Amazon DOP-C01 Online Practice Questions and Exam Preparation

Amazon DOP-C01 Online Questions & Answers

• Question 231:

  You have been tasked with deploying a solution for your company that will store images, which the marketing department will use for its campaigns. Employees are able to upload images via a web interface, and once uploaded, each image must be resized and watermarked with the company logo. Image resize and watermark is not time-sensitive and can be completed days after upload if required. How should you design this solution in the most highly available and cost-effective way?

  A. Configure your web application to upload images to the Amazon Elastic Transcoder service. Use the Amazon Elastic Transcoder watermark feature to add the company logo as a watermark on your images and then to upload the final images into an Amazon S3 bucket.
  B. Configure your web application to upload images to Amazon S3, and send the Amazon S3 bucket URI to an Amazon SQS queue. Create an Auto Scaling group and configure it to use Spot instances, specifying a price you are willing to pay. Configure the instances in this Auto Scaling group to poll the SQS queue for new images and then resize and watermark the image before uploading the final images into Amazon S3.
  C. Configure your web application to upload images to Amazon S3, and send the S3 object URI to an Amazon SQS queue. Create an Auto Scaling launch configuration that uses Spot instances, specifying a price you are willing to pay. Configure the instances in this Auto Scaling group to poll the Amazon SQS queue for new images and then resize and watermark the image before uploading the new images into Amazon S3 and deleting the message from the Amazon SQS queue.
  D. Configure your web application to upload images to the local storage of the web server. Create a cronjob to execute a script daily that scans this directory for new files and then uses the Amazon EC2 Service API to launch 10 new Amazon EC2 instances, which will resize and watermark the images daily.
  C. Configure your web application to upload images to Amazon S3, and send the S3 object URI to an Amazon SQS queue. Create an Auto Scaling launch configuration that uses Spot instances, specifying a price you are willing to pay. Configure the instances in this Auto Scaling group to poll the Amazon SQS queue for new images and then resize and watermark the image before uploading the new images into Amazon S3 and deleting the message from the Amazon SQS queue.

• Question 232:

  A company has built a web service that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company has deployed the application in us-east-1. Amazon Route 53 provides an external DNS that routes traffic from example.com to the application, created with appropriate health checks.

  The company has deployed a second environment for the application in eu-west-1. The company wants traffic to be routed to whichever environment results in the best response time for each user. If there is an outage in one Region, traffic should be directed to the other environment.

  Which configuration will achieve these requirements?

  A. 1. A subdomain us.example.com with weighted routing: the US ALB with weight 2 and the EU ALB with weight 1. 2. Another subdomain eu.example.com with weighted routing: the EU ALB with weight 2 and the US ALB with weight 1. 3. Geolocation routing records for example.com: North America aliased to us.example.com and Europe aliased to eu.example.com.
  B. 1. A subdomain us.example.com with latency-based routing: the US ALB as the first target and the EU ALB as the second target. 2. Another subdomain eu.example.com with latency-based routing: the EU ALB as the first target and the US ALB as the second target. 3. Failover routing records for example.com aliased to us.example.com as the first target and eu.example.com as the second target.
  C. 1. A subdomain us.example.com with failover routing: the US ALB as primary and the EU ALB as secondary. 2. Another subdomain eu.example.com with failover routing: the EU ALB as primary and the US ALB as secondary. 3. Latency-based routing records for example.com that are aliased to us.example.com and eu.example.com.
  D. 1. A subdomain us.example.com with multivalue answer routing: the US ALB first and the EU ALB second. 2. Another subdomain eu.example.com with multivalue answer routing: the EU ALB first and the US ALB second. 3. Failover routing records for example.com that are aliased to us.example.com and eu.example.com.
  C. 1. A subdomain us.example.com with failover routing: the US ALB as primary and the EU ALB as secondary. 2. Another subdomain eu.example.com with failover routing: the EU ALB as primary and the US ALB as secondary. 3. Latency-based routing records for example.com that are aliased to us.example.com and eu.example.com.

• Question 233:

  An application's users are encountering bugs immediately after Amazon API Gateway deployments. The development team deploys once or twice a day and uses a blue/green deployment strategy with custom health checks and automated rollbacks. The team wants to limit the number of users affected by deployment bugs and receive notifications when rollbacks are needed.

  Which combination of steps should a DevOps engineer use to meet these requests? (Choose two.)

  A. Implement a blue/green strategy using path mappings.
  B. Implement a canary deployment strategy.
  C. Implement a rolling deployment strategy using multiple stages.
  D. Use Amazon CloudWatch alarms to notify the development team.
  E. Use Amazon CloudWatch Events to notify the development team.
  A. Implement a blue/green strategy using path mappings.
  C. Implement a rolling deployment strategy using multiple stages.

• Question 234:

  A DevOps Engineer must ensure all IAM entity configurations across multiple AWS accounts in AWS Organizations are compliant with corporate IAM policies.

  Which combination of steps will accomplish this? (Choose two.)

  A. Enable AWS Trusted Advisor in Organizations for all accounts to report on noncompliant IAM entities.
  B. Configure an AWS Config aggregator in the Organizations master account for all accounts.
  C. Deploy AWS Config rules to the master account in Organizations that match corporate IAM policies.
  D. Apply an SCP in Organizations to ensure compliance of IAM entities.
  E. Deploy AWS Config rules to all accounts in Organizations that match the corporate IAM policies.
  D. Apply an SCP in Organizations to ensure compliance of IAM entities.
  E. Deploy AWS Config rules to all accounts in Organizations that match the corporate IAM policies.

  ---

  Reference: https://aws.amazon.com/blogs/mt/manage-custom-aws-config-rules-with-remediations-using- conformance-packs/?nc1=b_rp

  https://aws.amazon.com/blogs/security/announcing-aws-organizations-centrally-manage-multiple-aws- accounts/

• Question 235:

  The Development team at an online retailer has moved to Business support and wants to take advantage of the AWS Health Dashboard and the AWS Health API to automate remediation actions for issues with the health of AWS resources. The first use case is to respond to AWS detecting an IAM access key that is listed on a public code repository site. The automated response will be to delete the IAM access key and send a notification to the Security team.

  How should this be achieved?

  A. Create an AWS Lambda function to delete the IAM access key. Send AWS CloudTrail logs to AWS CloudWatch logs. Create a CloudWatch Logs metric filter for the AWS_RISK_CREDENTIALS_EXPOSED event with two actions: first, run the Lambda function; second, use Amazon SNS to send a notification to the Security team.
  B. Create an AWS Lambda function to delete the IAM access key. Create an AWS Config rule for changes to aws.health and the AWS_RISK_CREDENTIALS_EXPOSED event with two actions: first, run the Lambda function; second, use Amazon SNS to send a notification to the Security team.
  C. Use AWS Step Functions to create a function to delete the IAM access key, and then use Amazon SNS to send a notification to the Security team. Create an AWS Personal Health Dashboard rule for the AWS_RISK_CREDENTIALS_EXPOSED event; set the target of the Personal Health Dashboard rule to Step Functions.
  D. Use AWS Step Functions to create a function to delete the IAM access key, and then use Amazon SNS to send a notification to the Security team. Create an Amazon CloudWatch Events rule with an aws.health event source and the AWS_RISK_CREDENTIALS_EXPOSED event; set the target of the CloudWatch Events rule to Step Functions.
  D. Use AWS Step Functions to create a function to delete the IAM access key, and then use Amazon SNS to send a notification to the Security team. Create an Amazon CloudWatch Events rule with an aws.health event source and the AWS_RISK_CREDENTIALS_EXPOSED event; set the target of the CloudWatch Events rule to Step Functions.

• Question 236:

  You are creating an application which stores extremely sensitive financial information. All information in the system must be encrypted at rest and in transit. Which of these is a violation of this policy?

  A. ELB SSL termination.
  B. ELB Using Proxy Protocol v1.
  C. CloudFront Viewer Protocol Policy set to HTTPS redirection.
  D. Telling S3 to use AES256 on the server-side.
  A. ELB SSL termination.

  ---

  Terminating SSL terminates the security of a connection over HTTP, removing the S for "Secure" in HTTPS. This violates the "encryption in transit" requirement in the scenario.

  Reference:

  http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html

• Question 237:

  A company recently migrated its legacy application from on-premises to AWS. The application is hosted on Amazon EC2 instances behind an Application Load Balancer, which is behind Amazon API Gateway. The company wants to ensure users experience minimal disruptions during any deployment of a new version of the application. The company also wants to ensure it can quickly roll back updates if there is an issue.

  Which solution will meet these requirements with MINIMAL changes to the application?

  A. Introduce changes as a separate environment parallel to the existing one. Configure API Gateway to use a canary release deployment to send a small subset of user traffic to the new environment.
  B. Introduce changes as a separate environment parallel to the existing one. Update the application's DNS alias records to point to the new environment.
  C. Introduce changes as a separate target group behind the existing Application Load Balancer. Configure API Gateway to route user traffic to the new target group in steps.
  D. Introduce changes as a separate target group behind the existing Application Load Balancer. Configure API Gateway to route all traffic to the Application Load Balancer, which then sends the traffic to the new target group.
  C. Introduce changes as a separate target group behind the existing Application Load Balancer. Configure API Gateway to route user traffic to the new target group in steps.

• Question 238:

  What is the scope of an EBS snapshot?

  A. Availability Zone
  B. Placement Group
  C. Region
  D. VPC
  C. Region

  ---

  An EBS snapshot is tied to its region and can only be used to create volumes in the same region. You can copy a snapshot from one region to another. For more information, see Copying an Amazon EBS Snapshot.

  Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/resources.html

• Question 239:

  A company wants to migrate its content sharing web application hosted on Amazon EC2 to a serverless architecture. The company currently deploys changes to its application by creating a new Auto Scaling group of EC2 instances and a new Elastic Load Balancer, and then shifting the traffic away using an Amazon Route 53 weighted routing policy.

  For its new serverless application, the company is planning to use Amazon API Gateway and AWS Lambda. The company will need to update its deployment processes to work with the new application. It will also need to retain the ability to test new features on a small number of users before rolling the features out to the entire user base.

  Which deployment strategy will meet these requirements?

  A. Use AWS CDK to deploy API Gateway and Lambda functions. When code needs to be changed, update the AWS CloudFormation stack and deploy the new version of the APIs and Lambda functions. Use a Route 53 failover routing policy for the canary release strategy.
  B. Use AWS CloudFormation to deploy API Gateway and Lambda functions using Lambda function versions. When code needs to be changed, update the CloudFormation stack with the new Lambda code and update the API versions using a canary release strategy. Promote the new version when testing is complete.
  C. Use AWS Elastic Beanstalk to deploy API Gateway and Lambda functions. When code needs to be changed, delpoy a new version of the API and Lambda functions. Shift traffic gradually using an Elastic Beanstalk blue/green deployment.
  D. Use AWS OpsWorks to deploy API Gateway in the service layer and Lambda functions in a custom layer. When code needs to be changed, use OpsWorks to perform a blue/green deployment and shift traffic gradually.
  B. Use AWS CloudFormation to deploy API Gateway and Lambda functions using Lambda function versions. When code needs to be changed, update the CloudFormation stack with the new Lambda code and update the API versions using a canary release strategy. Promote the new version when testing is complete.

• Question 240:

  Your company operates an application consisting of an AWS CloudFormation stack that contains a load balancer, an Auto Scaling group of web servers, and an Amazon RDS instance. To save time and costs, you update the current test stack when testing minor changes, and create a new stack for major changes. As part of the testing procedure of your application, each version needs to be registered once and only once with a Configuration Management Database (CMDB). What cost-effective solution should you choose to perform this registration?

  A. Use Auto Scaling Leader Node functionality to notify the registration application from the UserData script of a single Instance. Use the AWS CloudFormation cfn-hup helper application to receive template updates on the leader node, which then notifies the CMDB.
  B. Define an AWS: :CloudFormation::CustomResource in the AWS CloudFormation template, with the application version as one of its properties. Modify the CMDB to subscribe to the resource's creation and update notifications.
  C. Define an AWS::CloudFormation::HttpRequest in the AWS CloudFormation template, and configure it to notify the CMDB on stack creation and update.
  D. Define an AWS::EC2::Instance resource in the AWS CloudFormation template that is configured to run a UserData script to notify the CMDB and then terminate itself on completion.
  B. Define an AWS: :CloudFormation::CustomResource in the AWS CloudFormation template, with the application version as one of its properties. Modify the CMDB to subscribe to the resource's creation and update notifications.