AWS Certified DevOps Engineer Professional Practice Exams

Practice Test 2: DOP-C02
Open

Practice Test 1: DOP-C02

Practice Test 3: DOP-C02

Set a certification due date

AWS Certified DevOps Engineer – Professional

Course content

AI Assistant

Practice tests

Start

Practice Test 1: DOP-C02

Start

Practice Test 2: DOP-C02

Start

Practice Test 3: DOP-C02

Start

Practice Test 4: DOP-C02

Start

Practice Test 5: DOP-C02

Start

Practice Test 6: DOP-C02

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

[2025] Pass the AWS DevOps Engineer Professional Exam DOP-C02 | Exam-Difficulty Practice Questions + Exam Simulation

Rating: 4.0 out of 54.0
320 ratings

4,812

Students

130 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified DevOps Engineer Professional exam the first time with a great score

EXAM SIMULATION: All practice tests are timed and scored (passing score is 75%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

ALWAYS UP TO DATE: Covering the latest DOP-C02 exam guide, our question bank is regularly updated based on student feedback from the real exam

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ACTIVE Q&A FORUM: In this discussion board, students ask questions and share their recent exam experience offering feedback on which topics were covered

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Description

Are you preparing for the AWS Certified DevOps Engineer Professional exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS DevOps Professional practice exams to assess your exam-readiness and get certified for DOP-C02.

Our course includes 6 AWS practice exams that include a total of 130 unique practice questions. All of our practice tests accurately reflect the difficulty of the Amazon Web Services exam questions and are the most realistic AWS exam experience available on Udemy.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Our questions are continually revised based on feedback from students who have recently taken the AWS exam, so you can be sure that they are up-to-date and reflect the latest exam format.

Our practice exam course is designed to give you a thorough understanding of the key concepts and topics covered in the DOP-C02 exam. Based on your test report that provides you with detailed feedback, you get to identify areas where you need to improve and build the confidence you need to succeed in the actual exam.

TOP REASONS WHY THESE PRACTICE EXAMS ARE YOUR BEST CHANCE TO ACE YOUR AWS EXAM

100% ALIGNED WITH LATEST DOP-C02 EXAM: All practice tests on Udemy are scenario-based reflecting the latest AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

SIMULATE THE REAL CERTIFICATION EXAM: Practice tests are timed (130 min to answer 65 questions) and scored (passing score is 72%) accurately mirroring the real exam environment. This allows you to become familiar with the AWS exam format

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

REGULAR UPDATES OF QUESTIONS: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, most of our students achieve exceptional results, with an average exam score of over 85%.

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered.

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the pass mark for the actual AWS exam is 72%, we highly recommend that you continue taking our AWS practice exams until you achieve a consistent score of 80% or higher. Once you reach this recommended score on our practice tests, you'll be well-prepared to sit the actual exam and achieve a great score.

GET FAMILIAR WITH THE ACTUAL EXAM FORMAT: Our AWS Certified DevOps Pro practice exams are specifically designed to help you become familiar with the test question format and structure of the actual AWS exam. Unlike many other practice tests on the market, our exams closely match the format of the real AWS exam, ensuring that you are adequately prepared for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS DevOps practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Certified DevOps certification exam with confidence.

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy.

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to fast-track their exam success!

MONEY-BACK GUARANTEE

We are totally confident in the value of our Practice Exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

ABOUT THE AWS CERTIFIED DEVOPS ENGINEER PROFESSIONAL CERTIFICATION

The AWS Certified DevOps Engineer Professional certification is one of the most sought-after certifications in the cloud computing industry. AWS DevOps are in huge demand and salaries can be above $150,000 USD per annum. The AWS Certified DevOps s exam aims to test knowledge of the key services and tools used by DevOps creating applications on AWS.

When you're ready to book your exam you can do so on the AWS Training portal. Curious about the AWS DevOps certification cost? The AWS DevOps Professional Certification cost is $300 USD in most regions and you currently have the choice of an online proctored exam or test center (subject to availability).

OUR MISSION

At Digital Cloud Training we are committed to your success. Our mission is to provide you with the resources you need to pass your exam on your first attempt - without wasting time or money. After completing these AWS Certified DevOps Pro Practice Tests and assessing your exam readiness, you'll be more than ready for the real AWS exam.

Who this course is for:

Students preparing for the AWS Certified DevOps Engineer Professional (DOP-C02) exam who want to pass with confidence

Students who want to test their skills in exam simulation, assessing their DOP-C02 exam readiness

Anyone who wants to learn AWS through high-quality questions and answers, explanations and reference links

Anyone who is keen to take their career and salary to the next level with an AWS certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Requirements

This course is designed for individuals with a solid AWS knowledge and experience (at the Associate level)

It is recommended that students have successfully passed one or more of the AWS Associate level exams.

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 2: DOP-C02

DOP-C02 - Results

Back to result overview
Attempt 1

All domains

All domains

AWS Storage

AWS Management & Governance

AWS Database

AWS Security, Identity, & Compliance

AWS Developer Tools

AWS Application Integration

AWS Compute

25 all

0 correct

0 incorrect

25 skipped

0 marked

Collapse all questions

Question 1Skipped

A DevOps engineer needs to enable cross-Region replication for all the objects in an Amazon S3 bucket. The destination bucket will also be created in a separate AWS account. The objects must be automatically replicated between the source and target buckets across Regions and accounts.

Which combination of actions should be performed to enable this replication? (Select THREE.)

Correct selection

Add statements to the target bucket policy allowing the replication IAM role to replicate objects.

Correct selection

Create a replication rule in the source bucket to enable replication for all the objects in the bucket.

Create an IAM role in the target account that has permissions to the source and destination buckets.

Add statements to the source bucket policy allowing the replication IAM role to replicate objects.

Create a replication rule in the target bucket to enable replication for all the objects in the source bucket.

Correct selection

Create an IAM role in the source account that has permissions to the source and destination buckets.

Overall explanation

The correct configuration for this solution is to create the IAM role in the source AWS account and apply permissions to the source and target buckets. Then, the engineer must add statements to the target bucket policy that allow the replication IAM role in the source account to replicate the objects into the target bucket. Finally, the engineer must create the replication rule in the source bucket to enable replication for all objects.

CORRECT: "Create an IAM role in the source account that has permissions to the source and destination buckets" is a correct answer (as explained above.)

CORRECT: "Add statements to the target bucket policy allowing the replication IAM role to replicate objects" is also a correct answer (as explained above.)

CORRECT: "Create a replication rule in the source bucket to enable replication for all the objects in the bucket" is also a correct answer (as explained above.)

INCORRECT: "Create an IAM role in the target account that has permissions to the source and destination buckets" is incorrect – please refer to the correct process which is provided above.

INCORRECT: "Add statements to the source bucket policy allowing the replication IAM role to replicate objects" is incorrect – please refer to the correct process which is provided above.

INCORRECT: "Create a replication rule in the target bucket to enable replication for all the objects in the source bucket" is incorrect – please refer to the correct process which is provided above.

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-2.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 2Skipped

To increase security, a company plans to use AWS Systems Manager Session Manager to managed Amazon EC2 instances rather than SSH. The connectivity to Session Manager should also use a private network connection.

Which configuration actions should be taken to implement this? (Select TWO.)

Allow inbound access to TCP port 22 in all associated EC2 security groups from the VPC CIDR range.

Establish private Session Manager connectivity using the instance IDs of EC2 instances.

Correct selection

Create a VPC endpoint for Systems Manager in the Region where the instances are running.

Correct selection

Attach an IAM instance profile to the EC2 instances that provides the necessary permissions for Systems Manager.

Attach an Elastic IP to a NAT gateway in a public subnet and specify a route to the NAT gateway in the private subnet route tables.

Overall explanation

Systems Manager Session Manager enables secure remote access to EC2 instances without the need to open ports for SSH or create bastion hosts. You can connect to instances through Session Manager privately by establishing a VPC endpoint in your VPC. This ensures that all connectivity takes place using private addresses.

The EC2 instances must have the Systems Manager agent running and they must have permissions to be able to communicate with the Systems Manager service. An instance profile can be easily attached to provide these permissions to instances.

CORRECT: "Attach an IAM instance profile to the EC2 instances that provides the necessary permissions for Systems Manager" is a correct answer (as explained above.)

CORRECT: "Create a VPC endpoint for Systems Manager in the Region where the instances are running" is also a correct answer (as explained above.)

INCORRECT: "Allow inbound access to TCP port 22 in all associated EC2 security groups from the VPC CIDR range" is incorrect.

Port 22 is used by the SSH protocol and is not required by Systems Manager Session Manager.

INCORRECT: "Attach an Elastic IP to a NAT gateway in a public subnet and specify a route to the NAT gateway in the private subnet route tables" is incorrect.

You cannot connect to EC2 instances via a NAT gateway. These gateways are used for outbound (internet) connectivity from the EC2 instances in private subnets.

INCORRECT: "Establish private Session Manager connectivity using the instance IDs of EC2 instances" is incorrect.

You cannot connect privately to instances simply by connecting via the instance ID. You must establish a VPC endpoint and attach the necessary permissions to instances.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/ec2-systems-manager-vpc-endpoints/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-systems-manager/

Domain

AWS Management & Governance

Question 3Skipped

A retail company has hired a DevOps engineer to provide consultancy services. The company runs Oracle and PostgreSQL services on Amazon RDS for storing large quantities of data generated by manufacturing equipment.

The business analytics team has been running ad-hoc queries on these databases to prepare daily reports for senior management. The engineering team has observed that the database performance takes a hit whenever these reports are run by the analytics team.

To facilitate the business analytics reporting, the engineering team now wants to replicate this data with high availability and consolidate these databases into a petabyte-scale data warehouse by streaming data to Amazon Redshift.

Which solution should the DevOps engineer recommend to achieve these requirements?

Correct answer

Use AWS Database Migration Service to replicate the data from the databases into Amazon Redshift.

Use Amazon Kinesis Data Streams to replicate the data from the databases into Amazon Redshift.

Use Amazon EMR to replicate the data from the databases into Amazon Redshift.

Use AWS Glue to replicate the data from the databases into Amazon Redshift.

Overall explanation

The AWS Database Migration Service (DMS) helps migrate databases to AWS quickly and securely. The source database remains fully operational during the migration, minimizing downtime to applications that rely on the database. With AWS DMS the data can be continuously replicated with high availability and the multiple databases can be consolidated into a petabyte-scale data warehouse.

The Amazon Redshift cluster must be in the same AWS account and the same AWS Region as the replication instance. During a database migration to Amazon Redshift, AWS DMS first moves data to an Amazon S3 bucket. When the files reside in an Amazon S3 bucket, AWS DMS then transfers them to the proper tables in the Amazon Redshift data warehouse. AWS DMS creates the S3 bucket in the same AWS Region as the Amazon Redshift database.

CORRECT: “Use AWS Database Migration Service to replicate the data from the databases into Amazon Redshift" is the correct answer (as explained above.)

INCORRECT: "Use AWS Glue to replicate the data from the databases into Amazon Redshift" is incorrect.

AWS Glue is an event-driven, serverless computing platform provided by Amazon as a part of Amazon Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code.

INCORRECT: "Use Amazon EMR to replicate the data from the databases into Amazon Redshift" is incorrect.

Amazon EMR (previously called Amazon Elastic MapReduce) is a managed cluster platform that simplifies running big data frameworks, such as Apache Hadoop and Apache Spark, on AWS to process and analyze vast amounts of data.

INCORRECT: "Use Amazon Kinesis Data Streams to replicate the data from the databases into Amazon Redshift" is incorrect.

Amazon Kinesis Data Streams is a fully managed, serverless data streaming service that stores and ingests various streaming data in real time at any scale. It is not suitable for migrating data between databases.

References:

https://aws.amazon.com/dms/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Database

Question 4Skipped

A company allows DevOps engineers to assume an administrator IAM role when they need more permissions within an AWS account. The security team would like to be able to track usage of the administrator role and receive a notification when the administrator IAM role is assumed.

How should this be accomplished?

Configure AWS Config to save logs to an Amazon S3 bucket. Use Amazon Athena to query the logs and look for AWS STS sign-in events. Publish a notification to Amazon Kinesis Firehose if the administrator IAM role is assumed.

Configure Amazon GuardDuty to monitor the account and alert on any anomalous usage of the administrator IAM role. When detected, publish a notification to an AWS CloudTrail trail.

Create an Amazon EventBridge events rule with an AWS Management Console sign-in events event pattern that triggers an AWS Lambda function that publishes a notification to an Amazon SNS topic if the administrator IAM role is assumed.

Correct answer

Create an Amazon EventBridge events rule with an AWS API call via CloudTrail event pattern that triggers an AWS Lambda function that publishes a notification to an Amazon SNS topic if the administrator IAM role is assumed.

Overall explanation

You can use Amazon EventBridge rules to react to API calls made by an AWS service that are recorded by AWS CloudTrail. The “AWS API call via CloudTrail” event pattern can be configured to specifically trigger when the API calls are made to assume the administrator IAM role.

Then, an AWS Lambda function can be triggered that processes the information received in the event and publishes this information to an Amazon SNS topic. The security team will be subscribers to the SNS topic and so will receive the notifications in their email inbox.

CORRECT: "Create an Amazon EventBridge events rule with an AWS API call via CloudTrail event pattern that triggers an AWS Lambda function that publishes a notification to an Amazon SNS topic if the administrator IAM role is assumed" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon EventBridge events rule with an AWS Management Console sign-in events event pattern that triggers an AWS Lambda function that publishes a notification to an Amazon SNS topic if the administrator IAM role is assumed" is incorrect.

Management console sign-in events are different to assuming a role. In this case the users will be signing in with their own accounts and then assuming the administrator IAM role so this would not detect the assuming of the role.

INCORRECT: "Configure AWS Config to save logs to an Amazon S3 bucket. Use Amazon Athena to query the logs and look for AWS STS sign-in events. Publish a notification to Amazon Kinesis Firehose if the administrator IAM role is assumed" is incorrect.

AWS Config does not log STS sign-in events. These would be logged as API calls in the AWS CloudTrail service and would need to be picked up there. There is also no mechanism for alerting that would work here as Firehose would simply load the data to a datastore and would not notify anyone.

INCORRECT: "Configure Amazon GuardDuty to monitor the account and alert on any anomalous usage of the administrator IAM role. When detected, publish a notification to an AWS CloudTrail trail" is incorrect.

GuardDuty cannot be configured to alert when a specific role is assumed. Also, you cannot publish a notification to an AWS CloudTrail trail, use SNS instead.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-CloudTrail-Rule.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-cloudtrail/

Domain

AWS Security, Identity, & Compliance

Question 5Skipped

A company has several AWS accounts and an on-premises data center. Several microservices applications run across the accounts and data center. The distributed architecture results in challenges with investigating application issues as the logs are saved in a variety of locations. A DevOps engineer must configure a solution that centralizes and aggregates the logs for analytics.

What is the MOST efficient and cost-effective solution?

Collect system logs and application logs using the Amazon CloudWatch Logs agent. Install the CloudWatch Logs agent on the on-premises servers. Use the Amazon S3 API to export log files and store them on-premises. Use an Amazon Elasticsearch Logstash Kibana stack to analyze logs in the on-premises data center.

Collect system logs and application logs using the Amazon CloudWatch Logs agent. Use the Amazon S3 API to import on-premises logs. Store all logs in S3 buckets in individual accounts. Use Amazon Athena to run SQL queries on the logs in each account.

Collect system logs and application logs using the Amazon CloudWatch Logs agent. Use the Amazon S3 API to export on-premises logs and store the logs in an S3 bucket in a central account. Use Amazon Kinesis Data Analytics to query the data in the S3 bucket.

Correct answer

Collect system logs and application logs using the Amazon CloudWatch Logs agent. Install the CloudWatch Logs agent on the on-premises servers. Store all logs in an S3 bucket in a central account. Set up an Amazon S3 trigger and an AWS Lambda function to analyze incoming logs and automatically identify anomalies. Use Amazon Athena to run ad hoc queries on the logs in the central account.

Overall explanation

The most efficient and cost-effective solution is to use the CloudWatch agent to collect log files from both AWS resources and on-premises servers and save that data to a centralized Amazon S3 bucket. S3 event notifications can be used to trigger an AWS Lambda function that analyzes the data looking for anomalies.

Amazon Athena is ideal for running ad-hoc SQL queries on data stored in S3. This can be used by the company when they have specific queries they need to run against the data.

CORRECT: "Collect system logs and application logs using the Amazon CloudWatch Logs agent. Install the CloudWatch Logs agent on the on-premises servers. Store all logs in an S3 bucket in a central account. Set up an Amazon S3 trigger and an AWS Lambda function to analyze incoming logs and automatically identify anomalies. Use Amazon Athena to run ad hoc queries on the logs in the central account" is the correct answer (as explained above.)

INCORRECT: "Collect system logs and application logs using the Amazon CloudWatch Logs agent. Install the CloudWatch Logs agent on the on-premises servers. Use the Amazon S3 API to export log files and store them on-premises. Use an Amazon Elasticsearch Logstash Kibana stack to analyze logs in the on-premises data center" is incorrect.

The best solution is not to store the data on-premises, it should be in the AWS Cloud. You would then be able to use the ELK stack to analyze the data.

INCORRECT: "Collect system logs and application logs using the Amazon CloudWatch Logs agent. Use the Amazon S3 API to export on-premises logs and store the logs in an S3 bucket in a central account. Use Amazon Kinesis Data Analytics to query the data in the S3 bucket" is incorrect.

You cannot use S3 APIs to export log files from on-premises servers. You also cannot use KDA to analyze data in S3, it is used for analyzing data in other Kinesis services.

INCORRECT: "Collect system logs and application logs using the Amazon CloudWatch Logs agent. Use the Amazon S3 API to import on-premises logs. Store all logs in S3 buckets in individual accounts. Use Amazon Athena to run SQL queries on the logs in each account" is incorrect.

As above, you cannot use the S3 API with on-premises resources.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-on-premise.html

https://aws.amazon.com/solutions/implementations/centralized-logging/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Security, Identity, & Compliance

Question 6Skipped

A company is using AWS CodeCommit for version control and AWS CodePipeline for orchestration of software deployments. The development team are using a remote main branch as the trigger for the pipeline. A developer noticed that the CodePipeline pipeline was not triggered after the developer pushed code changes to the CodeCommit repository.

Which of the following actions should be taken to troubleshoot this issue?

Correct answer

Check that an Amazon CloudWatch Events rule has been created for the main branch to trigger the pipeline.

Check that an AWS Lambda function has been created to check for code commits and trigger the pipeline.

Check that the developer's IAM role has permission to push to the CodeCommit repository.

Check that the CodePipeline service role has permission to access the CodeCommit repository.

Overall explanation

An Amazon CloudWatch Events rule must be created to trigger the pipeline when changes are committed to the CodeCommit repository. If you use the console to create or edit your pipeline, the CloudWatch Events rule is created for you. In this case, the developer should check to make sure that the rule has been created and is correctly configured.

The following is a sample CodeCommit event pattern for a MyTestRepo repository with a branch named master:

CORRECT: "Check that an Amazon CloudWatch Events rule has been created for the main branch to trigger the pipeline" is the correct answer (as explained above.)

INCORRECT: "Check that the CodePipeline service role has permission to access the CodeCommit repository" is incorrect.

The issue is that the pipeline was not triggered. If the service role does not have permissions the pipeline should still be triggered by the CloudWatch Events rule but then an error would be generated if insufficient permissions are assigned for accessing the CodeCommit repository.

INCORRECT: "Check that the developer's IAM role has permission to push to the CodeCommit repository" is incorrect.

The developer already committed the code to the repository and did not experience any errors.

INCORRECT: "Check that an AWS Lambda function has been created to check for code commits and trigger the pipeline" is incorrect.

An AWS Lambda function is not used to check for commits or to trigger the pipeline. A CloudWatch Events rule must be created for this purpose.

References:

https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-trigger-source-repo-changes-console.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 7Skipped

A DevOps engineer is developing an application that calls AWS Lambda functions. The functions must connect to a database and credentials must not be stored in source code. The credentials for connection to the database must be regularly rotated to meet security policy requirements.

What should a DevOps engineer do to meet these requirements?

Correct answer

Store the credentials in AWS Secrets Manager. Associate the Lambda function with a role that can retrieve the credentials from Secrets Manager given using the secret ID.

Store the credentials in AWS CloudHSM. Associate the Lambda function with a role that can retrieve the credentials from CloudHSM using the key ID.

Move the database credentials to an environment variable associated with the Lambda function. Retrieve the credentials from the environment variable upon execution.

Store the credentials in AWS Key Management Service (AWS KMS). Associate the Lambda function with a role that can retrieve the credentials from AWS KMS using the key ID.

Overall explanation

AWS Secrets Manager is ideal for this scenario as it can be used to securely store the secrets. Automatic rotation can be enabled for several AWS databases and can be configured through custom Lambda functions for other databases.

CORRECT: "Store the credentials in AWS Secrets Manager. Associate the Lambda function with a role that can retrieve the credentials from Secrets Manager given using the secret ID" is the correct answer (as explained above.)

INCORRECT: "Store the credentials in AWS CloudHSM. Associate the Lambda function with a role that can retrieve the credentials from CloudHSM using the key ID" is incorrect.

CloudHSM is used for storing encryption keys, not connection credentials.

INCORRECT: "Move the database credentials to an environment variable associated with the Lambda function. Retrieve the credentials from the environment variable upon execution" is incorrect.

This is not a secure method of storing the credentials and Secrets Manager is more secure.

INCORRECT: "Store the credentials in AWS Key Management Service (AWS KMS). Associate the Lambda function with a role that can retrieve the credentials from AWS KMS using the key ID" is incorrect.

KMS is used for storing encryption keys, not connection credentials.

References:

https://aws.amazon.com/secrets-manager/

Domain

AWS Security, Identity, & Compliance

Question 8Skipped

A company manages a continuous integration and continuous delivery (CI/CD) pipeline that includes a Jenkins implementation that runs on Amazon EC2. The security team has requested that all build artifacts are encrypted as they contain company sensitive data.

Which changes should a DevOps engineer make to meet these requirements whilst reducing operational overhead for ongoing management?

Store build artifacts on Amazon S3 with default encryption enabled and move Jenkins to an Auto Scaling group.

Correct answer

Replace the Jenkins instance running on Amazon EC2 with AWS CodeBuild and configure artifact encryption.

Add a build action using AWS CodePipeline and encrypt the artifacts using AWS Certification Manager (ACM).

Configure AWS Systems Manager to patch the Jenkins EC2 instances and set encryption for all Amazon EBS volumes.

Overall explanation

The existing Jenkins implementation runs on an Amazon EC2 instance, and this requires more operational management compared to using AWS CodeBuild which is a managed service. The DevOps engineer should replace Jenkins with AWS CodeBuild which is a fully managed build service.

CodeBuild compiles source code, runs unit tests, and produces artifacts that are ready to deploy. Encryption for build artifacts such as a cache, logs, exported raw test report data files, and build results, is enabled by default, and uses AWS managed keys (AWS KMS).

CORRECT: "Replace the Jenkins instance running on Amazon EC2 with AWS CodeBuild and configure artifact encryption" is the correct answer (as explained above.)

INCORRECT: "Configure AWS Systems Manager to patch the Jenkins EC2 instances and set encryption for all Amazon EBS volumes" is incorrect.

This solution may be secure, but it does require more operational management compared to using AWS CodeBuild and is therefore not the best option.

INCORRECT: "Store build artifacts on Amazon S3 with default encryption enabled and move Jenkins to an Auto Scaling group" is incorrect.

Moving Jenkins to an Auto Scaling group does not reduce the operational management. This is also an option that requires more overhead to manage compared to using a managed service such as AWS CodeBuild.

INCORRECT: "Add a build action using AWS CodePipeline and encrypt the artifacts using AWS Certification Manager (ACM)" is incorrect.

Artifacts cannot be encrypted using ACM as that is a service that issues SSL/TLS certificates which are used for encryption in-transit rather than encryption at-rest.

References:

https://docs.aws.amazon.com/codebuild/latest/userguide/security-encryption.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 9Skipped

A custom application processes data associated with customer purchase activity using a multistep sequential action. Each step completes within 5 minutes. If a single step fails the entire process must be restarted. The current solution uses Amazon EC2 instances in an Auto Scaling group.

The company wants to update the application architecture so that if a single step fails only that step should be reprocessed.

What is the MOST operationally efficient solution that meets these requirements?

Create a REST API in Amazon API Gateway and configure the API as the endpoint for a web application to pass the data for processing. Use a single AWS Lambda function to process the data.

Correct answer

Create a web application to pass the data to AWS Step Functions. Decouple the processing into Step Functions tasks and AWS Lambda functions.

Create a web application to write the data to an Amazon S3 bucket. Use S3 Event Notifications to publish to separate SQS queues for each step. Use EC2 instances to process the data in each SQS queue.

Create a web application to pass the data to separate Amazon SQS queues for each step. Process each step by using separate Lambda functions with the SQS queues.

Overall explanation

AWS Step Functions is the ideal solution for rearchitecting this application. With Step Functions you can configure separate tasks with separate Lambda functions for processing each step of the application. The application logic can be configured as part of the state machine. If a single step fails the logic can require that only that step must rerun to reprocess the data.

CORRECT: "Create a web application to pass the data to AWS Step Functions. Decouple the processing into Step Functions tasks and AWS Lambda functions" is the correct answer (as explained above.)

INCORRECT: "Create a web application to pass the data to separate Amazon SQS queues for each step. Process each step by using separate Lambda functions with the SQS queues" is incorrect.

This is more operationally complex and there is no overarching logic to orchestrate the different components of the application and coordinate the reprocessing of failed steps.

INCORRECT: "Create a web application to write the data to an Amazon S3 bucket. Use S3 Event Notifications to publish to separate SQS queues for each step. Use EC2 instances to process the data in each SQS queue" is incorrect.

There is no way that S3 can know which queue to place the data in as this answer states that all data is written to the same S3 bucket. This is also operationally complex and more expensive than using Lambda.

INCORRECT: "Create a REST API in Amazon API Gateway and configure the API as the endpoint for a web application to pass the data for processing. Use a single AWS Lambda function to process the data" is incorrect.

Using a single Lambda function will not assist with decoupling the application so only a single step must be rerun if processing fails.

References:

https://docs.aws.amazon.com/step-functions/latest/dg/concepts-states.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 10Skipped

A DevOps manager requires a disaster recovery (DR) solution for a workload deployed on Amazon EC2 instances in an Amazon VPC within the us-east-1 Region. The DR solution should enable data replication to a staging area subnet in another AWS Region. The DR solution minimize operational overhead and enable fast failover and failback.

Which solution meets these requirements?

Use AWS Resource Access Manager (RAM) to share the VPC across Regions and configure AWS DataSync to synchronize data between source and target systems.

Correct answer

Use AWS Elastic Disaster Recovery to replicate data to a staging area subnet in another Region using the replication agent installed on the EC2 instance.

Create a resource group for the EC2 instances and configure DR protection using AWS Resilience Hub. Configure RPO/RTO settings and enable automated recovery.

Use AWS Backup to enable cross-Region snapshots for the EC2 instances. Use AWS Fault Injection Simulator to enable automated recovery.

Overall explanation

AWS Elastic Disaster Recovery (AWS DRS) minimizes downtime and data loss with fast, reliable recovery of on-premises and cloud-based applications using affordable storage, minimal compute, and point-in-time recovery.

You can increase IT resilience when you use AWS Elastic Disaster Recovery to replicate on-premises or cloud-based applications running on supported operating systems. Use the AWS Management Console to configure replication and launch settings, monitor data replication, and launch instances for drills or recovery.

Set up AWS Elastic Disaster Recovery on your source servers to initiate secure data replication. Your data is replicated to a staging area subnet in your AWS account, in the AWS Region you select. The staging area design reduces costs by using affordable storage and minimal compute resources to maintain ongoing replication.

CORRECT: "Use AWS Elastic Disaster Recovery to replicate data to a staging area subnet in another Region using the replication agent installed on the EC2 instance" is the correct answer (as explained above.)

INCORRECT: "Use AWS Resource Access Manager (RAM) to share the VPC across Regions and configure AWS DataSync to synchronize data between source and target systems" is incorrect.

AWS RAM cannot be used to share VPCs across Regions. Also, DataSync is not suitable for synchronizing the application data on Amazon EC2 instances.

INCORRECT: "Create a resource group for the EC2 instances and configure DR protection using AWS Resilience Hub. Configure RPO/RTO settings and enable automated recovery" is incorrect.

AWS Resilience Hub provides a central place to define, validate, and track the resilience of applications on AWS. It cannot be used to configure DR protection or enable automated recovery.

INCORRECT: "Use AWS Backup to enable cross-Region snapshots for the EC2 instances. Use AWS Fault Injection Simulator to enable automated recovery" is incorrect.

You can use AWS Backup to enable cross-Region backups of EC2 instances. However, AWS Fault Injection Simulator is not used for automated recovery, it is used for running fault injection experiments to improve an application’s performance, observability, and resiliency.

References:

https://docs.aws.amazon.com/drs/latest/userguide/what-is-drs.html

Domain

AWS Compute

Question 11Skipped

A DevOps engineer builds an artifact locally and then uploads it to an Amazon S3 bucket. The application has a local cache that must be cleared as part of the deployment. The engineer executes a command to do this, retrieves the artifact from Amazon S3, and unzips the artifact to complete the deployment.

The engineer wants to migrate to an automated CI/CD solution and incorporate checks to stop and roll back the deployment in the event of a failure. This requires tracking the progression of the deployment.

Which combination of actions will accomplish this? (Select THREE.)

Correct selection

Write a custom script that clears the cache and specify the script in the BeforeInstall lifecycle hook in the AppSpec file.

Check the code into a code repository. On each pull into master use Amazon CloudWatch Events to trigger an AWS Lambda function that builds the artifact and uploads it to Amazon S3.

Use AWS Systems Manager to download the artifact from Amazon S3 and deploy it to all the EC2 instances.

Add user data to the Amazon EC2 instances that contains script to clear the cache. Once deployed, test the application. If it is not successful, deploy it again.

Correct selection

Set up an AWS CodePipeline pipeline to deploy the application. Check the code into a code repository as a source for the pipeline.

Correct selection

Use AWS CodeBuild to build the artifact and upload it to Amazon S3. Use AWS CodeDeploy to deploy the artifact to the Amazon EC2 instances.

Overall explanation

The engineer wants to build an automated CI/CD pipeline. Therefore, the best solution is to use a code repository such as CodeCommit for committing the code. Once committed a CodePipeline will automatically pick up the changes and initiate CodeBuild which will build the artifacts and upload the S3.

After the build artifact has been uploaded CodeDeploy can then be used to deploy the application. The AppSpec file is used by CodeDeploy during deployments. The engineer should add the script to clear the cache to the BeforeInstall lifecycle hook, so it is executed before the install occurs.

CORRECT: "Write a custom script that clears the cache and specify the script in the BeforeInstall lifecycle hook in the AppSpec file" is a correct answer (as explained above.)

CORRECT: "Set up an AWS CodePipeline pipeline to deploy the application. Check the code into a code repository as a source for the pipeline" is also a correct answer (as explained above.)

CORRECT: "Use AWS CodeBuild to build the artifact and upload it to Amazon S3. Use AWS CodeDeploy to deploy the artifact to the Amazon EC2 instances" is also a correct answer (as explained above.)

INCORRECT: "Check the code into a code repository. On each pull into master use Amazon CloudWatch Events to trigger an AWS Lambda function that builds the artifact and uploads it to Amazon S3" is incorrect.

A better solution is to use CodePipeline which is designed for automating CI/CD pipelines and CodeBuild for building the artifact.

INCORRECT: "Add user data to the Amazon EC2 instances that contains script to clear the cache. Once deployed, test the application. If it is not successful, deploy it again" is incorrect.

User data only runs when the instance is first started so is not useful for running any commands after that time.

INCORRECT: "Use AWS Systems Manager to download the artifact from Amazon S3 and deploy it to all of the EC2 instances" is incorrect.

Systems Manager is not suitable for deploying application updates and CodeDeploy should be used instead.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 12Skipped

A company needs is deploying a new application in AWS and requires a CI/CD pipeline to automate process. The company requires that the entire CI/CD pipeline can be re-provisioned in different AWS accounts or Regions within minutes.

The pipeline must support continuous integration, continuous delivery, and automatic rollback upon deployment failure. A DevOps engineer has already created an AWS CodeCommit repository to store the source code.

Which combination of actions should the DevOps engineer take to meet these requirements? (Select THREE.)

Correct selection

Configure an AWS CodePipeline pipeline with a build stage using AWS CodeBuild.

Correct selection

Provision all resources using AWS CloudFormation.

Launch Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) and set the ALB as the deployment target in AWS CodePipeline.

Implement an Amazon SQS queue to decouple the pipeline components.

Correct selection

Launch Amazon EC2 instances in an AWS Elastic Beanstalk environment and configure the environment as the deployment target in AWS CodePipeline.

Copy the build artifact from CodeCommit to Amazon S3.

Overall explanation

The DevOps engineer should create a pipeline using AWS CodePipeline to automate the entire deployment. The CodeCommit repository can be used as the source. The combinations of CodeBuild with Elastic Beanstalk provides a way to build, test, and deploy with automatic rollback upon failure.

The question also requires that the entire CI/CD pipeline can be recreated in different accounts and Regions. For this reason the pipeline should be deployed using AWS CloudFormation. The templates can then be easily used to recreate the entire stack.

CORRECT: "Configure an AWS CodePipeline pipeline with a build stage using AWS CodeBuild" is a correct answer (as explained above.)

CORRECT: "Launch Amazon EC2 instances in an AWS Elastic Beanstalk environment and configure the environment as the deployment target in AWS CodePipeline" is also a correct answer (as explained above.)

CORRECT: "Provision all resources using AWS CloudFormation" is also a correct answer (as explained above.)

INCORRECT: "Copy the build artifact from CodeCommit to Amazon S3" is incorrect.

There is no need to do this, CodeCommit can be used directly as a source for source code and build artifacts.

INCORRECT: Implement an Amazon SQS queue to decouple the pipeline components" is incorrect.

CodePipeline has its own built-in capabilities for passing information durably between stages and does not require decoupling using Amazon SQS.

INCORRECT: "Launch Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) and set the ALB as the deployment target in AWS CodePipeline" is incorrect.

This solution would not provide the automatic rollback upon failure requested. Automatic rollback can be implemented when using Elastic Beanstalk with CodeBuild. Otherwise, you would need CodeDeploy.

References:

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.deploy-existing-version.html

https://docs.aws.amazon.com/codepipeline/latest/userguide/concepts-continuous-delivery-integration.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 13Skipped

The information security policy of a company has been updated and now requires that all Amazon EBS volumes must be encrypted. Any volumes that are not encrypted should be marked as non-compliant. The company uses AWS Organizations to manage multiple accounts. A DevOps engineer needs to automatically deploy the solution and ensure that this compliance check is applied.

Which solution will accomplish this MOST efficiently?

Apply an SCP in Organizations that uses conditional expressions to prevent the launch of Amazon EC2 instances that do not have encrypted EBS volumes. Apply the SCP to all AWS accounts.

Enable the AWS Config ec2-ebs-encryption-by-default rule to check whether EBS encryption is enabled. Deploy the rule in the management account of the Organization.

Correct answer

Create an AWS Config rule at the AWS organization level to check whether EBS encryption is enabled. Create and apply an SCP to prohibit stopping and deleting AWS Config across the organization.

Run a scheduled AWS Lambda function in each account that checks the encryption status of EBS volumes in the account. Publish the report to a centralized Amazon S3 bucket. Use Amazon Athena to analyze the data.

Overall explanation

AWS Config allows you to manage AWS Config rules across all AWS accounts within an organization. You can:

Centrally create, update, and delete AWS Config rules across all accounts in your organization.

Deploy a common set of AWS Config rules across all accounts and specify accounts where AWS Config rules should not be created.

Use the APIs from the master account in AWS Organizations to enforce governance by ensuring that the underlying AWS Config rules are not modifiable by your organization’s member accounts.

The DevOps engineer should create an organization level rule and then setup an SCP that prevents any modifications from happening that would stop the rule from running.

The engineer can use the AWS Config “ec2-ebs-encryption-by-default” rule. This rule checks that Amazon Elastic Block Store (EBS) encryption is enabled by default. The rule is NON_COMPLIANT if the encryption is not enabled.

CORRECT: "Create an AWS Config rule at the AWS organization level to check whether EBS encryption is enabled. Create and apply an SCP to prohibit stopping and deleting AWS Config across the organization" is the correct answer (as explained above.)

INCORRECT: "Enable the AWS Config ec2-ebs-encryption-by-default rule to check whether EBS encryption is enabled. Deploy the rule in the management account of the Organization" is incorrect.

Deploying the rule in the management account will not suffice as the company has multiple accounts in an AWS Organizations configuration. The rule must be deployed across all accounts.

INCORRECT: "Run a scheduled AWS Lambda function in each account that checks the encryption status of EBS volumes in the account. Publish the report to a centralized Amazon S3 bucket. Use Amazon Athena to analyze the data" is incorrect.

While this may provide the required data, this is not the most efficient solution. Using Config is preferable as it will have less overhead and is designed specifically for compliance purposes and is a superior solution.

INCORRECT: "Apply an SCP in Organizations that uses conditional expressions to prevent the launch of Amazon EC2 instances that do not have encrypted EBS volumes. Apply the SCP to all AWS accounts" is incorrect.

SCPs don't affect users or roles in the management account and condition elements may not affect users logged in with root user credentials. AWS Config will be a better solution for this requirement.

References:

https://docs.aws.amazon.com/config/latest/developerguide/config-rule-multi-account-deployment.html

https://docs.aws.amazon.com/config/latest/developerguide/ec2-ebs-encryption-by-default.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-config/

https://digitalcloud.training/aws-organizations/

Domain

AWS Management & Governance

Question 14Skipped

A financial company has applications hosted in multiple AWS accounts which are managed by AWS organizations. A security audit was conducted to address any potential security breaches and implement best practices. The security audit report recommended that all security related logging and security findings are collect in a centralized security account.

How can this be achieved?

Correct answer

Use Amazon GuardDuty in each organization to detect the attacks on EC2 instances. Specify an organization as the GuardDuty administrator. Create a CloudWatch rule in the GuardDuty administrator account to detect these findings. Create an automation chain from the CloudWatch rule to trigger Kinesis Data Firehose to send findings to a designated S3 bucket.

Use Amazon Inspector in each organization to detect the attacks on EC2 instances. Specify an organization as the Inspector administrator. Create a CloudWatch rule in the Inspector administrator account to detect these findings. Create an automation chain from the CloudWatch rule to trigger Kinesis Data Firehose to send findings to a designated S3 bucket.

Use Amazon GuardDuty in each account to detect the attacks on EC2 instances. Create a CloudWatch rule in the GuardDuty administrator account to detect these findings. Create an automation chain from the CloudWatch rule to trigger Kinesis Data Streams to send findings to a designated S3 bucket.

Use Amazon Macie in each organization to detect the attacks on EC2 instances. Specify an organization as the Macie administrator. Create a CloudWatch rule in the Macie administrator account to detect these findings. Create an automation chain from the CloudWatch rule to trigger Kinesis Data Firehose to send findings to a designated S3 bucket.

Overall explanation

GuardDuty analyzes and processes VPC flow log, AWS CloudTrail event log, and DNS log data sources. You don’t need to manually manage these data sources because the data is automatically leveraged and analyzed when you activate GuardDuty.

For example, GuardDuty consumes VPC Flow Log events directly from the VPC Flow Logs feature through an independent and duplicative stream of flow logs. As a result, you don’t incur any operational burden on existing workloads.

Domain

AWS Security, Identity, & Compliance

Question 15Skipped

A company is running an eCommerce application on a fleet of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. There have been issues occurring occasionally where instances fail to launch successfully, and the support team wants to be notified whenever this occurs.

Which configuration update will achieve these requirements?

Which action will accomplish this?

Add a health check to the Auto Scaling group to invoke an AWS Lambda function whenever an instance status is impaired.

Create an Amazon CloudWatch alarm that sends an Amazon SNS notification when a failed SetInstanceHealth API call is made.

Correct answer

Configure an Amazon SNS topic for the Auto Scaling group that sends a notification whenever a failed instance launch occurs.

Create an Amazon CloudWatch alarm that sends a notification when an Amazon EC2 status check fails.

Overall explanation

You can be notified when Amazon EC2 Auto Scaling is launching or terminating the EC2 instances in your Auto Scaling group. You manage notifications using Amazon Simple Notification Service (Amazon SNS).

Amazon EC2 Auto Scaling supports sending Amazon SNS notifications when the following events occur:

The “autoscaling:EC2_INSTANCE_LAUNCH_ERROR” would be the correct event to monitor as this indicates if failed instance launch events have occurred. SNS can then send a notification to the support team to let them know what has happened.

CORRECT: "Configure an Amazon SNS topic for the Auto Scaling group that sends a notification whenever a failed instance launch occurs" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon CloudWatch alarm that sends an Amazon SNS notification when a failed SetInstanceHealth API call is made" is incorrect.

This API action is used to set the health of an instance and does not monitor failed instance launch events.

INCORRECT: "Create an Amazon CloudWatch alarm that sends a notification when an Amazon EC2 status check fails" is incorrect.

Status checks will show issues with instances that are already running rather than issues with launch events.

INCORRECT: "Add a health check to the Auto Scaling group to invoke an AWS Lambda function whenever an instance status is impaired" is incorrect.

Health checks can be used to check the status of an instance, but the instance is already running. This does not help if the instance failed to launch.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-sns-notifications.html#auto-scaling-sns-notifications

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 16Skipped

A company stores sensitive data in Amazon S3 buckets. Each day the development team create new buckets for projects they are working on, and all existing and future buckets must be secured. The security team requires encryption, logging, and versioning to be enabled. It is also required that buckets should not be publicly accessible.

What should a DevOps engineer do to meet these requirements?

Enable AWS Trusted Advisor and configure automatic remediation using Amazon CloudWatch Events.

Enable AWS Systems Manager and configure automatic remediation using Systems Manager documents.

Correct answer

Enable AWS Config rules and configure automatic remediation using AWS Systems Manager documents.

Enable AWS CloudTrail and configure automatic remediation using AWS Lambda.

Overall explanation

You can use the AWS Config Auto Remediation feature to auto remediate any non-compliant S3 buckets using the AWS Config rules. There are several pre-built rules you can leverage for various use cases. For example, the following rules can be used to meet the requirements specified in this question:

s3-bucket-logging-enabled

s3-bucket-server-side-encryption-enabled

s3-bucket-public-read-prohibited

s3-bucket-public-write-prohibited

These rules act as controls to prevent any non-compliant S3 activities. AWS Config uses AWS Systems Manager to implement the remediations and the rules are automation documents that Systems Manager runs.

CORRECT: "Enable AWS Config rules and configure automatic remediation using AWS Systems Manager documents" is the correct answer (as explained above.)

INCORRECT: "Enable AWS Trusted Advisor and configure automatic remediation using Amazon CloudWatch Events" is incorrect.

Trusted Advisor will not discover these specific compliance events and CloudWatch Events is not able to remediate them.

INCORRECT: "Enable AWS Systems Manager and configure automatic remediation using Systems Manager documents" is incorrect.

Systems Manager automation documents are used for remediation, but Systems Manager is unable to discover the specific compliance events for this scenario. AWS Config should be used with Systems Manager to meet the requirements.

INCORRECT: "Enable AWS CloudTrail and configure automatic remediation using AWS Lambda" is incorrect.

CloudTrail can only detect API actions rather than audit compliance with configuration requirements. Though it is possible to use CloudTrail to detect some configuration changes this would be complex to implement.

References:

https://aws.amazon.com/blogs/mt/aws-config-auto-remediation-s3-compliance/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-config/

Domain

AWS Management & Governance

Question 17Skipped

A company has an application that uses Amazon Cognito user pools as an identity provider. The company must secure access to user records. The company has set up multi-factor authentication (MFA). The company also wants to send a login activity notification by email every time a user logs in.

What is the MOST operationally efficient solution that meets this requirement?

Create an AWS Lambda function that uses Amazon SES to send the email notification. Add an Amazon API Gateway API to invoke the function. Call the API from the client side when login confirmation is received.

Correct answer

Create an AWS Lambda function that uses Amazon SES to send the email notification. Add an Amazon Cognito post authentication Lambda trigger for the function.

Configure Amazon Cognito to stream all logs to Amazon Kinesis Data Firehose. Create an AWS Lambda function to process the streamed logs and to send the email notification based on the login status of each user.

Create an AWS Lambda function that uses Amazon SES to send the email notification. Create an Amazon CloudWatch Logs log subscription filter to invoke the function based on the login status.

Overall explanation

Amazon Cognito can invoke a trigger after signing in a user such as triggering an AWS Lambda function. Cognito will pass certain parameters to the Lambda function and the Lambda function can then trigger Amazon SES to send an email notification.

These are the parameters that Amazon Cognito passes to this Lambda function along with the event information in the common parameters.

CORRECT: "Create an AWS Lambda function that uses Amazon SES to send the email notification. Add an Amazon Cognito post authentication Lambda trigger for the function" is the correct answer (as explained above.)

INCORRECT: "Create an AWS Lambda function that uses Amazon SES to send the email notification. Add an Amazon API Gateway API to invoke the function. Call the API from the client side when login confirmation is received" is incorrect.

The API is not suitable and not necessary for this purpose when Cognito can directly trigger Lambda which has the logic to send the necessary notification.

INCORRECT: "Create an AWS Lambda function that uses Amazon SES to send the email notification. Create an Amazon CloudWatch Logs log subscription filter to invoke the function based on the login status" is incorrect.

As above, this is unnecessary as Cognito can trigger the Lambda function directly.

INCORRECT: "Configure Amazon Cognito to stream all logs to Amazon Kinesis Data Firehose. Create an AWS Lambda function to process the streamed logs and to send the email notification based on the login status of each user" is incorrect.

As above, this is unnecessary as Cognito can trigger the Lambda function directly.

References:

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-post-authentication.html#cognito-user-pools-lambda-trigger-syntax-post-auth

Domain

AWS Security, Identity, & Compliance

Question 18Skipped

An organization is running containerized applications across Amazon EKS, Amazon ECS, and on-premises clusters. Due to some recent issues that caused outages, a solution is required to track container performance and system health, detect errors. The solution should enable collection and aggregation of time-series metrics from all container services for monitoring and analytics.

Which combination of services can the organization use?

Use the unified Amazon CloudWatch agent to collect the metrics, Amazon Athena to run SQL queries, and AWS Glue for visualization.

Use AWS AppConfig to collect application metrics from the containers and use Amazon OpenSearch Service for visualization and analytics.

Use the AWS Systems Manager agent to collect the metrics and use Amazon Managed Service for Prometheus for visualization and analytics.

Correct answer

Use Amazon Managed Service for Prometheus for collection of metrics and use Amazon Managed Grafana for visualization and analytics.

Overall explanation

Amazon Managed Service for Prometheus is a Prometheus-compatible service that monitors and provides alerts on containerized applications and infrastructure at scale. The service is integrated with Amazon Elastic Kubernetes Service (EKS), Amazon Elastic Container Service (ECS), and AWS Distro for OpenTelemetry.

The company can use Amazon Managed Grafana, a fully managed AWS service that makes it easy to use Grafana to monitor operational data with interactive data visualizations in a single console across multiple data sources, without needing to deploy, manage, and operate Grafana servers.

CORRECT: "Use Amazon Managed Service for Prometheus for collection of metrics and use Amazon Managed Grafana for visualization and analytics" is the correct answer (as explained above.)

INCORRECT: "Use the unified Amazon CloudWatch agent to collect the metrics, Amazon Athena to run SQL queries, and AWS Glue for visualization" is incorrect.

The CloudWatch agent is used with Amazon EC2 instances and cannot be used with containers running on all these platforms. The Container Insights tool which is part of CloudWatch can be used for containers running in the AWS Cloud.

INCORRECT: "Use the AWS Systems Manager agent to collect the metrics and use Amazon Managed Service for Prometheus for visualization and analytics" is incorrect.

Systems Manager cannot collect the time-series metrics from containerized applications running on the specified platforms.

INCORRECT: "Use AWS AppConfig to collect application metrics from the containers and use Amazon OpenSearch Service for visualization and analytics" is incorrect.

AWS AppConfig is a capability of Systems Manager that is used to create, manage, and quickly deploy application configurations. It is not used for collecting metrics.

References:

https://aws.amazon.com/prometheus/features/

Domain

AWS Management & Governance

Question 19Skipped

A company requires an extremely high performance in-memory database for an application. The database used should store data durably across multiple availability zones. The application requires that the database support strong consistency and can scale seamlessly to many terabytes in size.

Which database should the company use for this application?

Use Amazon ElastiCache for Memcached.

Correct answer

Use Amazon MemoryDB for Redis.

Use Amazon Managed Grafana.

Use Amazon ElastiCache for Redis.

Overall explanation

Amazon MemoryDB for Redis is a Redis-compatible, durable, in-memory database service that delivers ultra-fast performance. It is purpose-built for modern applications with microservices architectures.

Amazon MemoryDB for Redis vs ElastiCache:

• Use ElastiCache for caching DB queries.

• Use MemoryDB for a full DB solution combining DB and cache.

• MemoryDB offers higher performance with lower latency .

• MemoryDB offers strong consistency for primary nodes and eventual consistency for replica nodes.

• With ElastiCache there can be some inconsistency and latency depending on the engine and caching strategy.

For this scenario the requirement is for a full DB solution, not a caching solution, so MemoryDB for Redis is the best choice.

CORRECT: "Use Amazon MemoryDB for Redis" is the correct answer (as explained above.)

INCORRECT: "Use Amazon ElastiCache for Redis" is incorrect as explained above.

INCORRECT: "Use Amazon ElastiCache for Memcached" is incorrect as explained above.

INCORRECT: "Use Amazon Managed Grafana" is incorrect. This service is not a database service, it is used for data visualization of operational metrics, logs, and traces.

References:

https://aws.amazon.com/memorydb/features/

Domain

AWS Database

Question 20Skipped

An application is deployed on Amazon EC2 instances in an Auto Scaling group. The application includes a process that sometimes fails causing the application to return an error. Restarting the process resolves the issue. The DevOps team are investigating the issue. While the investigation is ongoing an engineer needs a method of identifying the issue and quickly remediating it without affecting the capacity of the Auto Scaling group.

Which approach meets this requirement in the fastest possible time?

Use Amazon EventBridge to run an AWS Lambda function that checks if the process is running. If the process returns an error, run the AWS CLI set-instance-health command to set the health state of the specified instance to Unhealthy.

Use Amazon EventBridge to run an event every 10 minutes. Configure the event to run an AWS Lambda function that takes instances out of service one-by-one, restarts them, and then places them back in service.

Correct answer

Install the Amazon CloudWatch agent on the EC2 instances and use the procstat plugin to monitor the application process and send metrics to CloudWatch. Use Systems Manager Run Command to restart any processes that are failed.

Run a regular cron job to execute commands and check if the process is running. If the process returns an error, run the AWS CLI set-instance-health command to set the health state of the specified instance to Unhealthy.

Overall explanation

The Amazon CloudWatch agent procstat plugin continuously watches specified processes and reports their metrics to Amazon CloudWatch. After the data is in Amazon CloudWatch, you can associate alarms to trigger actions like notifying teams or remediations like restarting the processes, resizing the instances, and so on. In this case AWS Systems Manager Run Command can then be used to restart any processes that are failed.

This solution will resolve the issue in the fastest time as metrics can be reported on a 1-minute timeframe and restarting the process is much quicker than restarting the instance or terminating it and launching a replacement. It also does not affect the capacity of the Auto Scaling group.

CORRECT: "Install the Amazon CloudWatch agent on the EC2 instances and use the procstat plugin to monitor the application process and send metrics to CloudWatch. Use Systems Manager Run Command to restart any processes that are failed" is the correct answer (as explained above.)

INCORRECT: "Run a regular cron job to execute commands and check if the process is running. If the process returns an error, run the AWS CLI set-instance-health command to set the health state of the specified instance to Unhealthy" is incorrect.

This will cause the instance to be terminated and a new instance will be launched. This could be slower than creating an automated process to restart the affected process. This also affects the capacity of the Auto Scaling group while the new instances are launched and brought into service.

INCORRECT: "Use Amazon EventBridge to run an AWS Lambda function that checks if the process is running. If the process returns an error, run the AWS CLI set-instance-health command to set the health state of the specified instance to Unhealthy" is incorrect.

This is like the previous answer and has the same issues though it is potentially better as it uses AWS services to automate the process.

INCORRECT: "Use Amazon EventBridge to run an event every 10 minutes. Configure the event to run an AWS Lambda function that takes instances out of service one-by-one, restarts them, and then places them back in service" is incorrect.

This may be the slowest of the options presented in terms of identification of the issue and it would be better to restart the process rather than restarting the instances.

References:

https://aws.amazon.com/blogs/mt/detecting-remediating-process-issues-on-ec2-instances-using-amazon-cloudwatch-aws-systems-manager/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-systems-manager/

Domain

AWS Management & Governance

Question 21Skipped

An application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. When bringing new EC2 instances online, the application must be tested before traffic can be directed to the instances.

Which Auto Scaling process should a DevOps engineer suspend to allow testing to be performed without removing the instances from the Auto Scaling group?

Suspend the process Replace Unhealthy.

Suspend the process AZ Rebalance.

Correct answer

Suspend the process AddToLoadBalancer.

Suspend the process Health Check.

Overall explanation

Auto Scaling processes can be suspended and then resumed. You might want to do this, for example, so that you can investigate a configuration issue that is causing the process to fail, or to prevent Amazon EC2 Auto Scaling from marking instances unhealthy and replacing them while you are making changes to your Auto Scaling group.

In this scenario the engineer wants to test the instances before directing traffic to them whilst keeping them in the auto scaling group. The best process to suspend in this case is AddToLoadBalancer.

This will prevent the instances from being added to the load balancer so no traffic will be directed to them.

CORRECT: "Suspend the process AddToLoadBalancer" is the correct answer (as explained above.)

INCORRECT: "Suspend the process Health Check" is incorrect.

This will stop all health checks from running. This may not have the desired effect as instances will not be marked as healthy.

INCORRECT: "Suspend the process Replace Unhealthy" is incorrect.

This is useful if you want to ensure that unhealthy instances are not terminated and replaced.

INCORRECT: "Suspend the process AZ Rebalance" is incorrect.

This would be used to suspend rebalancing of instances across availability zones.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-suspend-resume-processes.html

Save time with our exam-specific cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 22Skipped

A DevOps engineer is using AWS CodeBuild to build an application into a Docker image. The buildspec file is used to run the application build. The engineer needs to push the Docker image to an Amazon ECR repository only upon the successful completion of each build.

Add a post_build phase to the buildspec file that uses the artifacts sequence to find the build artifacts and push to Amazon ECR.

Add a post_build phase to the buildspec file that uses the finally block to push the Docker image.

Add an install phase to the buildspec file that uses the commands block to push the Docker image.

Correct answer

Add a post_build phase to the buildspec file that uses the commands block to push the Docker image.

Overall explanation

The post_build phase is an optional sequence. It represents the commands, if any, that CodeBuild runs after the build. For example, you might use Maven to package the build artifacts into a JAR or WAR file, or you might push a Docker image into Amazon ECR. Then you might send a build notification through Amazon SNS.

Here is an example of a buildspec file with a post_build phase that pushes a Docker image to Amazon ECR:

CORRECT: "Add a post_build phase to the buildspec file that uses the commands block to push the Docker image" is the correct answer (as explained above.)

INCORRECT: "Add a post_build phase to the buildspec file that uses the finally block to push the Docker image" is incorrect.

Commands specified in a final block are run after commands in the commands block. The commands in a final block are run even if a command in the commands block fails. This would not be ideal as this would push the image to ECR even if commands in previous sequences failed.

INCORRECT: "Add an install phase to the buildspec file that uses the commands block to push the Docker image" is incorrect.

These are commands that are run during installation. The develop would want to push the image only after all installations have succeeded. Therefore, the post_build phase should be used.

INCORRECT: "Add a post_build phase to the buildspec file that uses the artifacts sequence to find the build artifacts and push to Amazon ECR" is incorrect.

The artifacts sequence is not required if you are building and pushing a Docker image to Amazon ECR, or you are running unit tests on your source code, but not building it.

References:

https://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html

https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 23Skipped

A custom application generates events and produces data that must be processed for each event. An event-driven solution is required to process the events and save the output to a serverless key/value store.

Which actions should a DevOps engineer take?

Configure the application to submit the event data to an Amazon S3 bucket. Create an Amazon EventBridge rule that reacts to state changes in S3 and triggers Amazon Athena to process the data and save the output to an Amazon DynamoDB table.

Configure the application to submit the event data to an SQS queue. Configure a trigger for an AWS Lambda function and configure the function to process the data and save the output to an Amazon ElastiCache cluster.

Correct answer

Configure the application to submit the event data to an SNS topic. Subscribe an AWS Lambda function to the topic and configure the function to process the data and save the output to an Amazon DynamoDB table.

Configure the application to submit the event data to an Amazon Kinesis Data Firehose delivery stream with an Amazon S3 destination. Configure an event notification for an AWS Lambda function to process the data and save the output to an Amazon RDS database.

Overall explanation

To create an event-driven architecture for this requirement the engineer can configure the application to submit the event data to an SNS topic. The Lambda function can be subscribed to the topic and will process the data and then save the results to Amazon DynamoDB which is a key/value database.

CORRECT: "Configure the application to submit the event data to an SNS topic. Subscribe an AWS Lambda function to the topic and configure the function to process the data and save the output to an Amazon DynamoDB table" is the correct answer (as explained above.)

INCORRECT: "Configure the application to submit the event data to an Amazon S3 bucket. Create an Amazon EventBridge rule that reacts to state changes in S3 and triggers Amazon Athena to process the data and save the output to an Amazon DynamoDB table" is incorrect.

An event notification rule can be created on S3 rather than using EventBridge. However, you cannot use Athena to process data as it is an analytics service, not a compute service.

INCORRECT: "Configure the application to submit the event data to an Amazon Kinesis Data Firehose delivery stream with an Amazon S3 destination. Configure an event notification for an AWS Lambda function to process the data and save the output to an Amazon RDS database" is incorrect.

Amazon RDS is not a serverless key/value store. It is a relational database that uses Amazon EC2 instances so it is not suitable for this requirement.

INCORRECT: "Configure the application to submit the event data to an SQS queue. Configure a trigger for an AWS Lambda function and configure the function to process the data and save the output to an Amazon ElastiCache cluster" is incorrect.

Amazon ElastiCache is a key/value store, but it is not a serverless database; it uses Amazon EC2 instances, so it is not suitable for this requirement.

References:

https://docs.aws.amazon.com/lambda/latest/dg/with-sns.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 24Skipped

An application runs on Amazon EC2 instances and calls an AWS Lambda function to process certain operations. A DevOps engineer needs to update the Lambda code without needing to modify the application on EC2. The updates should be initially tested with a subset of the traffic and rollback must be possible if issues occur. The solution must be operationally efficient.

Which actions should the DevOps engineer take?

Create an alias that points to the current version of the function. Create a second function with the updated code and create an alias for that function that uses the same alias name. Configure the provisioned concurrency for the second function so it only serves 10% of requests. Modify the application on EC2 to use the alias endpoint address.

Create an additional function with the new code. Create Amazon Route 53 weighted records. Configure the records to direct 90% of the traffic to the original function and 10% to the new function. Modify the application on EC2 to use the DNS record configured in Route 53.

Create multiple Lambda layers for different versions of the code. Add the updated code to a new layer using a .zip archive. Create an alias that points to the layer containing the original code. Add the new layer to the alias and configure a weight that directs 10% of traffic to the new layer. Modify the application on EC2 to use the alias endpoint address.

Correct answer

Create an alias that points to the current version of the function. Publish an additional version with the new code, add the version to the alias, and configure a weight that directs 10% of traffic to the new version. Modify the application on EC2 to use the alias endpoint address.

Overall explanation

You can create one or more aliases for your Lambda function. A Lambda alias is like a pointer to a specific function version. Users can access the function version using the alias Amazon Resource Name (ARN). You can add multiple versions of a function to an alias and configure a weighting to direct percentages of traffic to one version or another.

This enables a blue/green deployment in which new code updates can be tested with a subset of the traffic. It is easy to then move to the new function or roll back to the original function by simply updating the alias configuration.

CORRECT: "Create an alias that points to the current version of the function. Publish an additional version with the new code, add the version to the alias, and configure a weight that directs 10% of traffic to the new version. Modify the application on EC2 to use the alias endpoint address" is the correct answer (as explained above.)

INCORRECT: "Create an additional function with the new code. Create Amazon Route 53 weighted records. Configure the records to direct 90% of the traffic to the original function and 10% to the new function. Modify the application on EC2 to use the DNS record configured in Route 53" is incorrect.

Though this is indeed possible, it would be better to use the built-in features of AWS Lambda rather than external services. It is also much less operationally efficient to use multiple functions rather than versioning.

INCORRECT: "Create an alias that points to the current version of the function. Create a second function with the updated code and create an alias for that function that uses the same alias name. Configure the provisioned concurrency for the second function so it only serves 10% of requests. Modify the application on EC2 to use the alias endpoint address" is incorrect.

This is not how aliases work; they are created within a function and point to separate versions of that function. Even if you create aliases with the same name on different functions they will still have a different ARN as the function name is included. It is also not possible to use provisioned concurrency to control weightings of traffic in this manner.

INCORRECT: "Create multiple Lambda layers for different versions of the code. Add the updated code to a new layer using a .zip archive. Create an alias that points to the layer containing the original code. Add the new layer to the alias and configure a weight that directs 10% of traffic to the new layer. Modify the application on EC2 to use the alias endpoint address" is incorrect.

A Lambda layer is a .zip file archive that can contain additional code or other content. A layer can contain libraries, a custom runtime, data, or configuration files. In this case, versions should be used rather than layers for updating the code. Aliases also point to versions, not layers.

References:

https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-lambda/

Domain

AWS Compute

Question 25Skipped

A retail company uses a Spring boot web application running in an Auto Scaling group and behind an Application Load Balancer. Whenever traffic spikes occur, there have been inconsistent errors when the application auto scales. The following error message was generated:

“Instance failed to complete user's Lifecycle Action: Lifecycle Action with token<token-Id> was abandoned: Heartbeat Timeout”.

Which actions should a DevOps engineer take to collect logs for all affected instances and store them for later analysis? (Select THREE.)

Correct selection

Create an Auto Scaling Group Lifecycle Hook for the terminate action. Create an Amazon EventBridge rule and invoke a Lambda function that uses SSM Run Command to extract the application logs and store them in S3.

Enable Access Logs at the Target Group level and configure an Amazon S3 bucket as the destination.

Correct selection

Analyze the logs directly in the Amazon S3 bucket using Amazon Athena.

Analyze the logs by loading them into an Amazon EMR cluster.

Correct selection

Update the deployment group as the AWS CodeDeploy limits have been reached.

Update the health checks on the Auto Scaling group to use the correct port and protocol for the application.

Overall explanation

The lifecycle-action-token is provided by Auto Scaling in the message sent as part of processing the lifecycle hook. You need to get the token from the original message.

The error message reported usually indicates one of the following:

The maximum number of concurrent AWS CodeDeploy deployments associated with an AWS account was reached.

The Auto Scaling group tried to launch too many EC2 instances too quickly. The API calls to RecordLifecycleActionHeartbeat or CompleteLifecycleAction for each new instance were throttled.

An application in CodeDeploy was deleted before its associated deployment groups were updated or deleted.

Therefore, the engineer can update the deployment group is limits have been reached and create a solution for extracting the application logs for later analysis. This solution can use Amazon EventBridge, Lambda and SSM Run Command with S3 as the destination.

Amazon Athena allows for running SQL queries against data in an Amazon S3 bucket. The engineer can then perform analysis to identify there are any application issues that must be fixed.

CORRECT: "Update the deployment group as the AWS CodeDeploy limits have been reached" is a correct answer (as explained above.)

CORRECT: "Create an Auto Scaling Group Lifecycle Hook for the terminate action. Create an Amazon EventBridge rule and invoke a Lambda function that uses SSM Run Command to extract the application logs and store them in S3" is also a correct answer (as explained above.)

CORRECT: "Analyze the logs directly in the Amazon S3 bucket using Amazon Athena" is also a correct answer (as explained above.)

INCORRECT: "Enable Access Logs at the Target Group level and configure an Amazon S3 bucket as the destination" is incorrect.

The access logs will not provide the necessary information to troubleshoot and analyze the issues that are occurring. Access logs record information about the requests from clients.

INCORRECT: "Analyze the logs by loading them into an Amazon EMR cluster" is incorrect.

This won’t be needed as this is not a map reduce use case and data can be analyzed by EMR in Amazon S3.

INCORRECT: "Update the health checks on the Auto Scaling group to use the correct port and protocol for the application" is incorrect.

There is no evidence that health checks are misconfigured from the errors that were generated. Auto scaling must be using the health checks as it is managing to auto scale and bring instances into service.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/troubleshooting-auto-scaling.html#troubleshooting-auto-scaling-reboot

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries