AWS Certified DevOps Engineer Professional Practice Exams

Practice Test 3: DOP-C02
Open

Practice Test 2: DOP-C02

Practice Test 4: DOP-C02

Set a certification due date

AWS Certified DevOps Engineer – Professional

Course content

AI Assistant

Practice tests

Start

Practice Test 1: DOP-C02

Start

Practice Test 2: DOP-C02

Start

Practice Test 3: DOP-C02

Start

Practice Test 4: DOP-C02

Start

Practice Test 5: DOP-C02

Start

Practice Test 6: DOP-C02

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

[2025] Pass the AWS DevOps Engineer Professional Exam DOP-C02 | Exam-Difficulty Practice Questions + Exam Simulation

Rating: 4.0 out of 54.0
320 ratings

4,812

Students

130 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified DevOps Engineer Professional exam the first time with a great score

EXAM SIMULATION: All practice tests are timed and scored (passing score is 75%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

ALWAYS UP TO DATE: Covering the latest DOP-C02 exam guide, our question bank is regularly updated based on student feedback from the real exam

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ACTIVE Q&A FORUM: In this discussion board, students ask questions and share their recent exam experience offering feedback on which topics were covered

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Description

Are you preparing for the AWS Certified DevOps Engineer Professional exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS DevOps Professional practice exams to assess your exam-readiness and get certified for DOP-C02.

Our course includes 6 AWS practice exams that include a total of 130 unique practice questions. All of our practice tests accurately reflect the difficulty of the Amazon Web Services exam questions and are the most realistic AWS exam experience available on Udemy.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Our questions are continually revised based on feedback from students who have recently taken the AWS exam, so you can be sure that they are up-to-date and reflect the latest exam format.

Our practice exam course is designed to give you a thorough understanding of the key concepts and topics covered in the DOP-C02 exam. Based on your test report that provides you with detailed feedback, you get to identify areas where you need to improve and build the confidence you need to succeed in the actual exam.

TOP REASONS WHY THESE PRACTICE EXAMS ARE YOUR BEST CHANCE TO ACE YOUR AWS EXAM

100% ALIGNED WITH LATEST DOP-C02 EXAM: All practice tests on Udemy are scenario-based reflecting the latest AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

SIMULATE THE REAL CERTIFICATION EXAM: Practice tests are timed (130 min to answer 65 questions) and scored (passing score is 72%) accurately mirroring the real exam environment. This allows you to become familiar with the AWS exam format

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

REGULAR UPDATES OF QUESTIONS: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, most of our students achieve exceptional results, with an average exam score of over 85%.

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered.

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the pass mark for the actual AWS exam is 72%, we highly recommend that you continue taking our AWS practice exams until you achieve a consistent score of 80% or higher. Once you reach this recommended score on our practice tests, you'll be well-prepared to sit the actual exam and achieve a great score.

GET FAMILIAR WITH THE ACTUAL EXAM FORMAT: Our AWS Certified DevOps Pro practice exams are specifically designed to help you become familiar with the test question format and structure of the actual AWS exam. Unlike many other practice tests on the market, our exams closely match the format of the real AWS exam, ensuring that you are adequately prepared for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS DevOps practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Certified DevOps certification exam with confidence.

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy.

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to fast-track their exam success!

MONEY-BACK GUARANTEE

We are totally confident in the value of our Practice Exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

ABOUT THE AWS CERTIFIED DEVOPS ENGINEER PROFESSIONAL CERTIFICATION

The AWS Certified DevOps Engineer Professional certification is one of the most sought-after certifications in the cloud computing industry. AWS DevOps are in huge demand and salaries can be above $150,000 USD per annum. The AWS Certified DevOps s exam aims to test knowledge of the key services and tools used by DevOps creating applications on AWS.

When you're ready to book your exam you can do so on the AWS Training portal. Curious about the AWS DevOps certification cost? The AWS DevOps Professional Certification cost is $300 USD in most regions and you currently have the choice of an online proctored exam or test center (subject to availability).

OUR MISSION

At Digital Cloud Training we are committed to your success. Our mission is to provide you with the resources you need to pass your exam on your first attempt - without wasting time or money. After completing these AWS Certified DevOps Pro Practice Tests and assessing your exam readiness, you'll be more than ready for the real AWS exam.

Who this course is for:

Students preparing for the AWS Certified DevOps Engineer Professional (DOP-C02) exam who want to pass with confidence

Students who want to test their skills in exam simulation, assessing their DOP-C02 exam readiness

Anyone who wants to learn AWS through high-quality questions and answers, explanations and reference links

Anyone who is keen to take their career and salary to the next level with an AWS certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Requirements

This course is designed for individuals with a solid AWS knowledge and experience (at the Associate level)

It is recommended that students have successfully passed one or more of the AWS Associate level exams.

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 3: DOP-C02

DOP-C02 - Results

Back to result overview
Attempt 1

All domains

All domains

AWS Developer Tools

AWS Application Integration

AWS Compute

AWS Database

AWS Security, Identity, & Compliance

AWS Networking & Content Delivery

AWS Storage

AWS Management & Governance

AWS Analytics

20 all

0 correct

0 incorrect

20 skipped

0 marked

Collapse all questions

Question 1Skipped

A DevOps engineer is deploying an AWS Service Catalog portfolio using AWS CodePipeline. A mapping.yaml file is used to define the portfolio and its associated permissions and products and is committed to an AWS CodeCommit repository which is defined in the pipeline.

How can the engineer automate the creation of new portfolios and products when the mapping.yaml file is updated?

Use an AWS Lambda action in AWS CodeBuild to run an AWS Lambda function to verify and push new versions of products into the AWS Service Catalog.

Use the AWS Service Catalog deploy action in AWS CodeBuild to verify and push new versions of products into the AWS Service Catalog.

Correct answer

Use an AWS Lambda action in CodePipeline to run an AWS Lambda function to verify and push new versions of products into the AWS Service Catalog.

Use the AWS Service Catalog deploy action in AWS CodePipeline to push new versions of products into the AWS Service Catalog.

Overall explanation

The solution is to enable synchronization of the updates in the mapping.yaml file into the AWS Service Catalog portfolio. This is achieved through an AWS Lambda function that scans the source file and checks for any updates. The Lambda function is called via the CodePipeline using an action. Note that this is an AWS CodePipeline orchestration, the Lambda action is not called via CodeBuild. This can be seen in the diagram below.

CORRECT: "Use an AWS Lambda action in CodePipeline to run an AWS Lambda function to verify and push new versions of products into the AWS Service Catalog" is the correct answer (as explained above.)

INCORRECT: "Use an AWS Lambda action in AWS CodeBuild to run an AWS Lambda function to verify and push new versions of products into the AWS Service Catalog" is incorrect.

The Lambda action is called via an AWS CodePipeline orchestration, not an CodeBuild action.

INCORRECT: "Use the AWS Service Catalog deploy action in AWS CodePipeline to push new versions of products into the AWS Service Catalog" is incorrect.

The solution should use an AWS Lambda function to make the updates, and this must be called via the pipeline.

INCORRECT: "Use the AWS Service Catalog deploy action in AWS CodeBuild to verify and push new versions of products into the AWS Service Catalog" is incorrect.

The solution should use an AWS Lambda function to make the updates, and this must be called via the pipeline.

References:

https://aws.amazon.com/blogs/devops/aws-service-catalog-sync-code/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 2Skipped

A company runs several business-critical applications on Amazon EC2 instances in an Amazon VPC. The company requires the applications to be available 24/7 and there should be no outages except for pre-arranged updates. The DevOps team requires an automated notification mechanism that lets them know if the state of any of the instance’s changes.

Create a scheduled AWS Lambda function that checks the running state of the Amazon EC2 instances and updates the AWS Personal Health Dashboard.

Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric and select the EC2 action to recover the instance.

Correct answer

Create an Amazon EventBridge rule with an event pattern configured with the ‘EC2 Instance State-change Notification’ event type and send an Amazon SNS notification.

Create an Amazon CloudWatch alarm for the StatusCheckFailed_Instance metric and select the EC2 action to reboot the instance.

Overall explanation

To receive email notifications when your instance changes state, create an Amazon SNS topic and then create an EventBridge rule for the EC2 Instance State-change Notification event. This will trigger a notification by SNS whenever the state of an EC2 instance changes.

CORRECT: "Create an Amazon EventBridge rule with an event pattern configured with the ‘EC2 Instance State-change Notification’ event type and send an Amazon SNS notification" is the correct answer (as explained above.)

INCORRECT: "Create a scheduled AWS Lambda function that checks the running state of the Amazon EC2 instances and updates the AWS Personal Health Dashboard" is incorrect.

The Personal Health Dashboard shows issues that may affect your resources. AWS updates the dashboard; it is not something you can do yourself.

INCORRECT: "Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric and select the EC2 action to recover the instance" is incorrect.

This would recover an instance if there were an issue with the underlying hardware that requires AWS to fix. However, the requirement here is simply to notify the team if the instance changes state.

INCORRECT: "Create an Amazon CloudWatch alarm for the StatusCheckFailed_Instance metric and select the EC2 action to reboot the instance" is incorrect.

As above, the team requires a notification if the state of the instance changes, they do not ask for automated recovery or restarting of instances.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-instance-state-changes.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 3Skipped

A company’s shopping website is hosted in an Auto Scaling group (ASG) of Amazon EC2 instances. There’s a sale coming up and the company anticipate huge traffic on the website. Currently, there’s a dynamic target tracking policy which scales up the instances gradually. However, the EC2 instances are taking a long time to spin up and the load balancer is sending traffic to unhealthy instances.

How can the issue be resolved with minimal operational overhead and cost?

Correct answer

Add a lifecycle hook to the Auto Scaling group, and to scale up quickly, utilize a warm pool.

Change the dynamic scaling policy to use a manual scaling policy and increase the pool size.

Configure the desired capacity to a large number of EC2 instances before the event so the application can handle the additional load.

Put the EC2 instances in standby state to debug the instance spin up time and add lifecycle hooks.

Overall explanation

Add a lifecycle hook in EC2 instance and to scale up quickly, utilize a warm pool.

A lifecycle hook can be added on scale out/ scale in events and get signal back from EC2 instances. This is to make the load balancer aware when the instances are ready to serve traffic.

A warm pool gives the ability to decrease latency for the applications that have exceptionally long boot times, for example, because instances need to write massive amounts of data to disk. With warm pools, Auto Scaling groups don’t need to be over provisioned to manage latency and improve application performance.

CORRECT: "Add a lifecycle hook to the Auto Scaling group, and to scale up quickly, utilize a warm pool" is the correct answer (as explained above.)

INCORRECT: "Change the dynamic scaling policy to use a manual scaling policy and increase the pool size" is incorrect.

This will increase the effort and cost of the solution.

INCORRECT: "Put the EC2 instances in standby state to debug the instance spin up time and add lifecycle hooks" is incorrect.

Standby mode is useful when there’s a specific issue within the instance that needs to be debugged and is not a regular practice.

INCORRECT: "Configure the desired capacity to a large number of EC2 instances before the event so the application can handle the additional load" is incorrect.

This will increase the overall cost and will result in underutilization of instances.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/lifecycle-hooks.html

https://aws.amazon.com/blogs/compute/scaling-your-applications-faster-with-ec2-auto-scaling-warm-pools/

https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-warm-pools.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 4Skipped

A DevOps engineer is deploying a series of updates to a web application that runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The updates are being deployed using a blue/green strategy with immutable instances.

An issue has been occurring where users are being logged of the application during deployments. The DevOps engineer needs to ensure that users remain logged in when scaling events occur and application updates are deployed.

How can these requirements be met with the LOWEST latency?

Enable session affinity on the load balancer and store authenticated session information on the instance’s attached block volumes.

Correct answer

Configure the application to store authenticated session information in an Amazon ElastiCache cluster.

Enable sticky sessions on the target group and store authenticated session information on the instance’s attached block volumes.

Configure the application to store authenticated session information in an Amazon S3 bucket.

Overall explanation

The issue here is that instances are being terminated and replaced and users who were bound to those instances and then being asked to reauthenticate when the load balancer directs them to another instance. This is because the information associated with their authenticated session was stored on the instance that has been terminated.

The best way to ensure that users are not asked to reauthenticate in this situation is to store the data in a session store. Amazon ElastiCache is ideal for this use case as it stores key/value pairs and offers extremely low latency.

The diagram below shows how you can use either DynamoDB or ElastiCache as a shared store for session state data:

CORRECT: "Configure the application to store authenticated session information in an Amazon ElastiCache cluster" is the correct answer (as explained above.)

INCORRECT: "Configure the application to store authenticated session information in an Amazon S3 bucket" is incorrect.

Amazon S3 could be used in this situation but the latency would likely be higher compared to using Amazon ElastiCache.

INCORRECT: "Enable sticky sessions on the target group and store authenticated session information on the instance’s attached block volumes" is incorrect.

Storing the data in the attached block volume is a bad idea as this would be deleted when the instance is terminated.

INCORRECT: "Enable session affinity on the load balancer and store authenticated session information on the instance’s attached block volumes" is incorrect.

Stick sessions (also known as session affinity) is enabled at the target group, not at the load balancer level. Also, the session state data should not be stored on a block volume.

References:

https://aws.amazon.com/getting-started/hands-on/building-fast-session-caching-with-amazon-elasticache-for-redis/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-elasticache/

Domain

AWS Database

Question 5Skipped

A company is concerned about the security of their Amazon EC2 instances. They require an automated solution for identifying security vulnerabilities on the instances and notifying the security team. They also require an audit trail of all login activities on the EC2 instances.

Which solution will meet these requirements?

Use AWS GuardDuty to detect vulnerabilities on the EC2 instances. Configure the AWS X-Ray daemon to gather trace data and add metrics to Amazon CloudWatch. View the audit trail of login activities in the CloudWatch console.

Use AWS Systems Manager to automatically detect vulnerabilities on the EC2 instances. Install the Kinesis Client Library (KCL) to capture system logs and save them to an Amazon S3 bucket.

Use AWS Systems Manager to automatically detect vulnerabilities on the EC2 instances. Install the Systems Manager Agent to capture an audit trail using system logs and view login activity in the AWS CloudTrail console.

Correct answer

Use Amazon Inspector to automatically detect vulnerabilities on the EC2 instances. Install the Amazon CloudWatch Agent to capture system logs and upload them to Amazon CloudWatch Logs.

Overall explanation

Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. This is the best service to use for automatic detection of security vulnerabilities on the EC2 instances.

The unified CloudWatch agent enables you to collect internal system-level metrics from Amazon EC2 instances across operating systems. The metrics can include in-guest metrics, in addition to the metrics for EC2 instances.

The logs collected by the unified CloudWatch agent are processed and stored in Amazon CloudWatch Logs. The system logs that are collected will include information on all login activities on the EC2 instances.

CORRECT: "Use Amazon Inspector to automatically detect vulnerabilities on the EC2 instances. Install the Amazon CloudWatch Agent to capture system logs and upload them to Amazon CloudWatch Logs" is the correct answer (as explained above.)

INCORRECT: "Use AWS Systems Manager to automatically detect vulnerabilities on the EC2 instances. Install the Kinesis Client Library (KCL) to capture system logs and save them to an Amazon S3 bucket" is incorrect.

Systems Manager Patch Manager can install patches to resolve vulnerabilities but does not provide automated detection of vulnerabilities. Instead, it scans to see if specific patches are installed or not. The KCL is used with Kinesis Data Streams for processing streaming data and does not collect system logs from EC2 instances.

INCORRECT: "Use AWS Systems Manager to automatically detect vulnerabilities on the EC2 instances. Install the Systems Manager Agent to capture an audit trail using system logs and view login activity in the AWS CloudTrail console" is incorrect.

As above, Systems Manager is not suitable for this task and does not capture auditing information by processing system logs.

INCORRECT: "Use AWS GuardDuty to detect vulnerabilities on the EC2 instances. Configure the AWS X-Ray daemon to gather trace data and add metrics to Amazon CloudWatch. View the audit trail of login activities in the CloudWatch console" is incorrect.

GuardDuty is a threat detection service that monitors for malicious activity. It does not detect vulnerabilities on EC2 instances. The X-Ray service is used for gathering trace data for troubleshooting and understanding application performance.

References:

https://aws.amazon.com/inspector/features/

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-inspector/

Domain

AWS Security, Identity, & Compliance

Question 6Skipped

A DevOps engineer must implement a serverless service that uses Amazon API Gateway, AWS Lambda, and DynamoDB. The serverless service must be deployed in multiple Regions and ensure fast response times for users within each geography.

Which solution will meet the requirements?

Correct answer

Create API Gateway APIs in each Region and configure Amazon Route 53 with latency-based routing rules and health checks. Configure the APIs with a Lambda proxy integration to a function in the same Region. Retrieve and update the data in a DynamoDB global table.

Create API Gateway APIs in each Region and configure Amazon Route 53 with health checks for each API. Configure the APIs with a Lambda proxy integration to a function in the same Region. Configure the Lambda functions to retrieve and update the data in a DynamoDB table in the same Region as the Lambda function.

Create API Gateway APIs in two Regions and configure Amazon Route 53 with a failover routing policy and health checks. Configure the APIs with a Lambda proxy integration to a function in the same Region. Retrieve and update the data in a DynamoDB global table.

Create API Gateway APIs in each Region and configure Amazon Route 53 with latency-based routing rules and health checks. Configure the APIs with a Lambda proxy integration to a central function in one AWS account. Configure the Lambda function to retrieve and update the data in a DynamoDB table in the same Region as the Lambda function.

Overall explanation

The best available solution is to deploy APIs into multiple Regions and configure each API with a local Lambda function as an integration. Users can be directed to the closest API by configuring Amazon Route 53 with latency-based routing rules. The data should be stored in a Global Table, so it is synchronized across Regions. This solution ensures a single data set using the multi-master Global Tables technology and low latency for users.

CORRECT: "Create API Gateway APIs in each Region and configure Amazon Route 53 with latency-based routing rules and health checks. Configure the APIs with a Lambda proxy integration to a function in the same Region. Retrieve and update the data in a DynamoDB global table" is the correct answer (as explained above.)

INCORRECT: "Create API Gateway APIs in each Region and configure Amazon Route 53 with health checks for each API. Configure the APIs with a Lambda proxy integration to a function in the same Region. Configure the Lambda functions to retrieve and update the data in a DynamoDB table in the same Region as the Lambda function" is incorrect.

The issue with this question is there are multiple records in Route 53 for each API but no way to direct users to the best one. A latency-based routing policy would be the best solution for this requirement.

INCORRECT: "Create API Gateway APIs in two Regions and configure Amazon Route 53 with a failover routing policy and health checks. Configure the APIs with a Lambda proxy integration to a function in the same Region. Retrieve and update the data in a DynamoDB global table" is incorrect.

Failover routing works when you have an active and passive deployment. In this case we want an active-active deployment with the serverless service available to users in multiple Regions.

INCORRECT: "Create API Gateway APIs in each Region and configure Amazon Route 53 with latency-based routing rules and health checks. Configure the APIs with a Lambda proxy integration to a central function in one AWS account. Configure the Lambda function to retrieve and update the data in a DynamoDB table in the same Region as the Lambda function" is incorrect.

You cannot configure the APIs with a central Lambda function. You must choose a Lambda function in the same Region as the API.

References:

https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-with-lambda-integration.html

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html

https://aws.amazon.com/dynamodb/global-tables/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-api-gateway/

https://digitalcloud.training/amazon-route-53/

Domain

AWS Networking & Content Delivery

Question 7Skipped

A media company is developing a new application which will be supported by mobile devices, tablets, and desktops. Each platform is customized for a different user experience and various viewing modes based on the resources being requested by users. This is enabled by path-based routing behind the scenes, using instances deployed on Amazon EC2. An auto scaling group has been configured to ensure EC2 instances are highly scalable.

Which of the following combinations will ensure high performance and minimal cost? (Select TWO.)

Correct selection

Utilize an Application Load Balancer behind auto scaling group.

Utilize Amazon Route 53 with traffic flow policies.

Utilize a Network Load Balancer behind auto scaling group.

Utilize a static website hosted behind an Amazon S3 bucket.

Correct selection

Amazon CloudFront with Lambda@Edge.

Overall explanation

Amazon CloudFront with Lambda@Edge - Lambda@Edge is a feature of Amazon CloudFront that lets you run code closer to users of your application, which improves performance and reduces latency. Lambda@Edge runs your code in response to events generated by the Amazon CloudFront content delivery network (CDN). By combining Lambda@Edge with other AWS services, developers can build dynamic, powerful web applications at the edge that automatically scale up and down—with zero origin infrastructure and administrative effort required for automatic scaling, backups, or data center redundancy.

By using Lambda@Edge to dynamically route requests to different origins based on different viewer characteristics, you can balance the load on your origins, while improving the performance for your users. For example, you can route requests to origins within a home region, based on a viewer's location.

With Lambda@Edge, you don't have to provision or manage infrastructure in multiple locations around the world. You pay only for the compute time you consume - there is no charge when your code is not running.

Application Load Balancer - An Application Load Balancer serves as the single point of contact for clients. The load balancer distributes incoming application traffic across multiple targets, such as EC2 instances, in multiple Availability Zones. This increases the availability of your application. You add one or more listeners to your load balancer. ALB offers support for Path conditions. You can configure rules for your listener that forward requests based on the URL in the request. This enables you to structure your application as smaller services, and route requests to the correct service based on the content of the URL.

CORRECT: "Amazon CloudFront with Lambda@Edge and utilize an application load balancer behind auto scaling group" is the correct answer (as explained above.)

INCORRECT: Utilize a Network Load Balancer behind auto scaling group" is incorrect.

The Application Load Balancer works at the Application Layer (Layer 7 of the OSI model, Request level). The Network Load Balancer works at the Transport layer (Layer 4 of the OSI model). The NLB just forwards requests whereas ALB examines the contents of the HTTP request header to determine where to route the request. So, the ALB can perform content-based routing while NLB cannot.

INCORRECT: "Utilize a static website hosted behind a S3 bucket" is incorrect.

It is mentioned in the question that the application is hosted on an Amazon EC2 instances and that a solution is needed for performance and cost-effectiveness. Hence, using Amazon S3 as a static website is not suitable answer.

INCORRECT: "Utilize Amazon Route 53 with traffic flow policies" is incorrect.

Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service. It is designed to give developers and businesses an extremely reliable and cost-effective way to route end users to Internet applications by translating names like www.example.com into the numeric IP addresses like 192.0.2.1 that computers use to connect. Amazon Route 53 is fully compliant with IPv6 as well.

Traffic Flow policy allows an Amazon Web Services customer to define how end-user traffic is routed to application endpoints through a visual interface. Route 53 can route between domains and subdomains but is not useful for path-based traffic flows.

References:

https://aws.amazon.com/lambda/edge/

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html

https://aws.amazon.com/premiumsupport/knowledge-center/create-subdomain-route-53/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 8Skipped

A startup company is launching a web application on AWS that uses Amazon EC2 instances behind an Application Load Balancer. The EC2 instances will store data in an Amazon RDS database and an Amazon DynamoDB table. The DevOps team require separate environments for development, testing, and production.

What is the MOST secure method of obtaining password credentials?

Configure access keys to access AWS services. Retrieve the database credentials from an AWS Secrets Manager SecretString parameter.

Launch the EC2 instances with an IAM instance profile with permissions to access AWS services. Store the database passwords in an encrypted config file in system metadata.

Correct answer

Launch the EC2 instances with an IAM instance profile with permissions to access AWS services. Retrieve the database credentials from AWS Secrets Manager.

Configure access keys to access AWS services. Retrieve the database credentials from a Systems Manager SecureString parameter.

Overall explanation

The most secure solution is to use a combination of an AWS IAM Instance Profile with a policy attached providing permissions to Amazon DynamoDB and AWS Secrets Manager for retrieving SecretString parameters for the Amazon RDS DB.

Instance profiles are far more secure compared to access keys are they leverage the AWS STS service to obtain temporary security credentials. No security credentials are stored on the EC2 instances when using this method.

For Amazon RDS you may need to use database connection credentials for authentication depending on your configuration. If this is the case you can securely store these credentials as SecretString (encrypted) parameters in AWS Secrets Manager. Your application can then issue API calls to Secrets Manager to securely retrieve the encrypted parameters when authentication is needed.

CORRECT: "Launch the EC2 instances with an IAM instance profile with permissions to access AWS services. Retrieve the database credentials from AWS Secrets Manager" is the correct answer (as explained above.)

INCORRECT: "Launch the EC2 instances with an IAM instance profile with permissions to access AWS services. Store the database passwords in an encrypted config file in system metadata" is incorrect.

Database passwords should not be stored in system metadata as this would be very insecure.

INCORRECT: "Configure access keys to access AWS services. Retrieve the database credentials from a Systems Manager SecureString parameter" is incorrect.

Access keys are less secure compared to using instance profiles as with access keys the actual access key ID and secret access key are stored in plaintext on the EC2 instance file system.

INCORRECT: "Configure access keys to access AWS services. Retrieve the database credentials from an AWS Secrets Manager SecretString parameter" is incorrect.

As above, access keys should not be used.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-instanceprofile.html

https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 9Skipped

A DevOps team manages an application that consists of four separate AWS Lambda functions. A DevOps Engineer on the team has built a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild that builds, tests, packages, and deploys each Lambda function in sequence. The pipeline uses an Amazon EventBridge rule that executes the pipeline after a change is made to the application source code. During testing, the engineer noticed that the pipeline takes a long time to complete.

What should the DevOps Engineer do to improve the speed of the pipeline?

Modify the CodeBuild projects within the pipeline to use a compute type with more available vCPUs.

Correct answer

Configure parallel executions of the Lambda functions by specifying the same runOrder in the CodePipeline configuration for the stage.

Configure the CodeBuild projects to run within a VPC and use dedicated instances to increase the build throughput.

Modify CodeBuild execute the builds in batches using a build graph deployment and specify the dependency chain.

Overall explanation

The best way to speed up the pipeline will be to run the builds in parallel. This can be achieved through the pipeline configuration by specifying the runOrder to be the same for the build of each function within the action structure.

To specify parallel actions, you use the same integer for each action you want to run in parallel.

CORRECT: "Configure parallel executions of the Lambda functions by specifying the same runOrder in the CodePipeline configuration for the stage" is the correct answer (as explained above.)

INCORRECT: "Configure the CodeBuild projects to run within a VPC and use dedicated instances to increase the build throughput" is incorrect.

Connecting to a VPC does not help and using dedicated instances is not the best way to improve the speed of the pipeline. Without specifying other changes the builds will still run sequentially.

INCORRECT: "Modify the CodeBuild projects within the pipeline to use a compute type with more available vCPUs" is incorrect.

This may offer some improvement in speed but not as much as running the builds in parallel.

INCORRECT: "Modify CodeBuild execute the builds in batches using a build graph deployment and specify the dependency chain" is incorrect.

CodeBuild can be configured to run builds in batches but a build list or build matrix should be used for running the builds in parallel. The build graph deployment runs the builds sequentially with dependencies mapped out.

References:

https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 10Skipped

A DevOps team is building a pipeline in AWS CodePipeline that will build, stage, test, and then deploy an application on Amazon EC2. The team will add a manual approval stage between the test stage and the deployment stage. The development team uses a custom chat tool that offers a webhook interface for sending notifications.

The DevOps team require status updates for pipeline activity and approval requests to be posted to the chat tool. How can this be achieved?

Create an AWS Lambda function that is invoked by AWS CloudTrail API events. When a CodePipeline Pipeline Execution State Change event is detected, send the event details directly to the chat webhook URL.

Create an AWS Config rule that checks for CodePipeline Pipeline Execution State Change events. Publish the events to an Amazon SNS topic. Create an AWS Lambda function that sends event details to the chat webhook URL and subscribe the function to the SNS topic.

Create an Amazon CloudWatch Logs subscription that filters on CodePipeline Pipeline Execution State Change events. Publish subscription events to an Amazon SNS topic and subscribe the chat webhook URL to the SNS topic and complete the subscription validation.

Correct answer

Create an Amazon EventBridge rule that filters on CodePipeline Pipeline Execution State Change events. Publish the events to an Amazon SNS topic. Create an AWS Lambda function that sends event details to the chat webhook URL and subscribe the function to the SNS topic.

Overall explanation

You can monitor CodePipeline events in EventBridge, which delivers a stream of real-time data from your own applications, software-as-a-service (SaaS) applications, and AWS services. EventBridge routes that data to targets such as AWS Lambda and Amazon Simple Notification Service.

Events are composed of rules that include an event pattern and event target. Each type of execution state change event in CodePipeline emits notifications with specific message content. In this case the team should filter for the “CodePipeline Pipeline Execution State Change” events and route to an SNS Topic as a target. The Lambda function can then be subscribed to the topic.

CORRECT: "Create an Amazon EventBridge rule that filters on CodePipeline Pipeline Execution State Change events. Publish the events to an Amazon SNS topic. Create an AWS Lambda function that sends event details to the chat webhook URL and subscribe the function to the SNS topic" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon CloudWatch Logs subscription that filters on CodePipeline Pipeline Execution State Change events. Publish subscription events to an Amazon SNS topic and subscribe the chat webhook URL to the SNS topic and complete the subscription validation" is incorrect.

CloudWatch Logs subscription filters can be used to publish to Kinesis Data Streams, Kinesis Data Firehose, or AWS Lambda. You cannot publish directly to SNS. Also, the log will not contain execution state change events for CodePipeline.

INCORRECT: "Create an AWS Lambda function that is invoked by AWS CloudTrail API events. When a CodePipeline Pipeline Execution State Change event is detected, send the event details directly to the chat webhook URL" is incorrect.

You cannot use API events to look for this specific event and then send directly from CloudTrail to the chat webhook URL.

INCORRECT: "Create an AWS Config rule that checks for CodePipeline Pipeline Execution State Change events. Publish the events to an Amazon SNS topic. Create an AWS Lambda function that sends event details to the chat webhook URL and subscribe the function to the SNS topic" is incorrect.

AWS Config is used for configuration compliance and cannot check for events that relate to pipeline execution state changes in AWS CodePipeline.

References:

https://docs.aws.amazon.com/codepipeline/latest/userguide/detect-state-changes-cloudwatch-events.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 11Skipped

An application running on an Amazon EC2 instance stores sensitive data on an attached Amazon EBS volume. The volume is not encrypted. A DevOps engineer must enable encryption at rest for the data.

Which actions should the engineer take? (Select TWO.)

Correct selection

Create and mount a new, encrypted EBS volume. Move the data to the new volume. Delete the old EBS volume.

Upload a self-signed SSL/TLS certificate to the EC2 instance. Use a secure session to encrypt all data transferred to the EBS volume.

Unmount the EBS volume, take a snapshot and encrypt the snapshot. Re-mount the EBS volume.

Correct selection

Copy an unencrypted snapshot of the volume and encrypt the new snapshot. Volumes restored from this encrypted snapshot will also be encrypted.

Use AWS Data Lifecycle Manager to automatically enable encryption for the EBS volume and encrypt the existing data.

Overall explanation

You cannot enable encryption for an existing EBS volume. You must enable encryption of the volume at creation time. There are a couple of ways to enable encryption of data stored on an unencrypted volume:

1) Create a snapshot of the volume. The snapshot will also be unencrypted, but you can then copy it and enable encryption. Then, you can create an encrypted volume from the snapshot and attach it to the instance.

2) Create and mount a new, encrypted EBS volume. The engineer would then need to move data onto the volume.

In both cases the engineer will need to update the application to use the new volume.

CORRECT: "Copy an unencrypted snapshot of the volume and encrypt the new snapshot. Volumes restored from this encrypted snapshot will also be encrypted" is a correct answer (as explained above.)

CORRECT: "Create and mount a new, encrypted EBS volume. Move the data to the new volume. Delete the old EBS volume" is also a correct answer (as explained above.)

INCORRECT: "Unmount the EBS volume, take a snapshot and encrypt the snapshot. Re-mount the EBS volume" is incorrect.

This has not resulted in any change to the EBS volume, it is still unencrypted.

INCORRECT: "Use AWS Data Lifecycle Manager to automatically enable encryption for the EBS volume and encrypt the existing data" is incorrect.

You cannot enable encryption for existing volumes through any AWS tools.

INCORRECT: "Upload a self-signed SSL/TLS certificate to the EC2 instance. Use a secure session to encrypt all data transferred to the EBS volume" is incorrect.

SSL/TLS certificates are used for enabling encryption in-transit, not encryption at-rest.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html

Save time with our exam-specific cheat sheets:

https://digitalcloud.training/amazon-ebs/

Domain

AWS Storage

Question 12Skipped

A company has deployed a web service that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company has deployed the application in us-east-1. The web service uses Amazon Route 53 records for DNS requests for example.com. The records are configured with health checks that assess the availability of the web service.

A second environment has been deployed into eu-west-1. The company requires traffic to be routed to the environment that provides the lowest latency for user requests. In the event of a regional outage, traffic should be directed to the alternate Region.

Which configuration will achieve these requirements?

Create a subdomain named us.example.com with multivalue answer routing. Configure the US ALB first and the EU ALB second. Create another subdomain named eu.example.com with multivalue answer routing. Configure the EU ALB first and the US ALB second. Create failover routing records for example.com that are aliased to us.example.com and eu.example.com.

Create a subdomain named us.example.com with latency-based routing. Configure the US ALB as the first target and the EU ALB as the second target. Create another subdomain named eu.example.com with latency-based routing. Configure the EU ALB as the first target and the US ALB as the second target. Create failover routing records for example.com aliased to us.example.com as the first target and eu.example.com as the second target.

Create a subdomain named us.example.com with weighted routing. Configure the US ALB with weight 2 and the EU ALB with weight 1. Create another subdomain named eu.example.com with weighted routing. Configure the EU ALB with weight 2 and the US ALB with weight 1. Create geolocation routing records for example.com with North America aliased to us.example.com and Europe aliased to eu.example.com.

Correct answer

Create a subdomain named us.example.com with failover routing. Configure the US ALB as primary and the EU ALB as secondary. Create another subdomain named eu.example.com with failover routing. Configure the EU ALB as primary and the US ALB as secondary. Create latency-based routing records for example.com that are aliased to us.example.com and eu.example.com.

Overall explanation

There are two key requirements that inform the design. Firstly, the solution must route based on latency. Secondly, failover across Regions must be automatic. This is a more complex DNS routing configuration. To meet both requirements the company will need to use a combination of latency-based routing records and failover routing records.

The solution is to create subdomains for each Region that can be used for the failover records and pointing the secondary to the alternate Region. Then, on top of those records the solution includes a latency-based routing record for example.com.

With this solution example.com will resolve to the subdomain that represents the lowest latency from the user request location. If the environment in that Region is not available (has failed health checks) then the request will be failed over to the alternate Region.

CORRECT: "Create a subdomain named us.example.com with failover routing. Configure the US ALB as primary and the EU ALB as secondary. Create another subdomain named eu.example.com with failover routing. Configure the EU ALB as primary and the US ALB as secondary. Create latency-based routing records for example.com that are aliased to us.example.com and eu.example.com" is the correct answer (as explained above.)

INCORRECT: "Create a subdomain named us.example.com with weighted routing. Configure the US ALB with weight 2 and the EU ALB with weight 1. Create another subdomain named eu.example.com with weighted routing. Configure the EU ALB with weight 2 and the US ALB with weight 1. Create geolocation routing records for example.com with North America aliased to us.example.com and Europe aliased to eu.example.com" is incorrect.

The solution should use failover routing and latency routing, not weighted routing and geolocation routing.

INCORRECT: "Create a subdomain named us.example.com with latency-based routing. Configure the US ALB as the first target and the EU ALB as the second target. Create another subdomain named eu.example.com with latency-based routing. Configure the EU ALB as the first target and the US ALB as the second target. Create failover routing records for example.com aliased to us.example.com as the first target and eu.example.com as the second target" is incorrect.

This solution gets the failover and latency records the wrong way around. Failover routing should be used for the subdomain and latency routing for the apex domain (example.com).

INCORRECT: "Create a subdomain named us.example.com with multivalue answer routing. Configure the US ALB first and the EU ALB second. Create another subdomain named eu.example.com with multivalue answer routing. Configure the EU ALB first and the US ALB second. Create failover routing records for example.com that are aliased to us.example.com and eu.example.com" is incorrect.

Multivalue routing is a form of DNS load balancing and will simply route records across all registered and available targets. This does not meet the requirements.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-configuring.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-route-53/

Domain

AWS Networking & Content Delivery

Question 13Skipped

A DevOps engineer created an S3 event notification to trigger an AWS Lambda function when objects are uploaded to the bucket. The solution was initially working but has since stopped working. The engineer noticed that the function is no longer being invoked.

What are two possible causes for this error? (Select TWO.)

Default encryption has been enabled on the S3 bucket.

The S3 bucket does not allow public access to objects.

Correct selection

The resource-based policy has been removed from the function.

Correct selection

The event notification has been deleted from the S3 bucket.

The IAM role the function is assuming does not have permissions.

Overall explanation

If the function is not being invoked then either the configuration that should initiate an invocation has been removed or the permissions the function requires have been removed. The Lambda function must have permissions defined in a resource-based policy that specify that the bucket can invoke the function.

CORRECT: "The event notification has been deleted from the S3 bucket" is a correct answer (as explained above.)

CORRECT: "The resource-based policy has been removed from the function" is also a correct answer (as explained above.)

INCORRECT: "The S3 bucket does not allow public access to objects" is incorrect.

There is no need to allow public access to objects as this is not a requirement for an event notification to succeed.

INCORRECT: "The IAM role the function is assuming does not have permissions" is incorrect.

The function does not need to assume a role. With an event notification, S3 directly invokes Lambda, and the function uses permissions assigned through a resource-based policy.

INCORRECT: "Default encryption has been enabled on the S3 bucket" is incorrect.

Encryption status does not affect this solution at all.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/lambda-invoke-error-s3-bucket-permission/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-lambda/

Domain

AWS Compute

Question 14Skipped

The DevOps team at an e-commerce company introduced multiple stages of security to the code release process. As an additional measure, they want to add additional SAST & DAST tools into an automated pipeline. These tools should be invoked for every code push in an AWS CodeCommit repository. The code must be sent via an external API.

Which actions should a DevOps engineer take to achieve these requirements MOST efficiently?

Create an Amazon CloudWatch Event rule on a schedule of 5 minutes that triggers an AWS Lambda function that checks for new commits in the CodeCommit repository. If new commits are detected, the function will download and zip the code and then send it to the 3rd party API.

Correct answer

Create a CloudWatch Event rule on the CodeCommit repository that reacts to code pushes. Choose an AWS Lambda function as a target that will request the code from CodeCommit, zip it, and send it to the 3rd party API.

Create a CodeCommit hook on an EC2 instance that streams changes from CodeCommit into the local filesystem. A cron job on the EC2 instance will zip the code and send it to the 3rd party API upon changes being detected.

Create an Amazon CloudWatch Event rule on the CodeCommit repository that reacts to pushes. Choose an S3 bucket as a target so the code will be automatically zipped into S3. Create an S3 event notification rule to trigger an AWS Lambda function that will retrieve the zipped code from S3 and send it to the 3rd party API.

Overall explanation

Amazon CloudWatch Events delivers a near real-time stream of system events that describe changes in Amazon Web Services (AWS) resources. Using simple rules that can be set up, you can match events and route them to one or more target functions or streams. Custom application-level events can be generated and published to CloudWatch Events. Scheduled events can be set up that are generated on a periodic basis. A rule matches incoming events and routes them to targets for processing.

CORRECT: "Create a CloudWatch Event rule on the CodeCommit repository that reacts to code pushes. Choose an AWS Lambda function as a target that will request the code from CodeCommit, zip it, and send it to the 3rd party API" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon CloudWatch Event rule on the CodeCommit repository that reacts to pushes. Choose an S3 bucket as a target so the code will be automatically zipped into S3. Create an S3 event notification rule to trigger an AWS Lambda function that will retrieve the zipped code from S3 and send it to the 3rd party API" is incorrect.

CloudWatch Event Rules cannot have S3 buckets as a target. It is more efficient to directly invoke the Lambda function from the CloudWatch Event rule than use S3 as a temporary store and then trigger a function execution.

INCORRECT: "Create a CodeCommit hook on an EC2 instance that streams changes from CodeCommit into the local filesystem. A cron job on the EC2 instance will zip the code and send it to the 3rd party API upon changes being detected" is incorrect.

You cannot create a CodeCommit hook on an EC2 instance, so this is not possible

INCORRECT: "Create an Amazon CloudWatch Event rule on a schedule of 5 minutes that triggers an AWS Lambda function that checks for new commits in the CodeCommit repository. If new commits are detected, the function will download and zip the code and then send it to the 3rd party API" is incorrect.

CloudWatch Event rules on a schedule would introduce lag and would be inefficient. So, this option is ruled out.

References:

https://aws.amazon.com/blogs/devops/building-end-to-end-aws-devsecops-ci-cd-pipeline-with-open-source-sca-sast-and-dast-tools/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 15Skipped

A company plans to migrate a Python application to AWS. A DevOps engineer must deploy the application in a configuration that supports blue/green deployments and rollback.

Which solution will meet these requirements with the LEAST operational complexity?

Use CodeCommit to store the application code. Use AWS CodeDeploy to deploy the application to Amazon ECS tasks and configure Amazon Route 53 failover routing.

Use Amazon LightSail to host the application. Store application code as zip files in an Amazon S3 bucket and use LightSail to deploy updates and manage the deployment.

Correct answer

Use AWS Elastic Beanstalk to host the application. Deploy new versions to separate environments and use Elastic Beanstalk to swap CNAMEs to redirect traffic.

Use AWS Elastic Beanstalk to host the application. Configure an Application Load Balancer and use a traffic splitting deployment to implement a blue/green update.

Overall explanation

With an Elastic Beanstalk blue/green update you can deploy the new application versions to a separate environment, and then swap the CNAMEs of the two environments to redirect traffic to the new version instantly. If any issues occur, you can simply swap the CNAMEs back again and traffic will be redirected back to your original set of instances. This is the solution that meets the requirements with the least operational complexity.

CORRECT: "Use AWS Elastic Beanstalk to host the application. Deploy new versions to separate environments and use Elastic Beanstalk to swap CNAMEs to redirect traffic" is the correct answer (as explained above.)

INCORRECT: "Use AWS Elastic Beanstalk to host the application. Configure an Application Load Balancer and use a traffic splitting deployment to implement a blue/green update" is incorrect,

Traffic splitting is a feature that implements deployments using a canary strategy in which a portion of traffic is directed to a new set of instances running the latest code and then after a period, if successful, the remaining traffic is redirected.

INCORRECT: "Use Amazon LightSail to host the application. Store application code as zip files in an Amazon S3 bucket and use LightSail to deploy updates and manage the deployment" is incorrect.

LightSail is a simple solution for hosted servers in the cloud and offers limited features. It cannot help you to achieve the requirements of this question.

INCORRECT: "Use CodeCommit to store the application code. Use AWS CodeDeploy to deploy the application to Amazon ECS tasks and configure Amazon Route 53 failover routing" is incorrect.

Route 53 failover routing is not ideal for blue/green deployment scenarios as you must cause the failover by taking the source instances out of action (or causing them to fail health checks). It is also not straightforward to roll back.

References:

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.CNAMESwap.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-beanstalk/

Domain

AWS Compute

Question 16Skipped

A company is using AWS CodePipeline to automate the release lifecycle of an application. AWS CodeDeploy used to deploy an application to Amazon ECS using the blue/green deployment model. The company wants to run test scripts to validate the green version of the application before shifting traffic. The scripts will complete in less than 5 minutes. If errors are discovered by the scripts, the application must be rolled back.

Which strategy will meet these requirements?

Add a stage to the CodePipeline pipeline between the source and deploy stages. Use AWS CodeBuild to create an execution environment and build commands in the buildspec file to invoke test scripts. If errors are found, use the aws deploy stop-deployment command to stop the deployment.

Add a stage to the CodePipeline pipeline between the source and deploy stages. Use this stage to invoke an AWS Lambda function that will run the test scripts. If errors are found, use the aws deploy stop-deployment command to stop the deployment.

Correct answer

Add a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTestTraffic lifecycle event to invoke an AWS Lambda function to run the test scripts. If errors are found, exit the Lambda function with an error to trigger rollback.

Add a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTraffic lifecycle event to invoke the test scripts. If errors are found, use the aws deploy stop-deployment CLI command to stop the deployment.

Overall explanation

You can use the 'hooks' section of the CodeDeploy AppSpec file to specify a Lambda function that CodeDeploy can call to validate an Amazon ECS deployment.

You can use the same function or a different one for the BeforeInstall, AfterInstall, AfterAllowTestTraffic, BeforeAllowTraffic, and AfterAllowTraffic deployment lifecyle events. Following completion of the validation tests, the Lambda AfterAllowTraffic function calls back CodeDeploy and delivers a result of Succeeded or Failed.

CORRECT: "Add a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTestTraffic lifecycle event to invoke an AWS Lambda function to run the test scripts. If errors are found, exit the Lambda function with an error to trigger rollback" is the correct answer (as explained above.)

INCORRECT: "Add a hooks section to the CodeDeploy AppSpec file. Use the AfterAllowTraffic lifecycle event to invoke the test scripts. If errors are found, use the aws deploy stop-deployment CLI command to stop the deployment" is incorrect.

The CLI command is not required, either the Lambda function can use AfterAllowTraffic to call back and deliver a success/failure message or if it does not report back within one hour the deployment is assumed to have failed.

INCORRECT: "Add a stage to the CodePipeline pipeline between the source and deploy stages. Use AWS CodeBuild to create an execution environment and build commands in the buildspec file to invoke test scripts. If errors are found, use the aws deploy stop-deployment command to stop the deployment" is incorrect.

CodeBuild is not required for running the test scripts which can be added using hooks instead.

INCORRECT: "Add a stage to the CodePipeline pipeline between the source and deploy stages. Use this stage to invoke an AWS Lambda function that will run the test scripts. If errors are found, use the aws deploy stop-deployment command to stop the deployment" is incorrect.

There is no need to use an extra stage to run an AWS Lambda function, this can be achieved using hooks in the AppSpec file.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html#reference-appspec-file-structure-hooks-section-structure-ecs-sample-function

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 17Skipped

Several applications will be deployed using AWS CloudFormation. The applications must be deployed into multiple accounts the company manages. Multiple administrator accounts must be granted permissions to create and manage the CloudFormation stacks and operational overhead should be minimized.

Which actions meet these requirements? (Select TWO.)

Correct selection

Create an AWS Organization with all features enabled and add all the accounts to the organization.

Create CloudFormation stacks in each account using cross-account IAM roles with permissions in each account.

Correct selection

Enable trusted access with AWS Organizations and create CloudFormation stack sets using the management account.

Create an AWS Organization with consolidated billing enabled and all the accounts to the organization.

Enable trusted access with AWS Organizations and create CloudFormation stack sets using self-managed permissions.

Overall explanation

A stack set lets you create stacks in AWS accounts across regions by using a single CloudFormation template. A stack set's CloudFormation template defines all the resources in each stack. As you create the stack set, specify the template to use, in addition to any parameters and capabilities that template requires.

You can create a stack set using the AWS Management Console or using AWS CloudFormation commands in the AWS CLI. You can create a stack set with either self-managed or service-managed permissions.

With self-managed permissions, you can deploy stack instances to specific AWS accounts in specific Regions. To do this, you must first create the necessary IAM roles to establish a trusted relationship between the account you're administering the stack set from and the account you're deploying stack instances to.

With service-managed permissions, you can deploy stack instances to accounts managed by AWS Organizations in specific Regions. With this model, you don't need to create the necessary IAM roles; StackSets creates the IAM roles on your behalf.

In this case it is better to use AWS Organizations and service-managed permissions as this will reduce operational overhead and meet the requirements. Administrators can be granted permissions to CloudFormation to create and update stacks and the stacks will be deployed using service accounts.

CORRECT: "Create an AWS Organization with all features enabled and add all the accounts to the organization" is a correct answer (as explained above.)

CORRECT: "Enable trusted access with AWS Organizations and create CloudFormation stack sets using the management account" is also a correct answer (as explained above.)

INCORRECT: "Create an AWS Organization with consolidated billing enabled and all the accounts to the organization" is incorrect.

All features must be enabled to that trusted access can be used to integrate CloudFormation.

INCORRECT: "Create CloudFormation stacks in each account using cross-account IAM roles with permissions in each account" is incorrect.

This requires more operational effort. Better to use AWS Organizations with trusted access and service-managed permissions rather than self-managed permissions.

INCORRECT: "Enable trusted access with AWS Organizations and create CloudFormation stack sets using self-managed permissions" is incorrect.

When using AWS Organizations and trusted access, service-managed permissions are used rather than self-managed permissions. This is the main advantage of enabling trusted access.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-enable-trusted-access.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-cloudformation/

Domain

AWS Management & Governance

Question 18Skipped

An automotive organization is planning to migrate their website into AWS across multiple accounts. The current infrastructure uses an on-premises Microsoft IIS web server and Microsoft SQL server for the data persistence layer.

They want to be able to scale their infrastructure based on demand. Along with the current website, they also want to collect user interest data from ad clicks that occur on the website. Amazon RedShift has been chosen for the consumption and aggregation of data.

Which of the below architectures best suits their needs?

Build the website to run in stateless EC2 instances which auto scale with traffic and migrate the databases into Amazon RDS. Push ad/referrer data using Amazon Kinesis Data Streams to Amazon S3 where it can be consumed by the internal billing system to determine referral fees. Additionally create another Kinesis delivery stream to push the data to the Amazon RedShift warehouse for analysis.

Build the website to run in stateless EC2 instances which auto scale with traffic and migrate the databases into Amazon RDS. Push ad/referrer data using Amazon Athena to Amazon S3 where it can be consumed by the internal billing system to determine referral fees. Additionally create another Kinesis delivery stream to push the data to the Amazon RedShift warehouse for analysis.

Correct answer

Build the website to run in stateless EC2 instances which auto scale with traffic and migrate the databases into Amazon RDS. Push ad/referrer data using Amazon Kinesis Data Firehose to S3 where it can be consumed by the internal billing system to determine referral fees. Additionally create another Kinesis delivery stream to push the data to Amazon Redshift warehouse for analysis.

Build the website to run in stateless EC2 instances which auto scale with traffic and migrate the databases into Amazon RDS. Push ad/referrer data using Amazon Kinesis Data Analytics to Amazon S3 where it can be consumed by the internal billing system to determine referral fees. Additionally create another Kinesis delivery stream to push the data to the Amazon RedShift warehouse for analysis.

Overall explanation

Amazon Kinesis Data Firehose is used to reliably load streaming data into data lakes, data stores, and analytics tools like Amazon Redshift. Process the incoming data from Firehose with Kinesis Data Analytics to provide real-time dashboarding of website activity.

CORRECT: "Build the website to run in stateless EC2 instances which auto scale with traffic and migrate the databases into Amazon RDS. Push ad/referrer data using Amazon Kinesis Data Firehose to S3 where it can be consumed by the internal billing system to determine referral fees. Additionally create another Kinesis delivery stream to push the data to Amazon Redshift warehouse for analysis" is the correct answer (as explained above.)

INCORRECT: "Build the website to run in stateless EC2 instances which auto scale with traffic and migrate the databases into Amazon RDS. Push ad/referrer data using Amazon Kinesis Data Streams to Amazon S3 where it can be consumed by the internal billing system to determine referral fees. Additionally create another Kinesis delivery stream to push the data to the Amazon RedShift warehouse for analysis" is incorrect.

To load data into S3, Kinesis Firehose is a more suitable tool.

INCORRECT: "Build the website to run in stateless EC2 instances which auto scale with traffic and migrate the databases into Amazon RDS. Push ad/referrer data using Amazon Kinesis Data Analytics to Amazon S3 where it can be consumed by the internal billing system to determine referral fees. Additionally create another Kinesis delivery stream to push the data to the Amazon RedShift warehouse for analysis" is incorrect.

As per the option above, Kinesis Data Firehose is a better service for this use case.

INCORRECT: "Build the website to run in stateless EC2 instances which auto scale with traffic and migrate the databases into Amazon RDS. Push ad/referrer data using Amazon Athena to Amazon S3 where it can be consumed by the internal billing system to determine referral fees. Additionally create another Kinesis delivery stream to push the data to the Amazon RedShift warehouse for analysis" is incorrect.

Athena is more suited to data analysis within S3 buckets and cannot be used for loading data into S3.

References:

https://aws.amazon.com/solutions/implementations/real-time-web-analytics-with-kinesis/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-kinesis/

Domain

AWS Analytics

Question 19Skipped

A company is deploying a new serverless application that uses AWS Lambda functions. A DevOps engineer must create a continuous deployment pipeline for the application. The deployment preferences must be configured to minimize the impact of failed deployments.

Which deployment configuration will meet these requirements?

Use AWS CloudFormation to publish a new version on every stack update and use the Routing Config property of the AWS::Lambda::Alias resource to shift traffic to the new version.

Correct answer

Use an AWS SAM template to define the serverless application. Use AWS CodeDeploy to deploy the Lambda functions with the Canary10Percent30Minutes deployment type.

Use AWS CloudFormation to deploy the serverless application. Use AWS CodeDeploy to deploy the Lambda functions with the AllAtOnce deployment type. Monitor error rates using Amazon CloudWatch.

Use AWS CloudFormation to publish a new version on each stack update and configure an AWS CodePipeline approval action for a DevOps engineer to test and approve the new version.

Overall explanation

The benefits of using AWS SAM to create the serverless application include that it comes built-in with CodeDeploy to provide gradual Lambda deployments. With just a few lines of configuration, AWS SAM can perform the following actions:

Deploys new versions of the Lambda function, and automatically creates aliases that point to the new version.

Gradually shifts customer traffic to the new version until you’re satisfied that it's working as expected, or you roll back the update.

Defines pre-traffic and post-traffic test functions to verify that the newly deployed code is configured correctly, and your application operates as expected.

Rolls back the deployment if CloudWatch alarms are triggered.

The DevOps engineer can choose the Deployment Preference Type. The following options are available:

Canary: Traffic is shifted in two increments. You can choose from predefined canary options. The options specify the percentage of traffic that's shifted to your updated Lambda function version in the first increment, and the interval, in minutes, before the remaining traffic is shifted in the second increment.

Linear: Traffic is shifted in equal increments with an equal number of minutes between each increment. You can choose from predefined linear options that specify the percentage of traffic that's shifted in each increment and the number of minutes between each increment.

All-at-once: All traffic is shifted from the original Lambda function to the updated Lambda function version at once.

The best option to minimize the impact of failed deployments is to use the canary deployment type. This will ensure that only a small amount of traffic reaches the new Lambda function in the first shift and if any issues occur the deployment can be stopped.

CORRECT: "Use an AWS SAM template to define the serverless application. Use AWS CodeDeploy to deploy the Lambda functions with the Canary10Percent30Minutes deployment type" is the correct answer (as explained above.)

INCORRECT: "Use AWS CloudFormation to deploy the serverless application. Use AWS CodeDeploy to deploy the Lambda functions with the AllAtOnce deployment type. Monitor error rates using Amazon CloudWatch" is incorrect.

The all-at-once deployment preference type would shift all traffic across to the new functions which would increase the impact of failed deployments. Also, CloudFormation is not a continuous deployment tool and is not a suitable substitute for CodePipeline and CodeDeploy.

INCORRECT: "Use AWS CloudFormation to publish a new version on every stack update and use the Routing Config property of the AWS::Lambda::Alias resource to shift traffic to the new version" is incorrect.

As above, CloudFormation is not designed for continuous delivery and should not be used in this scenario. Creating a CodePipeline that leverages CodeDeploy and a source control service such as CodeCommit would be a better solution.

INCORRECT: "Use AWS CloudFormation to publish a new version on each stack update and configure an AWS CodePipeline approval action for a DevOps engineer to test and approve the new version" is incorrect.

This option requires more operational overhead and testing on behalf of the DevOps team. The better solution is an automated pipeline that shifts some traffic across to the new functions so actual end users are attempting to use the application.

References:

https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/automating-updates-to-serverless-apps.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 20Skipped

An application is hosted on Amazon EC2 instances behind an Application Load Balancer with an Amazon API Gateway REST API as the front end. Users should experience minimal disruptions during any deployment of a new version of the application. It must also be possible to quickly roll back if there is an issue.

Which solution will meet these requirements with MINIMAL changes to the application?

Deploy updates into a separate target group behind the existing Application Load Balancer. Configure API Gateway to route user traffic to the new target group using a weighted distribution.

Deploy updates into a separate environment parallel to the existing one. Update the Amazon Route 53 alias records to point to the new environment.

Deploy updates into a separate target group behind the existing Application Load Balancer. Configure API Gateway to route all traffic to the Application Load Balancer, which then sends the traffic to the new target group.

Correct answer

Deploy updates into a separate environment parallel to the existing one. Configure API Gateway to use a canary release deployment to send a small percentage of API traffic to the new environment.

Overall explanation

A parallel environment will be required behind the ALB that is launched with the updated application code. The API configuration would be updated to point to a different listener than the production traffic. Then, a canary release deployment can be used to direct a subset of traffic to the new environment with the latest application code.

In a canary release deployment, total API traffic is separated at random into a production release and a canary release with a pre-configured ratio. Typically, the canary release receives a small percentage of API traffic, and the production release takes up the rest. The updated API features are only visible to API traffic through the canary.

By keeping canary traffic small and the selection random, most users are not adversely affected at any time by potential bugs in the new version, and no single user is adversely affected all the time.

CORRECT: "Deploy updates into a separate environment parallel to the existing one. Configure API Gateway to use a canary release deployment to send a small percentage of API traffic to the new environment" is the correct answer (as explained above.)

INCORRECT: "Deploy updates into a separate target group behind the existing Application Load Balancer. Configure API Gateway to route all traffic to the Application Load Balancer, which then sends the traffic to the new target group" is incorrect.

This would direct all traffic to the new application version which would affect all users. Also, the ALB would not know to route traffic to the new target group unless the original was taken out of service.

INCORRECT: "Deploy updates into a separate environment parallel to the existing one. Update the Amazon Route 53 alias records to point to the new environment" is incorrect.

This would affect all users as all traffic would be directed to the new application version.

INCORRECT: "Deploy updates into a separate target group behind the existing Application Load Balancer. Configure API Gateway to route user traffic to the new target group using a weighted distribution" is incorrect.

There is no mechanism in API gateway for directing traffic using a weighted distribution.

References:

https://docs.aws.amazon.com/apigateway/latest/developerguide/canary-release.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-api-gateway/

Domain

AWS Networking & Content Delivery

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries