AWS Certified DevOps Engineer Professional Practice Exams

Practice Test 4: DOP-C02
Open

Practice Test 3: DOP-C02

Practice Test 5: DOP-C02

Set a certification due date

AWS Certified DevOps Engineer – Professional

Course content

AI Assistant

Practice tests

Start

Practice Test 1: DOP-C02

Start

Practice Test 2: DOP-C02

Start

Practice Test 3: DOP-C02

Start

Practice Test 4: DOP-C02

Start

Practice Test 5: DOP-C02

Start

Practice Test 6: DOP-C02

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

[2025] Pass the AWS DevOps Engineer Professional Exam DOP-C02 | Exam-Difficulty Practice Questions + Exam Simulation

Rating: 4.0 out of 54.0
320 ratings

4,812

Students

130 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified DevOps Engineer Professional exam the first time with a great score

EXAM SIMULATION: All practice tests are timed and scored (passing score is 75%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

ALWAYS UP TO DATE: Covering the latest DOP-C02 exam guide, our question bank is regularly updated based on student feedback from the real exam

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ACTIVE Q&A FORUM: In this discussion board, students ask questions and share their recent exam experience offering feedback on which topics were covered

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Description

Are you preparing for the AWS Certified DevOps Engineer Professional exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS DevOps Professional practice exams to assess your exam-readiness and get certified for DOP-C02.

Our course includes 6 AWS practice exams that include a total of 130 unique practice questions. All of our practice tests accurately reflect the difficulty of the Amazon Web Services exam questions and are the most realistic AWS exam experience available on Udemy.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Our questions are continually revised based on feedback from students who have recently taken the AWS exam, so you can be sure that they are up-to-date and reflect the latest exam format.

Our practice exam course is designed to give you a thorough understanding of the key concepts and topics covered in the DOP-C02 exam. Based on your test report that provides you with detailed feedback, you get to identify areas where you need to improve and build the confidence you need to succeed in the actual exam.

TOP REASONS WHY THESE PRACTICE EXAMS ARE YOUR BEST CHANCE TO ACE YOUR AWS EXAM

100% ALIGNED WITH LATEST DOP-C02 EXAM: All practice tests on Udemy are scenario-based reflecting the latest AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

SIMULATE THE REAL CERTIFICATION EXAM: Practice tests are timed (130 min to answer 65 questions) and scored (passing score is 72%) accurately mirroring the real exam environment. This allows you to become familiar with the AWS exam format

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

REGULAR UPDATES OF QUESTIONS: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, most of our students achieve exceptional results, with an average exam score of over 85%.

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered.

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the pass mark for the actual AWS exam is 72%, we highly recommend that you continue taking our AWS practice exams until you achieve a consistent score of 80% or higher. Once you reach this recommended score on our practice tests, you'll be well-prepared to sit the actual exam and achieve a great score.

GET FAMILIAR WITH THE ACTUAL EXAM FORMAT: Our AWS Certified DevOps Pro practice exams are specifically designed to help you become familiar with the test question format and structure of the actual AWS exam. Unlike many other practice tests on the market, our exams closely match the format of the real AWS exam, ensuring that you are adequately prepared for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS DevOps practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Certified DevOps certification exam with confidence.

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy.

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to fast-track their exam success!

MONEY-BACK GUARANTEE

We are totally confident in the value of our Practice Exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

ABOUT THE AWS CERTIFIED DEVOPS ENGINEER PROFESSIONAL CERTIFICATION

The AWS Certified DevOps Engineer Professional certification is one of the most sought-after certifications in the cloud computing industry. AWS DevOps are in huge demand and salaries can be above $150,000 USD per annum. The AWS Certified DevOps s exam aims to test knowledge of the key services and tools used by DevOps creating applications on AWS.

When you're ready to book your exam you can do so on the AWS Training portal. Curious about the AWS DevOps certification cost? The AWS DevOps Professional Certification cost is $300 USD in most regions and you currently have the choice of an online proctored exam or test center (subject to availability).

OUR MISSION

At Digital Cloud Training we are committed to your success. Our mission is to provide you with the resources you need to pass your exam on your first attempt - without wasting time or money. After completing these AWS Certified DevOps Pro Practice Tests and assessing your exam readiness, you'll be more than ready for the real AWS exam.

Who this course is for:

Students preparing for the AWS Certified DevOps Engineer Professional (DOP-C02) exam who want to pass with confidence

Students who want to test their skills in exam simulation, assessing their DOP-C02 exam readiness

Anyone who wants to learn AWS through high-quality questions and answers, explanations and reference links

Anyone who is keen to take their career and salary to the next level with an AWS certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Requirements

This course is designed for individuals with a solid AWS knowledge and experience (at the Associate level)

It is recommended that students have successfully passed one or more of the AWS Associate level exams.

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 4: DOP-C02

DOP-C02 - Results

Back to result overview
Attempt 1

All domains

All domains

AWS Database

AWS Analytics

AWS Networking & Content Delivery

AWS Management & Governance

AWS Developer Tools

AWS Compute

AWS Security, Identity, & Compliance

20 all

0 correct

0 incorrect

20 skipped

0 marked

Collapse all questions

Question 1Skipped

A DevOps engineer is deploying a new application with a MySQL-compatible Amazon Aurora database cluster. The Multi-AZ database will have a cross-Region read replica deployed for disaster recovery. The DevOps engineer wants to automate promotion of the replica in the event of a failure of the primary database.

Which deployment option should the DevOps engineer choose?

Create an Aurora custom endpoint to point to the primary database instance. Configure the application to use this endpoint. Configure AWS CloudTrail to detect database failures and then run an AWS Lambda function. Configure the Lambda function to promote the replica instance and modify the custom endpoint to point to the newly promoted instance.

Save the Aurora endpoint in AWS Secrets Manager. Subscribe an Amazon SNS topic to Amazon RDS failure notifications from AWS CloudTrail and run an AWS Lambda function to promote the replica instance and update the endpoint URL stored in AWS Secrets Manager. Configure the application to retrieve the updated endpoint from the parameter store if the application fails.

Correct answer

Save the Aurora endpoint in AWS Systems Manager Parameter Store. Create an Amazon EventBridge event that detects the database failure and runs an AWS Lambda function to promote the replica instance and update the endpoint URL stored in AWS Systems Manager Parameter Store. Configure the application to retrieve the updated endpoint from the parameter store if the application fails.

Create an Amazon EventBridge event that detects the database failure and modifies the application's AWS CloudFormation template to promote the replica. Create an AWS Lambda function to apply the updated template to update the stack and point the application to the newly promoted instance.

Overall explanation

Systems Manager Parameter Store is an ideal service to use for storing database connection strings. The application can be configured to recheck for updated connection strings if the application experiences a failure.

Amazon EventBridge can be used to trigger an action based on state changes in the Aurora database. For instance, you can use the “RDS DB Instance Event” event pattern to detect state changes in the Aurora database.

When the database is in a failed state a Lambda function can be used to promote the replica and update the database connection endpoint in Systems Manager Parameter Store. This will fully automate the promotion of the replica and the application will automatically pick up the new endpoint.

CORRECT: "Save the Aurora endpoint in AWS Systems Manager Parameter Store. Create an Amazon EventBridge event that detects the database failure and runs an AWS Lambda function to promote the replica instance and update the endpoint URL stored in AWS Systems Manager Parameter Store. Configure the application to retrieve the updated endpoint from the parameter store if the application fails" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon EventBridge event that detects the database failure and modifies the application's AWS CloudFormation template to promote the replica. Create an AWS Lambda function to apply the updated template to update the stack and point the application to the newly promoted instance" is incorrect.

EventBridge cannot update CloudFormation templates. You would need to use an AWS Lambda function to update the template, but the answer states the EventBridge would do this work.

INCORRECT: "Save the Aurora endpoint in AWS Secrets Manager. Subscribe an Amazon SNS topic to Amazon RDS failure notifications from AWS CloudTrail and run an AWS Lambda function to promote the replica instance and update the endpoint URL stored in AWS Secrets Manager. Configure the application to retrieve the updated endpoint from the parameter store if the application fails" is incorrect.

There is no such thing as publishing RDS failure notifications into AWS CloudTrail, so this solution is not possible.

INCORRECT: "Create an Aurora custom endpoint to point to the primary database instance. Configure the application to use this endpoint. Configure AWS CloudTrail to detect database failures and then run an AWS Lambda function. Configure the Lambda function to promote the replica instance and modify the custom endpoint to point to the newly promoted instance" is incorrect.

As with the previous answer you cannot use CloudTrail to detect database failures as it is a service that is used for recording the API calls made within an account. It is not used for performance monitoring or recording the changes in state of resources (use CloudWatch/EventBridge instead).

References:

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-cloud-watch-events.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 2Skipped

A financial organization is using a multi-account strategy with AWS Organizations. The AWS accounts are organized into different organizational units. Amazon CloudWatch Logs is used for logging within each account. The company needs to ship all the logs to a single centralized account for archiving purposes. The solution must be secure, and centralized, and the logs must be stored cost-effectively.

How can a DevOps Engineer meet these requirements?

Correct answer

Create a log destination in the centralized account and create a log subscription on that destination. Create a Kinesis Firehose delivery stream and subscribe it to the log destination. The target of Kinesis Firehose should be Amazon S3.

Create a log destination in the centralized account and create a log subscription on that destination. Create a Kinesis Streams and subscribe it to the destination. Create a Kinesis Firehose delivery stream and subscribe it to the Kinesis Stream. The target of the Kinesis Firehose should be Amazon EFS.

Create a log destination in the centralized account and create a log subscription on that destination. Create a subscription for the log stream that triggers and AWS Lambda function that copies the log data to Amazon EFS.

Create a log destination in the centralized account and create a log subscription on that destination. Create a Kinesis Streams and subscribe it to the destination. Create a Kinesis Firehose delivery stream and subscribe it to the Kinesis Stream. The target of the Kinesis Firehose should be Amazon Redshift.

Overall explanation

Subscriptions can be used to get access to a real-time feed of log events from CloudWatch Logs and have it delivered to other services such as an Amazon Kinesis stream, an Amazon Kinesis Data Firehose stream, or AWS Lambda for custom processing, analysis, or loading to other systems. When log events are sent to the receiving service, they are Base64 encoded and compressed with the gzip format.

For cross-account log data sharing with subscriptions, you can collaborate with an owner of a different AWS account and receive their log events on the AWS resources, such as an Amazon Kinesis or Amazon Kinesis Data Firehose stream (this is known as cross-account data sharing). For example, this log event data can be read from a centralized Kinesis or Kinesis Data Firehose stream to perform custom processing and analysis. Therefore, we must subscribe the log destination to a Kinesis Firehose delivery stream, which in turn has a destination of S3.

CORRECT: "Create a log destination in the centralized account and create a log subscription on that destination. Create a Kinesis Firehose delivery stream and subscribe it to the log destination. The target of Kinesis Firehose should be Amazon S3" is the correct answer (as explained above.)

INCORRECT: "Create a log destination in the centralized account and create a log subscription on that destination. Create a Kinesis Streams and subscribe it to the destination. Create a Kinesis Firehose delivery stream and subscribe it to the Kinesis Stream. The target of the Kinesis Firehose should be Amazon EFS" is incorrect.

The issue with this option is that the target for Kinesis Firehose is set as Amazon EFS which is not a supported destination.

INCORRECT: "Create a log destination in the centralized account and create a log subscription on that destination. Create a subscription for the log stream that triggers and AWS Lambda function that copies the log data to Amazon EFS" is incorrect.

This solution is possible, but Amazon EFS is not the most cost-efficient storage solution for archiving purposes. Amazon S3 is more suitable.

INCORRECT: "Create a log destination in the centralized account and create a log subscription on that destination. Create a Kinesis Streams and subscribe it to the destination. Create a Kinesis Firehose delivery stream and subscribe it to the Kinesis Stream. The target of the Kinesis Firehose should be Amazon Redshift" is incorrect.

The issue with this option is that the target for Kinesis Firehose is set as Amazon Redshift which is not suitable for archiving data and would be very expensive. RedShift is used for analytics purposes.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CrossAccountSubscriptions.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-kinesis/

Domain

AWS Analytics

Question 3Skipped

A global multi-player gaming application that was deployed in Europe now needs to be extended globally. Availability of the application must be extremely high, and latency should be low. The application is hosted on Amazon EC2 instances. It is anticipated that the traffic will be unevenly distributed with a few locations having much more traffic than others.

Which of the below routing strategies would be best fit considering above parameters?

Correct answer

Deploy the EC2 instances in an Auto Scaling group behind an Application Load Balancer in two different Regions. Create a Route 53 geoproximity-based routing record. Point the record to each of your load balancers.

Utilize Route 53 latency-based routing and deploy the EC2 instances in an Auto Scaling group behind an Application Load Balancer in two different Regions.

Deploy the EC2 instances in an Auto Scaling group behind an Application Load Balancer in two different Regions. Create a Route 53 geolocation-based routing record. Point the record to each of your load balancers.

Deploy Amazon CloudFront in front of the instances to cache requests and deliver content from Edge Locations globally.

Overall explanation

Geo-proximity Routing - Lets Amazon Route 53 route traffic to your resources based on the geographic location of your users and your resources.

You can also optionally choose to route more traffic or less to a given resource by specifying a value, known as a bias. A bias expands or shrinks the size of the geographic region from which traffic is routed to a resource.

The catch in the question is a few regions have heavier traffic load than the others so a bias needs to be configured and geoproximity routing is a better fit for this solution.

CORRECT: "Deploy the EC2 instances in an Auto Scaling group behind an Application Load Balancer in two different Regions. Create a Route 53 geoproximity-based routing record. Point the record to each of your load balancers" is the correct answer (as explained above.)

INCORRECT: "Deploy the EC2 instances in an Auto Scaling group behind an Application Load Balancer in two different Regions. Create a Route 53 geolocation-based routing record. Point the record to each of your load balancers" is incorrect.

If the discrepancy between traffic volume was unknown, this would also been a correct option.

INCORRECT: "Utilize Route 53 latency-based routing and deploy the EC2 instances in an Auto Scaling group behind an Application Load Balancer in two different Regions" is incorrect.

Latency-based routing is based on latency measurements performed over a period, and the measurements reflect changes in network connectivity and routing.

INCORRECT: "Deploy Amazon CloudFront in front of the instances to cache requests and deliver content from Edge Locations globally" is incorrect.

It is unlikely that a CDN can be used to cache a dynamic gaming application. A load balanced deployment of auto scaling EC2 instances is needed to run the application and ensure availability and performance.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-route-53/

Domain

AWS Networking & Content Delivery

Question 4Skipped

A DevOps engineer needs to stream data from Amazon CloudWatch Logs to a VPC-based Amazon OpenSearch Service cluster. The DevOps engineer creates an OpenSearch subscription filter for the OpenSearch cluster. However, the DevOps engineer notices that the logs are not visible in Amazon OpenSearch.

What should the DevOps engineer do to solve this problem?

Create an IAM role that has the AWSLambdaVPCAccessExecutionRole policy. Attach the role to Amazon OpenSearch.

Correct answer

Add lambda.amazonaws.com in the trust relationship of the CloudWatch Logs Lambda IAM execution role.

Create an export task in Amazon CloudWatch. Integrate the export task into Amazon OpenSearch.

Add lambda.amazonaws.com in the trust relationship of the AWS Lambda function IAM execution role.

Overall explanation

The configuration requires that the Lambda IAM execution role that is specified in the CloudWatch Logs configuration must have the trust relationship configured to allow lambda.amazonaws.com to assume the role. The AWSLambdaVPCAccessExecutionRole policy must also be added to the function to allow access to the VPC-based OpenSearch cluster.

CORRECT: "Add lambda.amazonaws.com in the trust relationship of the CloudWatch Logs Lambda IAM execution role" is the correct answer (as explained above.)

INCORRECT: "Add lambda.amazonaws.com in the trust relationship of the AWS Lambda function IAM execution role" is incorrect.

The trust relationship is defined in the role attached to the CloudWatch Logs configuration.

INCORRECT: "Create an IAM role that has the AWSLambdaVPCAccessExecutionRole policy. Attach the role to Amazon OpenSearch" is incorrect.

This policy should be attached to the Lambda IAM execution role, not the OpenSearch cluster.

INCORRECT: "Create an export task in Amazon CloudWatch. Integrate the export task into Amazon OpenSearch" is incorrect.

The subscription filter is used instead of using an export which is a better and more automated solution.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/opensearch-stream-data-cloudwatch/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-opensearch/

Domain

AWS Analytics

Question 5Skipped

A company leverages AWS CloudFormation to build their infrastructure on AWS. The security department is concerned about sensitive data being exposed. A DevOps engineer has been asked to implement steps to prevent the exposure of sensitive parameters such as passwords during infrastructure deployment operations.

Which combination of steps should be taken to improve security when deploying infrastructure using AWS CloudFormation? (Select TWO.)

Correct selection

Use AWS Secrets Manager to store sensitive data as secret values and use dynamic references in AWS CloudFormation.

Use AWS Systems Manager Parameter Store to store sensitive data as secure strings and reference the strings using tags in the CloudFormation template.

Use AWS Secrets Manager to encrypt the CloudFormation template at rest using an AWS KMS key.

Use an Amazon S3 bucket with default encryption enabled to store the AWS CloudFormation template.

Correct selection

Use the CloudFormation NoEcho parameter property to mask any sensitive parameter values.

Overall explanation

The key issue here is that some parameters such as passwords may be exposed when deploying infrastructure using AWS CloudFormation. This data could be exposed through the console, command line tools, or API.

There are a couple of ways the company can deal with this issue. Firstly, AWS Secrets Manager can be used to store secure encrypted values. These values can be securely used in CloudFormation by referencing them as dynamic references.

Another option is to use the NoEcho parameter property to mask sensitive data. If you set the NoEcho attribute to true, CloudFormation returns the parameter value masked as asterisks (*****) for any calls that describe the stack or stack events.

CORRECT: "Use AWS Secrets Manager to store sensitive data as secret values and use dynamic references in AWS CloudFormation" is a correct answer (as explained above.)

CORRECT: "Use the CloudFormation NoEcho parameter property to mask any sensitive parameter values" is also a correct answer (as explained above.)

INCORRECT: "Use AWS Systems Manager Parameter Store to store sensitive data as secure strings and reference the strings using tags in the CloudFormation template" is incorrect.

You cannot securely share secure strings in SSM Parameter Store by using tags in the CloudFormation template. Tags are used for assigning optional metadata.

INCORRECT: "Use AWS Secrets Manager to encrypt the CloudFormation template at rest using an AWS KMS key" is incorrect.

Secrets Manager cannot be used to encrypt the template and the main issue is not the encryption of the template but preventing exposure of sensitive data during deployment operations.

INCORRECT: "Use an Amazon S3 bucket with default encryption enabled to store the AWS CloudFormation template" is incorrect.

This ensures the encryption of the template but does not protect sensitive data from being exposed during deployment operations.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secret.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-cloudformation/

Domain

AWS Management & Governance

Question 6Skipped

A company uses GitHub to store the code for their software development. The company’s DevOps team want to automate the build process of an application. When the GitHub repository is updated, the code should be compiled, tested, and then pushed to an Amazon S3 bucket.

Which combination of steps would address these requirements? (Select THREE.)

Launch an Amazon EC2 instance to perform the build.

Correct selection

Configure a GitHub webhook to trigger a build every time a code change is pushed to the repository.

Correct selection

Create an AWS CodeBuild project with GitHub as the source repository.

Correct selection

Add a buildspec.yml file to the source code with build instructions.

Create an AWS OpsWorks deployment with the install dependencies command.

Create an AWS CodeDeploy application with the Amazon EC2/On-Premises compute platform.

Overall explanation

AWS CodeBuild can be used for this project to perform the compilation of code, testing, and pushing the package to S3. AWS CodeBuild supports webhooks when the source repository is GitHub. This means that for a CodeBuild build project that has its source code stored in a GitHub repository, webhooks can be used to rebuild the source code every time a code change is pushed to the repository.

The buildspec.yml file is used to define the build commands and sequence to run during the build process. This file is placed in the source code.

CORRECT: "Create an AWS CodeBuild project with GitHub as the source repository" is a correct answer (as explained above.)

CORRECT: "Add a buildspec.yml file to the source code with build instructions" is also a correct answer (as explained above.)

CORRECT: "Configure a GitHub webhook to trigger a build every time a code change is pushed to the repository" is also a correct answer (as explained above.)

INCORRECT: "Create an AWS CodeDeploy application with the Amazon EC2/On-Premises compute platform" is incorrect.

CodeDeploy is used for deploying the code. In this case the code needs to be compiled and tested. CodeBuild is used for this purpose. There is no mention in the question about how the code will be deployed to servers.

INCORRECT: "Create an AWS OpsWorks deployment with the install dependencies command" is incorrect.

OpsWorks is not needed in this scenario as this is a pure compile and build requirement which is a good use case for CodeBuild.

INCORRECT: "Launch an Amazon EC2 instance to perform the build" is incorrect.

There is no need to launch an instance and CodeBuild can automatically do this on the platform of your choice.

References:

https://docs.aws.amazon.com/codebuild/latest/userguide/sample-github-pull-request.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 7Skipped

A DevOps Engineer needs a scalable Node.js application in AWS with a MySQL database. There should be no downtime during deployments and if issues occur rollback to a previous version must be easy to implement. The database may also be used by other applications.

Which solution meets these requirements?

Deploy the application using AWS Elastic Beanstalk. Configure the environment type for Elastic Load Balancing and Auto Scaling. Create an Amazon RDS MySQL instance inside the Elastic Beanstalk stack.

Deploy the application on Amazon EC2. Configure Elastic Load Balancing and Auto Scaling. Schedule an AWS Lambda function to take regular snapshots of attached EBS volumes. Use an Amazon RDS MySQL instance for the database tier.

Deploy the application on Amazon ECS. Configure Elastic Load Balancing and Auto Scaling. Create an ECS service and specify the desired task count. Use an Amazon RDS MySQL instance for the database tier.

Correct answer

Deploy the application using AWS Elastic Beanstalk. Configure the environment type for Elastic Load Balancing and Auto Scaling. Create the Amazon RDS MySQL instance outside the Elastic Beanstalk stack.

Overall explanation

AWS Elastic Beanstalk offers automatic rollback options for deployment updates. This coupled with auto scaling and the ALB meets the requirements for a scalable compute and web tier. The RDS database provides a managed solution for the MySQL database. The RDS MySQL database should be created outside of the Elastic Beanstalk environment as it may be used by other applications. If it is created within the Elastic Beanstalk environment it could be automatically deleted if the environment is deleted.

CORRECT: "Deploy the application using AWS Elastic Beanstalk. Configure the environment type for Elastic Load Balancing and Auto Scaling. Create the Amazon RDS MySQL instance outside the Elastic Beanstalk stack" is the correct answer (as explained above.)

INCORRECT: "Deploy the application using AWS Elastic Beanstalk. Configure the environment type for Elastic Load Balancing and Auto Scaling. Create an Amazon RDS MySQL instance inside the Elastic Beanstalk stack" is incorrect.

As explained above the RDS database should be created outside of the Elastic Beanstalk environment.

INCORRECT: "Deploy the application on Amazon ECS. Configure Elastic Load Balancing and Auto Scaling. Create an ECS service and specify the desired task count. Use an Amazon RDS MySQL instance for the database tier" is incorrect.

ECS does not offer automatic rollback so Elastic Beanstalk is a better solution to meet the requirements.

INCORRECT: "Deploy the application on Amazon EC2. Configure Elastic Load Balancing and Auto Scaling. Schedule an AWS Lambda function to take regular snapshots of attached EBS volumes. Use an Amazon RDS MySQL instance for the database tier" is incorrect.

Automating the creation of snapshots is not a suitable solution for rollback. Elastic Beanstalk offers several deployment options which offer automatic rollback.

References:

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.rolling-version-deploy.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-beanstalk/

Domain

AWS Compute

Question 8Skipped

A fast-growing US based company has just opened an office in Frankfurt, Germany. The users in the new office have reported high latency for the company’s CRM application. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) and stores data in an Amazon DynamoDB table. The CRM application runs in the us-east-1 Region.

A DevOps engineer must minimize application response times and improve availability for users in both Regions.

Which combination of actions should be taken to address the latency issues? (Select THREE.)

Correct selection

Use DynamoDB Global Tables to create a replica of the existing DynamoDB table in the eu-central-1 Region.

Create a new Auto Scaling group in the eu-central-1 Region and configure the existing ALB to direct traffic to the new Auto Scaling group.

Create Amazon Route 53 aliases, health checks, and failover routing policies to route to the ALB.

Correct selection

Create Amazon Route 53 records, health checks, and latency-based routing policies to route to the ALB.

Correct selection

Create a new ALB and Auto Scaling group in the eu-central-1 Region and configure the new ALB to direct traffic to the new Auto Scaling group.

Create a new DynamoDB table in the eu-central-1 Region with cross-Region replication enabled.

Overall explanation

To reduce latency the application must be deployed in a Region closest to the users, in this case eu-central-1. As ALBs and Auto Scaling groups are regional services they must be deployed in this new Region. Amazon Route 53 can be used to create records with latency-based routing to direct users to the Region that provides the lowest latency. This will typically be the eu-central-1 Region for users in Frankfurt.

The database must be replicated to ensure the CRM data is consistent. A multi-master database is required so that changes in either Region will be synchronized. DynamoDB tables is ideal for this requirement and can be easily enabled at any time by creating a replication configuration on the existing table.

CORRECT: "Create a new ALB and Auto Scaling group in the eu-central-1 Region and configure the new ALB to direct traffic to the new Auto Scaling group" is a correct answer (as explained above.)

CORRECT: "Create Amazon Route 53 records, health checks, and latency-based routing policies to route to the ALB" is also a correct answer (as explained above.)

CORRECT: "Use DynamoDB Global Tables to create a replica of the existing DynamoDB table in the eu-central-1 Region" is also a correct answer (as explained above.)

INCORRECT: "Create a new DynamoDB table in the eu-central-1 Region with cross-Region replication enabled" is incorrect.

DynamoDB Global Tables should be used and can be enabled by creating a replication configuration on the existing table.

INCORRECT: "Create a new Auto Scaling group in the eu-central-1 Region and configure the existing ALB to direct traffic to the new Auto Scaling group" is incorrect.

You cannot direct traffic to an ASG that is in another Region as both ELBs and ASGs are regional services.

INCORRECT: "Create Amazon Route 53 aliases, health checks, and failover routing policies to route to the ALB" is incorrect.

Latency-based routing should be used rather than failover routing as the objective is to direct users to the application endpoint that has the lowest latency.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.tutorial.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-dynamodb/

https://digitalcloud.training/amazon-route-53/

Domain

AWS Database

Question 9Skipped

A service provider has created business relationships with several companies. The service provider plans to deploy an application to multiple AWS accounts managed by these partner companies using AWS CloudFormation. Each partner company has granted the permissions to create IAM roles with permissions for the deployment in their respective accounts. The organization must minimize operational overhead and stack management.

Which actions should be taken to deploy the application across these accounts?

Create an AWS Organization with all features enabled and add the partner accounts to the organization. Use CloudFormation stack sets with service-managed permissions to deploy the application.

Create an IAM role in the service provider account that grants permissions to perform stack set operations in the partner accounts. Use CloudFormation stack sets with service-managed permissions to deploy the application.

Correct answer

Create IAM roles in each partner account that grant administrators in the service provider’s account permissions to perform stack set operations in the partner accounts. Use CloudFormation stack sets with self-managed permissions to deploy the application.

Add the CloudFormation template to a central shared Amazon S3 bucket. Create administrative user accounts in each partner account. Log in to each partner account and create a stack set to deploy the application from the shared template.

Overall explanation

A stack set lets you create stacks in AWS accounts across regions by using a single CloudFormation template. A stack set's CloudFormation template defines all the resources in each stack. As you create the stack set, specify the template to use, in addition to any parameters and capabilities that template requires.

You can create a stack set using the AWS Management Console or using AWS CloudFormation commands in the AWS CLI. You can create a stack set with either self-managed or service-managed permissions.

With self-managed permissions, you can deploy stack instances to specific AWS accounts in specific Regions. To do this, you must first create the necessary IAM roles to establish a trusted relationship between the account you're administering the stack set from and the account you're deploying stack instances to.

With service-managed permissions, you can deploy stack instances to accounts managed by AWS Organizations in specific Regions. With this model, you don't need to create the necessary IAM roles; StackSets creates the IAM roles on your behalf

In this case the best solution is to use self-managed permissions as the partner companies have only granted the ability to create IAM roles. They would certainly not want their entire account to be controlled by the service provider through AWS Organizations just so they can deploy a single application.

CORRECT: "Create IAM roles in each partner account that grant administrators in the service provider’s account permissions to perform stack set operations in the partner accounts. Use CloudFormation stack sets with self-managed permissions to deploy the application" is the correct answer (as explained above.)

INCORRECT: "Create an IAM role in the service provider account that grants permissions to perform stack set operations in the partner accounts. Use CloudFormation stack sets with service-managed permissions to deploy the application" is incorrect.

You cannot have a role in one account that has permissions in another account. The roles must be created in each AWS account and self-managed permissions must be used with AWS CloudFormation stack sets.

INCORRECT: "Create an AWS Organization with all features enabled and add the partner accounts to the organization. Use CloudFormation stack sets with service-managed permissions to deploy the application" is incorrect.

The partner companies would not want the service provider to control their accounts with AWS Organizations just for a single application. They have granted the ability to create roles which is enough for the service provider to deploy the application using stack sets with self-managed permissions.

INCORRECT: "Add the CloudFormation template to a central shared Amazon S3 bucket. Create administrative user accounts in each partner account. Log in to each partner account and create a stack set to deploy the application from the shared template" is incorrect.

The partner companies have granted the ability to create roles, not user accounts. Also, this would be inefficient.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-cloudformation/

Domain

AWS Management & Governance

Question 10Skipped

A company is deploying a new application that uses Amazon EC2 instances for the web tier and a MySQL database for the database tier. An Application Load Balancer (ALB) will be used in front of the web tier. The company requires an RPO of 2 hours and an RTO of 10 minutes for the solution.

Which combination of deployment strategies will meet these requirements? (Select TWO.)

Deploy the application in two Regions and create Amazon Route 53 latency-based routing records pointing to the ALB in each Regions. Enable health checks for the records.

Create an Amazon Aurora multi-master cluster across multiple Regions for the database tier. Configure the database in an active-active mode across the Regions.

Create two Amazon Aurora clusters spread across two Regions. Use AWS Database Migration Service (AWS DMS) to synchronize changes.

Correct selection

Create an Amazon Aurora global database in two Regions for the database tier. In the event of a failure, promote the secondary Region to take on read/write responsibilities.

Correct selection

Deploy the application in two Regions and create Amazon Route 53 failover-based routing records pointing to the ALB in each Regions. Enable health checks for the records.

Overall explanation

To meet the RTO and RPO requirements the best solution for the database tier is to use Amazon Aurora global database. This solution provides replication from the Aurora storage layer across Regions. The reader endpoint in the secondary endpoint can be promoted in the event of a DR scenario to be the main database which takes on read/write responsibilities.

For the web tier this can be placed behind ALBs in each Region. Amazon Route 53 failover-based routing policies with health checks should be created. These records will point to the ALBs in each Region and if the health checks fail in the primary Region, automatic failover to the secondary Region will occur.

CORRECT: "Create an Amazon Aurora global database in two Regions for the database tier. In the event of a failure, promote the secondary Region to take on read/write responsibilities" is a correct answer (as explained above.)

CORRECT: "Deploy the application in two Regions and create Amazon Route 53 failover-based routing records pointing to the ALB in each Regions. Enable health checks for the records" is also a correct answer (as explained above.)

INCORRECT: "Create two Amazon Aurora clusters spread across two Regions. Use AWS Database Migration Service (AWS DMS) to synchronize changes" is incorrect.

The better solution is to use Aurora Global Database as this will simplify the failover process which can be instantiated through a few API calls. Also, this replication uses Aurora replication with low latency and the Aurora reader endpoint can also be utilized in the second Region.

INCORRECT: "Create an Amazon Aurora multi-master cluster across multiple Regions for the database tier. Configure the database in an active-active mode across the Regions" is incorrect.

It is not possible to create multi-master clusters across Regions, they work within a Region only.

INCORRECT: "Deploy the application in two Regions and create Amazon Route 53 latency-based routing records pointing to the ALB in each Regions. Enable health checks for the records" is incorrect.

Failover routing policy records should be created, not latency routing records. With latency records users closer to the secondary Region will be directed there but the DB layer is not in read/write mode except in a DR scenario.

References:

https://aws.amazon.com/rds/aurora/global-database/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 11Skipped

As part of single click deployment strategy, a financial organization is utilizing AWS CodeCommit, CodeBuild and CodeDeploy in an automated pipeline using AWS CodePipeline. It was discovered that in some instances, code was deployed which led to vulnerabilities in production systems.

It is mandated that additional checks must be included before code is promoted into production.

What additional steps could be taken to ensure code quality?

Add test stages before and after the deploy action.

Have the build stage trigger an AWS Lambda function that can perform a verification before deployment.

Pause the deployment stage to perform a final validation on the deployment.

Correct answer

Add a manual approval to a stage before the deploy action in the code pipeline deploying code to PROD.

Overall explanation

An approval action can be added to a stage in a CodePipeline pipeline at the point where you want the pipeline to stop, so someone can manually approve or reject the action. This is the simplest and most effective option presented.

CORRECT: "Add a manual approval to a stage before the deploy action in the code pipeline deploying code to PROD" is the correct answer (as explained above.)

INCORRECT: "Pause the deployment stage to perform a final validation on the deployment" is incorrect.

Pausing can help in the above scenario but could lead to additional delay based on user input, adding a manual approval stage is a better solution.

INCORRECT: "Add test stages before and after the deploy action" is incorrect.

This could work but would need more configuration and effort as compared to adding a stage.

INCORRECT: "Have the build stage trigger a Lambda function that can perform a verification before deployment" is incorrect.

Since the verification could change, Lambda would need customization depending on scenario and would be a time-consuming option.

References:

https://docs.aws.amazon.com/codepipeline/latest/userguide/approvals-action-add.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-developer-tools/

Domain

AWS Developer Tools

Question 12Skipped

An application sits behind a Network Load Balancer (NLB) that is configured with a TLS listener. The DevOps team must analyze traffic patterns and require information about the connections made by clients. The data that is captured must be stored securely with encryption at rest and should only be accessible to the DevOps team members.

Which actions should a DevOps engineer take?

Correct answer

Enable access logs on the NLB and configure an Amazon S3 bucket as the destination. Enable SSE-S3 encryption on the S3 bucket and configure the bucket policy to allow write access for the principal ‘delivery.logs.amazonaws.com’. Apply an IAM permissions policy to the DevOps team that grants read access.

Enable access logs on the NLB and configure an Amazon S3 bucket as the destination. Enable SSE-KMS encryption on the S3 bucket and configure the bucket policy to allow write access for the IAM group containing the DevOps team user accounts and the AWS service account.

Enable access logs on the NLB and configure an Amazon S3 bucket as the destination. Enable SSE-S3 encryption on the S3 bucket and configure the bucket policy to allow write access for the principal ‘delivery.logs.amazonaws.com’.

Enable access logs on the NLB and configure an Amazon S3 bucket as the destination. Enable SSE-KMS encryption on the S3 bucket and configure the bucket policy to allow write access for the AWS service account.

Overall explanation

Elastic Load Balancing provides access logs that capture detailed information about the TLS requests sent to your Network Load Balancer. You can use these access logs to analyze traffic patterns and troubleshoot issues. The logs are sent to an Amazon S3 bucket you configure as the logging destination. This bucket can be encrypted using one of the available server-side encryption options.

When you enable access logging, you must specify an S3 bucket for the access logs. The policy must grant permission to the AWS service account ‘delivery.logs.amazonaws.com’. In this case, the DevOps team also require permissions to access the bucket, and this can be granted through an IAM policy attached to the team members, most likely via an IAM group.

CORRECT: "Enable access logs on the NLB and configure an Amazon S3 bucket as the destination. Enable SSE-S3 encryption on the S3 bucket and configure the bucket policy to allow write access for the principal ‘delivery.logs.amazonaws.com’. Apply an IAM permissions policy to the DevOps team that grants read access" is the correct answer (as explained above.)

INCORRECT: "Enable access logs on the NLB and configure an Amazon S3 bucket as the destination. Enable SSE-KMS encryption on the S3 bucket and configure the bucket policy to allow write access for the IAM group containing the DevOps team user accounts and the AWS service account" is incorrect.

This will not allow read access for the DevOps team as the only permission is write access.

INCORRECT: "Enable access logs on the NLB and configure an Amazon S3 bucket as the destination. Enable SSE-S3 encryption on the S3 bucket and configure the bucket policy to allow write access for the principal ‘delivery.logs.amazonaws.com’" is incorrect.

This solution does not grant any permissions to the DevOps team to access the data in the logging location.

INCORRECT: "Enable access logs on the NLB and configure an Amazon S3 bucket as the destination. Enable SSE-KMS encryption on the S3 bucket and configure the bucket policy to allow write access for the AWS service account" is incorrect.

This solution does not grant any permissions to the DevOps team to access the data in the logging location.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-access-logs.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Networking & Content Delivery

Question 13Skipped

A company manages both Amazon EC2 instances and on-premises servers running Linux and Windows. A DevOps engineer needs to manage patching across these environments. All patching must take place outside of business hours.

Which combination of actions will meet these requirements? (Select THREE.)

Use Amazon CloudWatch Events scheduled events to schedule a patch window outside of business hours.

Create an AWS Systems Manager Automation document that installs that latest patches every hour.

Correct selection

Add the on-premises servers into AWS Systems Manager using Systems Manager Hybrid Activations.

Correct selection

Use AWS Systems Manager Maintenance Windows to schedule a patch window outside of business hours.

Correct selection

Attach an IAM role to the EC2 instances, granting AWS Systems Manager permission to manage the instances.

Create IAM access keys for the on-premises servers to provide permission to AWS Systems Manager.

Overall explanation

In a hybrid environment the most secure deployment includes using Systems Manager Hybrid activations for on-premises servers and an IAM role for the EC2 instances. The hybrid activations feature in systems manager is a more secure option than using access keys as it uses an IAM service role.

To ensure that systems are not affected during business hours the DevOps engineer needs to simply select a patching window during acceptable times and Systems Manager Patch Manager will only apply updates during that timeframe.

CORRECT: "Add the on-premises servers into AWS Systems Manager using Systems Manager Hybrid Activations" is a correct answer (as explained above.)

CORRECT: "Attach an IAM role to the EC2 instances, granting AWS Systems Manager permission to manage the instances" is also a correct answer (as explained above.)

CORRECT: "Use AWS Systems Manager Maintenance Windows to schedule a patch window outside of business hours" is also a correct answer (as explained above.)

INCORRECT: "Create IAM access keys for the on-premises servers to provide permission to AWS Systems Manager" is incorrect.

This is a less secure method than using Hybrid Activations in Systems Manager and would also be harder to manage.

INCORRECT: "Create an AWS Systems Manager Automation document that installs that latest patches every hour" is incorrect.

Automation documents are used for running tasks on managed instances using Systems Manager but are not used for patch management.

INCORRECT: "Use Amazon CloudWatch Events scheduled events to schedule a patch window outside of business hours" is incorrect.

CloudWatch Events responds to state changes in resources but cannot be used to schedule patch installation using AWS Systems Manager Patch Manager.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-managedinstances.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-systems-manager/

Domain

AWS Management & Governance

Question 14Skipped

A company runs a serverless application that includes video sharing functionality for logged in users. The video service has become popular, and the company need to know which videos are getting the most interest. A DevOps engineer has been asked to identify the access patterns of the videos. The video files are stored in an Amazon S3 bucket. The information that must be gathered includes the number of users who access specific video files per day and the number of access requests for these files.

How can the company meet these requirements with the LEAST amount of effort?

Enable event notifications on the bucket to trigger an AWS Lambda function for all object access events. Configure the function to write access request information to an Amazon RedShift database. Run SQL queries to analyze the access patterns.

Enable logging to Amazon CloudWatch Logs for the S3 bucket. Create a subscription to the log stream and invoke an AWS Lambda function that analyzes the access patterns and saves results to another S3b bucket.

Enable S3 server access logging and import the access logs into an Amazon RedShift database. Run SQL queries to analyze the access patterns.

Correct answer

Enable S3 server access logging and use Amazon Athena to create an external table for the log files. Use Athena to run SQL queries and analyze the access patterns.

Overall explanation

The simplest solution for this request is to enable server access logging on the bucket and then analyze the data that is logged using Amazon Athena. Server access logging provides detailed records for the requests that are made to a bucket. This includes the information requested by the company.

Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL. Athena is serverless, so there is no infrastructure to manage, and you pay only for the queries that you run.

CORRECT: "Enable S3 server access logging and use Amazon Athena to create an external table for the log files. Use Athena to run SQL queries and analyze the access patterns" is the correct answer (as explained above.)

INCORRECT: "Enable S3 server access logging and import the access logs into an Amazon RedShift database. Run SQL queries to analyze the access patterns" is incorrect $

INCORRECT: "Enable event notifications on the bucket to trigger an AWS Lambda function for all object access events. Configure the function to write access request information to an Amazon RedShift database. Run SQL queries to analyze the access patterns" is incorrect $

INCORRECT: "Enable logging to Amazon CloudWatch Logs for the S3 bucket. Create a subscription to the log stream and invoke an AWS Lambda function that analyzes the access patterns and saves results to another S3b bucket" is incorrect $

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/LogFormat.html#log-record-fields

https://aws.amazon.com/premiumsupport/knowledge-center/analyze-logs-athena/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-athena/

Domain

AWS Analytics

Question 15Skipped

A new application is being deployed on AWS using Amazon EC2 instances. The operations team must monitor the instance’s application logs and API activity and need a solution for querying both sets of logs.

Which solution will meet these requirements?

Install the Amazon CloudWatch agent on the instances to send the application logs to an Amazon S3 bucket and configure AWS CloudTrail to log API activity to the same S3 bucket. Use Amazon Athena to query both sets of logs.

Install the Amazon CloudWatch agent on the instances to send the application logs to Amazon CloudWatch Logs and use AWS CloudTrail to log API activity to Amazon S3. Use CloudWatch Logs Insights to query both sets of logs.

Correct answer

Install the Amazon CloudWatch agent on the instances to send the application logs to Amazon CloudWatch Logs and configure AWS CloudTrail to log API activity to CloudWatch Logs. Use CloudWatch Logs Insights to query both sets of logs.

Install the Amazon CloudWatch agent on the instances to send the application logs to an Amazon SQS queue and configure AWS CloudTrail to log API activity to the same SQS queue. Create an AWS Lambda function to query messages in the queue.

Overall explanation

The unified CloudWatch agent enables you to collect system logs, application logs, and metrics from your Amazon EC2 instances. The log files can be stored in Amazon CloudWatch Logs.

AWS CloudTrail logs API activity from your account and can also be configured to stream the log data to an Amazon CloudWatch Logs log group.

CloudWatch Logs Insights can then be used to query both sets of logs. This service is used to interactively search and analyze your log data in Amazon CloudWatch Logs.

CORRECT: "Install the Amazon CloudWatch agent on the instances to send the application logs to Amazon CloudWatch Logs and configure AWS CloudTrail to log API activity to CloudWatch Logs. Use CloudWatch Logs Insights to query both sets of logs" is the correct answer (as explained above.)

INCORRECT: "Install the Amazon CloudWatch agent on the instances to send the application logs to Amazon CloudWatch Logs and use AWS CloudTrail to log API activity to Amazon S3. Use CloudWatch Logs Insights to query both sets of logs" is incorrect.

CloudWatch Logs Insights can be used to query log data in CloudWatch Logs log groups but not data that is stored directly in an Amazon S3 bucket.

INCORRECT: "Install the Amazon CloudWatch agent on the instances to send the application logs to an Amazon S3 bucket and configure AWS CloudTrail to log API activity to the same S3 bucket. Use Amazon Athena to query both sets of logs" is incorrect.

The CloudWatch agent can be configured to send the log files to an Amazon CloudWatch Logs log group but cannot send data into an S3 bucket.

INCORRECT: "Install the Amazon CloudWatch agent on the instances to send the application logs to an Amazon SQS queue and configure AWS CloudTrail to log API activity to the same SQS queue. Create an AWS Lambda function to query messages in the queue" is incorrect.

The SQS queue is not a destination you can configure in the CloudWatch Logs agent and it not a suitable storage location as it is meant for temporary storage of data that is awaiting processing.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Management & Governance

Question 16Skipped

An online retail chain processes thousands of orders each day from 100 countries and its website is localized in 15 languages. The company’s website faces continual security threats and challenges in the form of HTTP flood attacks, distributed denial of service (DDoS) attacks, and rogue robots that flood its website with traffic. Most of these attacks originate from certain countries.

The company wants to block access to its application from specific countries; however, the company wants to allow its remote development team (from one of the blocked countries) to have access to the application. The application is deployed on EC2 instances running behind an Application Load Balancer (ALB) with AWS WAF.

How can a DevOps engineer protect workloads from DDoS attacks whilst allowing the development team to be productive? (Select TWO.)

Use an ALB geo match statement listing the countries that needs to be blocked.

Create a deny rule for the blocked countries in the NACL associated with each of the EC2 instances.

Correct selection

Use an AWS WAF IP set statement that specifies the IP addresses that needs to be allowed.

Correct selection

Use an AWS WAF geo match statement listing the countries that need to be blocked.

Use an ALB IP set statement that specifies the IP addresses that needs to be allow through.

Overall explanation

AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns and rules that filter out specific traffic patterns you define.

You can deploy AWS WAF on Amazon CloudFront as part of your CDN solution, the Application Load Balancer that fronts your web servers or origin servers running on EC2, or Amazon API Gateway for your APIs.

CORRECT: "Use an AWS WAF IP set statement that specifies the IP addresses that needs to be allowed" is a correct answer (as explained above.)

CORRECT: "Use an AWS WAF geo match statement listing the countries that need to be blocked" is also a correct answer (as explained above.)

INCORRECT: "Use an ALB geo match statement listing the countries that needs to be blocked" is incorrect.

An ALB cannot block or allow traffic based on geographic match conditions or IP based conditions.

INCORRECT: "Use an ALB IP set statement that specifies the IP addresses that needs to be allow through" is incorrect.

Geo match restriction works with WAF and not ALB. The correct way to add geo restriction is to bind the condition as an WAF rule.

INCORRECT: "Create a deny rule for the blocked countries in the NACL associated with each of the EC2 instances" is incorrect.

Creating a Network Access Control List (NACL) would be tedious and won’t entirely cover the requirements here. AWS WAF is designed for protecting against the types of attacks mentioned.

References:

https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl-ip-conditions.html

https://aws.amazon.com/blogs/security/how-to-use-aws-waf-to-filter-incoming-traffic-from-embargoed-countries/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-waf-shield/

Domain

AWS Security, Identity, & Compliance

Question 17Skipped

An application runs on Amazon EC2 instances in an Auto Scaling group behind an application Load Balancer (ALB). The applications runs across two Availability Zones (AZs). Recently the application has become very popular and to increase reliability of the application a DevOps engineer has configured the Auto Scaling group to launch instances across three AZs. However, instances launched in the newly added AZ are not receiving any traffic.

What is the most likely cause of this issue?

Cross-zone load balancing has not been enabled for the ALB.

The AMI has not been updated to include the new AZ.

Correct answer

The new AZ has not been enabled for the ALB.

There are no subnets associated with the new AZ.

Overall explanation

Elastic Load Balancing creates a load balancer node for each Availability Zone you enable for the load balancer. The most likely issue here is that the ALB has not been updated with the new AZ so it has not created a node in that AZ and will not distribute traffic there. The DevOps engineer simply needs to update the ALB to include the new AZ and it will then register the targets in the target group and start distributing traffic to them.

CORRECT: "The new AZ has not been enabled for the ALB" is the correct answer (as explained above.)

INCORRECT: "Cross-zone load balancing has not been enabled for the ALB" is incorrect.

Cross-zone load balancing aims to balance the load between instances evenly across AZs. But you still need to enable the AZ for the ALB.

INCORRECT: "The AMI has not been updated to include the new AZ" is incorrect.

AMIs do not have configuration settings to control which AZ they can be launched into.

INCORRECT: "There are no subnets associated with the new AZ" is incorrect.

This cannot be the case as the ASG has already been updated with the new AZ and instances have already been launched there.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-add-availability-zone.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Networking & Content Delivery

Question 18Skipped

A DevOps engineer deployed an application to AWS which makes use of Amazon EC2 Auto Scaling to launch new instances. The engineer needs to modify the instance type used for all new instances that are launched through automatic scaling. The Auto Scaling group is configured to use a launch template.

Which of the following actions should be taken to achieve this requirement?

Launch new EC2 instances with the new instance type using the AWS CLI and attach them to the Auto Scaling group.

Correct answer

Modify the existing launch template to create a new version that uses the new instance type and modify the Auto Scaling group to use the new template version.

Use the Overrides structure to define a new launch template for individual instance types using the existing Auto Scaling group.

Create an AWS Elastic Beanstalk environment to deploy the new instance type for all scaling events.

Overall explanation

When you make a change to an existing launch template it creates a new version of the template. It is then easy to modify the Auto Scaling group to use the new version. As you can see in the diagram below you can modify the launch template used or the version of the launch template used.

In this case the engineer can simply save a new version of the template and then update the version of template used by the Auto Scaling group. All subsequent scaling events will launch using the new version of the template.

CORRECT: "Modify the existing launch template to create a new version that uses the new instance type and modify the Auto Scaling group to use the new template version" is the correct answer (as explained above.)

INCORRECT: "Use the Overrides structure to define a new launch template for individual instance types using the existing Auto Scaling group" is incorrect.

The Overrides structure is used to define a different launch template for specific instance types. The best solution for this scenario is to simply update the launch template.

INCORRECT: "Create an AWS Elastic Beanstalk environment to deploy the new instance type for all scaling events" is incorrect.

There is no need to move the solution to Elastic Beanstalk as the launch template can simply be updated.

INCORRECT: "Launch new EC2 instances with the new instance type using the AWS CLI and attach them to the Auto Scaling group" is incorrect.

This is not a good solution as it is highly manual. The solution should be automated.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/examples-launch-templates-aws-cli.html

Save time with our exam-specific cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 19Skipped

A DevOps team is assisting with the deployment of a web application's infrastructure using AWS CloudFormation. The database management team maintains the database resources in a CloudFormation template, and the software development team maintains the web application resources in a separate CloudFormation template. The software development team needs to use resources maintained by the database engineering team. However, both teams have their own review and lifecycle management processes that they want to maintain. Both teams also require resource-level change-set reviews. The software development team would like to deploy changes to this template using their CI/CD pipeline.

Which solution will meet these requirements?

Create input parameters in the web application CloudFormation template and pass resource names and IDs from the database stack.

Create a CloudFormation nested stack to make cross-stack resource references and parameters available in both stacks.

Correct answer

Create a stack export from the database CloudFormation template and import those references into the web application CloudFormation template.

Create a CloudFormation stack set to make cross-stack resource references and parameters available in both stacks.

Overall explanation

A nested stack is a stack that you create within another stack by using the AWS::CloudFormation::Stack resource. With nested stacks, you deploy and manage all resources from a single stack. You can use outputs from one stack in the nested stack group as inputs to another stack in the group. This differs from exporting values.

If you want to isolate information sharing to within a nested stack group, AWS suggests that you use nested stacks. To share information with other stacks (not just within the group of nested stacks), you should export values instead.

Change sets for nested stacks affect the entire stack hierarchy which does not meet the requirements as each team requires resource-level change-set reviews. Therefore, in this scenario it is better to export values rather than use a nested stack.

CORRECT: "Create a stack export from the database CloudFormation template and import those references into the web application CloudFormation template" is the correct answer (as explained above.)

INCORRECT: "Create a CloudFormation nested stack to make cross-stack resource references and parameters available in both stacks" is incorrect.

As described above, to meet the requirements an export of values is preferable to using nested stacks in this scenario.

INCORRECT: "Create a CloudFormation stack set to make cross-stack resource references and parameters available in both stacks" is incorrect.

Stack sets are used for extending the capability of stacks by enabling you to create, update, or delete stacks across multiple accounts and AWS Regions.

INCORRECT: "Create input parameters in the web application CloudFormation template and pass resource names and IDs from the database stack" is incorrect.

Values should be exported as per the correct answer.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-exports.html#output-vs-nested

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-cloudformation/

Domain

AWS Management & Governance

Question 20Skipped

A financial services company requires that DevOps engineers should not log directly into Amazon EC2 instances that process highly sensitive data except in exceptional circumstances. The security team requires a notification within 15 minutes if a DevOps engineer does log in to an instance.

Which solution will meet these requirements with the least operational overhead?

Correct answer

Install the Amazon CloudWatch agent on the EC2 instances. Configure the agent to push all logs to Amazon CloudWatch Logs and set up a CloudWatch metric filter that searches for user login data. If this information is found, send a notification to the security team using Amazon SNS.

Install the AWS Systems Manager agent on each EC2 instance. Subscribe to Amazon CloudWatch Events notifications. Trigger an AWS Lambda function to check if a message contains user login data. If this information is found, send a notification to the security team using Amazon SNS.

Use AWS Systems Manager to automate the execution of a script on each Amazon EC2 instance that pushes all logs to Amazon S3. Set up an S3 event to trigger an AWS Lambda function that checks if files in S3 contain user login data. If this information is found, send a notification to the security team using Amazon SNS.

Configure an AWS CloudTrail trail and send events to Amazon CloudWatch Logs. Subscribe CloudWatch Logs to an AWS Lambda function. Configure the Lambda function to check if the logs contain user login data. If this information is found, send a notification to the security team using Amazon SNS.

Overall explanation

The CloudWatch Logs agent provides an automated way to send log data to CloudWatch Logs from Amazon EC2 instances. The agent includes the following components:

· A plug-in to the AWS CLI that pushes log data to CloudWatch Logs.

· A script (daemon) that initiates the process to push data to CloudWatch Logs.

· A cron job that ensures that the daemon is always running.

You can create metric filters to match terms in your log events and convert log data into metrics. When a metric filter matches a term, it increments the metric's count. For example, you can create a metric filter that counts the number of times the word ERROR occurs in your log events.

In this case the metric filter can search for user login data and then if this information is found it can send an SNS notification to the security team.

CORRECT: "Install the Amazon CloudWatch agent on the EC2 instances. Configure the agent to push all logs to Amazon CloudWatch Logs and set up a CloudWatch metric filter that searches for user login data. If this information is found, send a notification to the security team using Amazon SNS" is the correct answer (as explained above.)

INCORRECT: "Install the AWS Systems Manager agent on each EC2 instance. Subscribe to Amazon CloudWatch Events notifications. Trigger an AWS Lambda function to check if a message contains user login data. If this information is found, send a notification to the security team using Amazon SNS" is incorrect.

The Systems Manager agent will not gather this information from EC2 instances. The CloudWatch Logs agent must be installed.

INCORRECT: "Configure an AWS CloudTrail trail and send events to Amazon CloudWatch Logs. Subscribe CloudWatch Logs to an AWS Lambda function. Configure the Lambda function to check if the logs contain user login data. If this information is found, send a notification to the security team using Amazon SNS" is incorrect.

CloudTrail will only report on API activity, and this does not include login data from an Amazon EC2 instance.

INCORRECT: "Use AWS Systems Manager to automate the execution of a script on each Amazon EC2 instance that pushes all logs to Amazon S3. Set up an S3 event to trigger an AWS Lambda function that checks if files in S3 contain user login data. If this information is found, send a notification to the security team using Amazon SNS" is incorrect.

This is possible though it is not the best solution as it requires the script to be rerun on a regular basis and requires more operational overhead to create and maintain.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Management & Governance

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries