📘 Free DOP-C02 Sample Questions
A company has a mobile application that makes HTTP API calls to an Application Load Balancer (ALB). The ALB
routes requests to an AWS Lambda function. Many different versions of the application are in use at any given
time, including versions that are in testing by a subset of users. The version of the application is defined in the
user-agent header that is sent with all requests to the API.
After a series of recent changes to the API, the company has observed issues with the application. The company
needs to gather a metric for each API operation by response code for each version of the application that is in use.
A DevOps engineer has modified the Lambda function to extract the API operation name, version information from
the user-agent header and response code.
Which additional set of actions should the DevOps engineer take to gather the required metrics?
A
Modify the Lambda function to write the API operation name, response code, and version number as a log line
to an Amazon CloudWatch Logs log group. Configure a CloudWatch Logs metric filter that increments a metric
for each API operation name. Specify response code and application version as dimensions for the metric.
B
Modify the Lambda function to write the API operation name, response code, and version number as a log line
to an Amazon CloudWatch Logs log group. Configure a CloudWatch Logs Insights query to populate
CloudWatch metrics from the log lines. Specify response code and application version as dimensions for the
metric.
C
Configure the ALB access logs to write to an Amazon CloudWatch Logs log group. Modify the Lambda
function to respond to the ALB with the API operation name, response code, and version number as response
metadata. Configure a CloudWatch Logs metric filter that increments a metric for each API operation name.
Specify response code and application version as dimensions for the metric.
D
Configure AWS X-Ray integration on the Lambda function. Modify the Lambda function to create an X-Ray
subsegment with the API operation name, response code, and version number. Configure X-Ray insights to
extract an aggregated metric for each API operation name and to publish the metric to Amazon CloudWatch.
Specify response code and application version as dimensions for the metric.
Correct Answer:
A. Modify the Lambda function to write the API operation name, response code, and version number as a log line
to an Amazon CloudWatch Logs log group. Configure a CloudWatch Logs metric filter that increments a metric
for each API operation name. Specify response code and application version as dimensions for the metric.
Explanation:
Explanation:
Option A: This option is the most efficient way to gather the required metrics. It does not require any
additional infrastructure and can be easily implemented.Option B: This option is more complex than Option A
and requires configuring a CloudWatch Logs Insights query. This can be more time-consuming to set up and
can be less efficient if the query is not optimized.Option C: This option requires configuring the ALB access
logs to write to CloudWatch Logs. This can add additional latency to the requests.Option D: This option
requires configuring AWS X-Ray integration. This is a more complex solution that is not necessary in this case.
A company is adopting AWS CodeDeploy to automate its application deployments for a Java-Apache Tomcat application with an Apache Webserver. The development team started with a proof of concept, created a deployment group for a developer environment, and performed functional tests within the application. Aftercompletion, the team will create additional deployment groups for staging and production. The current log level is configured within the Apache settings, but the team wants to change this configuration dynamically when the deployment occurs, so that they can set different log level configurations depending on the deployment group without having a different application revision for each group. How can these requirements be met with the LEAST management overhead and without requiring different script versions for each deployment group?
A
Tag the Amazon EC2 instances depending on the deployment group. Then place a script into the application
revision that calls the metadata service and the EC2 API to identify which deployment group the instance is
part of. Use this information to configure the log level settings. Reference the script as part of the AfterInstall
lifecycle hook in the appspec.yml file.
B
Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ NAME to identify
which deployment group the instance is part of. Use this information to configure the log level settings.
Reference this script as part of the BeforeInstall lifecycle hook in the appspec.yml file.
C
Create a CodeDeploy custom environment variable for each environment. Then place a script into the
application revision that checks this environment variable to identify which deployment group the instance is
part of. Use this information to configure the log level settings. Reference this script as part of the
ValidateService lifecycle hook in the appspec.yml file.
D
Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ID to identify which
deployment group the instance is part of to configure the log level settings. Reference this script as part of the
Install lifecycle hook in the appspec.yml file.
Correct Answer:
B. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ NAME to identify
which deployment group the instance is part of. Use this information to configure the log level settings.
Reference this script as part of the BeforeInstall lifecycle hook in the appspec.yml file.
Explanation:
Explanation:
B. Create a script that uses the Code Deploy environment variable DEPLOYMENT_GROUP_NAME to identify
which deployment group the instance is part of, and use this information to configure the log level settings.
Reference this script as part of the Before Install lifecycle hook in the app spec. yml file, would be the option
with the least management overhead and without requiring different script versions for each deployment
group
A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to
indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, dally, or weekly that correspond
to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes.
A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the
company can perform backups at least weekly unless a different value is specified.
Which solution will meet these requirements?
A
Set up AWS Config in the account. Create a custom rule that returns a compliance failure for all Amazon EC2
resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom
AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
B
Set up AWS Config in the account. Use a managed rule that returns a compliance failure for EC2::Volume
resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom
AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
C
Turn on AWS CloudTrail in the account. Create an Amazon EventBridge rule that reacts to EBS CreateVolume
events. Configure a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag
with a value of weekly. Specify the runbook as the target of the rule.
D
Turn on AWS CloudTrail in the account. Create an Amazon EventBridge rule that reacts to EBS CreateVolume
events or EBS ModifyVolume events. Configure a custom AWS Systems Manager Automation runbook to apply
the Backup_Frequency tag with a value of weekly. Specify the runbook as the target of the rule.
Correct Answer:
B. Set up AWS Config in the account. Use a managed rule that returns a compliance failure for EC2::Volume
resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom
AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
Explanation:
Explanation:
B is the most straightforward and efficient solution to ensure that all EBS volumes always have the
Backup_Frequency tag applied with the least amount of effort.A This approach requires more effort than
using a managed rule provided by AWS
A company is using an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured
with a single DB instance. The application performs read and write operations on the database by using the
cluster's instance endpoint.
The company has scheduled an update to be applied to the cluster during an upcoming maintenance window. The
cluster must remain available with the least possible interruption during the maintenance window.
What should a DevOps engineer do to meet these requirements?
A
Add a reader instance to the Aurora cluster. Update the application to use the Aurora cluster endpoint for
write operations. Update the Aurora cluster's reader endpoint for reads.
B
Add a reader instance to the Aurora cluster. Create a custom ANY endpoint for the cluster. Update the
application to use the Aurora cluster's custom ANY endpoint for read and write operations.
C
Turn on the Multi-AZ option on the Aurora cluster. Update the application to use the Aurora cluster endpoint
for write operations. Update the Aurora cluster’s reader endpoint for reads.
D
Turn on the Multi-AZ option on the Aurora cluster. Create a custom ANY endpoint for the cluster. Update the
application to use the Aurora cluster's custom ANY endpoint for read and write operations
Correct Answer:
A. Add a reader instance to the Aurora cluster. Update the application to use the Aurora cluster endpoint for
write operations. Update the Aurora cluster's reader endpoint for reads.
Explanation:
Explanation:
Add a reader instance to the Aurora cluster. Update the application to use the Aurora cluster endpoint for
write operations. Update the Aurora cluster's reader endpoint for reads.
A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a
target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps
engineer must share the AMI with the target account.
The company has created an AWS Key Management Service (AWS KMS) key in the source account.
Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)
A
In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy
action.
B
In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the default Amazon Elastic
Block Store (Amazon EBS) encryption key in the copy action.
C
In the source account, create a KMS grant that delegates permissions to the Auto Scaling group servicelinked role in the target account.
D
In the source account, modify the key policy to give the target account permissions to create a grant. In the
target account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role.
E
In the source account, share the unencrypted AMI with the target account.
F
In the source account, share the encrypted AMI with the target account
Correct Answer:
A. In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy
action.
Explanation:
Explanation:
Step 1: Always specify the KMS (CMK) key to encrypt with when creating/copying images
Step 2: Modify the CMK key policy to allow trusted role to assume the key to decrypt image
Step 3: Use cross-account trust policy to grant the other account access to the encrypted image
Reference:
https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html
A company uses AWS CodePipeline pipelines to automate releases of its application A typical pipeline consists of
three stages build, test, and deployment. The company has been using a separate AWS CodeBuild project to run
scripts for each stage. However, the company now wants to use AWS CodeDeploy to handle the deployment stage
of the pipelines.
The company has packaged the application as an RPM package and must deploy the application to a fleet of
Amazon EC2 instances. The EC2 instances are in an EC2 Auto Scaling group and are launched from a common AMI.
Which combination of steps should a DevOps engineer perform to meet these requirements? (Choose two.)
A
Create a new version of the common AMI with the CodeDeploy agent installed. Update the IAM role of the
EC2 instances to allow access to CodeDeploy.
B
Create a new version of the common AMI with the CodeDeploy agent installed. Create an AppSpec file that
contains application deployment scripts and grants access to CodeDeploy.
C
Create an application in CodeDeploy. Configure an in-place deployment type. Specify the Auto Scaling group
as the deployment target. Add a step to the CodePipeline pipeline to use EC2 Image Builder to create a new
AMI. Configure CodeDeploy to deploy the newly created AMI.
D
Create an application in CodeDeploy. Configure an in-place deployment type. Specify the Auto Scaling group
as the deployment target. Update the CodePipeline pipeline to use the CodeDeploy action to deploy the
application.
E
Create an application in CodeDeploy. Configure an in-place deployment type. Specify the EC2 instances that
are launched from the common AMI as the deployment target. Update the CodePipeline pipeline to use the
CodeDeploy action to deploy the application.
Correct Answer:
A. Create a new version of the common AMI with the CodeDeploy agent installed. Update the IAM role of the
EC2 instances to allow access to CodeDeploy.
Explanation:
Explanation:
A. Create a new version of the common AMI with the Code Deploy agent installed. Update the IAM role of the
EC2 instances to allow access to Code Deploy.
D. Create an application in Code Deploy.Configure an in-place deployment type. Specify the Auto Scaling
group as the deployment target. Update the Code Pipeline pipeline to use the Code Deploy action to deploy
the application.
https://docs.aws.amazon.com/codedeploy/latest/userguide/integrations-aws-auto-scaling.html
A company’s security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway
APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are
included in a single organization in AWS Organizations. The company has configured AWS Config for the
organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS
WAF web ACLs.
Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)
A
Delegate AWS Firewall Manager to a security account.
B
Delegate Amazon GuardDuty to a security account.
C
Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API
Gateway APIs.
D
Create an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API
Gateway APIs.
E
Configure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created ALBs and API
Gateway APIs.
Correct Answer:
A. Delegate AWS Firewall Manager to a security account.
Explanation:
Explanation:
A. Delegate AWS Firewall Manager to a security account.
C. Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API
Gateway APIs
A security review has identified that an AWS CodeBuild project is downloading a database population script from
an Amazon S3 bucket using an unauthenticated request. The security team does not allow unauthenticated
requests to S3 buckets for this project.
How can this issue be corrected in the MOST secure manner?
A
Add the bucket name to the AllowedBuckets section of the CodeBuild project settings. Update the build spec
to use the AWS CLI to download the database population script.
B
Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token. Update the build
spec to use cURL to pass the token and download the database population script.
C
Remove unauthenticated access from the S3 bucket with a bucket policy. Modify the service role for the
CodeBuild project to include Amazon S3 access. Use the AWS CLI to download the database population script
D
Remove unauthenticated access from the S3 bucket with a bucket policy. Use the AWS CLI to download the
database population script using an IAM access key and a secret access key.
Correct Answer:
C. Remove unauthenticated access from the S3 bucket with a bucket policy. Modify the service role for the
CodeBuild project to include Amazon S3 access. Use the AWS CLI to download the database population script
Explanation:
Explanation:
C is the correct answer because it involves removing unauthenticated access from the S3 bucket with a
bucket policy, which ensures that only authorized users or services can access the bucket.
An ecommerce company has chosen AWS to host its new platform. The company's DevOps team has started
building an AWS Control Tower landing zone. The DevOps team has set the identity store within AWS IAM Identity
Center (AWS Single Sign-On) to external identity provider (IdP) and has configured SAML 2.0.
The DevOps team wants a robust permission model that applies the principle of least privilege. The model must
allow the team to build and manage only the team's own resources.
Which combination of steps will meet these requirements? (Choose three.)
A
Create IAM policies that include the required permissions. Include the aws:PrincipalTag condition key.
B
Create permission sets. Attach an inline policy that includes the required permissions and uses the
aws:PrincipalTag condition key to scope the permissions.
C
Create a group in the IdP. Place users in the group. Assign the group to accounts and the permission sets in
IAM Identity Center.
D
Create a group in the IdP. Place users in the group. Assign the group to OUs and IAM policies
E
Enable attributes for access control in IAM Identity Center. Apply tags to users. Map the tags as key-value
pairs.
F
Enable attributes for access control in IAM Identity Center. Map attributes from the IdP as key-value pairs.
Correct Answer:
B. Create permission sets. Attach an inline policy that includes the required permissions and uses the
aws:PrincipalTag condition key to scope the permissions.
An ecommerce company is receiving reports that its order history page is experiencing delays in reflecting the
processing status of orders. The order processing system consists of an AWS Lambda function that uses reserved
concurrency. The Lambda function processes order messages from an Amazon Simple Queue Service (Amazon
SQS) queue and inserts processed orders into an Amazon DynamoDB table. The DynamoDB table has auto scaling
enabled for read and write capacity.
Which actions should a DevOps engineer take to resolve this delay? (Choose two.)
A
Check the ApproximateAgeOfOldestMessage metric for the SQS queue. Increase the Lambda function
concurrency limit.
B
Check the ApproximateAgeOfOldestMessage metnc for the SQS queue Configure a redrive policy on the
SQS queue.
C
Check the NumberOfMessagesSent metric for the SQS queue. Increase the SQS queue visibility timeout.
D
Check the WriteThrottleEvents metric for the DynamoDB table. Increase the maximum write capacity units
(WCUs) for the table's scaling policy.
E
Check the Throttles metric for the Lambda function. Increase the Lambda function timeout.
Correct Answer:
A. Check the ApproximateAgeOfOldestMessage metric for the SQS queue. Increase the Lambda function
concurrency limit.
Explanation:
Explanation:
A: Check the Approximate AgeOfOldestMessage metric for the SQS queue. If this age is high, increasing the
Lambda function's concurrency limit would help speed up processing
D: Check the WriteThrottleEvents metric for the DynamoDB table. If write operations are being throttled,
increasing the maximum WCUs for the table’s scaling policy could help.
Questions: 1-10 out of 429
Continue Full Practice..
GET ALL 429 QUESTIONS