Amazon DOP-C02 Online Practice Questions and Exam Preparation

Amazon DOP-C02 Online Questions & Answers

• Question 151:

  When Ansible's connection state is set to `remote', what method of communication does Ansible utilize to run commands on the remote target host?

  A. SSH
  B. RSH
  C. PSExec
  D. API call to Ansible client on host
  A. SSH

  ---

  Explanation Explanation/Reference:Ansible does not require a client/server architecture and makes all remote connections over SSH. Ansible utilizes the Paramiko Python libraries for SSH when the native system OpenSSH libraries do not meet the requirements. Also note, Ansible does require Python be installed on the target host. When the target host is Windows, it uses WinRS http://docs.ansible.com/ansible/intro_getting_started.html#remote-connection-information

• Question 152:

  A company has a mission-critical application on AWS that uses automatic scaling. The company wants the deployment lifecycle to meet the following parameters:

  1.

  The application must be deployed one instance at a time to ensure the remaining fleet continues to serve traffic.

  2.

  The application is CPU intensive and must be closely monitored.

  3.

  The deployment must automatically roll back if the CPU utilization of the deployment instance exceeds 85%.

  Which solution will meet these requirements?

  A. Use AWS CloudFormation to create an AWS Step Functions state machine and Auto Scaling lifecycle hooks to move to one instance at a time into a wait state. Use AWS Systems Manager automation to deploy the update to each instance and move it back into the Auto Scaling group using the heartbeat timeout.
  B. Use AWS CodeDeploy with Amazon EC2 Auto Scaling Configure an alarm tied to the CPU utilization metric. Use the CodeDeployDefault OneAtAtime configuration as a deployment strategy. Configure automatic rollbacks within the deployment group to roll back the deployment if the alarm thresholds are breached.
  C. Use AWS Elastic Beanstalk for load balancing and AWS Auto Scaling. Configure an alarm tied to the CPU utilization metric. Configure rolling deployments with a fixed batch size of one instance. Enable enhanced health to monitor the status of the deployment and roll back based on the alarm previously created.
  D. Use AWS Systems Manager to perform a blue/green deployment with Amazon EC2 Auto Scaling. Configure an alarm tied to the CPU utilization metric. Deploy updates one at a time. Configure automatic rollbacks within the Auto Scaling group to roll back the deployment if the alarm thresholds are breached.
  B. Use AWS CodeDeploy with Amazon EC2 Auto Scaling Configure an alarm tied to the CPU utilization metric. Use the CodeDeployDefault OneAtAtime configuration as a deployment strategy. Configure automatic rollbacks within the deployment group to roll back the deployment if the alarm thresholds are breached.

  ---

  B is correct: < must be deployed one instance at a time> means codedeploy, which provides this option A: AWS Step Functions state machine does not provide deployment Functions C: Beanstalk does not work with EC2 D: AWS SSM does not provides deployment Functions

• Question 153:

  A highly regulated company has a policy that DevOps engineers should not log in to their Amazon EC2 instances except in emergencies. It a DevOps engineer does log in the security team must be notified within 15 minutes of the occurrence.

  Which solution will meet these requirements'?

  A. Install the Amazon Inspector agent on each EC2 instance. Subscribe to Amazon EventBridge notifications. Invoke an AWS Lambda function to check if a message is about user logins. If it is, send a notification to the security team using Amazon SNS.
  B. Install the Amazon CloudWatch agent on each EC2 instance. Configure the agent to push all logs to Amazon CloudWatch Logs and set up a CloudWatch metric filter that searches for user logins. If a login is found, send a notification to the security team using Amazon SNS.
  C. Set up AWS CloudTrail with Amazon CloudWatch Logs. Subscribe CloudWatch Logs to Amazon Kinesis. Attach AWS Lambda to Kinesis to parse and determine if a log contains a user login. If it does, send a notification to the security team using Amazon SNS.
  D. Set up a script on each Amazon EC2 instance to push all logs to Amazon S3. Set up an S3 event to invoke an AWS Lambda function, which invokes an Amazon Athena query to run. The Athena query checks for logins and sends the output to the security team using Amazon SNS.
  B. Install the Amazon CloudWatch agent on each EC2 instance. Configure the agent to push all logs to Amazon CloudWatch Logs and set up a CloudWatch metric filter that searches for user logins. If a login is found, send a notification to the security team using Amazon SNS.

  ---

  https://aws.amazon.com/blogs/security/how-to-monitor-and-visualize-failed-ssh-access-attempts-to-amazon-ec2-linux-instances/

• Question 154:

  A company's web app runs on EC2 Linux instances and needs to monitor custom metrics for API response and DB query latency across instances with least overhead.

  Which solution meets this?

  A. Install CloudWatch agent on instances, configure it to collect custom metrics, and instrument app to send metrics to agent.
  B. Use Amazon Managed Service for Prometheus to scrape metrics, use CloudWatch agent to forward metrics to CloudWatch.
  C. Create Lambda to poll app endpoints and DB, calculate metrics, send to CloudWatch via PutMetricData.
  D. Implement custom logging in app; use CloudWatch Logs Insights to extract and analyze metrics.
  A. Install CloudWatch agent on instances, configure it to collect custom metrics, and instrument app to send metrics to agent.

• Question 155:

  A company hosts applications in its AWS account Each application logs to an individual Amazon CloudWatch log group. The company's CloudWatch costs for ingestion are increasing

  A DevOps engineer needs to Identify which applications are the source of the increased logging costs.

  Which solution Will meet these requirements?

  A. Use CloudWatch metrics to create a custom expression that Identifies the CloudWatch log groups that have the most data being written to them.
  B. Use CloudWatch Logs Insights to create a set of queries for the application log groups to Identify the number of logs written for a period of time
  C. Use AWS Cost Explorer to generate a cost report that details the cost for CloudWatch usage
  D. Use AWS CloudTrail to filter for CreateLogStream events for each application
  C. Use AWS Cost Explorer to generate a cost report that details the cost for CloudWatch usage

  ---

  A comprehensive and detailed explanation is: Option A is incorrect because using CloudWatch metrics to create a custom expression that identifies the CloudWatch log groups that have the most data being written to them is not a valid solution. CloudWatch metrics do not provide information about the size or volume of data being ingested by CloudWatch logs. CloudWatch metrics only provide information about the number of events, bytes, and errors that occur within a log group or stream. Moreover, creating a custom expression with CloudWatch metrics would require using the search_web tool, which is not necessary for this use case. Option B is incorrect because using CloudWatch Logs Insights to create a set of queries for the application log groups to identify the number of logs written for a period of time is not a valid solution. CloudWatch Logs Insights can help analyze and filter log events based on patterns and expressions, but it does not provide information about the cost or billing of CloudWatch logs. CloudWatch Logs Insights also charges based on the amount of data scanned by each query, which could increase the logging costs further. Option C is correct because using AWS Cost Explorer to generate a cost report that details the cost for CloudWatch usage is a valid solution. AWS Cost Explorer is a tool that helps visualize, understand, and manage AWS costs and usage over time. AWS Cost Explorer can generate custom reports that show the breakdown of costs by service, region, account, tag, or any other dimension. AWS Cost Explorer can also filter and group costs by usage type, which can help identify the specific CloudWatch log groups that are the source of the increased logging costs. Option D is incorrect because using AWS CloudTrail to filter for CreateLogStream events for each application is not a valid solution. AWS CloudTrail is a service that records API calls and account activity for AWS services, including CloudWatch logs. However, AWS CloudTrail does not provide information about the cost or billing of CloudWatch logs. Filtering for CreateLogStream events would only show when a new log stream was created within a log group, but not how much data was ingested or stored by that log stream. References: CloudWatch Metrics CloudWatch Logs Insights AWS Cost Explorer AWS CloudTrail

• Question 156:

  Which statement is true about configuring proxy support for Amazon Inspector agent on Linuxbased systems?

  A. Amazon Inspector proxy support on Linux-based systems is achieved through installing proxyenabled version of the agent which comes with pre-configured files that you need to edit to match your environment.
  B. Amazon Inspector agent does NOT support the use of proxy on Linux-based systems.
  C. Amazon Inspector proxy configuration on Linux-based system is included in awsagent.env file under /etc/init.d/
  D. Amazon Inspector agent proxy settings on Linux-based systems are configured through WinHTTP proxy.
  C. Amazon Inspector proxy configuration on Linux-based system is included in awsagent.env file under /etc/init.d/

  ---

  To install an AWS agent on an EC2 instance that uses a proxy server Create a file called awsagent.env and save it in the /etc/init.d/ directory. Edit awsagent.env to include these environment variables in the following format: export https_proxy=https://hostname:port export http_proxy=http://hostname:port export no_proxy= 123.456.789.111 https://docs.aws.amazon.com/inspector/latest/userguide/inspector_agents-on-win.html#inspectoragent-proxy

• Question 157:

  A company is developing a web application's infrastructure using AWS CloudFormation. The database engineering team maintains the database resources in a CloudFormation template, and the software development team maintains the web application resources in a separate CloudFormation template. As the scope of the application grows, the software development team needs to use resources maintained by the database engineering team. However, both teams have their own review and lifecycle management processes that they want to keep. Both teams also require resource-level change-set reviews. The software development team would like to deploy changes to this template using their CI/CD pipeline.

  Which solution will meet these requirements?

  A. Create a stack export from the database CloudFormation template and import those references into the web application CloudFormation template.
  B. Create a CloudFormation nested stack to make cross-stack resource references and parameters available in both stacks.
  C. Create a CloudFormation stack set to make cross-stack resource references and parameters available in both stacks.
  D. Create input parameters in the web application CloudFormation template and pass resource names and IDs from the database stack.
  A. Create a stack export from the database CloudFormation template and import those references into the web application CloudFormation template.

  ---

  Create a stack export from the database CloudFormation template and import those references into the web application CloudFormation template. - Decoupled Management: Each team retains its management process, aligning with their specific workflows. - Cross-Stack Referencing: Utilizes CloudFormation's Exports and Fn::ImportValue to reference resources between stacks efficiently. - Resource-Level Change Sets: Supports detailed change-set reviews, enabling teams to preview changes before deployment. - CI/CD Pipeline Compatibility: Works seamlessly with CI/CD pipelines by allowing modular updates to stacks without direct dependencies.

• Question 158:

  A company's application is running on Amazon EC2 instances in an Auto Scaling group. A DevOps engineer needs to ensure there are at least four application servers running at all times. Whenever an update has to be made to the application, the engineer creates a new AMI with the updated configuration and updates the AWS CloudFormation template with the new AMI ID. After the stack finishes, the engineer manually terminates the old instances one by one, verifying that the new instance is operational before proceeding. The engineer needs to automate this process.

  Which action will allow for the LEAST number of manual steps moving forward?

  A. Update the CloudFormation template to include the UpdatePolicy attribute with the AutoScalingRollingUpdate policy.
  B. Update the CloudFormation template to include the UpdatePolicy attribute with the AutoScalingReplacingUpdate policy.
  C. Use an Auto Scaling lifecycle hook to verify that the previous instance is operational before allowing the DevOps engineer's selected instance to terminate.
  D. Use an Auto Scaling lifecycle hook to confirm there are at least four running instances before allowing the DevOps engineer's selected instance to terminate.
  B. Update the CloudFormation template to include the UpdatePolicy attribute with the AutoScalingReplacingUpdate policy.

• Question 159:

  A company runs applications in AWS accounts that are in an organization in AWS Organizations The applications use Amazon EC2 instances and Amazon S3.

  The company wants to detect potentially compromised EC2 instances suspicious network activity and unusual API activity in its existing AWS accounts and in any AWS accounts that the company creates in the future When the company detects one to these events the company wants to use an existing Amazon Simple Notification Service (Amazon SNS) topic to send a notification to its operational support team for investigation and remediation.

  Which solution will meet these requirements in accordance with AWS best practices?

  A. In the organization's management account, configure an AWS account as the Amazon GuardDuty administrator account. In the GuardDuty administrator account, add the company's existing AWS accounts to GuardDuty as members. In the GuardDuty administrator account, create an Amazon EventBridge rule with an event pattern to match GuardDuty events and to forward matching events to the SNS topic
  B. In the organization's management account configure Amazon GuardDuty to add newly created AWS accounts by invitation and to send invitations to the existing AWS accounts Create an AWS Cloud Formation stack set that accepts the GuardDuty invitation and creates an Amazon EventBridge rule Configure the rule with an event pattern to match. GuardDuty events and to forward matching events to the SNS topic. Configure the Cloud Formation stack set to deploy into all AWS accounts in the organization.
  C. In the organization's management account. create an AWS CloudTrail organization trail Activate the organization trail in all AWS accounts in the organization. Create an SCP that enables VPC Flow Logs in each account in the organization. Configure AWS Security Hub for the organization Create an Amazon EventBridge rule with an even pattern to match Security Hub events and to forward matching events to the SNS topic.
  D. In the organization's management account configure an AWS account as the AWS CloudTrail administrator account in the CloudTrail administrator account create a CloudTrail organization trail. Add the company's existing AWS accounts to the organization trail Create an SCP that enables VPC Flow Logs in each account in the organization. Configure AWS Security Hub for the organization. Create an Amazon EventBridge rule with an event pattern to match Security Hub events and to forward matching events to the SNS topic.
  A. In the organization's management account, configure an AWS account as the Amazon GuardDuty administrator account. In the GuardDuty administrator account, add the company's existing AWS accounts to GuardDuty as members. In the GuardDuty administrator account, create an Amazon EventBridge rule with an event pattern to match GuardDuty events and to forward matching events to the SNS topic

• Question 160:

  For Amazon Inspector's integration with CloudTrail, what information is logged for List* and Describe* APIs?

  A. None. Amazon Inspector is an automated service and not monitored by CloudTrail.
  B. Both request and response information is logged.
  C. Only request information is logged.
  D. Request information is always logged. Response information is logged only for Completed assessment runs.
  C. Only request information is logged.

  ---

  Explanation Explanation/Reference:For the Amazon Inspector integration with CloudTrail, for the List* and Describe* APIs, only the request information is logged. https://docs.aws.amazon.com/inspector/latest/userguide/logging-using-cloudtrail.html