RDS instance in the new AWS Region. Configure Amazon Route 53 health checks to automatically initiate DNS failover to new Region

Configure your workload to simultaneously run in multiple AWS Regions as part of a multi-site active/active DR strategy. Replicate your entire workload to another AWS Region. With this strategy, asynchronous data replication between the regions enables near-zero RPO. Configure Amazon Route 53 with latency-based routing to choose between the active regional endpoint for directing user traffic

Opt for a Warm standby approach by ensuring that there is a scaled-down, but fully functional, copy of your production environment in another AWS Region. Then, deploy enough resources to handle initial traffic, ensuring low RTO, and then rely on Auto Scaling to ramp up for subsequent traffic

25 / 25

A production environment has Amazon EC2 instances configured to log all application/system logs via the CloudWatch Logs agent that has been configured on all instances. The company has recently introduced a security policy that mandates terminating any Amazon EC2 instance accessed manually by a user other than the administrators within an hour. All the production instances are configured with Auto Scaling groups.

As a DevOps Engineer, how will you automate this process?

Create an Amazon CloudWatch alarm that is triggered by the login event data. Create alarm action that notifies system administrators through a message using the Amazon Simple Notification Service topic. The system administrators will then manually terminate the instance

Create a CloudWatch Logs subscription to an AWS Step Function that coordinates with AWS Lambda function and Amazon EventBridge to create a serverless automated solution. Configure an AWS Lambda function to add a tag to the EC2 instance that produced the login event and mark the instance to be decommissioned. Create an Amazon EventBridge rule to invoke a second Lambda function every hour, which will terminate all instances with this tag

Create a CloudWatch Logs subscription to deliver the login event data of Amazon EC2 instances to an AWS Lambda function. Configure the Lambda function to add a decommission tag to the EC2 instance that produced the login event. Schedule an Amazon EventBridge rule to invoke another Lambda function every hour, to terminate all EC2 instances with the decommission tag

Set up an Amazon CloudWatch alarm that is triggered by login event data to call an AWS Lambda function. Configure the Lambda function to add a decommission tag to the EC2 instance that produced the login event. Schedule an Amazon EventBridge rule to invoke the Lambda function every hour, to terminate all EC2 instances with the decommission tag

Your score is

The average score is 0%

AWS Practise Test

Most Recent Posts

All Post
AWS Practise Test
Django
Programming Blogs
Statistics

AWS DevOps Practise Test (DOP-C02) Practise Test – 3

Why Take This Quiz?

Most Recent Posts

AWS DevOps Practise Test (DOP-C02) Practise Test – 3

AWS DevOps Practise Test – (DOP-C02) Practise Test – 2

AWS DevOps Practise Test (DOP-C02) Practise Test – 1

Mastering Proxy Models in Django

Mastering Django Models: Overriding clean(), save(), and delete()

Understanding Sample vs Population and Measures of Central Tendency

Quick Links

Copyright © 2024 - All Rights Reserved By Infronx