Amazon DOP-C02 Exam Dumps

Question # 1

A company is migrating its web application to AWS. The application uses WebSocketconnections for real-time updates and requires sticky sessions.A DevOps engineer must implement a highly available architecture for the application. Theapplication must be accessible to users worldwide with the least possible latency.Which solution will meet these requirements with the LEAST operational overhead?

A. Deploy an Application Load Balancer (ALB). Deploy another ALB in a different AWSRegion. Enable cross-zone load balancing and sticky sessions on the ALBs. Integrate theALBs with Amazon Route 53 latency-based routing. 
B. Deploy a Network Load Balancer (NLB). Deploy another NLB in a different AWS Region.Enable cross-zone load balancing and sticky sessions on the NLBs. Integrate the NLBswith Amazon Route 53 geolocation routing. 
C. Deploy a Network Load Balancer (NLB) with cross-zone load balancing enabled.Configure the NLB with IP-based targets in multiple Availability Zones. Use AmazonCloudFront for global content delivery. Implement sticky sessions by using source IPaddress preservation on the NLB
D. Deploy an Application Load Balancer (ALB) for HTTP traffic. Deploy a Network LoadBalancer (NLB) in each of the company's AWS Regions for WebSocket connections.Enable sticky sessions on the ALB. Configure the ALB to forward requests to the NLB. 

  Show Answer

Question # 2

A company uses an organization in AWS Organizations with all features enabled tomanage a fleet of AWS accounts. The company expects to create many new accounts foran upcoming project.The company wants to ensure that the new accounts will not have default VPCs and thatusers can develop only in specific AWS Regions. The company must monitor the newaccounts for compliance with the Center for Internet Security (CIS) AWS FoundationsBenchmark framework.Which combination of solutions will meet these requirements with the LEAST operationaleffort? (Select TWO.)

A. Activate AWS Control Tower. Configure AWS Control Tower to disable internetaccessible subnets. Set the maximum number of private subnets to zero. Configure Regiondenies, and ensure that users can access only the specified Regions.
B. Activate AWS Control Tower. Install Customizations for AWS Control Tower (CfCT).Develop a custom AWS CloudFormation template to delete default VPCs. ConfigureRegion denies, and ensure that users can access only the specified Regions.
C. Write an SCP that denies access to all Regions except the specified Regions. Create anAWS Lambda function that assumes an IAM role by using the Organizations default servicerole in each member account to identify and delete default VPCs. Create an AmazonEventBridge rule that invokes the Lambda function when the company creates a new AWSaccount.
D. Activate AWS Security Hub at the organization level. Select the CIS AWS FoundationsBenchmark framework, and apply the framework to the organization. 
E. Activate the CIS AWS Foundations Benchmark framework on the Control Library panelin AWS Control Tower. 

  Show Answer

Question # 3

A company has an on-premises application that is written in Go. A DevOps engineer mustmove the application to AWS. The company's development team wants to enableblue/green deployments and perform A/B testing.Which solution will meet these requirements?

A. Deploy the application on an Amazon EC2 instance, and create an AMI of the instance.Use the AMI to create an automatic scaling launch configuration that is used in an AutoScaling group. Use Elastic Load Balancing to distribute traffic. When changes are made tothe application, a new AMI will be created, which will initiate an EC2 instance refresh.
B. Use Amazon Lightsail to deploy the application. Store the application in a zipped formatin an Amazon S3 bucket. Use this zipped version to deploy new versions of the applicationto Lightsail. Use Lightsail deployment options to manage the deployment.
C. Use AWS CodeArtifact to store the application code. Use AWS CodeDeploy to deploythe application to a fleet of Amazon EC2 instances. Use Elastic Load Balancing todistribute the traffic to the EC2 instances. When making changes to the application, uploada new version to CodeArtifact and create a new CodeDeploy deployment.
D. Use AWS Elastic Beanstalk to host the application. Store a zipped version of theapplication in Amazon S3. Use that location to deploy new versions of the application. UseElastic Beanstalk to manage the deployment options. 

  Show Answer

Question # 4

A company runs a fleet of Amazon EC2 instances in a VPC. The company's employeesremotely access the EC2 instances by using the Remote Desktop Protocol (RDP). Thecompany wants to collect metrics about how many RDP sessions the employees initiateevery day. Which combination of steps will meet this requirement? (Select THREE.)

A. Create an Amazon EventBridge rule that reacts to EC2 Instance State-changeNotification events. 
B. Create an Amazon CloudWatch Logs log group. Specify the log group as a target for theEventBridge rule. 
C. Create a flow log in VPC Flow Logs. 
D. Create an Amazon CloudWatch Logs log group. Specify the log group as a destinationfor the flow log. 
E. Create a log group metric filter. 
F. Create a log group subscription filter. Use EventBridge as the destination. 

  Show Answer

Question # 5

A company is building a new pipeline by using AWS CodePipeline and AWS CodeBuild ina build account. The pipeline consists of two stages. The first stage is a CodeBuild job tobuild and package an AWS Lambda function. The second stage consists of deploymentactions that operate on two different AWS accounts a development environment accountand a production environment account. The deployment stages use the AWS Cloud Formation action that CodePipeline invokes to deploy the infrastructure that the Lambda functionrequires.A DevOps engineer creates the CodePipeline pipeline and configures the pipeline toencrypt build artifacts by using the AWS Key Management Service (AWS KMS) AWSmanaged key for Amazon S3 (the aws/s3 key). The artifacts are stored in an S3 bucketWhen the pipeline runs, the Cloud Formation actions fail with an access denied error.Which combination of actions must the DevOps engineer perform to resolve this error?(Select TWO.)

A. Create an S3 bucket in each AWS account for the artifacts Allow the pipeline to write tothe S3 buckets. Create a CodePipeline S3 action to copy the artifacts to the S3 bucket ineach AWS account Update the CloudFormation actions to reference the artifacts S3 bucketin the production account.
B. Create a customer managed KMS key Configure the KMS key policy to allow the IAMroles used by the CloudFormation action to perform decrypt operations Modify the pipelineto use the customer managed KMS key to encrypt artifacts.
C. Create an AWS managed KMS key Configure the KMS key policy to allow thedevelopment account and the production account to perform decrypt operations. Modify thepipeline to use the KMS key to encrypt artifacts.
D. In the development account and in the production account create an IAM role forCodePipeline. Configure the roles with permissions to perform CloudFormation operationsand with permissions to retrieve and decrypt objects from the artifacts S3 bucket. In theCodePipeline account configure the CodePipeline CloudFormation action to use the roles. 
E. In the development account and in the production account create an IAM role forCodePipeline Configure the roles with permissions to perform CloudFormationoperationsand with permissions to retrieve and decrypt objects from the artifacts S3 bucket. In theCodePipelme account modify the artifacts S3 bucket policy to allow the roles accessConfigure the CodePipeline CloudFormation action to use the roles. 

  Show Answer

Question # 6

A company is using AWS Organizations to create separate AWS accounts for each of itsdepartments The company needs to automate the following tasks• Update the Linux AMIs with new patches periodically and generate a golden image• Install a new version to Chef agents in the golden image, is available• Provide the newly generated AMIs to the department's accountsWhich solution meets these requirements with the LEAST management overhead'?

A. Write a script to launch an Amazon EC2 instance from the previous golden image Applythe patch updates Install the new version of the Chef agent, generate a new golden image,and then modify the AMI permissions to share only the new image with the department'saccounts. 
B. Use Amazon EC2 Image Builder to create an image pipeline that consists of the baseLinux AMI and components to install the Chef agent Use AWS Resource Access Managerto share EC2 Image Builder images with the department's accounts
C. Use an AWS Systems Manager Automation runbook to update the Linux AMI by usingthe previous image Provide the URL for the script that will update the Chef agent Use AWSOrganizations to replace the previous golden image in the department's accounts. 
D. Use Amazon EC2 Image Builder to create an image pipeline that consists of the baseLinux AMI and components to install the Chef agent Create a parameter in AWS SystemsManager Parameter Store to store the new AMI ID that can be referenced by thedepartment's accounts

  Show Answer

Question # 7

A DevOps engineer has created an AWS CloudFormation template that deploys anapplication on Amazon EC2 instances The EC2 instances run Amazon Linux Theapplication is deployed to the EC2 instances by using shell scripts that contain user data.The EC2 instances have an 1AM instance profile that has an 1AM role with theAmazonSSMManagedlnstanceCore managed policy attachedThe DevOps engineer has modified the user data in the CloudFormation template to installa new version of the application. The engineer has also applied the stack update. However,the application was not updated on the running EC2 instances. The engineer needs toensure that the changes to the application are installed on the running EC2 instances.Which combination of steps will meet these requirements? (Select TWO.)

A. Configure the user data content to use the Multipurpose Internet Mail Extensions(MIME) multipart format. Set the scripts-user parameter to always in the text/cloud-configsection. 
B. Refactor the user data commands to use the cfn-init helper script. Update the user datato install and configure the cfn-hup and cfn-mit helper scripts to monitor and apply themetadata changes
C. Configure an EC2 launch template for the EC2 instances. Create a new EC2 AutoScaling group. Associate the Auto Scaling group with the EC2 launch template Use theAutoScalingScheduledAction update policy for the Auto Scaling group.
D. Refactor the user data commands to use an AWS Systems Manager document (SSMdocument). Add an AWS CLI command in the user data to use Systems Manager RunCommand to apply the SSM document to the EC2 instances
E. Refactor the user data command to use an AWS Systems Manager document (SSMdocument) Use Systems Manager State Manager to create an association between theSSM document and the EC2 instances. 

  Show Answer

Question # 8

A company uses an organization in AWS Organizations to manage its AWS accounts. Thecompany's automation account contains a CI/CD pipeline that creates and configures newAWS accounts.The company has a group of internal service teams that provide services to accounts in theorganization. The service teams operate out of a set of services accounts. The serviceteams want to receive an AWS CloudTrail event in their services accounts when theCreateAccount API call creates a new account.How should the company share this CloudTrail event with the service accounts?

A. Create an Amazon EventBridge rule in the automation account to send account creationevents to the default event bus in the services accounts. Update the default event bus inthe services accounts to allow events from the automation account. 
B. Create a custom Amazon EventBridge event bus in the services accounts. Update thecustom event bus to allow events from the automation account. Create an EventBridge rulein the services account that directly listens to CloudTrail events from the automationaccount.
C. Create a custom Amazon EventBridge event bus in the automation account and theservices accounts. Create an EventBridge rule and policy that connects the custom eventbuses that are in the automation account and the services accounts. 
D. Create a custom Amazon EventBridge event bus in the automation account. Create anEventBridge rule and policy that connects the custom event bus to the default event busesin the services accounts. 

  Show Answer

Question # 9

A DevOps engineer uses AWS WAF to manage web ACLs across an AWS account. TheDevOps engineer must ensure that AWS WAF is enabled for all Application LoadBalancers (ALBs) in the account. The DevOps engineer uses an AWS CloudFormationtemplate to deploy an individual ALB and AWS WAF as part of each application stack'sdeployment process. If AWS WAF is removed from the ALB after the ALB is deployed,AWS WAF must be added to the ALB automatically.Which solution will meet these requirements with the MOST operational efficiency?

A. Enable AWS Config. Add the alb-waf-enabled managed rule. Create an AWS SystemsManager Automation document to add AWS WAF to an ALB. Edit the rule to automaticallyremediate. Select the Systems Manager Automation document as the remediation action.
B. Enable AWS Config. Add the alb-waf-enabled managed rule. Create an AmazonEventBridge rule to send all AWS Config ConfigurationItemChangeNotification notificationtypes to an AWS Lambda function. Configure the Lambda function to call the AWS Configstart-resource-evaluation API in detective mode.
C. Configure an Amazon EventBridge rule to periodically call an AWS Lambda function thatcalls the detect-stack-drift API on the CloudFormation template. Configure the Lambdafunction to modify the ALB attributes with waf.fail_open.enabled set to true if theAWS::WAFv2::WebACLAssociation resource shows a status of drifted.
D. Configure an Amazon EventBridge rule to periodically call an AWS Lambda function thatcalls the detect-stack-drift API on the CloudFormation template. Configure the Lambdafunction to delete and redeploy the CloudFormation stack if theAWS::WAFv2::WebACLAssociation resource shows a status of drifted.

  Show Answer

Question # 10

A company is using AWS CodePipeline to deploy an application. According to a newguideline, a member of the company's security team must sign off on any applicationchanges before the changes are deployed into production. The approval must be recordedand retained.Which combination of actions will meet these requirements? (Select TWO.)

A. Configure CodePipeline to write actions to Amazon CloudWatch Logs. 
B. Configure CodePipeline to write actions to an Amazon S3 bucket at the end of eachpipeline stage.
C. Create an AWS CloudTrail trail to deliver logs to Amazon S3. 
D. Create a CodePipeline custom action to invoke an AWS Lambda function for approval.Create a policy that gives the security team access to manage CodePipeline customactions. 
E. Create a CodePipeline manual approval action before the deployment step. Create apolicy that grants the security team access to approve manual approval stages.

  Show Answer

Question # 11

A company has an organization in AWS Organizations for its multi-account environment. ADevOps engineer is developing an AWS CodeArtifact based strategy for applicationpackage management across the organization. Each application team at the company hasits own account in the organization. Each application team also has limited access to acentralized shared services account.Each application team needs full access to download, publish, and grant access to its ownpackages. Some common library packages that the application teams use must also beshared with the entire organization.Which combination of steps will meet these requirements with the LEAST administrativeoverhead? (Select THREE.)

A. Create a domain in each application team's account. Grant each application team'saccount lull read access and write access to the application team's domain 
B. Create a domain in the shared services account Grant the organization read access andCreateRepository access.
C. Create a repository in each application team's account. Grant each application team'saccount lull read access and write access to its own repository. 
D. Create a repository in the shared services account. Grant the organization read accessto the repository in the shared services account. Set the repository as the upstreamrepository in each application team's repository. 
E. For teams that require shared packages, create resource-based policies that allow readaccess to the repository from other application teams' accounts. 
F. Set the other application teams' repositories as upstream repositories. 

  Show Answer

Question # 12

A company has developed a static website hosted on an Amazon S3 bucket. The websiteis deployed using AWS CloudFormation. The CloudFormation template defines an S3bucket and a custom resource that copies content into the bucket from a source location.The company has decided that it needs to move the website to a new location, so theexisting CloudFormation stack must be deleted and re-created. However, CloudFormationreports that the stack could not be deleted cleanly.What is the MOST likely cause and how can the DevOps engineer mitigate this problem forthis and future versions of the website?

A. Deletion has failed because the S3 bucket has an active website configuration. Modifythe Cloud Formation template to remove the WebsiteConfiguration properly from the S3bucket resource.
B. Deletion has failed because the S3 bucket is not empty. Modify the custom resource'sAWS Lambda function code to recursively empty the bucket when RequestType is Delete. 
C. Deletion has failed because the custom resource does not define a deletion policy. Adda DeletionPolicy property to the custom resource definition with a value ofRemoveOnDeletion. 
D. Deletion has failed because the S3 bucket is not empty. Modify the S3 bucket resourcein the CloudFormation template to add a DeletionPolicy property with a value of Empty.

  Show Answer

Question # 13

A company uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to host itsmachine learning (ML) application. As the ML model and the container image grow, podstartup time has increased to several minutes. The DevOps engineer created anEventBridge rule that triggers Systems Manager automation to prefetch container imagesfrom ECR. Node groups and the cluster have tags configured.What should the DevOps engineer do next to meet the requirements?

A. Create an IAM role allowing EventBridge to use Systems Manager to run commands inthe control plane nodes. Create a State Manager association using control plane nodetags.
B. Create an IAM role allowing EventBridge to use Systems Manager to run commands inthe worker nodes. Create a State Manager association using the nodes’ machine size. 
C. Create an IAM role allowing EventBridge to use Systems Manager to run commands inthe worker nodes. Create a State Manager association using the nodes’ tags to prefetchcontainer images. 
D. Create an IAM role allowing EventBridge to use Systems Manager to run commands inthe control plane nodes. Create a State Manager association using the nodes’ tags

  Show Answer

Question # 14

AnyCompany is using AWS Organizations to create and manage multiple AWS accountsAnyCompany recently acquired a smaller company, Example Corp. During the acquisitionprocess, Example Corp's single AWS account joined AnyCompany's management accountthrough an Organizations invitation. AnyCompany moved the new member account underan OU that is dedicated to Example Corp.AnyCompany's DevOps eng•neer has an IAM user that assumes a role that is namedOrganizationAccountAccessRole to access member accounts. This role is configured witha full access policy When the DevOps engineer tries to use the AWS Management Consoleto assume the role in Example Corp's new member account, the DevOps engineerreceives the following error message "Invalid information in one or more fields. Check yourinformation or contact your administrator."Which solution will give the DevOps engineer access to the new member account?

A. In the management account, grant the DevOps engineer's IAM user permission toassume the OrganzatlonAccountAccessR01e IAM role in the new member account. 
B. In the management account, create a new SCR In the SCP, grant the DevOpsengineer's IAM user full access to all resources in the new member account. Attach theSCP to the OU that contains the new member account, 
C. In the new member account, create a new IAM role that is namedOrganizationAccountAccessRole. Attach the AdmInistratorAccess AVVS managed policy tothe role. In the role's trust policy, grant the management account permission to assume therole.
D. In the new member account edit the trust policy for the Organ zationAccountAccessRoleIAM role. Grant the management account permission to assume the role. 

  Show Answer

Question # 15

A DevOps engineer wants to find a solution to migrate an application from on premises toAWS The application is running on Linux and needs to run on specific versions of ApacheTomcat HAProxy and Varnish Cache to function properly. The application's operatingsystem-level parameters require tuning The solution must include a way to automate thedeployment of new application versions. The infrastructure should be scalable and faultyservers should be replaced automatically.Which solution should the DevOps engineer use?

A. Upload the application as a Docker image that contains all the necessary software toAmazon ECR Create an Amazon ECS cluster using an AWS Fargate launch type and anAuto Scaling group. Create an AWS CodePipeline pipeline that uses Amazon ECR as asource and Amazon ECS as a deployment provider 
B. Upload the application code to an AWS CodeCommit repository with a savedconfiguration file to configure and install the software Create an AWS Elastic Beanstalkweb server tier and a load balanced-type environment that uses the Tomcat solution stackCreate an AWS CodePipeline pipeline that uses CodeCommit as a source and ElasticBeanstalk as a deployment provider
C. Upload the application code to an AWS CodeCommit repository with a set ofebextensions files to configure and install the software. Create an AWS Elastic Beanstalkworker tier environment that uses the Tomcat solution stack Create an AWS CodePipelinepipeline that uses CodeCommit as a source and Elastic Beanstalk as a deploymentprovider
D. Upload the application code to an AWS CodeCommit repository with an appspec.yml fileto configure and install the necessary software. Create an AWS CodeDeploy deploymentgroup associated with an Amazon EC2 Auto Scaling group Create an AWS CodePipelinepipeline that uses CodeCommit as a source and CodeDeploy as a deployment provider 

  Show Answer