Amazon Amazon Certifications DOP-C02 Questions & Answers

• Question 71:

  A DevOps engineer wants to find a solution to migrate an application from on premises to AWS. The application is running on Linux and needs to run on specific versions of Apache Tomcat, HAProxy, and Varnish Cache to function properly. The application's operating system-level parameters require tuning. The solution must include a way to automate the deployment of new application versions. The infrastructure should be scalable and faulty servers should be replaced automatically.

  Which solution should the DevOps engineer use?

  A. Upload the application as a Docker image that contains all the necessary software to Amazon ECR. Create an Amazon ECS cluster using an AWS Fargate launch type and an Auto Scaling group. Create an AWS CodePipeline pipeline that uses Amazon ECR as a source and Amazon ECS as a deployment provider.

  B. Upload the application code to an AWS CodeCommit repository with a saved configuration file to configure and install the software. Create an AWS Elastic Beanstalk web server tier and a load balanced-type environment that uses the Tomcat solution stack. Create an AWS CodePipeline pipeline that uses CodeCommit as a source and Elastic Beanstalk as a deployment provider.

  C. Upload the application code to an AWS CodeCommit repository with a set of .ebextensions files to configure and install the software. Create an AWS Elastic Beanstalk worker tier environment that uses the Tomcat solution stack. Create an AWS CodePipeline pipeline that uses CodeCommit as a source and Elastic Beanstalk as a deployment provider.

  D. Upload the application code to an AWS CodeCommit repository with an appspec.yml file to configure and install the necessary software. Create an AWS CodeDeploy deployment group associated with an Amazon EC2 Auto Scaling group. Create an AWS CodePipeline pipeline that uses CodeCommit as a source and CodeDeploy as a deployment provider.

  Correct Answer: D

  D is correct: means the user need controls over os-level

  A: AWS Fargate and Docker dont provide os-level controls B and C: Beanstalk does not support Varnish Cache and no os-level controls provided

• Question 72:

  A DevOps engineer notices that all Amazon EC2 instances running behind an Application Load Balancer in an Auto Scaling group are failing to respond to user requests. The EC2 instances are also failing target group HTTP health checks.

  Upon inspection, the engineer notices the application process was not running in any EC2 instances. There are a significant number of out of memory messages in the system logs. The engineer needs to improve the resilience of the application to cope with a potential application memory leak. Monitoring and notifications should be enabled to alert when there is an issue.

  Which combination of actions will meet these requirements? (Choose two.)

  A. Change the Auto Scaling configuration to replace the instances when they fail the load balancer's health checks.

  B. Change the target group health check HealthCheckIntervalSeconds parameter to reduce the interval between health checks.

  C. Change the target group health checks from HTTP to TCP to check if the port where the application is listening is reachable.

  D. Enable the available memory consumption metric within the Amazon CloudWatch dashboard for the entire Auto Scaling group. Create an alarm when the memory utilization is high. Associate an Amazon SNS topic to the alarm to receive notifications when the alarm goes off.

  E. Use the Amazon CloudWatch agent to collect the memory utilization of the EC2 instances in the Auto Scaling group. Create an alarm when the memory utilization is high and associate an Amazon SNS topic to receive a notification.

  Correct Answer: AE

  A and E are correct: If there is failed instance, we should replace it with a new one to restart. Use cloudwatch agent to monitor metrics

  B: this does not do anything

  C: should not change from HTTP to TCP

  D: Cloudwatch work with agents, about which this option does not mention

• Question 73:

  A company has a mission-critical application on AWS that uses automatic scaling. The company wants the deployment lifecycle to meet the following parameters:

  1.

  The application must be deployed one instance at a time to ensure the remaining fleet continues to serve traffic.

  2.

  The application is CPU intensive and must be closely monitored.

  3.

  The deployment must automatically roll back if the CPU utilization of the deployment instance exceeds 85%.

  Which solution will meet these requirements?

  A. Use AWS CloudFormation to create an AWS Step Functions state machine and Auto Scaling lifecycle hooks to move to one instance at a time into a wait state. Use AWS Systems Manager automation to deploy the update to each instance and move it back into the Auto Scaling group using the heartbeat timeout.

  B. Use AWS CodeDeploy with Amazon EC2 Auto Scaling Configure an alarm tied to the CPU utilization metric. Use the CodeDeployDefault OneAtAtime configuration as a deployment strategy. Configure automatic rollbacks within the deployment group to roll back the deployment if the alarm thresholds are breached.

  C. Use AWS Elastic Beanstalk for load balancing and AWS Auto Scaling. Configure an alarm tied to the CPU utilization metric. Configure rolling deployments with a fixed batch size of one instance. Enable enhanced health to monitor the status of the deployment and roll back based on the alarm previously created.

  D. Use AWS Systems Manager to perform a blue/green deployment with Amazon EC2 Auto Scaling. Configure an alarm tied to the CPU utilization metric. Deploy updates one at a time. Configure automatic rollbacks within the Auto Scaling group to roll back the deployment if the alarm thresholds are breached.

  Correct Answer: B

  B is correct: < must be deployed one instance at a time> means codedeploy, which provides this option

  A: AWS Step Functions state machine does not provide deployment Functions

  C: Beanstalk does not work with EC2

  D: AWS SSM does not provides deployment Functions

• Question 74:

  A security team is concerned that a developer can unintentionally attach an Elastic IP address to an Amazon EC2 instance in production. No developer should be allowed to attach an Elastic IP address to an instance. The security team must be notified if any production server has an Elastic IP address at any time.

  How can this task be automated?

  A. Use Amazon Athena to query AWS CloudTrail logs to check for any associate-address attempts. Create an AWS Lambda function to disassociate the Elastic IP address from the instance, and alert the security team.

  B. Attach an IAM policy to the developers' IAM group to deny associate-address permissions. Create a custom AWS Config rule to check whether an Elastic IP address is associated with any instance tagged as production, and alert the security team.

  C. Ensure that all IAM groups associated with developers do not have associate-address permissions. Create a scheduled AWS Lambda function to check whether an Elastic IP address is associated with any instance tagged as production, and alert the security team if an instance has an Elastic IP address associated with it.

  D. Create an AWS Config rule to check that all production instances have EC2 IAM roles that include deny associate-address permissions. Verify whether there is an Elastic IP address associated with any instance, and alert the security team if an instance has an Elastic IP address associated with it.

  Correct Answer: B

  B is correct: < Attach an IAM policy to the developers' IAM group to deny associate-address permissions>: means we can deny all address-assosiate attempts

  A: AWS CloudTrail logs is used for monitoring users' actions. Though it would reveal associate-address attempts, it would not trigger AWS lambda to disassosiate the IPs

  C: : This is unnecessary and can be done more easily with option B.

  D: : We dont need to check the role of the EC2, we need to handle the role of developers.

  Summary: D is irrelevant while A and C, though can achive the requirements, consume more efforts and resources.

• Question 75:

  A DevOps engineer is using AWS CodeDeploy across a fleet of Amazon EC2 instances in an EC2 Auto Scaling group. The associated CodeDeploy deployment group, which is integrated with EC2 Auto Scaling, is configured to perform in-place deployments with CodeDeployDefault.OneAtATime. During an ongoing new deployment, the engineer discovers that, although the overall deployment finished successfully, two out of five instances have the previous application revision deployed. The other three instances have the newest application revision.

  What is likely causing this issue?

  A. The two affected instances failed to fetch the new deployment.

  B. A failed AfterInstall lifecycle event hook caused the CodeDeploy agent to roll back to the previous version on the affected instances.

  C. The CodeDeploy agent was not installed in two affected instances.

  D. EC2 Auto Scaling launched two new instances while the new deployment had not yet finished, causing the previous version to be deployed on the affected instances.

  Correct Answer: D

  D. EC2 Auto Scaling launched two new instances while the new deployment had not yet finished, causing the previous version to be deployed on the affected instances. In an EC2 Auto Scaling group, when a deployment is in progress and new instances are launched, they may receive the previous version of the application if the deployment has not yet completed. This is because the new instances join the Auto Scaling group and need to fetch the latest revision during the deployment process. If the deployment has not finished when the new instances are launched, they will fetch the current revision available in the Auto Scaling group, which might be the previous version.

• Question 76:

  An ecommerce company uses a large number of Amazon Elastic Block Store (Amazon EBS) backed Amazon EC2 instances. To decrease manual work across all the instances, a DevOps engineer is tasked with automating restart actions when EC2 instance retirement events are scheduled.

  How can this be accomplished?

  A. Create a scheduled Amazon EventBridge rule to run an AWS Systems Manager Automation runbook that checks if any EC2 instances are scheduled for retirement once a week. If the instance is scheduled for retirement, the runbook will hibernate the instance.

  B. Enable EC2 Auto Recovery on all of the instances. Create an AWS Config rule to limit the recovery to occur during a maintenance window only.

  C. Reboot all EC2 instances during an approved maintenance window that is outside of standard business hours. Set up Amazon CloudWatch alarms to send a notification in case any instance is failing EC2 instance status checks.

  D. Set up an AWS Health Amazon EventBridge rule to run AWS Systems Manager Automation runbooks that stop and start the EC2 instance when a retirement scheduled event occurs.

  Correct Answer: D

  D is correct: : these even occurs when the underlying infra that runs the instances needs to be repaired. To deal with this, just need to stop and start the instance to re-locate the instance to a different physical machine

  A: Hibernate would not work for this scenario

  B: This would also bring back the instance. However, AWS config rule cannot limit the recovery. It only reports, not actions

  C: This option is a manual work, not automated one

• Question 77:

  A DevOps engineer is building a solution that uses Amazon Simple Queue Service (Amazon SQS) standard queues. The solution also includes an AWS Lambda function and an Amazon DynamoDB table. The Lambda function pulls content from an SQS queue event source and writes the content to the DynamoDB table.

  The solution must maximize the scalability of Lambda and must prevent successfully processed SQS messages from being processed multiple times.

  Which solution will meet these requirements?

  A. Decrease the batch window to 1 second when configuring the Lambda function's event source mapping.

  B. Decrease the batch size to 1 when configuring the Lambda function's event source mapping.

  C. Include the ReportBatchItemFailures value in the FunctionResponseTypes list in the Lambda function's event source mapping.

  D. Set the queue visibility timeout on the Lambda function's event source mapping to account for invocation throttling of the Lambda function.

  Correct Answer: C

  C is correct. We need ReportBatchItemFailures to return only failed items

  A: batch window is the interval process time

  B: batch size is the size of the job

  D: queue visibility timeout is about re-process

• Question 78:

  A company uses an organization in AWS Organizations to manage its AWS accounts. The company's automation account contains a CI/CD pipeline that creates and configures new AWS accounts.

  The company has a group of internal service teams that provide services to accounts in the organization. The service teams operate out of a set of services accounts. The service teams want to receive an AWS CloudTrail event in their services accounts when the CreateAccount API call creates a new account.

  How should the company share this CloudTrail event with the service accounts?

  A. Create an Amazon EventBridge rule in the automation account to send account creation events to the default event bus in the services accounts. Update the default event bus in the services accounts to allow events from the automation account.

  B. Create a custom Amazon EventBridge event bus in the services accounts. Update the custom event bus to allow events from the automation account. Create an EventBridge rule in the services account that directly listens to CloudTrail events from the automation account.

  C. Create a custom Amazon EventBridge event bus in the automation account and the services accounts. Create an EventBridge rule and policy that connects the custom event buses that are in the automation account and the services accounts.

  D. Create a custom Amazon EventBridge event bus in the automation account. Create an EventBridge rule and policy that connects the custom event bus to the default event buses in the services accounts.

  Correct Answer: A

  A is correct: We need account creation events and this option provides us with exactly that

  B: < Create an EventBridge rule in the services account that directly listens to CloudTrail events>: This does not make sense. We should apply rule to eventbus to send event C and D: Both options send all events, not just account creation events

• Question 79:

  A company has an AWS Control Tower landing zone that manages its organization in AWS Organizations. The company created an OU structure that is based on the company's requirements. The company's DevOps team has established the core accounts for the solution and an account for all centralized AWS CloudFormation and AWS Service Catalog solutions.

  The company wants to offer a series of customizations that an account can request through AWS Control Tower.

  Which combination of steps will meet these requirements? (Choose three.)

  A. Enable trusted access for CloudFormation with Organizations by using service-managed permissions.

  B. Create an IAM role that is named AWSControlTowerBlueprintAccess. Configure the role with a trust policy that allows the AWSControlTowerAdmin role in the management account to assume the role. Attach the AWSServiceCatalogAdminFullAccess IAM policy to the AWSControlTowerBlueprintAccess role.

  C. Create a Service Catalog product for each CloudFormation template.

  D. Create a CloudFormation stack set for each CloudFormation template. Enable automatic deployment for each stack set. Create a CloudFormation stack instance that targets specific OUs.

  E. Deploy the Customizations for AWS Control Tower (CfCT) CloudFormation stack.

  F. Create a CloudFormation template that contains the resources for each customization.

  Correct Answer: BCF

  BCF are correct: means we need to set up a role for this accoun

  A: Trusted access is for assuming role only

  D: no mention of customization

  E: CFCT is needed only when we need to apply to best practice

• Question 80:

  A company runs applications in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster uses an Application Load Balancer to route traffic to the applications that run in the cluster.

  A new application that was migrated to the EKS cluster is performing poorly. All the other applications in the EKS cluster maintain appropriate operation. The new application scales out horizontally to the preconfigured maximum number of pods immediately upon deployment, before any user traffic routes to the web application.

  Which solution will resolve the scaling behavior of the web application in the EKS cluster?

  A. Implement the Horizontal Pod Autoscaler in the EKS cluster.

  B. Implement the Vertical Pod Autoscaler in the EKS cluster.

  C. Implement the Cluster Autoscaler.

  D. Implement the AWS Load Balancer Controller in the EKS cluster.

  Correct Answer: B