Amazon DOP-C01 Exam Dumps

AWS Certified DevOps Engineer - Professional

Amazon DOP-C01 Sample Questions

Question # 1

A company has deployed several applications globally. Recently, Security Auditors found that few Amazon EC2 instances were launched without Amazon EBS disk encryption. The Auditors have requested a report detailing all EBS volumes that were not encrypted in multiple AWS accounts and regions. They also want to be notified whenever this occurs in future.How can this be automated with the LEAST amount of operational overhead? 

A. Create an AWS Lambda function to set up an AWS Config rule on all the targetaccounts. Use AWS Config aggregators to collect data from multiple accounts and regions.Export the aggregated report to an Amazon S3 bucket and use Amazon SNS to deliver thenotifications.
B. Set up AWS CloudTrail to deliver all events to an Amazon S3 bucket in a centralizedaccount. Use the S3 event notification feature to invoke an AWS Lambda function to parseAWS CloudTrail logs whenever logs are delivered to the S3 bucket. Publish the output toan Amazon SNS topic using the same Lambda function.
C. Create an AWS CloudFormation template that adds an AWS Config managed rule forEBS encryption. Use a CloudFormation stack set to deploy the template across allaccounts and regions. Store consolidated evaluation results from config rules in AmazonS3. Send a notification using Amazon SNS when non- compliant resources are detected.
D. Using AWS CLI, run a script periodically that invokes the aws ec2 describe-volumesquery with a JMESPATH query filter. Then, write the output to an Amazon S3 bucket. Setup an S3 event notification to send events using Amazon SNS when new data is written tothe S3 bucket

Answer: C

Show Answer

Question # 2

A company's application is running on Amazon EC2 instances in an Auto Scaling group. A DevOps engineer needs to ensure there are at least four application servers running at all times. Whenever an update has to be made to the application, the engineer creates a new AMI with the updated configuration and updates the AWS CloudFormation template with the new AMI ID. After the stack update finishes, the engineer manually terminates the old instances one by one. verifying that the new instance is operational before proceeding. The engineer needs to automate this process.Which action will allow for the LEAST number of manual steps moving forward?  

A. Update the CloudFormation template to include the UpdatePolicy attribute with theAutoScalingRollingUpdate policy.
B. Update the CloudFormation template to include the UpdatePolicy attribute with theAutoScalingReplacingUpdate policy.
C. Use an Auto Scaling lifecycle hook to verify that the previous instance is operationalbefore allowing the DevOps engineer's selected instance to terminate.
D. Use an Auto Scaling lifecycle hook to confirm there are at least four running instancesbefore allowing the DevOps engineer's selected instance to terminate.

Answer: A

Show Answer

Question # 3

A highly regulated company has a policy that DevOps Engineers should not log in to theirAmazon EC2 instances except in emergencies. If a DevOps Engineer does log in, theSecurity team must be notified within 15 minutes of the occurrence.Which solution will meet these requirements?

A. Install the Amazon Inspector agent on each EC2 instance. Subscribe to AmazonCloudWatch Events notifications. Trigger an AWS Lambda function to check if a messageis about user logins. If it is, send a notification to the Security team using Amazon SNS.
B. Install the Amazon CloudWatch agent on each EC2 instance. Configure the agent topush all logs to Amazon CloudWatch Logs and set up a CloudWatch metric filter thatsearches for user logins. If a login is found, send a notification to the Security team usingAmazon SNS.
C. Set up AWS CloudTrail with Amazon CloudWatch Logs. Subscribe CloudWatch Logs toAmazon Kinesis. Attach AWS Lambda to Kinesis to parse and determine if a log contains auser login. If it does, send a notification to the Security team using Amazon SNS.
D. Set up a script on each Amazon EC2 instance to push all logs to Amazon S3. Set up anS3 event to trigger an AWS Lambda function, which triggers an Amazon Athena query torun. The Athena query checks for logins and sends the output to the Security team usingAmazon SNS. 

Answer: B

Show Answer

Question # 4

An IT team has built an AWS CloudFormation template so others in the company canquickly and reliably deploy and terminate an application. The template creates an AmazonEC2 instance with a user data script to install the application and an Amazon S3 bucketthat the application uses to serve static webpages while it is running.All resources should be removed when the CloudFormation stack is deleted. However, theteam observes that CloudFormation reports an error during stack deletion, and the S3bucket created by the stack is not deleted.How can the team resolve the error in the MOST efficient manner to ensure that allresources are deleted without errors?

A. Add Deletion Policy attribute to the S3 bucket resource, with the value Delete forcing thebucket to be removed when the stack is deleted.
B. Add a custom resource when an AWS Lambda function with the DependsOn attributespecifying the S3 bucket, and an IAM role. Writhe the Lambda function to delete all objectsfrom the bucket when the RequestType is Delete.
C. Identify the resource that was not deleted. From the S3 console, empty the S3 bucketand then delete it.
D. Replace the EC2 and S3 bucket resources with a single AWS OpsWorks Stacksresource. Define a custom recipe for the stack to create and delete the EC2 instance andthe S3 bucket.

Answer: C

Show Answer

Question # 5

A DevOps Engineer is designing a deployment strategy for a web application. Theapplication will use an Auto Scaling group to launch Amazon EC2 instances using an AMI.The same infrastructure will be deployed in multiple environments (development, test, andquality assurance). The deployment strategy should meet the following requirements: "¢Minimize the startup time for the instance "¢ Allow the same AMI to work in multipleenvironments "¢ Store secrets for multiple environments securelyHow should this be accomplished?

A. Preconfigure the AMI using an AWS Lambda function that launches an Amazon EC2instance, and then runs a script to install the software and create the AMI. Configure anAuto Scaling lifecycle hook to determine which environment the instance is launched in,and, based on that finding, run a configuration script. Save the secrets on an .ini file andstore them in Amazon S3. Retrieve the secrets using a configuration script in EC2 user data.
B. Preconfigure the AMI by installing all the software using AWS Systems Managerautomation and configure Auto Scaling to tag the instances at launch with their specificenvironment. Then use a bootstrap script in user data to read the tags and configuresettings for the environment. Use the AWS Systems Manager Parameter Store to store thesecrets using AWS KMS.
C. Use a standard AMI from the AWS Marketplace. Configure Auto Scaling to detect thecurrent environment. Install the software using a script in Amazon EC2 user data. UseAWS Secrets Manager to store the credentials for all environments.
D. Preconfigure the AMI by installing all the software and configuration for all environments.Configure Auto Scaling to tag the instances at launch with their environment. Use theAmazon EC2 user data to trigger an AWS Lambda function that reads the instance ID andthen reconfigures the setting for the proper environment. Use the AWS Systems ManagerParameter Store to store the secrets using AWS KMS.

Answer: A

Show Answer

Question # 6

A company's web application will be migrated to AWS. The application is designed so thatthere is no server-side code required. As part of the migration, the company would like toimprove the security of the application by adding HTTP response headers, following theOpen Web Application Security Project (OWASP) secure headers recommendations.How can this solution be implemented to meet the security requirements using bestpractices?

A. Use an Amazon S3 bucket configured for website hosting, then set up server accesslogging on the S3 bucket to track user activity. Then configure the static website hostingand execute a scheduled AWS Lambda function to verify, and if missing, add securityheaders to the metadata.
B. Use an Amazon S3 bucket configured for website hosting, then set up server accesslogging on the S3 bucket to track user activity. Configure the static website hosting toreturn the required security headers.
C. Use an Amazon S3 bucket configured for website hosting. Create an AmazonCloudFront distribution that refers to this S3 bucket, with the origin response event set totrigger a Lambda@Edge Node.js function to add in the security headers.
D. set an Amazon S3 bucket configured for website hosting. Create an Amazon CloudFrontdistribution that refers to this S3 bucket. Set "Cache Based on Selected Request Headers"to "Whitelist," and add the security headers into the whitelist.

Answer: C

Show Answer

Question # 7

An application's users ate encountering bugs immediately after Amazon API Gateway deployments. The development team deploys once or twice a day and uses a blue/green deployment strategy with custom health checks and automated rollbacks. The team wantsto limit the number of users affected by deployment bugs and receive notifications whenrollbacks are needed.Which combination of steps should a DevOps engineer use to meet these requests?(Select TWO.)

A. Implement a blue/green strategy using path mappings.
B. Implement a canary deployment strategy.
C. Implement a rolling deployment strategy using multiple stages.
D. Use Amazon CloudWatch alarms to notify the development team.
E. Use Amazon CloudWatch Events to notify the development team.

Answer: B,D

Show Answer

Question # 8

After presenting a working proof of concept for a new application that uses AWS APIGateway, a Developer must set up a team development environment for the project. Due toa tight timeline, the Developer wants to minimize time spent on infrastructure setup, andwould like to reuse the code repository created for the proof of concept. Currently, allsource code is stored in AWS CodeCommit.Company policy mandates having alpha, beta, and production stages with separateJenkins servers to build code and run tests for every stage. The DevelopmentManager must have the ability to block code propagation between admins at any time. TheSecurity team wants to make sure that users will not be able to modify the environmentwithout permission.How can this be accomplished?

A. Create API Gateway alpha, beta, and production stages. Create a CodeCommit triggerto deploy code to the different stages using an AWS Lambda function.
B. Create API Gateway alpha, beta, and production stages. Create an AWS CodePipelinethat pulls code from the CodeCommit repository. Create CodePipeline actions to deploycode to the API Gateway stages.
C. Create Jenkins servers for the alpha, beta, and production stages on Amazon EC2instances. Create multiple CodeCommit triggers to deploy code to different stages using anAWS Lambda function.
D. Create an AWS CodePipeline pipeline that pulls code from the CodeCommit repository.Create alpha, beta, and production stages with Jenkins servers on CodePipeline.

Answer: D

Show Answer

Question # 9

A retail company wants to use AWS Elastic Beanstalk to host its online sales websiterunning on Java. Since this will be the production website, the CTO has the followingrequirements for the deployment strategy:*Zero downtime. While the deployment is ongoing, the current Amazon EC2 instances inservice should remain in service. No deployment or any other action should be performedon the EC2 instances because they serve production traffic.*A new fleet of instances should be provisioned for deploying the new application version.*Once the new application version is deployed successfully in the new fleet of instances,the new instances should be placed in service and the old ones should be removed.*The rollback should be as easy as possible. If the new fleet of instances fail to deploy thenew application version, they should be terminated and the current instances shouldcontinue serving traffic as normal.*The resources within the environment (EC2 Auto Scaling group, Elastic Load Balancing,Elastic Beanstalk DNS CNAME) should remain the same and no DNS change should bemade.Which deployment strategy will meet the requirements?

A. Use rolling deployments with a fixed amount of one instance at a time and set thehealthy threshold to OK.
B. Use rolling deployments with additional batch with a fixed amount of one instance at atime and set the healthy threshold to OK.
C. launch a new environment and deploy the new application version there, then perform aCNAME swap between environments.
D. Use immutable environment updates to meet all the necessary requirements.

Answer: D

Show Answer

Question # 10

A company has migrated its container-based applications to Amazon EKS and want toestablish automated email notifications. The notifications sent to each email address are forspecific activities related to EXS components. The solution will include Amazon SNS topicsand an AWS Lambda function to evaluate incoming log events and publish messages tothe correct SNS topic.Which logging solution will support these requirements?

A. Enable Amazon CloudWatch Logs to log the EKS components. Create a CloudWatch subscription filter for each component with Lambda as the subscription feed destination.
B. Enable Amazon CloudWatch Logs to log the EKS components. Create CloudWatchLogs Insights queries linked to Amazon CloudWatch Events events that trigger Lambda.
C. Enable Amazon S3 logging for the EKS components. Configure an Amazon CloudWatchsubscription filter for each component with Lambda as the subscription feed destination.
D. Enable Amazon S3 logging for the EKS components. Configure S3 PUT Object eventnotifications with AWS Lambda as the destination.

Answer: A

Show Answer

Question # 11

The management team at a company with a large on-premises OpenStack environmentwants to move non-production workloads to AWS. An AWS DirectConnect connection has been provisioned and configured to connect the environments.Due to contractual obligations, the production workloads must remain on- premises, andwill be moved to AWS after the next contract negotiation. The company follows Center forInternet Security (CIS) standards for hardening images; this configuration was developedusing the company's configuration management system.Which solution will automatically create an identical image in the AWS environment withoutsignificant overhead?

A. Write an AWS CloudFormation template that will create an Amazon EC2 instance. Usecloud-unit to install the configuration management agent, use cfn-wait to wait forconfiguration management to successfully apply, and use an AWS Lambda-backed customresource to create the AMI.
B. Log in to the console, launch an Amazon EC2 instance, and install the configurationmanagement agent. When changes are applied through the configuration managementsystem, log in to the console and create a new AMI from the instance.
C. Create a new AWS OpsWorks layer and mirror the image hardening standards. Use thislayer as the baseline for all AWS workloads.
D. When a change is made in the configuration management system, a job in Jenkins istriggered to use the VM Import command to create an Amazon EC2 instance in theAmazon VPC. Use lifecycle hooks to launch an AWS Lambda function to create the AMI.

Answer: D

Show Answer