Amazon DOP-C02 Online Practice Questions and Exam Preparation

Amazon DOP-C02 Online Questions & Answers

• Question 381:

  A company runs several applications across multiple AWS accounts in an organization in AWS Organizations. Some of the resources are not tagged properly and the company's finance team cannot determine which costs are associated with which applications. A DevOps engineer must remediate this issue and prevent this issue from happening in the future.

  Which combination of actions should the DevOps engineer take to meet these requirements? (Choose two.)

  A. Activate the user-defined cost allocation tags in each AWS account.
  B. Create and attach an SCP that requires a specific tag.
  C. Define each line of business (LOB) in AWS Budgets. Assign the required tag to each resource.
  D. Scan all accounts with Tag Editor. Assign the required tag to each resource.
  E. Use the budget report to find untagged resources. Assign the required tag to each resource.
  C. Define each line of business (LOB) in AWS Budgets. Assign the required tag to each resource.
  D. Scan all accounts with Tag Editor. Assign the required tag to each resource.

• Question 382:

  If Ansible encounters a resource that does not meet the requirements specified in the play it makes the necessary changes to the resource; however if the resource is already in the desired state Ansible will do nothing. This is an example of which methodology?

  A. Idempotency
  B. Immutability
  C. Convergence
  D. Infrastructure as Code
  A. Idempotency

  ---

  Explanation Explanation/Reference:Idempotency states that changes are only made if a resource does not meet the requirement specifications. If a change is made, it is made `in-place' and will not break existing resources. http://docs.ansible.com/ansible/glossary.html

• Question 383:

  A company containerized its Java app and uses CodePipeline. They want to scan images in ECR for vulnerabilities and reject images with critical vulnerabilities in a manual approval stage.

  Which solution meets these?

  A. Basic scanning with EventBridge for Inspector findings and Lambda to reject manual approval if critical vulnerabilities found.
  B. Enhanced scanning, Lambda invokes Inspector for SBOM, exports to S3, Athena queries SBOM, rejects manual approval on critical findings.
  C. Enhanced scanning, EventBridge listens to Detective scan findings, Lambda rejects manual approval on critical vulnerabilities.
  D. Enhanced scanning, EventBridge listens to Inspector scan findings, Lambda rejects manual approval on critical vulnerabilities.
  D. Enhanced scanning, EventBridge listens to Inspector scan findings, Lambda rejects manual approval on critical vulnerabilities.

• Question 384:

  Ansible provides some methods for controlling how or when a task is ran. Which of the following is a valid method for controlling a task with a loop?

  A. - with:
  B. - with_items:
  C. - only_when:
  D. - items:
  B. - with_items:

  ---

  Explanation Explanation/Reference:Ansible provides two methods for controlling tasks, loops and conditionals. The "with_items" context will allow the task to loop through a list of items, while the `when' context will allow a conditional requirement to be met for the task to run. Both can be used at the same time. http://docs.ansible.com/ansible/playbooks_conditionals.html#loops-and-conditionals

• Question 385:

  A company uses Amazon RDS for Microsoft SQL Server as its primary database. They need high availability within and across AWS Regions, with an RPO <1 min and RTO <10 min. Route 53 CNAME is used for the DB endpoint and must redirect to standby during failover.

  Which solution meets these requirements?

  A. Deploy an Amazon RDS for SQL Server Multi-AZ DB cluster with cross-Region read replicas. Use automation to promote replica and update Route 53.
  B. Deploy RDS Multi-AZ with snapshots copied every 5 minutes; use Lambda to restore snapshot and update Route 53 on failover.
  C. Deploy Single-AZ RDS and use AWS DMS to continuously replicate to another Region. Use CloudWatch alarms for failover notification.
  D. Deploy Single-AZ RDS and use AWS Backup for cross-Region backups every 30 seconds. Use automation to restore and update Route 53 during failover.
  A. Deploy an Amazon RDS for SQL Server Multi-AZ DB cluster with cross-Region read replicas. Use automation to promote replica and update Route 53.

• Question 386:

  A company has configured an Amazon S3 event source on an AWS Lambda function The company needs the Lambda function to run when a new object is created or an existing object IS modified In a particular S3 bucket The Lambda function will use the S3 bucket name and the S3 object key of the incoming event to read the contents of the created or modified S3 object The Lambda function will parse the contents and save the parsed contents to an Amazon DynamoDB table.

  The Lambda function's execution role has permissions to read from the S3 bucket and to write to the DynamoDB table, During testing, a DevOps engineer discovers that the Lambda function does not run when objects are added to the S3 bucket or when existing objects are modified.

  Which solution will resolve this problem?

  A. Increase the memory of the Lambda function to give the function the ability to process large files from the S3 bucket.
  B. Create a resource policy on the Lambda function to grant Amazon S3 the permission to invoke the Lambda function for the S3 bucket
  C. Configure an Amazon Simple Queue Service (Amazon SQS) queue as an OnFailure destination for the Lambda function
  D. Provision space in the /tmp folder of the Lambda function to give the function the ability to process large files from the S3 bucket
  B. Create a resource policy on the Lambda function to grant Amazon S3 the permission to invoke the Lambda function for the S3 bucket

  ---

  Option A is incorrect because increasing the memory of the Lambda function does not address the root cause of the problem, which is that the Lambda function is not triggered by the S3 event source. Increasing the memory of the Lambda function might improve its performance or reduce its execution time, but it does not affect its invocation. Moreover, increasing the memory of the Lambda function might incur higher costs, as Lambda charges based on the amount of memory allocated to the function. Option B is correct because creating a resource policy on the Lambda function to grant Amazon S3 the permission to invoke the Lambda function for the S3 bucket is a necessary step to configure an S3 event source. A resource policy is a JSON document that defines who can access a Lambda resource and under what conditions. By granting Amazon S3 permission to invoke the Lambda function, the company ensures that the Lambda function runs when a new object is created or an existing object is modified in the S3 bucket1. Option C is incorrect because configuring an Amazon Simple Queue Service (Amazon SQS) queue as an On-Failure destination for the Lambda function does not help with triggering the Lambda function. An On-Failure destination is a feature that allows Lambda to send events to another service, such as SQS or Amazon Simple Notification Service (Amazon SNS), when a function invocation fails. However, this feature only applies to asynchronous invocations, and S3 event sources use synchronous invocations. Therefore, configuring an SQS queue as an On-Failure destination would have no effect on the problem. Option D is incorrect because provisioning space in the /tmp folder of the Lambda function does not address the root cause of the problem, which is that the Lambda function is not triggered by the S3 event source. Provisioning space in the /tmp folder of the Lambda function might help with processing large files from the S3 bucket, as it provides temporary storage for up to 512 MB of data. However, it does not affect the invocation of the Lambda function. References: Using AWS Lambda with Amazon S3 Lambda resource access permissions AWS Lambda destinations [AWS Lambda file system]

• Question 387:

  A company has a workflow that generates a file for each of the company's products and stores the files in a production environment Amazon S3 bucket. The company's users can access the S3 bucket.

  Each file contains a product ID. Product IDs for products that have not been publicly announced are prefixed with a specific UUID. Product IDs are 12 characters long. IDs for products that have not been publicly announced begin with the letter P. The company does not want information about products that have not been publicly announced to be available in the production environment S3 bucket.

  Which solution will meet these requirements?

  A. Create a new staging S3 bucket. Generate all files in the new staging bucket. Create an Amazon Macie custom data identifier to identify product IDs in the new bucket that begin with the specific UUID. Launch an Amazon Macie sensitive data discovery job with the custom data identifier. Copy all files that do not have a Macie finding to the production S3 bucket.
  B. Create an Amazon Macie custom data identifier to identify product IDs in the production bucket that begin with the specific UUID. Launch an Amazon Macie sensitive data discovery job with the custom data identifier. Remove all files that have a Macie finding from the production S3 bucket.
  C. Create a new staging S3 bucket. Generate all files in the new staging bucket. Launch an Amazon Macie sensitive data discovery job with a managed data identifier. Copy all files that do not have a Macie finding to the production S3 bucket.
  D. Create an Amazon Macie sensitive data discovery job with a managed data identifier. Remove all files that have a Macie finding from the production S3 bucket.
  A. Create a new staging S3 bucket. Generate all files in the new staging bucket. Create an Amazon Macie custom data identifier to identify product IDs in the new bucket that begin with the specific UUID. Launch an Amazon Macie sensitive data discovery job with the custom data identifier. Copy all files that do not have a Macie finding to the production S3 bucket.

• Question 388:

  A company groups its AWS accounts in OUs in an organization in AWS Organizations. The company has deployed a set of Amazon API Gateway APIs in one of the Organizations accounts. The APIs are bound to the account's VPC and have no existing authentication mechanism. Only principals in a specific OU can have permissions to invoke the APIs.

  The company applies the following policy to the API Gateway interface VPC endpoint:

  

  The company also updates the API Gateway resource policies to deny invocations that do not come through the interface VPC endpoint. After the updates, the following error message appears during attempts to use the interface VPC endpoint URL to invoke an API: "User: anonymous is not authorized."

  Which combination of steps will solve this problem? (Choose two.)

  A. Enable IAM authentication on all API methods by setting AWS JAM as the authorization method.
  B. Create a token-based AWS Lambda authorizer that passes the caller's identity in a bearer token.
  C. Create a request parameter-based AWS Lambda authorizer that passes the caller's identity in a combination of headers, query string parameters, stage variables, and $cortext variables.
  D. Use Amazon Cognito user pools as the authorizer to control access to the API.
  E. Verify the identity of the requester by using Signature Version 4 to sign client requests by using AWS credentials.
  A. Enable IAM authentication on all API methods by setting AWS JAM as the authorization method.
  E. Verify the identity of the requester by using Signature Version 4 to sign client requests by using AWS credentials.

• Question 389:

  A software team is using AWS CodePipeline to automate its Java application release pipeline. The pipeline consists of a source stage, then a build stage, and then a deploy stage. Each stage contains a single action that has a runOrder value of 1.

  The team wants to integrate unit tests into the existing release pipeline. The team needs a solution that deploys only the code changes that pass all unit tests.

  Which solution will meet these requirements?

  A. Modify the build stage. Add a test action that has a runOrder value of 1. Use AWS CodeDeploy as the action provider to run unit tests.
  B. Modify the build stage. Add a test action that has a runOrder value of 2. Use AWS CodeBuild as the action provider to run unit tests.
  C. Modify the deploy stage. Add a test action that has a runOrder value of 1. Use AWS CodeDeploy as the action provider to run unit tests.
  D. Modify the deploy stage. Add a test action that has a runOrder value of 2. Use AWS CodeBuild as the action provider to run unit tests.
  B. Modify the build stage. Add a test action that has a runOrder value of 2. Use AWS CodeBuild as the action provider to run unit tests.

  ---

  B is correct: Runorder value of 2 ensure that we do unit tests after we build artifacts. A: The unit tests would run in parellel with the build step, which is incorrect. We can only test after we have done building C and D: The unit tests would not run before the deploy step.

• Question 390:

  A company runs applications on Windows and Linux Amazon EC2 instances. The instances run across multiple Availability Zones in an AWS Region. The company uses Auto Scaling groups for each application.

  The company needs a durable storage solution for the instances. The solution must use SMB for Windows and must use NFS for Linux. The solution must also have sub-millisecond latencies. All instances will read and write the data.

  Which combination of steps will meet these requirements? (Choose three.)

  A. Create an Amazon Elastic File System (Amazon EFS) file system that has targets in multiple Availability Zones.
  B. Create an Amazon FSx for NetApp ONTAP Multi-AZ file system.
  C. Create a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume to use for shared storage.
  D. Update the user data for each application's launch template to mount the file system.
  E. Perform an instance refresh on each Auto Scaling group.
  F. Update the EC2 instances for each application to mount the file system when new instances are launched.
  B. Create an Amazon FSx for NetApp ONTAP Multi-AZ file system.
  D. Update the user data for each application's launch template to mount the file system.
  E. Perform an instance refresh on each Auto Scaling group.