AWS Certified DevOps Engineer Professional Practice Exams

Practice Test 1: DOP-C02
Open

Practice Test 2: DOP-C02

Set a certification due date

AWS Certified DevOps Engineer – Professional

Course content

AI Assistant

Practice tests

Start

Practice Test 1: DOP-C02

Start

Practice Test 2: DOP-C02

Start

Practice Test 3: DOP-C02

Start

Practice Test 4: DOP-C02

Start

Practice Test 5: DOP-C02

Start

Practice Test 6: DOP-C02

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

[2025] Pass the AWS DevOps Engineer Professional Exam DOP-C02 | Exam-Difficulty Practice Questions + Exam Simulation

Rating: 4.0 out of 54.0
320 ratings

4,812

Students

130 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified DevOps Engineer Professional exam the first time with a great score

EXAM SIMULATION: All practice tests are timed and scored (passing score is 75%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

ALWAYS UP TO DATE: Covering the latest DOP-C02 exam guide, our question bank is regularly updated based on student feedback from the real exam

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ACTIVE Q&A FORUM: In this discussion board, students ask questions and share their recent exam experience offering feedback on which topics were covered

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Description

Are you preparing for the AWS Certified DevOps Engineer Professional exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS DevOps Professional practice exams to assess your exam-readiness and get certified for DOP-C02.

Our course includes 6 AWS practice exams that include a total of 130 unique practice questions. All of our practice tests accurately reflect the difficulty of the Amazon Web Services exam questions and are the most realistic AWS exam experience available on Udemy.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Our questions are continually revised based on feedback from students who have recently taken the AWS exam, so you can be sure that they are up-to-date and reflect the latest exam format.

Our practice exam course is designed to give you a thorough understanding of the key concepts and topics covered in the DOP-C02 exam. Based on your test report that provides you with detailed feedback, you get to identify areas where you need to improve and build the confidence you need to succeed in the actual exam.

TOP REASONS WHY THESE PRACTICE EXAMS ARE YOUR BEST CHANCE TO ACE YOUR AWS EXAM

100% ALIGNED WITH LATEST DOP-C02 EXAM: All practice tests on Udemy are scenario-based reflecting the latest AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

SIMULATE THE REAL CERTIFICATION EXAM: Practice tests are timed (130 min to answer 65 questions) and scored (passing score is 72%) accurately mirroring the real exam environment. This allows you to become familiar with the AWS exam format

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

REGULAR UPDATES OF QUESTIONS: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, most of our students achieve exceptional results, with an average exam score of over 85%.

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered.

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the pass mark for the actual AWS exam is 72%, we highly recommend that you continue taking our AWS practice exams until you achieve a consistent score of 80% or higher. Once you reach this recommended score on our practice tests, you'll be well-prepared to sit the actual exam and achieve a great score.

GET FAMILIAR WITH THE ACTUAL EXAM FORMAT: Our AWS Certified DevOps Pro practice exams are specifically designed to help you become familiar with the test question format and structure of the actual AWS exam. Unlike many other practice tests on the market, our exams closely match the format of the real AWS exam, ensuring that you are adequately prepared for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS DevOps practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Certified DevOps certification exam with confidence.

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy.

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to fast-track their exam success!

MONEY-BACK GUARANTEE

We are totally confident in the value of our Practice Exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

ABOUT THE AWS CERTIFIED DEVOPS ENGINEER PROFESSIONAL CERTIFICATION

The AWS Certified DevOps Engineer Professional certification is one of the most sought-after certifications in the cloud computing industry. AWS DevOps are in huge demand and salaries can be above $150,000 USD per annum. The AWS Certified DevOps s exam aims to test knowledge of the key services and tools used by DevOps creating applications on AWS.

When you're ready to book your exam you can do so on the AWS Training portal. Curious about the AWS DevOps certification cost? The AWS DevOps Professional Certification cost is $300 USD in most regions and you currently have the choice of an online proctored exam or test center (subject to availability).

OUR MISSION

At Digital Cloud Training we are committed to your success. Our mission is to provide you with the resources you need to pass your exam on your first attempt - without wasting time or money. After completing these AWS Certified DevOps Pro Practice Tests and assessing your exam readiness, you'll be more than ready for the real AWS exam.

Who this course is for:

Students preparing for the AWS Certified DevOps Engineer Professional (DOP-C02) exam who want to pass with confidence

Students who want to test their skills in exam simulation, assessing their DOP-C02 exam readiness

Anyone who wants to learn AWS through high-quality questions and answers, explanations and reference links

Anyone who is keen to take their career and salary to the next level with an AWS certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Requirements

This course is designed for individuals with a solid AWS knowledge and experience (at the Associate level)

It is recommended that students have successfully passed one or more of the AWS Associate level exams.

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Practice Test 1: DOP-C02

DOP-C02 - Results

Back to result overview
Attempt 1

All domains

All domains

AWS Security, Identity, & Compliance

AWS Management & Governance

AWS Database

AWS Storage

AWS Developer Tools

AWS Compute

AWS Networking & Content Delivery

AWS Analytics

25 all

0 correct

0 incorrect

25 skipped

0 marked

Collapse all questions

Question 1Skipped

An application is being deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team requires that the traffic is secured with SSL/TLS certificates. Protection against common web exploits must also be implemented. The solution should not have a performance impact on the EC2 instances.

What steps should be taken to secure the web application? (Select TWO.)

Correct selection

Add an SSL/TLS certificate to a secure listener on the ALB.

Correct selection

Create an AWS WAF web ACL and attach it to the ALB.

Install SSL/TLS certificates on the EC2 instances.

Configure Server-Side Encryption with KMS managed keys.

Enable EBS encryption for the EC2 volumes to encrypt all traffic.

Overall explanation

To secure the traffic in transit an SSL/TLS certificate should be attached to a secure listener on the ALB. This will not affect the performance of the EC2 instances as the encryption takes place only between the client and the ALB. The certificate can be issued through AWS Certificate Manager (ACM).

The AWS Web Application Firewall (AWS WAF) protects against common web exploits. The company can create a web ACL with a rule and action and then attach it to the ALB. This will protect against web exploits.

CORRECT: "Add an SSL/TLS certificate to a secure listener on the ALB" is a correct answer (as explained above.)

CORRECT: "Create an AWS WAF web ACL and attach it to the ALB" is also a correct answer (as explained above.)

INCORRECT: "Install SSL/TLS certificates on the EC2 instances" is incorrect.

Encryption on the EC2 instances would impact the performance of those instances.

INCORRECT: "Configure Server-Side Encryption with KMS managed keys" is incorrect.

This is not relevant to in transit encryption, this is used to encrypt data at rest on services such as Amazon S3.

INCORRECT: "Enable EBS encryption for the EC2 volumes to encrypt all traffic" is incorrect.

EBS encryption is used for encrypting data at rest. The question requires encryption using SSL/TLS certificates which is encryption in transit.

References:

https://aws.amazon.com/blogs/aws/aws-web-application-firewall-waf-for-application-load-balancers/

https://aws.amazon.com/elasticloadbalancing/application-load-balancer/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Security, Identity, & Compliance

Question 2Skipped

A company runs many different workloads across hundreds of Amazon EC2 instances. The DevOps team requires that all instances have standard configurations. These configurations include standard logging, metrics, security assessments, and weekly patching.

Which combination of actions meets these requirements with the most operational efficiency? (Select TWO.)

Use Amazon Inspector to install and manage AWS Systems Manager, AWS OpsWorks, and the Amazon CloudWatch agent on all instances.

Correct selection

Use AWS Systems Manager maintenance windows with Systems Manager Run Command to schedule Systems Manager Patch Manager tasks. Use Amazon EventBridge to schedule Amazon Inspector assessment runs.

Use AWS CloudFormation with change sets to deploy AMIs patched by Systems Manager Patch Manager to existing EC2 instances. Use AWS Config to require regular Amazon Inspector assessment runs.

Use AWS OpsWorks and execute custom recipes to patch the EC2 instances. Use AWS Systems Manager Run Command to initiate regular Amazon Inspector assessment runs.

Correct selection

Use AWS Systems Manager to install and manage Amazon Inspector, Systems Manager Patch Manager, and the Amazon CloudWatch agent on all instances.

Overall explanation

The most operationally efficient solution is to use AWS Systems Manager patch manager for patching and Amazon Inspector for assessing the security status of the instances. The Amazon CloudWatch agent can also be installed on the instances to get enhanced metrics and logging.

Systems Manager can be used to install and manage the other components. You must have the Systems Manager agent installed on the instances and the instance profile attached must have permissions to Systems Manager.

The patching process can be implemented by using Systems Manager Run Command to schedule tasks that deploy the updates using Systems Manager Patch Manager. EventBridge is ideal for scheduling the Amazon Inspector assessment runs.

CORRECT: "Use AWS Systems Manager to install and manage Amazon Inspector, Systems Manager Patch Manager, and the Amazon CloudWatch agent on all instances" is a correct answer (as explained above.)

CORRECT: "Use AWS Systems Manager maintenance windows with Systems Manager Run Command to schedule Systems Manager Patch Manager tasks. Use Amazon EventBridge to schedule Amazon Inspector assessment runs" is also a correct answer (as explained above.)

INCORRECT: "Use Amazon Inspector to install and manage AWS Systems Manager, AWS OpsWorks, and the Amazon CloudWatch agent on all instances" is incorrect.

Inspector is not a service that can be used to install anything, it simply runs assessments against your instances and lets you know if there are any security concerns.

INCORRECT: "Use AWS OpsWorks and execute custom recipes to patch the EC2 instances. Use AWS Systems Manager Run Command to initiate regular Amazon Inspector assessment runs" is incorrect.

OpsWorks would be less operationally efficient for this purpose. Systems Manager Patch Manager is a better way to deploy patches as it is designed for this purpose and provides many features to simplify and optimize the patching process.

INCORRECT: "Use AWS CloudFormation with change sets to deploy AMIs patched by Systems Manager Patch Manager to existing EC2 instances. Use AWS Config to require regular Amazon Inspector assessment runs" is incorrect.

You cannot deploy patched AMIs to existing instances. AMIs are used to deploy the instance initially but you cannot redeploy the AMI without wiping the instance state. Config also cannot be used to enforce an Amazon Inspector assessment run.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html

https://aws.amazon.com/inspector/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-systems-manager/

https://digitalcloud.training/amazon-inspector/

Domain

AWS Management & Governance

Question 3Skipped

An eCommerce company has operations in several countries around the world. The company runs an application in co-location facilities that uses Linux servers and a relational database running on MySQL. The application will be migrated to AWS and will include Amazon EC2 instances behind an Application Load Balancer in multiple AWS Regions. The database configuration has not yet been finalized.

A DevOps engineer has been asked to assist with determining the best solution for the database. The data includes product catalog information which must be served with low latency and customer purchase information which should be kept within each Region for compliance purposes.

Which database solution should the DevOps engineer recommend to meet these requirements with the LEAST changes to the application?

Use Amazon DynamoDB global tables for the product catalog and regional tables for the customer purchase data.

Correct answer

Use Aurora with read replicas for the product catalog and additional local Aurora instances in each region for the customer purchase data.

Use Amazon Redshift for the product catalog and Amazon DynamoDB tables for the customer purchase data.

Use Aurora for the product catalog and Amazon DynamoDB global tables for the customer purchase data.

Overall explanation

The current database runs on MySQL which is a relational database. Therefore, to meet the requirement to minimize changes to the application the cloud solution for the database should also be a relational database. Otherwise significant changes to the application may be required. This rules out all answers that include DynamoDB as that service is a non-relational database.

Amazon Aurora provides read replicas for scaling read performance horizontally. These replicas can be within a Region or across Regions. The product catalog data can be provided at low latency within each AWS Region using cross-Region read replicas.

For the customer purchase data, this can be kept within each Region by implementing local Aurora database instances which can additionally have read replicas within the Region if additional read performance is required.

CORRECT: "Use Aurora with read replicas for the product catalog and additional local Aurora instances in each region for the customer purchase data" is the correct answer (as explained above.)

INCORRECT: "Use Amazon Redshift for the product catalog and Amazon DynamoDB tables for the customer purchase data" is incorrect.

RedShift is used for online analytics processing (OLAP) use cases as it is a data warehouse solution. In this case the solution calls for an online transaction processing (OLTP) type of database as it is processing transactions.

INCORRECT: "Use Amazon DynamoDB global tables for the product catalog and regional tables for the customer purchase data" is incorrect.

DynamoDB is a non-relational database, and the application is designed to work with a relational database. Using DynamoDB would require significant changes to the application.

INCORRECT: "Use Aurora for the product catalog and Amazon DynamoDB global tables for the customer purchase data" is incorrect.

As above, DynamoDB should not be used for this solution.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Replication.CrossRegion.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 4Skipped

A company uses a single AWS account and Region for development activities with multiple teams working on independent projects. A DevOps engineer must implement a mechanism to notify the operations manager when the creation of resources approaches the service limits for the AWS account.

Which solution will accomplish this with the LEAST amount of development effort?

Create an AWS Config custom rule that runs regularly and checks the AWS service limit status and sends notifications to an Amazon SNS topic. Deploy an AWS Lambda function that notifies the operations manager and subscribe the Lambda function to the SNS topic.

Create an AWS Lambda function that evaluates the deployed resources in the account and evaluates them against resource limits on the account. Create an Amazon EventBridge rule to run the Lambda function regularly and configure an Amazon SNS topic that notifies the operations manager.

Create an AWS Lambda function that refreshes AWS Personal Health Dashboard checks and use an Amazon EventBridge rule to run the Lambda function regularly. Create another EventBridge rule with an event pattern matching Trusted Advisor checks and configure an Amazon SNS topic that notifies the operations manager.

Correct answer

Create an AWS Lambda function that refreshes AWS Trusted Advisor checks and use an Amazon EventBridge rule to run the Lambda function regularly. Create another EventBridge rule with an event pattern matching Trusted Advisor checks and configure an Amazon SNS topic that notifies the operations manager.

Overall explanation

AWS Trusted Advisor provides recommendations that help you follow AWS best practices. Trusted Advisor evaluates your account by using checks. Some checks are refreshed automatically whilst others do require you to call the RefreshTrustedAdvisorCheck API action. Checks include evaluating the service limit usage by AWS service in a Region.

The solution presented here uses AWS Lambda to refresh the service limit checks and EventBridge to trigger the Lambda function execution. Then, EventBridge is used again to look for event patterns that indicate service limits have been reached and then send an SNS notification to the operations manager. This is the simplest solution for meeting these requirements.

CORRECT: "Create an AWS Lambda function that refreshes AWS Trusted Advisor checks and use an Amazon EventBridge rule to run the Lambda function regularly. Create another EventBridge rule with an event pattern matching Trusted Advisor checks and configure an Amazon SNS topic that notifies the operations manager" is the correct answer (as explained above.)

INCORRECT: "Create an AWS Lambda function that evaluates the deployed resources in the account and evaluates them against resource limits on the account. Create an Amazon EventBridge rule to run the Lambda function regularly and configure an Amazon SNS topic that notifies the operations manager" is incorrect.

This would require complex development and is much more difficult compared to using AWS Trusted Advisor which already has all the service limit checks built in.

INCORRECT: "Create an AWS Lambda function that refreshes AWS Personal Health Dashboard checks and use an Amazon EventBridge rule to run the Lambda function regularly. Create another EventBridge rule with an event pattern matching Trusted Advisor checks and configure an Amazon SNS topic that notifies the operations manager" is incorrect.

Personal Health Dashboard does not monitor service limits, it is a place to learn about the availability and operations of AWS services.

INCORRECT: "Create an AWS Config custom rule that runs regularly and checks the AWS service limit status and sends notifications to an Amazon SNS topic. Deploy an AWS Lambda function that notifies the operations manager and subscribe the Lambda function to the SNS topic" is incorrect.

This would be complex to implement and again it would be better to use AWS Trusted Advisor which already has the service limit checks built in.

References:

https://docs.aws.amazon.com/awssupport/latest/user/cloudwatch-events-ta.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-trusted-advisor/

Domain

AWS Security, Identity, & Compliance

Question 5Skipped

A DevOps engineer launched an Amazon EC2 instance in an Amazon VPC. The instance must download an object from a restricted Amazon S3 bucket. When trying to download the object, a 403 Access Denied error was received.

What are two possible causes for this error? (Select TWO.)

Default encryption is enabled on the S3 bucket.

Correct selection

There is an issue with the IAM role configuration.

The object has been moved to Amazon Glacier.

S3 versioning is enabled on the S3 bucket.

Correct selection

The bucket policy does not grant permission.

Overall explanation

The most likely cause of this error message is that either the S3 bucket policy or IAM role configuration has an error or simply does not grant the required permissions. The DevOps engineer should review the bucket policy or associated IAM user policies for any statements that might be denying access.

The engineer should also verify that the requests to the bucket meet any conditions in the bucket policy or IAM policies, checking for any incorrect deny statements, missing actions, or incorrect spacing in the policy.

CORRECT: "The bucket policy does not grant permission" is a correct answer (as explained above.)

CORRECT: "There is an issue with the IAM role configuration" is also a correct answer (as explained above.)

INCORRECT: "Default encryption is enabled on the S3 bucket" is incorrect.

This would not affect access to the object as the object would be automatically decrypted by S3.

INCORRECT: "The object has been moved to Amazon Glacier" is incorrect.

With Glacier an AccessDeniedException error would be received if permission is not granted.

INCORRECT: "S3 versioning is enabled on the S3 bucket" is incorrect.

Versioning does not affect access permissions to an object.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/s3-troubleshoot-403/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 6Skipped

A web application runs on Amazon EC2 instances in an EC2 Auto Scaling group behind an Application Load Balancer (ALB). A DevOps engineer needs to implement a strategy for deploying updates that meets the following requirements:

· Automatically launches the new version of the application on a second set of instances with the same capacity as the old version of the application.

· Maintains the old version unchanged while the new version is launched.

· Shifts traffic to the new version when the instances are fully deployed.

· Terminates the old fleet of instances automatically 1 hour after shifting traffic.

Which solution will satisfy these requirements?

Correct answer

Use AWS CodeDeploy and create a deployment group that uses a blue/green deployment configuration. Use the BlueInstanceTerminationOption to terminate the instances in the blue environment after 1 hour.

Use AWS Elastic Beanstalk with the configuration set to Immutable. Create an .ebextension using the Resources key that sets the deletion policy of the ALB to 1 hour and deploy the application.

Create an AWS CloudFormation template and configure a retention policy for the ALB set to 1 hour. Update the Amazon Route 53 record to redirect traffic to the new ALB.

Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from old set of instances to the new one. Create an application version lifecycle policy that terminates the original environment after 1 hour.

Overall explanation

When you use a blue/green deployment strategy with AWS CodeDeploy it can be configured to automatically copy the auto scaling group and launch instances running the new version of the application in a new environment. The capacity of the new auto scaling group can be the same and the original ASG can be maintained until the launch is complete.

The instances in the new environment can be a new target group behind the ALB. The traffic can be shifted across to the new environment when the launch is complete by modifying the target group setting in the ALB. This is performed automatically by CodeDeploy.

The BlueInstanceTerminationOption can be used to configure whether instances in the original environment are terminated when a blue/green deployment is successful. The options are:

TERMINATE: Instances are terminated after a specified wait time.

KEEP_ALIVE: Instances are left running after they are deregistered from the load balancer and removed from the deployment group.

CORRECT: "Use AWS CodeDeploy and create a deployment group that uses a blue/green deployment configuration. Use the BlueInstanceTerminationOption to terminate the instances in the blue environment after 1 hour" is the correct answer (as explained above.)

INCORRECT: "Create an AWS CloudFormation template and configure a retention policy for the ALB set to 1 hour. Update the Amazon Route 53 record to redirect traffic to the new ALB" is incorrect.

A CloudFormation retention policy configures which resources should be retained when a stack is deleted. Retention policies are not suitable for implementing blue/green deployments.

INCORRECT: "Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from old set of instances to the new one. Create an application version lifecycle policy that terminates the original environment after 1 hour" is incorrect.

A lifecycle policy tells Elastic Beanstalk to delete application versions that are old, or to delete application versions when the total number of versions for an application exceeds a specified number. This is not used for blue/green deployments.

INCORRECT: "Use AWS Elastic Beanstalk with the configuration set to Immutable. Create an .ebextension using the Resources key that sets the deletion policy of the ALB to 1 hour and deploy the application" is incorrect.

You can use the Resources key in a configuration file to create and customize AWS resources in your environment. However this is not suitable for implementing a blue/green deployment strategy and the ALB does not need to be deleted. Instead, traffic simply needs to be shifted from one target group to another (when using the correct deployment configuration).

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-groups-create-blue-green.html

https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BlueInstanceTerminationOption.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 7Skipped

The launch template that is used by an Auto Scaling group has been modified to use a new instance type and AMI. The Auto Scaling group is deployed using AWS CloudFormation. There are 8 production EC2 instances running in the Auto Scaling group.

A DevOps engineer needs to modify the Auto Scaling group to use the new template version without causing any interruption to the application and must ensure that at least 4 instances are always running.

Correct answer

Use the AutoScalingRollingUpdate attribute with the MinInstancesInService property.

Use the AutoScalingReplacingUpdate attribute and specify the WaitOnResourceSignals and PauseTime properties.

Use the UpdateReplacePolicy attribute and specify the MinSuccessfulInstancesPercent and MaxBatchSize properties.

Use the AutoScalingScheduledAction attribute with the MaxBatchSize property.

Overall explanation

You can use the UpdatePolicy attribute to specify how AWS CloudFormation handles updates to several types of resource including Auto Scaling groups. This attribute can be configured with several properties to determine how the update process works. This is important to ensure that the correct number of instances are still available to service requests whilst the update process occurs.

The MinInstancesInService property specifies the minimum number of instances that must be in service within the Auto Scaling group while CloudFormation updates old instances. You can also specify the MaxBatchSize which specifies the maximum number of instances that CloudFormation updates.

CORRECT: "Use the AutoScalingRollingUpdate attribute with the MinInstancesInService property" is the correct answer (as explained above.)

INCORRECT: "Use the AutoScalingScheduledAction attribute with the MaxBatchSize property" is incorrect.

This is the wrong attribute to use; the engineer must use the AutoScalingRollingUpdate attribute instead.

INCORRECT: "Use the AutoScalingReplacingUpdate attribute and specify the WaitOnResourceSignals and PauseTime properties" is incorrect.

A rolling update should be used to specify the number of instances to update in a batch. The replacing update either replaces all instances or creates a new ASG. The properties specified are also inappropriate for the situation (check the link below for more detail).

INCORRECT: "Use the UpdateReplacePolicy attribute and specify the MinSuccessfulInstancesPercent and MaxBatchSize properties" is incorrect.

This attribute is used to retain or, in some cases, backup the existing physical instance of a resource when it's replaced during a stack update operation.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-updatepolicy.html

Save time with our exam-specific cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 8Skipped

A company plans to deploy a high-performance computing (HPC) workload on Amazon EC2 instances in a shared Amazon VPC. Developers in multiple participant accounts must be granted access to the cluster to perform analytics. The cluster requires a shared file system that supports file-based access to objects stored in Amazon S3 buckets.

Which deployment steps should be implemented to support the required features and access control?

Deploy and Amazon FSx for OpenZFS file system. Create an IAM role that can be assumed by members of the participant accounts and provide permissions through an identity based policy assigned to the role. Use security groups to enable file system access.

Deploy an Amazon FSx for Windows file server file system. Create an IAM role that can be assumed by members of the participant accounts and provide permissions through an identity based policy assigned to the role. Use security groups to enable file system access.

Correct answer

Deploy an Amazon FSx for Lustre file system. Create an IAM role that can be assumed by members of the participant accounts and provide permissions through an identity based policy assigned to the role. Use security groups to enable file system access.

Deploy an Amazon FSx for NetApp ONTAP file system with NFS access. Create a resource based policy that allows cross-account access for members of the participant accounts. Use access keys to authenticate users and use security groups to enable file system access.

Overall explanation

Amazon FSx for Lustre is the only option that can present objects stored in S3 buckets as files. The question specifically asks for file-based access for objects stored in buckets, so this requirement is satisfied by using FSx for Lustre. The access control requirements can be implemented through an AWS IAM role that can be assumed by cross-account participants. Permissions should be assigned through an identity-based permissions policy assigned to the role.

CORRECT: "Deploy an Amazon FSx for Lustre file system. Create an IAM role that can be assumed by members of the participant accounts and provide permissions through an identity based policy assigned to the role. Use security groups to enable file system access" is the correct answer (as explained above.)

INCORRECT: "Deploy an Amazon FSx for NetApp ONTAP file system with NFS access. Create a resource based policy that allows cross-account access for members of the participant accounts. Use access keys to authenticate users and use security groups to enable file system access" is incorrect.

This FSx file system does not allow file-based access to S3 objects. You also cannot use resource based policies with FSx file systems and access keys would be unsuitable for cross-account access.

INCORRECT: "Deploy an Amazon FSx for Windows file server file system. Create an IAM role that can be assumed by members of the participant accounts and provide permissions through an identity based policy assigned to the role. Use security groups to enable file system access" is incorrect.

This FSx file system does not allow file-based access to S3 objects. This file system should be used with Windows servers that need an NTFS file system.

INCORRECT: "Deploy and Amazon FSx for OpenZFS file system. Create an IAM role that can be assumed by members of the participant accounts and provide permissions through an identity based policy assigned to the role. Use security groups to enable file system access" is incorrect.

This FSx file system does not allow file-based access to S3 objects.

References:

https://docs.aws.amazon.com/fsx/latest/LustreGuide/security_iam_service-with-iam.html

https://aws.amazon.com/fsx/lustre/faqs/

Domain

AWS Storage

Question 9Skipped

A law firm is planning to migrate existing applications to AWS. These applications are hosted in an on-premises data center and are complex in nature. The applications could take many months to migrate. While the migration is underway, the application development team implemented a tactical solution using Amazon CloudFront with a custom origin pointing to the SSL endpoint URL for the legacy web application.

The ad-hoc solution worked for several weeks; however, all browser connections recently began showing an HTTP 502 Bad Gateway error with the header "X-Cache: Error from CloudFront". Network monitoring services show that the HTTPS port 443 on the legacy web application is open and responding to requests.

Which option could be the reason for the error and how can it be solved?

The SSL certificate on the legacy web application server has expired. Install a new self-signed certificate along with the full certificate chain onto the legacy web application server.

The SSL certificate on the legacy web application server has expired. Reissue the SSL certificate on the web server via the AWS Certificate Manager (ACM) in the hosting region.

Correct answer

The SSL certificate on the legacy web application server has expired. Reissue the SSL certificate on the web server that is signed by a globally recognized certificate authority (CA). Install the full certificate chain onto the legacy web application server.

The SSL certificate on the CloudFront distribution has expired. Reissue the SSL certificate on the CloudFront distribution via the AWS Certificate Manager (ACM) in the hosting region.

Overall explanation

CORRECT: "The SSL certificate on the legacy web application server has expired. Reissue the SSL certificate on the web server that is signed by a globally recognized certificate authority (CA). Install the full certificate chain onto the legacy web application server" is the correct answer (as explained above.)

INCORRECT: "The SSL certificate on the legacy web application server has expired. Reissue the SSL certificate on the web server via the AWS Certificate Manager (ACM) in the hosting region" is incorrect.

You can't export an Amazon Issued ACM public certificate for use on an EC2 instance or another custom web server because ACM manages the private key.

INCORRECT: "The SSL certificate on the CloudFront distribution has expired. Reissue the SSL certificate on the CloudFront distribution via the AWS Certificate Manager (ACM) in the hosting region" is incorrect.

If you’re using certificates that you get from a third-party certificate authority (CA), you must monitor certificate expiration dates and renew the certificates that you import into AWS Certificate Manager (ACM) or upload to the AWS Identity and Access Management certificate store before they expire.

INCORRECT: "The SSL certificate on the legacy web application server has expired. Install a new self-signed certificate along with the full certificate chain onto the legacy web application server" is incorrect.

A self-signed certificate is a security certificate that is not signed by a certificate authority (CA). You can't use a self-signed certificate for HTTPS communication between CloudFront and your origin, so this option is incorrect.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-whatis-howdoesitwork.html

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html#https-requirements-cert-expiration

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 10Skipped

A DevOps engineer manages an application that stores logs in Amazon CloudWatch Logs. The engineer needs to archive the logs in an Amazon S3 bucket. The log files are rarely accessed after 90 days and for compliance reasons must be retained for 10 years. The solution should run in an automated fashion.

Which combination of steps should the DevOps engineer take to meet the requirements? (Select TWO.)

Create a CloudWatch Logs export to save the log files to a logging bucket and then import all logs to the destination S3 bucket.

Create an S3 bucket lifecycle policy that transitions the log files to Reduced Redundancy after 90 days and expires the log files after 3,650 days.

Create a CloudWatch Logs subscription filter that uses AWS DataSync to synchronize all logs to an S3 bucket.

Correct selection

Create an S3 bucket lifecycle policy that transitions the log files to S3 Glacier after 90 days and expires the log files after 3,650 days.

Correct selection

Create a CloudWatch Logs subscription filter that uses Amazon Kinesis Data Firehose to stream all logs to an S3 bucket.

Overall explanation

The best solution to meet these requirements is to use an CloudWatch Logs subscription filter to automatically stream the log files via Amazon Kinesis Data Firehose to the S3 bucket. You can use a subscription filter with Kinesis, Lambda, or Kinesis Data Firehose.

The S3 bucket can be configured with a bucket lifecycle policy that transitions the log files to S3 Glacier after 90 days and then expires the log files after 10 years (3,650 days). Glacier is the most cost-effective option for storing objects that are rarely accessed.

CORRECT: "Create a CloudWatch Logs subscription filter that uses Amazon Kinesis Data Firehose to stream all logs to an S3 bucket" is a correct answer (as explained above.)

CORRECT: "Create an S3 bucket lifecycle policy that transitions the log files to S3 Glacier after 90 days and expires the log files after 3,650 days" is also a correct answer (as explained above.)

INCORRECT: "Create a CloudWatch Logs subscription filter that uses AWS DataSync to synchronize all logs to an S3 bucket" is incorrect.

You cannot use DataSync with a CloudWatch Logs subscription filter. You can use a subscription filter with Kinesis, Lambda, or Kinesis Data Firehose.

INCORRECT: "Create a CloudWatch Logs export to save the log files to a logging bucket and then import all logs to the destination S3 bucket" is incorrect.

This is not an automated solution, and the logging bucket is not required in this case.

INCORRECT: "Create an S3 bucket lifecycle policy that transitions the log files to Reduced Redundancy after 90 days and expires the log files after 3,650 days" is incorrect.

The most cost-effective solution for rarely accessed files is Glacier.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Storage

Question 11Skipped

A critical production application running on AWS uses automatic scaling. The operations team must run updates on the application that affect only one instance at a time. The deployment process must ensure all remaining instances continue to serve traffic. The deployment must roll back if the update causes the CPU utilization of the updated instance to exceed 85%.

Which solution will meet these requirements?

Correct answer

Configure AWS CodeDeploy with Amazon EC2 Auto Scaling. Create an alarm based on the CPU utilization metric. Use the CodeDeployDefault.OneAtAtime configuration for deployment. Configure automatic rollbacks to roll back the deployment if the alarm thresholds are exceeded.

Configure AWS CloudFormation to create an AWS Step Functions state machine and Auto Scaling lifecycle hooks to move one instance at a time into a wait state. Use AWS Systems Manager automation to deploy the update to each instance and move it back into the Auto Scaling group.

Configure AWS Systems Manager to perform a blue/green deployment with Amazon EC2 Auto Scaling. Create an alarm based on the CPU utilization metric. Deploy updates one at a time. Configure automatic rollbacks to roll back the deployment if the alarm thresholds are exceeded.

Configure AWS Elastic Beanstalk with a load balancer and use AWS Auto Scaling. Create an alarm based on the CPU utilization metric. Configure rolling deployments with a fixed batch size of one instance. Configure automatic rollbacks to roll back the deployment if the alarm thresholds are exceeded.

Overall explanation

You can monitor and automatically react to changes in your AWS CodeDeploy deployments using Amazon CloudWatch alarms. Amazon CloudWatch is a monitoring service for AWS cloud resources and the applications you run on AWS.

Using CloudWatch with CodeDeploy, you can monitor metrics for Amazon EC2 instances or Auto Scaling groups being managed by CodeDeploy and then invoke an action if the metric you are tracking crosses a certain threshold for a defined period. You can monitor metrics such as instance CPU utilization.

If the alarm is activated, CloudWatch initiates actions such as sending a notification to Amazon Simple Notification Service, stopping a CodeDeploy deployment, or changing the state of an instance (e.g. reboot, terminate, recover).

For this scenario the deployment can use the CodeDeployDefault.OneAtAtime strategy which ensures that only one instance will be taken out of action at a time, and automatic rollbacks if the alarm threshold is exceeded. This meets all requirements.

CORRECT: "Configure AWS CodeDeploy with Amazon EC2 Auto Scaling. Create an alarm based on the CPU utilization metric. Use the CodeDeployDefault.OneAtAtime configuration for deployment. Configure automatic rollbacks to roll back the deployment if the alarm thresholds are exceeded" is the correct answer (as explained above.)

INCORRECT: "Configure AWS CloudFormation to create an AWS Step Functions state machine and Auto Scaling lifecycle hooks to move one instance at a time into a wait state. Use AWS Systems Manager automation to deploy the update to each instance and move it back into the Auto Scaling group" is incorrect.

CodeDeploy is a much better solution as it is designed for this purpose. This answer pieces together several services in a more complex solution.

INCORRECT: "Configure AWS Elastic Beanstalk with a load balancer and use AWS Auto Scaling. Create an alarm based on the CPU utilization metric. Configure rolling deployments with a fixed batch size of one instance. Configure automatic rollbacks to roll back the deployment if the alarm thresholds are exceeded" is incorrect.

Elastic Beanstalk uses ELB health checks (basic health), or with enhanced health it monitors application logs and the state of your environment's other resources. It does not use CloudWatch alarms.

INCORRECT: "Configure AWS Systems Manager to perform a blue/green deployment with Amazon EC2 Auto Scaling. Create an alarm based on the CPU utilization metric. Deploy updates one at a time. Configure automatic rollbacks to roll back the deployment if the alarm thresholds are exceeded" is incorrect.

Systems Manager cannot perform blue/green updates though it can be used with other AWS Developer Tools as part of a solution for deploying updates in this manner.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/monitoring-create-alarms.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Management & Governance

Question 12Skipped

A security review has identified that an AWS CodeBuild project is downloading a database population script from an Amazon S3 bucket using an unauthenticated request. The security team has prohibited unauthenticated requests to S3 buckets for this project.

How can this issue be resolved in the MOST secure manner?

Correct answer

Remove unauthenticated access from the S3 bucket using a bucket policy. Modify the service role for the CodeBuild project to include Amazon S3 access permissions. Use the AWS CLI to download the database population script.

Remove unauthenticated access from the S3 bucket using a bucket policy. Use the AWS CLI to download the database population script using an IAM access key and a secret access key.

Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token. Update the build spec to use cURL to pass the token and download the database population script.

Add the bucket name to the AllowedBuckets section of the CodeBuild project settings. Update the build spec to use the AWS CLI to download the database population script.

Overall explanation

Removing unauthenticated access from the bucket through a bucket policy ensures that the S3 bucket is protected from unauthorized access. Granting the CodeBuild project's service role explicit permissions to access the S3 bucket aligns with the principle of least privilege. Using the AWS CLI within the build spec ensures secure and seamless access to the bucket.

CORRECT: "Remove unauthenticated access from the S3 bucket using a bucket policy. Modify the service role for the CodeBuild project to include Amazon S3 access permissions. Use the AWS CLI to download the database population script" is the correct answer (as explained above.)

INCORRECT: "Add the bucket name to the AllowedBuckets section of the CodeBuild project settings. Update the build spec to use the AWS CLI to download the database population script" is incorrect.

Adding the bucket name to the AllowedBuckets section does not address the security issue. The CodeBuild project needs proper IAM permissions to access the S3 bucket securely. Relying on unauthenticated access remains insecure and against the security team's requirements.

INCORRECT: "Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token. Update the build spec to use cURL to pass the token and download the database population script" is incorrect.

Enabling HTTPS basic authentication for the S3 bucket is not supported by AWS. Amazon S3 uses IAM policies and bucket policies for access control, not basic authentication. Additionally, using cURL to pass tokens does not align with AWS's recommended best practices.

INCORRECT: "Remove unauthenticated access from the S3 bucket using a bucket policy. Use the AWS CLI to download the database population script using an IAM access key and a secret access key" is incorrect.

Using IAM access keys and secret access keys directly is less secure than granting a CodeBuild service role the necessary permissions. Hardcoding access keys in the build spec or environment can lead to security vulnerabilities, such as accidental exposure of credentials.

References:

https://docs.aws.amazon.com/codebuild/latest/userguide/setting-up-service-role.html

Domain

AWS Management & Governance

Question 13Skipped

An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). Users on the internet have reported performance issues with the application. A DevOps engineer must investigate the reports and identify the processing latencies for requests.

How can the engineer obtain this information?

Review Amazon CloudWatch metrics.

Install the Amazon CloudWatch agent.

Use AWS CIoudTrail to identify API requests.

Correct answer

Enable access logs on the load balancer.

Overall explanation

Elastic Load Balancing provides access logs that capture detailed information about requests sent to your load balancer. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses. You can use these access logs to analyze traffic patterns and troubleshoot issues.

The access logs include the following entries (relating to processing latency):

· Request_processing_time - The total time elapsed from the time the load balancer received the request until the time it sent the request to a target.

· Target_processing_time - The total time elapsed from the time the load balancer sent the request to a target until the target started to send the response headers.

· Response_processing_time - The total time elapsed from the time the load balancer received the response header from the target until it started to send the response to the client.

CORRECT: "Enable access logs on the load balancer" is the correct answer (as explained above.)

INCORRECT: "Use AWS CIoudTrail to identify API requests" is incorrect.

API requests do not include any application metrics.

INCORRECT: "Install the Amazon CloudWatch agent" is incorrect.

The CloudWatch agent does capture additional metrics, but this does not include application processing times.

INCORRECT: "Review Amazon CloudWatch metrics" is incorrect.

CloudWatch does not capture this information in standard metrics. You would need to create custom metrics.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#access-log-entry-format

Save time with our exam-specific cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Networking & Content Delivery

Question 14Skipped

A legacy application uses IAM user credentials to access resources in the company's AWS Organizations organization. It should not be possible to create IAM users unless the user account making the requires is specific on an exception list. A DevOps engineer must apply these restrictions.

Which solution will meet these requirements?

Correct answer

Attach an Organizations SCP with an explicit deny for all iam:CreateUser actions with a condition that includes StringNotLike for aws:username with a value of the exception list.

Create an Amazon EventBridge rule with a pattern that matches the iam:GetUser action and an AWS Lambda function target. Use the function to check the user’s name against the exception list and delete the user account if it is not listed.

Create an Amazon EventBridge rule with a pattern that matches the iam:CreateUser action and an AWS Lambda function target. Use the function to check the user’s name against the exception list and delete the user account if it is not listed.

Attach an Organizations SCP with an explicit deny for all iam:CreateLoginProfile actions with a condition that excludes StringEquals for aws:username with a value of the exception list.

Overall explanation

With AWS Organizations Service Control Policies (SCPs) you can restrict access to specific resources or define conditions for when SCPs are in effect. The condition element is supported when the Effect element has a value of Deny.

The StringNotLike condition will check the exception list for the aws:username that made the request. If the username is not present the request will be denied.

CORRECT: "Attach an Organizations SCP with an explicit deny for all iam:CreateUser actions with a condition that includes StringNotLike for aws:username with a value of the exception list" is the correct answer (as explained above.)

INCORRECT: "Attach an Organizations SCP with an explicit deny for all iam:CreateLoginProfile actions with a condition that excludes StringEquals for aws:username with a value of the exception list" is incorrect.

The API action iam:CreateLoginProfile creates a password for the specified IAM user. This is not used to create the user account.

INCORRECT: "Create an Amazon EventBridge rule with a pattern that matches the iam:GetUser action and an AWS Lambda function target. Use the function to check the user’s name against the exception list and delete the user account if it is not listed" is incorrect.

The API action iam:GetUser retrieves information about the specified IAM user, including the user's creation date, path, unique ID, and ARN.

INCORRECT: "Create an Amazon EventBridge rule with a pattern that matches the iam:CreateUser action and an AWS Lambda function target. Use the function to check the user’s name against the exception list and delete the user account if it is not listed" is incorrect.

The function should be used to validate that the iam:CreateUser request is being initiated by a user on the exception list. It should not delete the requesting user account.

References:

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_syntax.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-organizations/

Domain

AWS Management & Governance

Question 15Skipped

A data intelligence and analytics company has implemented a CI/CD pipeline using AWS CodePipeline which takes code from an AWS CodeCommit repository and then builds it using AWS CodeBuild. During the deploy stage, the application is deployed onto an Amazon ECS cluster. During deployment, the application is only partly updated on some ECS tasks which are running an older version of the image.

A DevOps engineer investigated and found that terminating the task or clearing the local Docker cache fixes the issue, but a more robust solution is required that provides visibility and identification to track where container images are deployed. Also, the start-up time of the containers needs to be optimized.

Which actions should the DevOps engineer take to achieve these requirements? (Select TWO.)

Move secondary dependencies to be downloaded at application startup rather than including them within a static container image.

Correct selection

Move all the dependencies into a single image and pull them from a single container registry.

Correct selection

When creating a new task definition for the ECS service, ensure to add the sha256 hash in the full image name so that ECS pulls the correct image every time.

When creating a new task definition for the ECS service, ensure to add the latest tag in the full image name so that ECS pulls the correct image every time.

After the deploy step in CodePipeline is done, include a Custom Step that triggers an AWS Lambda. The function will SSH onto the ECS instances and clear the local Docker cache and restart the task.

Overall explanation

Amazon ECS SHA Tracking provides visibility and identification to track where container images are deployed by using task state change events emitted to CloudWatch Events. SHA Tracking is integrated with Amazon ECR, ECS, Fargate and CloudWatch Events to support application lifecycle operations. The IMAGEID property is the SHA digest for the Docker image used to start the container.

Ideally, a container image is intended to be a complete snapshot of everything that the application requires to function. With a complete container image, the application could be run by downloading one container image from one place.

There is no need to download several separate pieces from different locations. Therefore, as a best practice, store all application dependencies as static files inside the container image. This will improve performance and start up time.

CORRECT: "Move all the dependencies into a single image and pull them from a single container registry" is a correct answer (as explained above.)

CORRECT: "When creating a new task definition for the ECS service, ensure to add the sha256 hash in the full image name so that ECS pulls the correct image every time" is also a correct answer (as explained above.)

INCORRECT: "When creating a new task definition for the ECS service, ensure to add the latest tag in the full image name so that ECS pulls the correct image every time" is incorrect.

The exact image tag needs to be pulled because the latest tag will only pull the image that was pushed last.

INCORRECT: "After the deploy step in CodePipeline is done, include a Custom Step that triggers an AWS Lambda. The function will SSH onto the ECS instances and clear the local Docker cache and restart the task" is incorrect.

Using Lambda to SSH onto instances is not a workable solution. SSM Run Command may be better but it’s also not ideal.

INCORRECT: "Move secondary dependencies to be downloaded at application startup rather than including them within a static container image" is incorrect.

This would delay the image spin up time rather than improving it.

References:

https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/application.html

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/container-metadata.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 16Skipped

The DevOps team at a global retail company wants to deploy the latest application code to through build, staging, beta & prod environments. While doing the staging deployment, an automated functional test suite needs to be executed which runs for approximately two hours to complete regression testing. The code is managed via AWS CodeCommit.

How can a DevOps engineer optimize the configuration and automate the pipeline?

Create a CodePipeline pointing to the master branch of the CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a Step Function which will run the test suite. Create a CloudWatch Event Rule on the execution termination of the Step Function to invoke a Lambda function and signal CodePipeline the success or failure. If the stage doesn’t fail, the last stage will deploy the application to production.

Create a CodePipeline pointing to the master branch of the CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a custom stage using a Lambda function that will run the test suite. If the stage succeeds, the last stage will deploy the application to production.

Create a CodePipeline pointing to the master branch of the CodeCommit repository and as a first stage run a CodeBuild build that will run the test suite against the staging environment. Upon passing, deploy to staging using CodeDeploy and if it succeeds, deploy to production.

Correct answer

Create a CodePipeline pointing to the master branch of the CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a CodeBuild build that will run the test suite. If the stage doesn’t fail, the last stage will deploy the application to production.

Overall explanation

The solution to these requirements uses an AWS CodePipeline pipeline to automate the entire CI/CD pipeline. When code is committed it will be picked up as a change and the pipeline execution commences. This will automate the testing suites and deployment into production using CodeDeploy.

Lambda should be ruled out for running the test suite as the maximum timeout for a Lambda function is 15 minutes, so it will not support the given use-case since the functional test suite runs for over two hours.

INCORRECT: "Create a CodePipeline pointing to the master branch of the CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a CodeBuild build that will run the test suite. If the stage doesn’t fail, the last stage will deploy the application to production" is incorrect.

CORRECT: "Create a CodePipeline pointing to the master branch of the CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a custom stage using a Lambda function that will run the test suite. If the stage succeeds, the last stage will deploy the application to production" is the correct answer (as explained above.)

INCORRECT: "Create a CodePipeline pointing to the master branch of the CodeCommit repository and as a first stage run a CodeBuild build that will run the test suite against the staging environment. Upon passing, deploy to staging using CodeDeploy and if it succeeds, deploy to production" is incorrect.

Since CodeBuild Test can’t be as a stage prior to deploying in the staging environment, so this option is incorrect.

INCORRECT: "Create a CodePipeline pointing to the master branch of the CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a Step Function which will run the test suite. Create a CloudWatch Event Rule on the execution termination of the Step Function to invoke a Lambda function and signal CodePipeline the success or failure. If the stage doesn’t fail, the last stage will deploy the application to production" is incorrect.

AWS Step Functions is a low-code, visual workflow service that developers use to build distributed applications, automate IT and business processes, and build data and machine learning pipelines using AWS services. Workflows manage failures, retries, parallelization, service integrations, and observability so developers can focus on higher-value business logic. This is not an ideal use case for Step Functions.

References:

https://aws.amazon.com/blogs/devops/test-reports-with-aws-codebuild/

https://aws.amazon.com/blogs/devops/automating-your-api-testing-with-aws-codebuild-aws-codepipeline-and-postman/

https://docs.aws.amazon.com/codebuild/latest/userguide/how-to-create-pipeline.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 17Skipped

A company manages several legacy applications that all generate different log formats. The logs need to be standardized so they can be queried and analyzed. A DevOps engineer needs a solution for standardizing the log formats before writing them to
an Amazon S3 bucket.

How can this requirement be met at the LOWEST cost?

Correct answer

Configure the Amazon Kinesis Agent to upload the logs to Amazon Kinesis Data Firehose and use an AWS Lambda function to normalize the log files before they are loaded to Amazon S3.

Configure the application to send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs. Do the analysis directly from Amazon QuickSight.

Configure the application to send the log files to an Amazon S3 bucket and use Amazon Redshift Spectrum to normalize the logs in place.

Configure the application to send its logs to an Amazon OpenSearch cluster and use Lambda to normalize the logs and export to S3.

Overall explanation

Kinesis Data Firehose can invoke an AWS Lambda function to transform incoming source data and deliver the transformed data to destinations. You can enable Kinesis Data Firehose data transformation when you create your delivery stream.

Each server can run the Kinesis agent and upload logs to the Kinesis Data Firehose delivery stream. Then the Lambda function will normalize the log files before they are loaded to the S3 bucket.

CORRECT: "Configure the Amazon Kinesis Agent to upload the logs to Amazon Kinesis Data Firehose and use an AWS Lambda function to normalize the log files before they are loaded to Amazon S3" is the correct answer (as explained above.)

INCORRECT: "Configure the application to send its logs to an Amazon OpenSearch cluster and use Lambda to normalize the logs and export to S3" is incorrect.

The Amazon OpenSearch service is not a suitable solution for this scenario as it is a service that is used for searching and analyzing data sets. In this case the data simply needs to be transformed (normalized) before loading it to S3 so there is no need to involve OpenSearch.

INCORRECT: "Configure the application to send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs. Do the analysis directly from Amazon QuickSight" is incorrect.

QuickSight is used for analysis but in this scenario we simply need a solution for normalizing the log files before loading to S3.

INCORRECT: "Configure the application to send the log files to an Amazon S3 bucket and use Amazon Redshift Spectrum to normalize the logs in place" is incorrect.

To use RedShift Spectrum you must have a RedShift cluster in place and these run-on Amazon EC2 instances. Therefore, this solution is unlikely to be the lowest cost option.

References:

https://docs.aws.amazon.com/firehose/latest/dev/data-transformation.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-kinesis/

Domain

AWS Analytics

Question 18Skipped

A development team run a fleet of Amazon EC2 instances in a dev/test environment. A manager is concerned about the costs of the workloads. While the developers are unable to determine the exact resource requirements for each workload, they also cannot terminate any instances as all are currently in operational use.

What is the best way to ensure the most efficient use of the underlying hardware?

Correct answer

Use AWS Compute Optimizer to report on resource utilization on EC2 instances and use the recommendations to manually reconfigure resources for improved utilization.

Use AWS Control Tower to inspect the utilization metrics of the workloads and use the reports to right-size the instance types to the workloads. Implement the changes using EC2 Image Builder.

Use Amazon Detective to run statistical analysis on the log data collected from EC2 instances to determine services that are underutilized. Disable unnecessary services automatically using an AWS Lambda function.

Use AWS CloudWatch to collect performance metrics and create a dashboard displaying utilization metrics across the EC2 instances. Auto remediate instance types with AWS Systems Manager automation documents.

Overall explanation

AWS Compute Optimizer helps you identify the optimal AWS resource configurations, such as Amazon Elastic Compute Cloud (EC2) instance types, Amazon Elastic Block Store (EBS) volume configurations, task sizes of Amazon Elastic Container Service (ECS) services on AWS Fargate, and AWS Lambda function memory sizes, using machine learning to analyze historical utilization metrics.

The recommendations provided by AWS Computer Optimizer can be used by the development team to right-size the workloads which will ensure cost-efficiency.

CORRECT: "Use AWS Computer Optimizer to report on resource utilization on EC2 instances and use the recommendations to manually reconfigure resources for improved utilization" is the correct answer (as explained above.)

INCORRECT: "Use AWS Control Tower to inspect the utilization metrics of the workloads and use the reports to right-size the instance types to the workloads. Implement the changes using EC2 Image Builder" is incorrect.

Control Tower is used for managing multiple AWS accounts and applying best practice baselines and guardrails. It is not used for monitoring instance utilization metrics. EC2 Image Builder is used for automating the image management processes for AMIs.

INCORRECT: "Use Amazon Detective to run statistical analysis on the log data collected from EC2 instances to determine services that are underutilized. Disable unnecessary services automatically using an AWS Lambda function" is incorrect.

Amazon Detective is a security service that runs statistical analysis on log data using machine learning algorithms. It is used to identify security issues and does not provide performance recommendations for right-sizing workloads.

INCORRECT: "Use AWS CloudWatch to collect performance metrics and create a dashboard displaying utilization metrics across the EC2 instances. Auto remediate instance types with AWS Systems Manager automation documents" is incorrect.

Amazon CloudWatch is used for performance monitoring. However, it would be more efficient for the development team to leverage AWS Computer Optimizer for the purpose of right-sizing workloads as it is a tool that is designed for exactly that purpose.

References:

https://aws.amazon.com/compute-optimizer/faqs/

Domain

AWS Compute

Question 19Skipped

A company runs a Java application in an on-premises data center. The application is not currently containerized but the company plans to migrate it to the AWS Cloud and modernize the application into a containerized deployment. A CI/CD pipeline should also be created to automate application updates.

Which solution can a DevOps engineer use to meet all these requirements?

Correct answer

Use AWS App2Container (A2C) to analyze and inventory the on-premises application and then containerize it on Amazon ECS. Configure A2C to build a CI/CD pipeline using CodeBuild and CodeDeploy.

Use AWS Copilot to analyze and inventory the on-premises application and then containerize it on Amazon ECS. Configure Copilot to generate a CI/CD pipeline using AWS CloudFormation templates.

Use Amazon AppFlow to build a data flow between the on-premises application and Amazon ECS. Map and merge the Java application code to an ECS task through a CI/CD pipeline using CodeBuild and CodeDeploy.

Use AWS Proton to build a service template for refactoring the on-premises application to a container running on Amazon EKS Distro. Build a CI/CD pipeline by deploying template updates through a Git repository.

Overall explanation

App2Container (A2C) is a command-line tool for modernizing .NET and Java applications into containerized applications. A2C analyzes and builds an inventory of all applications running in virtual machines on-premises or in the cloud.

With A2C you can simply select the application you want to containerize, and A2C packages the application artifact and identified dependencies into container images, configures the network ports, and generates the ECS task and Kubernetes pod definitions.

App2Container creates CI/CD pipelines for Amazon DevOps services such as CodeBuild and CodeDeploy to build and deploy containers. If you have existing CI/CD tooling (for example, Azure DevOps and Jenkins), then you can integrate A2C provided artifacts – dockerfile, ECS task definition, EKS deployment YAML - into your existing CI/CD workflows.

CORRECT: "Use AWS App2Container (A2C) to analyze and inventory the on-premises application and then containerize it on Amazon ECS. Configure A2C to build a CI/CD pipeline using CodeBuild and CodeDeploy" is the correct answer (as explained above.)

INCORRECT: "Use AWS Copilot to analyze and inventory the on-premises application and then containerize it on Amazon ECS. Configure Copilot to generate a CI/CD pipeline using AWS CloudFormation templates" is incorrect.

AWS Copilot is a command line interface (CLI) that you can use to quickly launch and manage containerized applications on AWS. It simplifies running applications on Amazon Elastic Container Service (ECS), AWS Fargate, and AWS App Runner. It is not able to inventory and analyze existing applications or migrate them to containers.

INCORRECT: "Use AWS Proton to build a service template for refactoring the on-premises application to a container running on Amazon EKS Distro. Build a CI/CD pipeline by deploying template updates through a Git repository" is incorrect.

AWS Proton is used to create application stack templates and build infrastructure for applications using the CLI, API, or UI. It is not used for refactoring applications or migrating them to containerized deployments.

INCORRECT: "Use Amazon AppFlow to build a data flow between the on-premises application and Amazon ECS. Map and merge the Java application code to an ECS task through a CI/CD pipeline using CodeBuild and CodeDeploy" is incorrect.

Amazon AppFlow is used to automate bi-directional data flows between SaaS applications and AWS services. It is not used to migrate applications between on-premises deployments and Amazon ECS.

References:

https://aws.amazon.com/app2container/features/

Domain

AWS Compute

Question 20Skipped

A DevOps engineer must deploy a serverless website on AWS. The website will host content that includes HTML files, images, videos, and JavaScript (client-side scripts). The website must be optimized for global performance and be protected against web exploits.

Which actions should the engineer take?

Deploy the website on an Amazon EC2 instance. Create an Amazon ElastiCache Redis cluster and enable AWS Shield.

Correct answer

Deploy the website using a static website running on Amazon S3. Create an Amazon CloudFront distribution and an AWS WAF web ACL.

Deploy the website on an Amazon ECS cluster with the Fargate launch type. Create an Amazon ElastiCache Redis cluster and an AWS WAF web ACL.

Deploy the website using an AWS Lambda function with an Amazon API Gateway front end. Enable AWS GuardDuty.

Overall explanation

You can use Amazon S3 to host a static website. On a static website, individual webpages include static content. They might also contain client-side scripts.

To host a static website on Amazon S3, you configure an Amazon S3 bucket for website hosting and then upload your website content to the bucket. When you configure a bucket as a static website, you enable static website hosting, set permissions, and add an index document.

To get content closer to users for better performance you can also use Amazon CloudFront in front of the S3 static website.

AWS Web Application Firewall (WAF) can be used to protect the static website from web exploits. To do this, the engineer should create an AWS WAF web ACL.

CORRECT: "Deploy the website using a static website running on Amazon S3. Create an Amazon CloudFront distribution and an AWS WAF web ACL" is the correct answer (as explained above.)

INCORRECT: "Deploy the website on an Amazon EC2 instance. Create an Amazon ElastiCache Redis cluster and enable AWS Shield" is incorrect.

Both EC2 and ElastiCache use EC2 instances so they are not serverless services. AWS Shield protects against DDoS attacks but AWS WAF should be used for web exploits.

INCORRECT: "Deploy the website on an Amazon ECS cluster with the Fargate launch type. Create an Amazon ElastiCache Redis cluster and an AWS WAF web ACL" is incorrect.

ECS with Fargate is serverless but you cannot use a Redis cluster to cache content served by a task running on Amazon ECS. ElastiCache is used for caching database content.

INCORRECT: "Deploy the website using an AWS Lambda function with an Amazon API Gateway front end. Enable AWS GuardDuty" is incorrect.

Lambda with a REST API as the frontend is definitely possible, however the static website on S3 would be easier to deploy and manage. AWS GuardDuty does not protect against web exploits.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-serve-static-website/

https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

https://digitalcloud.training/aws-waf-shield/

Domain

AWS Storage

Question 21Skipped

A company has deployed AWS Single Sign-On (AWS SSO) and needs to ensure that user accounts are not created within AWS Identity and Access Management (AWS IAM). A DevOps engineer must create an automated solution for immediately disabling credentials of any new IAM user that is created. The security team must be notified when user creation events take place.

Which combination of steps should the DevOps engineer take to meet these requirements? (Select THREE.)

Correct selection

Create an AWS Lambda function that disables the access keys and deletes the login profiles associated with new IAM users. Configure the function as a target of the EventBridge rule.

Create an Amazon EventBridge rule that is triggered by IAM GetLoginProfile API calls in AWS CloudTrail.

Create an AWS Config rule that sends a notification to the security team using Amazon SNS when user accounts are modified.

Correct selection

Create an Amazon EventBridge rule that is triggered by IAM CreateUser API calls in AWS CloudTrail.

Create an AWS Lambda function that deletes the login profiles associated with new IAM users. Configure the function as a target of the EventBridge rule.

Correct selection

Create an Amazon SNS topic that is a target of the EventBridge rule. Subscribe the security team's group email address to the topic.

Overall explanation

The company is using AWS SSO and we can presume have an identity source that is outside of AWS IAM. They therefore want to control creation of IAM users. The solution uses an EventBridge rule that monitors for CreateUser API calls in AWS CloudTrail. This will pick up all user creation events.

Then, an AWS Lambda function will disable both the access keys (if created) and login profile (if created) that are associated with the newly created user account. Then, an SNS notification will be sent to the security team.

This solution meets all the stated requirements.

CORRECT: "Create an Amazon EventBridge rule that is triggered by IAM CreateUser API calls in AWS CloudTrail" is a correct answer (as explained above.)

CORRECT: "Create an AWS Lambda function that disables the access keys and deletes the login profiles associated with new IAM users. Configure the function as a target of the EventBridge rule" is also a correct answer (as explained above.)

CORRECT: "Create an Amazon SNS topic that is a target of the EventBridge rule. Subscribe the security team's group email address to the topic" is also a correct answer (as explained above.)

INCORRECT: "Create an Amazon EventBridge rule that is triggered by IAM GetLoginProfile API calls in AWS CloudTrail" is incorrect.

This would only be triggered when user accounts with console (password) access are created. A user with programmatic access does not have a login profile unless you create a password for the user to access the AWS Management Console. Therefore, this would miss users that are created with programmatic-only access.

INCORRECT: "Create an AWS Lambda function that deletes the login profiles associated with new IAM users. Configure the function as a target of the EventBridge rule" is incorrect.

As above, login profiles are associated with console-based password access only, they do not apply to users with programmatic-only access.

INCORRECT: "Create an AWS Config rule that sends a notification to the security team using Amazon SNS when user accounts are modified" is incorrect.

The DevOps engineer should directly configure Amazon SNS to be triggered by EventBridge. There is no need to send notifications related to user modifications, only creation events.

References:

https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetLoginProfile.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 22Skipped

A DevOps engineer is deploying a three-tier application on AWS that includes an Application Load Balancer in front of the Amazon ECS web tier, an Amazon ECS application tier, and an Amazon RDS database. The load balancer should only distribute traffic to the web tier if the web tier can successfully communicate with the application and database tiers.

How can this validation be implemented?

Use an Amazon RDS active connection count and an Amazon CloudWatch ELB metric to alarm on a significant change to the number of open connections. Configure the load balancer to consider targets unhealthy based on the alarm status.

Use Amazon Route 53 health checks to detect issues with the web service and use the Application Auto Scaling service to automatically terminate unhealthy ECS and RDS instances.

Correct answer

Create a health check endpoint in the web application that tests connectivity to the application and database tiers. Configure the endpoint as the health check URL for the target group.

Register the ECS tasks and RDS database instances in the target group for the load balancer. Create health checks that test the liveness of the ECS tasks and database instances.

Overall explanation

The requirement is that the web tier must be able to communicate with the application and database tiers and this should be validated by the load balancer. You can configure health checks in the load balancer for registered instances/tasks. However, that would not check each tier and the database.

A solution is to create an endpoint within the web tier that performs a connectivity/liveness check on the application and database tiers. Then, the load balancer simply needs to be configured with this URL as the endpoint for health checks for the target group associated with the web tier.

If the connectivity exists the health check returns a 200 (success) status code, and the load balancer considers the instance/task as being healthy.

CORRECT: "Create a health check endpoint in the web application that tests connectivity to the application and database tiers. Configure the endpoint as the health check URL for the target group" is the correct answer (as explained above.)

INCORRECT: "Use an Amazon RDS active connection count and an Amazon CloudWatch ELB metric to alarm on a significant change to the number of open connections. Configure the load balancer to consider targets unhealthy based on the alarm status" is incorrect.

This is not a reliable way to test the connectivity between the tiers and you cannot configure the load balancer to consider targets unhealthy based on CloudWatch alarm status.

INCORRECT: "Use Amazon Route 53 health checks to detect issues with the web service and use the Application Auto Scaling service to automatically terminate unhealthy ECS and RDS instances" is incorrect.

You cannot use Application Auto Scaling to terminate RDS instances and you wouldn’t want to do that. The solution does not call for terminating only validating connectivity.

INCORRECT: "Register the ECS tasks and RDS database instances in the target group for the load balancer. Create health checks that test the liveness of the ECS tasks and database instances" is incorrect.

You cannot register RDS database instances in a target group.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Compute

Question 23Skipped

A company requires an automated solution that terminates Amazon EC2 instances that have been logged into manually within 24 hours of the login event. The applications running in the account are launched using Auto Scaling groups and the CloudWatch Logs agent is configured on all instances.

How should a DevOps engineer build the automation?

Correct answer

Create a CloudWatch Logs subscription filter that delivers logs to an AWS Lambda function. Configure the function to tag the resources that produced the login event. Create a CloudWatch Events rule that triggers another Lambda function daily that terminates all instances that were tagged.

Create a CloudWatch alarm that will trigger on login events. Send the notification to a Kinesis Data Firehose stream. Configure the stream to send notifications to an SNS topic and instruct the operations team to subscribe to the topic and terminate EC2 instances that produced login events within 24 hours.

Create a CloudWatch alarm that will trigger on AWS API call events in CloudTrail. Configure the alarm to send a message to an Amazon SQS queue. Create an AWS Lambda function that processes messages from the queue and terminates the instances that produced the login event.

Create a CloudWatch Logs subscription filter that delivers logs to an AWS Step Functions state machine. Configure the function to tag the resources that produced the login event. Create a CloudWatch Events rule that triggers another Lambda function daily that terminates all instances that were tagged.

Overall explanation

You can use subscriptions to get access to a real-time feed of log events from CloudWatch Logs and have it delivered to Kinesis, Lambda, or Kinesis Data Firehose. When log events are sent to the receiving service, they are base64 encoded and compressed with the gzip format.

The Lambda function that receives the log events can process the log files looking for entries that indicate that a manual login event occurred and add a tag. Another Lambda function that runs on a schedule can then look for instances that have been tagged and terminate them.

CORRECT: "Create a CloudWatch Logs subscription filter that delivers logs to an AWS Lambda function. Configure the function to tag the resources that produced the login event. Create a CloudWatch Events rule that triggers another Lambda function daily that terminates all instances that were tagged" is the correct answer (as explained above.)

INCORRECT: "Create a CloudWatch Logs subscription filter that delivers logs to an AWS Step Functions state machine. Configure the function to tag the resources that produced the login event. Create a CloudWatch Events rule that triggers another Lambda function daily that terminates all instances that were tagged" is incorrect.

You cannot configure Step Functions to receive the events.

INCORRECT: "Create a CloudWatch alarm that will trigger on AWS API call events in CloudTrail. Configure the alarm to send a message to an Amazon SQS queue. Create an AWS Lambda function that processes messages from the queue and terminates the instances that produced the login event" is incorrect.

The API calls logged via CloudTrail will not show that a manual login event occurred as that does not require an AWS API call to be made. The manual login data would be included in the logs delivered to CloudWatch Logs by the CloudWatch agent.

INCORRECT: "Create a CloudWatch alarm that will trigger on login events. Send the notification to a Kinesis Data Firehose stream. Configure the stream to send notifications to an SNS topic and instruct the operations team to subscribe to the topic and terminate EC2 instances that produced login events within 24 hours" is incorrect.

You can configure a KDS stream to receive the events but would then need a record processor (KCL worker) to process the events, you cannot send directly to an SNS topic. Also, requiring the operations team to process the terminations is not automated.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Subscriptions.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Compute

Question 24Skipped

A development team is running a project that will involve deploying applications across several Amazon VPCs. The applications will require fully meshed network connectivity to enable transitive routing between VPCs. The development lead is concerned about security and has requested centralized control over network access controls.

Which deployment will satisfy the requirements with the most operational efficiency?

Correct answer

Deploy AWS Transit Gateway to create a fully meshed network topology with transitive routing. Use AWS Firewall Manager to centrally deploy and manage security policies across the VPCs.

Create VPC peering connections between the VPCs and configure a fully meshed network topology. Use AWS Web Application Firewall (WAF) to centrally deploy and manage WebACLs across the VPCs.

Deploy an AWS Site-to-Site VPN between each VPC and configure route tables to enable fully meshed routing. Use AWS Firewall Manager to centrally deploy and manage security policies across the VPCs.

Create an AWS PrivateLink connection between each VPC and configure VPC endpoints to enable fully meshed connectivity. Use AWS Security Hub to centrally deploy and manage security policies across the VPCs.

Overall explanation

AWS Transit Gateway can be configured to enable a fully meshed network topology which allows transitive routing between all the VPCs. With AWS Network Firewall, you can define firewall rules that provide fine-grained control over network traffic.

AWS Firewall Manager allows you to build policies based on Network Firewall rules and then centrally apply those policies across your virtual private clouds (VPCs) and accounts.

CORRECT: "Deploy AWS Transit Gateway to create a fully meshed network topology with transitive routing. Use AWS Firewall Manager to centrally deploy and manage security policies across the VPCs" is the correct answer (as explained above.)

INCORRECT: "Create VPC peering connections between the VPCs and configure a fully meshed network topology. Use AWS Web Application Firewall (WAF) to centrally deploy and manage WebACLs across the VPCs" is incorrect.

VPC peering requires creating complex peering relationships and does not support transitive routing (though this can be achieved through a mesh of peering connections). VPC peering is less operationally efficient compared to using a Transit Gateway. AWS WAF is not the best solution for enforcing centralized network access controls, it is used for preventing web based attacks.

INCORRECT: "Deploy an AWS Site-to-Site VPN between each VPC and configure route tables to enable fully meshed routing. Use AWS Firewall Manager to centrally deploy and manage security policies across the VPCs" is incorrect.

You cannot connect Amazon VPCs using AWS S2S VPNs. You can only use an AWS VPN to connect on-premises networks.

INCORRECT: "Create an AWS PrivateLink connection between each VPC and configure VPC endpoints to enable fully meshed connectivity. Use AWS Security Hub to centrally deploy and manage security policies across the VPC" is incorrect.

PrivateLink is not used for creating this kind of network deployment. It is used for private access to AWS services using private IP addresses.

References:

https://aws.amazon.com/network-firewall/

https://aws.amazon.com/transit-gateway/

Domain

AWS Networking & Content Delivery

Question 25Skipped

A DevOps engineer is building a web application that will use federated access to a SAML identity provider (IdP). The web application requires sign up and sign in functionality using a custom webpage with authenticated access to AWS services.

Which steps should the DevOps engineer take to implement the authentication and access control solution for the web application?

Use AWS Directory Service to create a Simple AD and configure a trust relationship with the SAML IdP. Create a custom webpage on an Amazon S3 static website and use Amazon CloudFront for sign up and sign in functionality. Use role-based access control to access AWS services through the web application.

Use an Amazon API Gateway REST API to provide a web endpoint for the application. Use an AWS Lambda authorizer to control access to the API with a bearer token authentication strategy utilizing the SAML IdP. Authorize access to the backend services using identity-based policies.

Use Amazon Cognito and create an identity pool for federated sign-in. Configure the SAML IdP to add a relying party trust between the IdP and AWS. Use the AssumeRoleWithWebIdentity API to call the AWS Security Token Service (STS) and generate temporary security credentials providing access to the appropriate AWS services.

Correct answer

Use Amazon Cognito and create a user pool for federated sign-in. Add a SAML IdP and enter identifiers to map the sign-in email addresses to the relevant provider. Generate access tokens and exchange them for temporary security credentials providing access to the appropriate AWS services.

Overall explanation

The DevOps engineer should use Amazon Cognito with a user pool to create a custom webpage offering sign in and sign up functionality. The user pool can be integrated with a SAML IdP for federated access.

The process for configuring this federation is as follows:

Create or select a user pool.

Choose the Sign-in experience tab. Locate Federated sign-in and select Add an identity provider.

Choose a SAML social identity provider.

Enter Identifiers separated by commas. An identifier tells Amazon Cognito it should check the email address a user enters when they sign in, and then direct them to the provider that corresponds to their domain.

When a user signs into the app, Amazon Cognito verifies the login information. If the login is successful, Amazon Cognito creates a session and returns an ID, access, and refresh token for the authenticated user. The tokens can be used to grant users access to server-side resources or to the Amazon API Gateway. Or they can be exchanged for temporary AWS credentials to access other AWS services.

CORRECT: "Use Amazon Cognito and create a user pool for federated sign-in. Add a SAML IdP and enter identifiers to map the sign-in email addresses to the relevant provider. Generate access tokens and exchange them for temporary security credentials providing access to the appropriate AWS services" is the correct answer (as explained above.)

INCORRECT: "Use Amazon Cognito and create an identity pool for federated sign-in. Configure the SAML IdP to add a relying party trust between the IdP and AWS. Use the AssumeRoleWithWebIdentity API to call the AWS Security Token Service (STS) and generate temporary security credentials providing access to the appropriate AWS services" is incorrect.

Though you can use an identity pool for federated sign in you should use a user pool for creating a custom webpage offering sign in and sign up functionality. Also the API action provided is not suitable for SAML – AssumeRoleWith SAML should be used instead.

INCORRECT: "Use an Amazon API Gateway REST API to provide a web endpoint for the application. Use an AWS Lambda authorizer to control access to the API with a bearer token authentication strategy utilizing the SAML IdP. Authorize access to the backend services using identity-based policies" is incorrect.

API Gateway is not a suitable web endpoint for providing a custom webpage with the required sign in and sign up functionality.

INCORRECT: "Use AWS Directory Service to create a Simple AD and configure a trust relationship with the SAML IdP. Create a custom webpage on an Amazon S3 static website and use Amazon CloudFront for sign up and sign in functionality. Use role-based access control to access AWS services through the web application" is incorrect.

You cannot configure trust relationships with any other directory when using Simple AD. Amazon CloudFront also does not offer sign up and sign in functionality.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/cognito-user-pools-identity-pools/

https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-configuring-federation-with-saml-2-0-idp.html

Domain

AWS Security, Identity, & Compliance

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Expanded view

Beta

0 / 10used queries