AWS Certified DevOps Engineer Professional Practice Exams

Practice Test 5: DOP-C02
Open

Practice Test 4: DOP-C02

Practice Test 6: DOP-C02

Set a certification due date

AWS Certified DevOps Engineer – Professional

Course content

AI Assistant

Practice tests

Start

Practice Test 1: DOP-C02

Start

Practice Test 2: DOP-C02

Start

Practice Test 3: DOP-C02

Start

Practice Test 4: DOP-C02

Start

Practice Test 5: DOP-C02

Start

Practice Test 6: DOP-C02

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

[2025] Pass the AWS DevOps Engineer Professional Exam DOP-C02 | Exam-Difficulty Practice Questions + Exam Simulation

Rating: 4.0 out of 54.0
320 ratings

4,812

Students

130 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified DevOps Engineer Professional exam the first time with a great score

EXAM SIMULATION: All practice tests are timed and scored (passing score is 75%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

ALWAYS UP TO DATE: Covering the latest DOP-C02 exam guide, our question bank is regularly updated based on student feedback from the real exam

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ACTIVE Q&A FORUM: In this discussion board, students ask questions and share their recent exam experience offering feedback on which topics were covered

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Description

Are you preparing for the AWS Certified DevOps Engineer Professional exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS DevOps Professional practice exams to assess your exam-readiness and get certified for DOP-C02.

Our course includes 6 AWS practice exams that include a total of 130 unique practice questions. All of our practice tests accurately reflect the difficulty of the Amazon Web Services exam questions and are the most realistic AWS exam experience available on Udemy.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Our questions are continually revised based on feedback from students who have recently taken the AWS exam, so you can be sure that they are up-to-date and reflect the latest exam format.

Our practice exam course is designed to give you a thorough understanding of the key concepts and topics covered in the DOP-C02 exam. Based on your test report that provides you with detailed feedback, you get to identify areas where you need to improve and build the confidence you need to succeed in the actual exam.

TOP REASONS WHY THESE PRACTICE EXAMS ARE YOUR BEST CHANCE TO ACE YOUR AWS EXAM

100% ALIGNED WITH LATEST DOP-C02 EXAM: All practice tests on Udemy are scenario-based reflecting the latest AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

SIMULATE THE REAL CERTIFICATION EXAM: Practice tests are timed (130 min to answer 65 questions) and scored (passing score is 72%) accurately mirroring the real exam environment. This allows you to become familiar with the AWS exam format

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

REGULAR UPDATES OF QUESTIONS: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, most of our students achieve exceptional results, with an average exam score of over 85%.

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered.

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the pass mark for the actual AWS exam is 72%, we highly recommend that you continue taking our AWS practice exams until you achieve a consistent score of 80% or higher. Once you reach this recommended score on our practice tests, you'll be well-prepared to sit the actual exam and achieve a great score.

GET FAMILIAR WITH THE ACTUAL EXAM FORMAT: Our AWS Certified DevOps Pro practice exams are specifically designed to help you become familiar with the test question format and structure of the actual AWS exam. Unlike many other practice tests on the market, our exams closely match the format of the real AWS exam, ensuring that you are adequately prepared for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS DevOps practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Certified DevOps certification exam with confidence.

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy.

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to fast-track their exam success!

MONEY-BACK GUARANTEE

We are totally confident in the value of our Practice Exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

ABOUT THE AWS CERTIFIED DEVOPS ENGINEER PROFESSIONAL CERTIFICATION

The AWS Certified DevOps Engineer Professional certification is one of the most sought-after certifications in the cloud computing industry. AWS DevOps are in huge demand and salaries can be above $150,000 USD per annum. The AWS Certified DevOps s exam aims to test knowledge of the key services and tools used by DevOps creating applications on AWS.

When you're ready to book your exam you can do so on the AWS Training portal. Curious about the AWS DevOps certification cost? The AWS DevOps Professional Certification cost is $300 USD in most regions and you currently have the choice of an online proctored exam or test center (subject to availability).

OUR MISSION

At Digital Cloud Training we are committed to your success. Our mission is to provide you with the resources you need to pass your exam on your first attempt - without wasting time or money. After completing these AWS Certified DevOps Pro Practice Tests and assessing your exam readiness, you'll be more than ready for the real AWS exam.

Who this course is for:

Students preparing for the AWS Certified DevOps Engineer Professional (DOP-C02) exam who want to pass with confidence

Students who want to test their skills in exam simulation, assessing their DOP-C02 exam readiness

Anyone who wants to learn AWS through high-quality questions and answers, explanations and reference links

Anyone who is keen to take their career and salary to the next level with an AWS certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Requirements

This course is designed for individuals with a solid AWS knowledge and experience (at the Associate level)

It is recommended that students have successfully passed one or more of the AWS Associate level exams.

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 5: DOP-C02

DOP-C02 - Results

Back to result overview
Attempt 1

All domains

All domains

AWS Compute

AWS Networking & Content Delivery

AWS Management & Governance

AWS Developer Tools

AWS Application Integration

AWS Security, Identity, & Compliance

AWS Database

20 all

0 correct

0 incorrect

20 skipped

0 marked

Collapse all questions

Question 1Skipped

An application uses an Elastic Load Balancer (ELB) in front of an Auto Scaling group of Amazon EC2 instances. A recent update to the application has resulted in longer times to run and complete bootstrap scripts. The instances often become healthy before they are ready to accept traffic resulting in errors. A DevOps engineer must prevent the instances from being registered with Elastic Load Balancing until the instances are ready to accept traffic.

Which solution meets these requirements?

Increase the health check timeout from the default value to 120 seconds and configure the healthy threshold count to 5.

Create an AWS Lambda function that uses the Auto Scaling API to suspend the health check processes until the bootstrap scripts are complete.

Increase the health check grace period from 300 seconds to 600 seconds to ensure the instances are not marked as healthy before they are ready to accept traffic.

Correct answer

Use an Auto Scaling lifecycle hook to verify that the bootstrap scripts have completed before registering the instances with the ELB.

Overall explanation

Amazon EC2 Auto Scaling offers the ability to add lifecycle hooks to your Auto Scaling groups. These hooks let you create solutions that are aware of events in the Auto Scaling instance lifecycle, and then perform a custom action on instances when the corresponding lifecycle event occurs.

A popular use of lifecycle hooks is to control when instances are registered with Elastic Load Balancing. By adding a launch lifecycle hook to your Auto Scaling group, you can ensure that your bootstrap scripts have completed successfully and the applications on the instances are ready to accept traffic before they are registered to the load balancer at the end of the lifecycle hook.

The following illustration shows the transitions between Auto Scaling instance states:

CORRECT: "Use an Auto Scaling lifecycle hook to verify that the bootstrap scripts have completed before registering the instances with the ELB" is the correct answer (as explained above.)

INCORRECT: "Increase the health check timeout from the default value to 120 seconds and configure the healthy threshold count to 5" is incorrect.

The question specifically states that the solution should prevent the instances from being registered with Elastic Load Balancing until the instances are ready to accept traffic. This solution does not meet the requirement.

INCORRECT: "Increase the health check grace period from 300 seconds to 600 seconds to ensure the instances are not marked as healthy before they are ready to accept traffic" is incorrect.

The HealthCheckGracePeriod parameter for the Auto Scaling group helps Amazon EC2 Auto Scaling distinguish unhealthy instances from newly launched instances that are not yet ready to serve traffic. This grace period can prevent Amazon EC2 Auto Scaling from marking InService instances as unhealthy and terminating them before they have time to finish initializing. This does not affect registration with the load balancer.

INCORRECT: "Create an AWS Lambda function that uses the Auto Scaling API to suspend the health check processes until the bootstrap scripts are complete" is incorrect.

A better solution would be to suspend registration with the load balancer but that was not offered. Suspending health check processes does not meet the requirements.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/lifecycle-hooks.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 2Skipped

A company is deploying a serverless application that includes an Amazon API Gateway REST API and an AWS Lambda function. A DevOps engineer must come up with a strategy for updating the application that enables new features to be tested on a small number of users before rolling out the update to all users.

Which deployment strategy will meet these requirements?

Use the AWS CDK to deploy the serverless services. When code needs to be changed, update the AWS CloudFormation stack, and deploy the new version of the APIs and Lambda functions. Use an Amazon Route 53 failover routing policy for the canary release strategy.

Correct answer

Use AWS CloudFormation to deploy the serverless services and use Lambda function versions. When code needs to be changed, update the CloudFormation stack with the new Lambda code and update the API versions using a canary release strategy. Promote the new version when testing is complete.

Use AWS SAM to deploy the serverless services and use a Lambda alias. When code needs to be changed, update the CloudFormation stack with the new Lambda code and API version. Use an Amazon Route 53 latency routing policy for the canary release strategy.

Use AWS Elastic Beanstalk to deploy the serverless services. When code needs to be changed, deploy a new version of the API and Lambda functions. Shift traffic using a canary release strategy.

Overall explanation

CloudFormation can be used to deploy both the AWS Lambda function and API Gateway REST API. The CloudFormation stack can then be updated to point to new function code when the version needs to be updated. For the REST API the update can be configured to use a canary release strategy to test the updates on a small number of users before full rollout. Once fully tested, the new version of the function code can be configured to take all traffic.

CORRECT: "Use AWS CloudFormation to deploy the serverless services and use Lambda function versions. When code needs to be changed, update the CloudFormation stack with the new Lambda code and update the API versions using a canary release strategy. Promote the new version when testing is complete" is the correct answer (as explained above.)

INCORRECT: "Use the AWS CDK to deploy the serverless services. When code needs to be changed, update the AWS CloudFormation stack, and deploy the new version of the APIs and Lambda functions. Use an Amazon Route 53 failover routing policy for the canary release strategy" is incorrect.

The CDK is used when you need to define cloud application resources using programming languages such as TypeScript, Python, Java etc. and then deploy through CloudFormation. The CDK isn’t needed here, and the Route 53 failover routing policy cannot be used for a canary strategy as it involves one target receiving all traffic until it fails a health check at which time all traffic is failed to the failover target.

INCORRECT: "Use AWS Elastic Beanstalk to deploy the serverless services. When code needs to be changed, deploy a new version of the API and Lambda functions. Shift traffic using a canary release strategy" is incorrect.

You cannot use Elastic Beanstalk to deploy these serverless services.

INCORRECT: "Use AWS SAM to deploy the serverless services and use a Lambda alias. When code needs to be changed, update the CloudFormation stack with the new Lambda code and API version. Use an Amazon Route 53 latency routing policy for the canary release strategy" is incorrect.

The serverless services can be deployed via SAM but should then be updated via the “sam deploy” command. The update of the stack will also update everything in place and the latency routing would not achieve a canary release strategy as it simply routes traffic based on latency (and we only have one target anyway).

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-code.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigateway-deployment-deploymentcanarysettings.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-beanstalk/

Domain

AWS Networking & Content Delivery

Question 3Skipped

A DevOps Engineer manages a containerized rules engine application running inside an Amazon ECS container which pulls configuration files from AWS Systems Manager Parameter Store every time the container spins up. The configuration files are in a JSON format and are around 3 KB in size.

As new clients are onboarding, the engineer must load many new configuration files. The configuration files may increase significantly in number with increasing customer load. The engineer must load the configuration files on the fly after changes are done. The engineer must also ensure a history can be maintained for configuration changes.

What is the best solution for onboarding the new configuration files with the LEAST effort?

Put the configuration files as source code in the form of a properties file and refresh the binding via container restart.

Correct answer

Store configuration files in a versioning enabled Amazon S3 bucket and load the configuration settings using an Amazon EventBridge trigger and AWS Lambda function that is triggered by a cron job.

Use AWS Secret Manager instead of AWS Systems Manager Parameter Store.

Save hierarchical configuration settings in AWS Systems Manager Parameter Store and load this data on application start up.

Overall explanation

SSM Parameter Store is an ideal choice for externalizing the configuration, but it has a limit of 4kb in standard tier and 8kb in advanced tier.

In the scenario where size might exceed 8kb, this configuration needs to externalize via an external store for which S3 is an ideal candidate.

CORRECT: “Store configuration files in a versioning enabled Amazon S3 bucket and load the configuration settings using an Amazon EventBridge trigger and AWS Lambda function that is triggered by a cron job” is the correct answer (as explained above).

INCORRECT: "Put the configuration files as source code in the form of a properties file and refresh the binding via container restart " is a possible option but efforts will be increased hence this is incorrect.

INCORRECT: "Use AWS Secret Manager instead of AWS Systems Manager Parameter Store " is incorrect since secret manager also impose 512-character length restriction on secrets stored.

INCORRECT: "Save hierarchical configuration in a parameter store and load this data on application start up" is incorrect since due to size restriction this will fail" is incorrect since due to size restriction this will fail.

References:

Managing parameter tiers - AWS Systems Manager (amazon.com)

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-systems-manager/

Domain

AWS Management & Governance

Question 4Skipped

A DevOps engineer must implement a serverless service that runs on multiple AWS Lambda functions and uses Amazon DynamoDB as the data store. The functions require a front end that supports unencrypted HTTP and allows routing to the functions based on the path in the URL.

Which solution will meet the requirements?

Correct answer

Deploy an Application Load Balancer (ALB) as the front end. Create an HTTP listener and configure the Lambda functions as targets in separate target groups. Create path-based routing rules that forward requests to targets based on path values in the request.

Deploy an Amazon API Gateway REST API as the front end with an HTTP endpoint. Create resources to represent each URL path and use the ANY method. Use Lambda proxy integrations for each resource.

Deploy a Network Load Balancer (NLB) as the front end. Create an HTTP listener and configure the Lambda functions as targets in separate target groups. Create IP-based routing rules that forward requests to targets based on path values in the request.

Deploy an Amazon API Gateway HTTP API as the front end with an HTTP endpoint. Create resources to represent each URL path and use the ANY method. Use Lambda non-proxy integrations for each resource.

Overall explanation

It is not possible to use Amazon API Gateway for this solution as it only supports encrypted endpoints. This solution requires unencrypted HTTP. The best solution is to use an ALB as the front end and configure the Lambda functions as targets. An HTTP listener can be configured, and rules can be created to map requests to targets based on the path values in the request.

CORRECT: "Deploy an Application Load Balancer (ALB) as the front end. Create an HTTP listener and configure the Lambda functions as targets in separate target groups. Create path-based routing rules that forward requests to targets based on path values in the request" is the correct answer (as explained above.)

INCORRECT: "Deploy a Network Load Balancer (NLB) as the front end. Create an HTTP listener and configure the Lambda functions as targets in separate target groups. Create IP-based routing rules that forward requests to targets based on path values in the request" is incorrect.

You cannot use an NLB for routing to targets based on path values in the requests. IP-based routing does not assist here and is also supported only on the ALB.

INCORRECT: "Deploy an Amazon API Gateway REST API as the front end with an HTTP endpoint. Create resources to represent each URL path and use the ANY method. Use Lambda proxy integrations for each resource" is incorrect.

As explained above, you cannot deploy unencrypted HTTP endpoints with API Gateway, so this solution does not work.

INCORRECT: "Deploy an Amazon API Gateway HTTP API as the front end with an HTTP endpoint. Create resources to represent each URL path and use the ANY method. Use Lambda non-proxy integrations for each resource" is incorrect.

As explained above, you cannot deploy unencrypted HTTP endpoints with API Gateway, so this solution does not work.

References:

https://docs.aws.amazon.com/lambda/latest/dg/services-alb.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Compute

Question 5Skipped

A DevOps engineer updated the AWS CloudFormation template for an application. The stack update failed and CloudFormation attempted to roll back the stack to its previous state. The roll back process failed and generated a UPDATE_ROLLBACK_FAILED error message.

What are the most likely causes for this issue? (Select TWO.)

An interface VPC endpoint was not operational and CloudFormation could not update resources in the VPC.

A change set was not created and executed prior to deploying the updated template to the stack.

Correct selection

The user or role that was used to perform the stack update had insufficient permissions.

Correct selection

Changes to resources were made outside of CloudFormation and the template was not updated.

Amazon EC2 instances included in the stack were updated recently using the ‘yum update’ command.

Overall explanation

This error indicates that a dependent resource can't return to its original state, causing the rollback to fail (UPDATE_ROLLBACK_FAILED state). A dependent resource has likely been changed or cannot be modified. There are several possible causes of this issue which include that a dependent resource has been changed outside of the CloudFormation stack or the resource cannot be modified as the user or role that performed the update has insufficient permissions.

CORRECT: "The user or role that was used to perform the stack update had insufficient permissions" is a correct answer (as explained above.)

CORRECT: "Changes to resources were made outside of CloudFormation and the template was not updated" is also a correct answer (as explained above.)

INCORRECT: "A change set was not created and executed prior to deploying the updated template to the stack" is incorrect.

Change sets are useful but not mandatory. There is no reason that the stack update would fail to roll back because a change set had not been used.

INCORRECT: "An interface VPC endpoint was not operational and CloudFormation could not update resources in the VPC" is incorrect.

CloudFormation uses APIs rather than the network, so it is not reliant on interface endpoints to be able to modify resources in a VPC.

INCORRECT: "Amazon EC2 instances included in the stack were updated recently using the ‘yum update’ command" is incorrect.

This command updates the operating system with the latest patches. There is no reason that running this update would have any bearing on CloudFormation’s ability to roll back a failed update.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-cloudformation/

Domain

AWS Management & Governance

Question 6Skipped

A DevOps manager has been asked to optimize the costs associated with Amazon EBS volumes. There are many unattached EBS volumes which should be deleted if not used for 14 days. The manager asked a DevOps engineer to create an automation solution that deletes volumes that have been unattached for 14 days or more.

Which solution will accomplish this?

Use the AWS Config ec2-volume-inuse-check managed rule to mark unattached volumes are non-compliant. Create a new Amazon CloudWatch Events rule scheduled to invoke an AWS Lambda function in 14 days to delete the non-compliant volumes.

Use AWS Trusted Advisor to detect EBS volumes that have been detached for more than 14 days. Invoke an AWS Lambda function that creates a snapshot and then deletes the EBS volume.

Correct answer

Create an Amazon CloudWatch Events rule to invoke an AWS Lambda function daily. Configure the function to find unattached EBS volumes and tag them with the current date and delete unattached volumes that have tags with dates that are more than 14 days old.

Use Amazon EC2 and Amazon Data Lifecycle Manager to configure a volume lifecycle policy. Set the interval period for unattached EBS volumes to 14 days and set the retention rule to delete. Set the policy target volumes as *.

Overall explanation

CloudWatch Events can be configured with a rule to run an AWS Lambda function on a schedule. The function can be written to find unattached volumes and tag them with the current date. It should avoid tagging volumes that are already tagged and it should delete volumes which have dates older than 14 days. This meets the requirements of the question.

CORRECT: "Create an Amazon CloudWatch Events rule to invoke an AWS Lambda function daily. Configure the function to find unattached EBS volumes and tag them with the current date and delete unattached volumes that have tags with dates that are more than 14 days old" is the correct answer (as explained above.)

INCORRECT: "Use AWS Trusted Advisor to detect EBS volumes that have been detached for more than 14 days. Invoke an AWS Lambda function that creates a snapshot and then deletes the EBS volume" is incorrect.

Trusted Advisor checks for underutilized volumes but the criteria is that a volume is unattached or had less than 1 IOPS per day for the past 7 days.

INCORRECT: "Use the AWS Config ec2-volume-inuse-check managed rule to mark unattached volumes are non-compliant. Create a new Amazon CloudWatch Events rule scheduled to invoke an AWS Lambda function in 14 days to delete the non-compliant volumes" is incorrect.

The function should run daily to delete those that have reached 14 days since being attached. This answer indicates that a specific rule is created for each instance of a non-compliant volume which is inefficient.

INCORRECT: "Use Amazon EC2 and Amazon Data Lifecycle Manager to configure a volume lifecycle policy. Set the interval period for unattached EBS volumes to 14 days and set the retention rule to delete. Set the policy target volumes as *" is incorrect.

DLM assists with automating the lifecycle of snapshots and AMIs. In this case the DevOps team need to automate deletion of unattached EBS volumes.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/RunLambdaSchedule.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Management & Governance

Question 7Skipped

A DevOps engineer needs a managed environment for running a Node.js application. The infrastructure should support load balancing and auto scaling. The application will require a managed relational database, and data should be stored persistently and protected from accidental deletion. The solution should minimize ongoing operational effort.

Which actions should the engineer take to meet these requirements? (Select TWO.)

Correct selection

Create an AWS Elastic Beanstalk environment with load balancing and auto scaling enabled.

Create an auto scaling group of Amazon EC2 instances managed by AWS Systems Manager.

Create multiple AWS Lambda functions and associated Amazon Route 53 multivalue records.

Correct selection

Create an independent Amazon RDS database in an Amazon VPC with automatic backups and deletion protection enabled.

Create an Amazon DynamoDB table in an Amazon VPC with automatic backups and deletion protection enabled.

Overall explanation

AWS Elastic Beanstalk is a service that provides managed infrastructure onto which developers and DevOps engineers can simply add their code. Node.js is supported along with many other popular programming languages. Elastic Beanstalk supports load balancing and auto scaling for the underlying infrastructure.

The question calls for a relational database that is managed. This requirement can be satisfied by deploying an Amazon RDS database. To ensure the database is protected from accidental deletion it should be created independently of the Elastic Beanstalk environment. The engineer may also want to enable deletion protection and automatic backups.

CORRECT: "Create an AWS Elastic Beanstalk environment with load balancing and auto scaling enabled" is a correct answer (as explained above.)

CORRECT: "Create an independent Amazon RDS database in an Amazon VPC with automatic backups and deletion protection enabled" is also a correct answer (as explained above.)

INCORRECT: "Create an auto scaling group of Amazon EC2 instances managed by AWS Systems Manager" is incorrect.

This does not provide the managed infrastructure platform the question requires. Elastic Beanstalk is a better solution as it takes care of the management of the underlying infrastructure. Systems Manager can help with management of EC2, but you are still responsible.

INCORRECT: "Create multiple AWS Lambda functions and associated Amazon Route 53 multivalue records" is incorrect.

This is not a good solution for running highly available and managed code. Lambda scales concurrently and therefore using Route 53 to load balance via DNS resolution is not necessary.

INCORRECT: "Create an Amazon DynamoDB table in an Amazon VPC with automatic backups and deletion protection enabled" is incorrect.

DynamoDB is a NoSQL database, and the question requires that a relational database is deployed.

References:

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.managing.as.html

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/security.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-beanstalk/

https://digitalcloud.training/amazon-dynamodb/

Domain

AWS Compute

Question 8Skipped

An application runs on Amazon ECS instances in an Auto Scaling group behind an Application Load Balancer. An issue has occurred where instances are failing to respond to requests and are failing HTTP target group health checks.

A DevOps engineer has reviewed the configuration and noticed that the application has failed on some EC2 instances and error messages relating to memory usage have been logged in the system logs of affected instances.

The application may have a memory leak and the DevOps engineer needs to take steps to improve the resiliency of the application. Monitoring and notifications should be enabled for when issues occur.

Which combination of actions will meet these requirements? (Select TWO.)

Configure an Amazon CloudWatch alarm that automatically recovers instances based on EC2 status checks.

Correct selection

Configure the Amazon CloudWatch agent on the EC2 instances. Create an alarm based on memory utilization metrics and send a message to an Amazon SNS topic when the alarm is triggered.

Configure an alarm in Amazon CloudWatch that monitors memory utilization and sends a message to an Amazon SNS topic when memory utilization is high.

Correct selection

Configure the Auto Scaling group configuration to replace the EC2 instances when they fail the load balancer's health checks.

Configure the target group health checks to use TCP rather than HTTP and set the port to the port the application is listening on.

Overall explanation

By default, Amazon EC2 Auto Scaling ignores the results of the Elastic Load Balancing health checks. However, you can enable these health checks for your Auto Scaling group. After you do this, when Elastic Load Balancing reports a registered instance as unhealthy, Amazon EC2 Auto Scaling marks the instance as unhealthy on its next periodic health check and replaces it. This will resolve the issue of having EC2 instances running that are out of memory and on which the application has failed.

Amazon CloudWatch does not collect memory utilization metrics by default. To get notifications the DevOps engineer can install the Amazon CloudWatch agent on the EC2 instances. The agent includes metrics such as ‘mem_active’, ‘mem_available’, and ‘mem_free’. This information can be used in a CloudWatch alarm to trigger notifications via SNS if an alarm threshold is exceeded.

CORRECT: "Configure the Auto Scaling group configuration to replace the EC2 instances when they fail the load balancer's health checks" is a correct answer (as explained above.)

CORRECT: "Configure the Amazon CloudWatch agent on the EC2 instances. Create an alarm based on memory utilization metrics and send a message to an Amazon SNS topic when the alarm is triggered" is also a correct answer (as explained above.)

INCORRECT: "Configure an Amazon CloudWatch alarm that automatically recovers instances based on EC2 status checks" is incorrect.

EC2 instance status checks do not check the application, they check the underlying instance, software, and network connectivity. In this case, the underlying instance is healthy, but the application has failed, and this will not be detected through status checks.

INCORRECT: "Configure the target group health checks to use TCP rather than HTTP and set the port to the port the application is listening on" is incorrect.

The application runs on port 80 and it is a web service. Changing the health check from HTTP to TCP but with the same port will not make any difference. Also, with an ALB you can only use HTTP or HTTPS for health checks, so the configuration is not even possible.

INCORRECT: "Configure an alarm in Amazon CloudWatch that monitors memory utilization and sends a message to an Amazon SNS topic when memory utilization is high" is incorrect.

CloudWatch does collect memory utilization metrics from EC2 instances by default. You must use the CloudWatch agent.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-health-checks.html

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/metrics-collected-by-CloudWatch-agent.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 9Skipped

A development team use a staging deployment of an application to test updates. The application includes an Amazon RDS database instances and Amazon EC2 instances. The resources only need to run when testing deployments are run using AWS CodePipeline. The testing usually runs for just a few hours a couple of times each week. A DevOps engineer wants cost-effective automating the instantiation and shutdown of the resources without changing the architecture of the application

Which solution best meets the requirements?

Convert the RDS database to an Amazon Aurora Serverless database and create an Application Load Balancer for EC2. Use an AWS Lambda function to start and stop the EC2 and RDS instances before and after tests.

Replace the EC2 instances with EC2 Spot Instances and the RDS database with an RDS Reserved Instance. Use AWS CLI commands to start and stop EC2 and RDS instances before and after tests.

Correct answer

Configure CodePipeline to subscribe to an event in Amazon EventBridge that triggers an AWS Systems Manager automation document that starts and stops the EC2 and RDS instances before and after deployment tests.

Put the EC2 instances into an Auto Scaling group. Use Application Auto Scaling to configure a scheduled scaling event that runs at the start of the deployment tests.

Overall explanation

You can monitor CodePipeline events in EventBridge and then trigger another service to run using the event data. In this case, the DevOps engineer can create an event pattern that triggers the Systems Manager automation document to run when a CodePipeline execution has been initiated.

CORRECT: "Configure CodePipeline to subscribe to an event in Amazon EventBridge that triggers an AWS Systems Manager automation document that starts and stops the EC2 and RDS instances before and after deployment tests" is the correct answer (as explained above.)

INCORRECT: "Convert the RDS database to an Amazon Aurora Serverless database and create an Application Load Balancer for EC2. Use an AWS Lambda function to start and stop the EC2 and RDS instances before and after tests" is incorrect.

This requires more of an architectural change to the application and there is no automated solution for triggering the execution of the Lambda function.

INCORRECT: "Put the EC2 instances into an Auto Scaling group. Use Application Auto Scaling to configure a scheduled scaling event that runs at the start of the deployment tests" is incorrect.

There is no solution here for the RDS database, this answer only provides a partial solution for EC2 instances.

INCORRECT: "Replace the EC2 instances with EC2 Spot Instances and the RDS database with an RDS Reserved Instance. Use AWS CLI commands to start and stop EC2 and RDS instances before and after tests" is incorrect.

Changing the pricing structure does not automate starting and stopping the resources. Also, a reserved instance is not a good pricing option for this solution as it means you have paid regardless of whether the resource is running. The AWS CLI commands are not automated in this answer.

References:

https://docs.aws.amazon.com/codepipeline/latest/userguide/detect-state-changes-cloudwatch-events.html

https://aws.amazon.com/blogs/mt/systems-manager-automation-documents-manage-instances-cut-costs-off-hours/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 10Skipped

To improve security, a company plans to use AWS Systems Manager Session Manager to manage EC2 instances instead of using key pairs. The company also requires that access to Session Manager goes across private networks only.

Which combinations of actions will accomplish this? (Select TWO.)

Deploy an AWS Site to Site VPN in the relevant AWS Region for private access to Systems Manager.

Run the ‘aws configure’ command on all EC2 instances to add access keys that provide the required Systems Manager permissions.

Correct selection

Attach an IAM policy providing the required Systems Manager permissions to an existing IAM instance profile.

Correct selection

Create VPC endpoints for Systems Manager in the relevant AWS Region to provide private access.

Update all EC2 instance security groups to allow SSH port TCP 22 inbound from the VPC CIDR.

Overall explanation

Session Manager is a fully managed AWS Systems Manager capability. With Session Manager, you can manage Amazon EC2 instances, edge devices, and on-premises servers and virtual machines (VMs).

Session Manager provides secure and auditable node management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys. You do not need to open SSH ports in security groups and can enable private access using VPC endpoints.

To manage your instances using Session Manager you must install the Systems Manager agent on them and provide the necessary permissions for management. Permissions should be assigned through IAM instance profiles and policies.

CORRECT: "Attach an IAM policy providing the required Systems Manager permissions to an existing IAM instance profile" is a correct answer (as explained above.)

CORRECT: "Create VPC endpoints for Systems Manager in the relevant AWS Region to provide private access" is also a correct answer (as explained above.)

INCORRECT: "Update all EC2 instance security groups to allow SSH port TCP 22 inbound from the VPC CIDR" is incorrect.

With Systems Manager Session Manager you do not need to open SSH ports.

INCORRECT: "Deploy an AWS Site to Site VPN in the relevant AWS Region for private access to Systems Manager" is incorrect.

The private access between Session Manager and EC2 instances happens within AWS via VPC endpoints. A VPN cannot be used.

INCORRECT: "Run the ‘aws configure’ command on all EC2 instances to add access keys that provide the required Systems Manager permissions" is incorrect.

This is a less secure method of providing the permissions needed by the EC2 instances. The better option is to use IAM instance profiles and policies.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-systems-manager/

Domain

AWS Management & Governance

Question 11Skipped

An application is being deployed using an AWS CodePipeline pipeline. The pipeline includes an AWS CodeBuild stage which downloads source code from AWS CodeCommit, pulls data from an S3 bucket, and builds and tests the application before deployment.

A DevOps engineer has discovered that the S3 data is not being successfully downloaded due to a permissions issue.

How can the permissions be assigned to CodeBuild in the MOST secure manner?

Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token. Update the buildspec to use cURL to pass the token and download the data.

Correct answer

Modify the service role for the CodeBuild project to include permissions for S3. Use the AWS CLI to download the data.

Configure an IAM access key and a secret access key in the application code and use the AWS CLI to download the data.

Use an aws:Referer condition key in the CodeBuild project settings. Update the buildspec to use the AWS CLI to download the data.

Overall explanation

The most likely issue is that the service role used by AWS CodeBuild does not have the correct permissions to download the data securely from the Amazon S3 bucket. CodeBuild uses the service role for all operations that are performed on your behalf. Therefore, the role must have the permissions needed during the build stage.

In this case, simply adding the correct permissions statements to the policy attached to the service role should resolve the permission issue. The data can then be downloaded from S3 using the AWS CLI by specifying commands in the buildspec document.

CORRECT: "Modify the service role for the CodeBuild project to include permissions for S3. Use the AWS CLI to download the data" is the correct answer (as explained above.)

INCORRECT: "Configure an IAM access key and a secret access key in the application code and use the AWS CLI to download the data" is incorrect.

This is an insecure method of using credentials and should be avoided. It would also not provide the permissions needed by CodeBuild as the service gets those permissions from the service role.

INCORRECT: "Use an aws:Referer condition key in the CodeBuild project settings. Update the buildspec to use the AWS CLI to download the data" is incorrect.

The condition key referenced is used in policies to restrict access to specific HTTP referers. This is not useful here as it does not provide any permissions to CodeBuild.

INCORRECT: "Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token. Update the buildspec to use cURL to pass the token and download the data" is incorrect.

You cannot configure different authentication options on S3 as it is a managed service. You can only limit who can access the bucket and objects and under what conditions.

References:

https://docs.aws.amazon.com/codebuild/latest/userguide/setting-up.html#setting-up-service-role

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 12Skipped

An application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The instances often come online before they are ready which leads to errors being experienced. The health check configuration provides a 60-second grace period and considers instances healthy after two 200 response codes from /index.php. This page can respond intermittently during the deployment process.

A DevOps engineer has been tasked with troubleshooting the errors. The instances should come online as soon as possible but not before they are ready.

Which strategy can be used to address this issue?

Which strategy would address this issue?

Modify the deployment script to create a /health-check.php file at the beginning of the deployment and modify the health check path to point to that file.

Increase the instance grace period from 60 seconds to 300 seconds, and the consecutive health check requirement from 2 to 3.

Increase the instance grace period from 60 seconds to 180 seconds and change the response code requirement from 200 to 202.

Correct answer

Modify the deployment script to create a /health-check.php file at the end of the deployment and modify the health check path to point to that file.

Overall explanation

The correct solution includes the creation of a health-check.php file at the end of the deployment when the application should be running consistently. The health check path is reconfigured to point to this file. This means that as soon as the application deployment is complete the health checks should start to return success (200) status codes and the instances will be marked as healthy.

CORRECT: "Modify the deployment script to create a /health-check.php file at the end of the deployment and modify the health check path to point to that file" is the correct answer (as explained above.)

INCORRECT: "Modify the deployment script to create a /health-check.php file at the beginning of the deployment and modify the health check path to point to that file" is incorrect.

This solution creates the health-check.php file too early in the process. The application may not be ready at this point so if the file is present the 200 response codes will be returned, and the instance will be marked as healthy despite the application not being ready to process requests. The question indicates that errors have been experienced due to the application being marked as healthy too early.

INCORRECT: "Increase the instance grace period from 60 seconds to 300 seconds, and the consecutive health check requirement from 2 to 3" is incorrect.

The grace period helps Amazon EC2 Auto Scaling distinguish unhealthy instances from newly launched instances that are not yet ready to serve traffic. This grace period can prevent Amazon EC2 Auto Scaling from marking InService instances as unhealthy and terminating them before they have time to finish initializing. The issue experienced is not related to instances being terminated too early, it is related to instances coming online (marked as healthy) too early.

Changing the health check requirement from 2 to 3 may help delay bringing the application online but depends on the interval specified.

INCORRECT: "Increase the instance grace period from 60 seconds to 180 seconds and change the response code requirement from 200 to 202" is incorrect.

As above, the changing the health check requirement from 2 to 3 may help delay bringing the application online but depends on the interval specified. Changing the response code requirement will not make any positive difference here.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-health-checks.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 13Skipped

A company runs an application across thousands of EBS-backed Amazon EC2 instances. The company needs to ensure availability of the application and requires that instances are restarted when an EC2 instance retirement event is scheduled.

How can this a DevOps engineer automate this task?

Create a rule in Amazon EventBridge with Amazon EC2 as the source and look for EC2 instance state-change notifications that indicate the instance is shutting down. Run an AWS Systems Manager automation document that starts the affected instances.

Create an Amazon CloudWatch alarm for EC2 status checks. Configure the alarm to trigger an Amazon SNS notification to the operations team and have them stop and start affected instances.

Enable EC2 Auto Recovery on all instances. Configure an Amazon CloudWatch alarm with the alarm action set to Recover. Specify a time for recovery that is outside of business hours.

Correct answer

Create a rule in Amazon EventBridge with AWS Health as the source and look for instance retirement scheduled events. Run an AWS Systems Manager automation document that stops and starts affected instances.

Overall explanation

An EC2 instance is scheduled for retirement when AWS detects an irreparable failure in the infrastructure that's hosting your instance. You are required to stop and then start the instance at your preferred time before the instance retirement date. Stopping and starting the instance moves the instance to another healthy host.

The best way to automate this process is to create a rule in Amazon EventBridge that looks for AWS Health events. The specific event is:

“AWS_EC2_INSTANCE_RETIREMENT_SCHEDULED”

When this event occurs EventBridge can trigger an AWS Systems Manager automation document that stops and starts the EC2 instances.

CORRECT: "Create a rule in Amazon EventBridge with AWS Health as the source and look for instance retirement scheduled events. Run an AWS Systems Manager automation document that stops and starts affected instances" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon CloudWatch alarm for EC2 status checks. Configure the alarm to trigger an Amazon SNS notification to the operations team and have them stop and start affected instances" is incorrect.

Status checks do not inform us that an instance retirement event is scheduled, they let us know if there are issues that are affecting the instances or hosts.

INCORRECT: "Enable EC2 Auto Recovery on all instances. Configure an Amazon CloudWatch alarm with the alarm action set to Recover. Specify a time for recovery that is outside of business hours" is incorrect.

Auto Recovery will recover an instance automatically, but this is not related to retirement events. You also cannot configure a time schedule in the alarm action.

INCORRECT: "Create a rule in Amazon EventBridge with Amazon EC2 as the source and look for EC2 instance state-change notifications that indicate the instance is shutting down. Run an AWS Systems Manager automation document that starts the affected instances" is incorrect.

This would restart all instances that are shutdown, so the scope is too broad. We specifically want to target only the instances that are affected by retirement events.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-retirement/

https://docs.aws.amazon.com/health/latest/ug/cloudwatch-events-health.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-systems-manager/

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Application Integration

Question 14Skipped

A gaming startup company is finishing its migration to AWS and realizes that many DevOps engineers have permissions to delete Amazon DynamoDB tables.

A solution is required to receive near real-time notifications when the API call DeleteTable is invoked in DynamoDB.

Which actions should be taken to achieve this requirement most cost-effectively?

Create an Amazon CloudWatch event filter that monitors for DeleteTable API actions and sends an alert via Amazon SNS.

Create an AWS CloudTrail event filter and use an AWS Lambda function to send an Amazon SNS notification.

Correct answer

Create an AWS CloudTrail trail. Create an Amazon EventBridge rule to track an AWS API call via CloudTrail and use Amazon SNS as a target.

Enable DynamoDB Streams and configure an AWS Lambda function to process events from the stream. Send alerts using Amazon SNS.

Overall explanation

To create a rule that triggers on an action by an AWS service that does not emit events, you can base the rule on API calls made by that service. The API calls are recorded by AWS CloudTrail. You must create an AWS CloudTrail trail. For the given use-case, we can use the 'AWS API Call via CloudTrail' feature of CloudWatch Events and set up SNS as a target to achieve the desired outcome.

CORRECT: "Create an AWS CloudTrail trail. Create an Amazon EventBridge rule to track an AWS API call via CloudTrail and use Amazon SNS as a target" is the correct answer (as explained above.)

INCORRECT: "Enable DynamoDB Streams and configure an AWS Lambda function to process events from the stream. Send alerts using Amazon SNS" is incorrect.

This would be less cost-effective compared to using AWS CloudTrail and Amazon EventBridge.

INCORRECT: "Create an AWS CloudTrail event filter and use an AWS Lambda function to send an Amazon SNS notification" is incorrect.

Event filters are used with CloudWatch, not with CloudTrail.

INCORRECT: "Create an Amazon CloudWatch event filter that monitors for DeleteTable API actions and sends an alert via Amazon SNS" is incorrect.

API actions are tracked by AWS CloudTrail but not by Amazon CloudWatch.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-CloudTrail-Rule.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Security, Identity, & Compliance

Question 15Skipped

The security team at a company requires a solution to identify activities that indicate that Amazon EC2 instances have been compromised. The solution should notify them by email if issues are discovered.

Which solution will meet these requirements?

Correct answer

Configure AWS GuardDuty to identify activities that indicate the EC2 instances have been compromised. Create an Amazon EventBridge rule with an event source set to ‘aws.guardduty’. Send a notification using an Amazon SNS topic when the specified events are logged.

Install the AWS Systems Manager agent on the EC2 instances and attach an instance profile with the necessary permissions. Configure Systems Manager to alert via an Amazon SNS topic if malicious activities are detected on the EC2 instances.

Configure Amazon Inspector to identify activities that indicate the EC2 instances have been compromised. Configure Inspector to send notifications directly via an Amazon SNS topic when there are changes in the state of findings.

Create an AWS CloudTrail trail and log API events that indicate account compromise. Create an alarm in Amazon CloudWatch based on a custom metric filter for the API events. Send a notification via an Amazon SNS topic.

Overall explanation

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, EC2 workloads, container applications, and data stored in Amazon Simple Storage Service (S3)

GuardDuty provides threat detection services that cover several types of activity. One of these is instance compromise as per the following description of the scope of this service:

Activity indicating an instance compromise, such as cryptocurrency mining, backdoor command, and control (C&C) activity, malware using domain generation algorithms (DGA), outbound denial of service activity, unusually high network traffic volume, unusual network protocols, outbound instance communication with a known malicious IP, temporary Amazon EC2 credentials used by an external IP address, and data exfiltration using DNS.

The GuardDuty findings are automatically logged to Amazon CloudWatch Events. You can then use EventBridge to create a rule that triggers an action when certain events that match the filter pattern are logged. In this case the trigger will be Amazon SNS as the security team require an email notification.

CORRECT: "Configure AWS GuardDuty to identify activities that indicate the EC2 instances have been compromised. Create an Amazon EventBridge rule with an event source set to ‘aws.guardduty’. Send a notification using an Amazon SNS topic when the specified events are logged" is the correct answer (as explained above.)

INCORRECT: "Configure Amazon Inspector to identify activities that indicate the EC2 instances have been compromised. Configure Inspector to send notifications directly via an Amazon SNS topic when there are changes in the state of findings" is incorrect.

Inspector does not identify instance compromise activities, use GuardDuty for this use case.

INCORRECT: "Install the AWS Systems Manager agent on the EC2 instances and attach an instance profile with the necessary permissions. Configure Systems Manager to alert via an Amazon SNS topic if malicious activities are detected on the EC2 instances" is incorrect.

Systems Manager does not identify instance compromise activities, use GuardDuty for this use case.

INCORRECT: "Create an AWS CloudTrail trail and log API events that indicate account compromise. Create an alarm in Amazon CloudWatch based on a custom metric filter for the API events. Send a notification via an Amazon SNS topic" is incorrect.

The question asks for identifying activities relating to instance compromise rather than account compromise. Either way, GuardDuty is the best tool for this job as it will discover possible compromise by looking at CloudTrail API events as well as other data sources.

References:

https://aws.amazon.com/guardduty/features/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-guardduty/

Domain

AWS Security, Identity, & Compliance

Question 16Skipped

An application that was updated is returning HTTP 502 Bad Gateway errors to users. The application runs on Amazon EC2 instances in an Auto Scaling group that spans multiple Availability Zones.

The DevOps engineer wants to analyze the issue, but Auto Scaling is terminating the instances shortly after launch as the health check status is changing to unhealthy.

What steps can the DevOps engineer take to gain access to one of the instances for troubleshooting?

Correct answer

Add a lifecycle hook to your Auto Scaling group to move instances in the Terminating state to the Terminating:Wait state.

Take a snapshot of the attached EBS volumes. Create an image from the snapshot and launch an instance from the image.

Edit the Auto Scaling group to enable termination protection as this will protect unhealthy instances from being terminated.

Suspend the AZRebalance auto scaling process to prevent instances from being terminated.

Overall explanation

The DevOps engineer can add a lifecycle hook to the AWS Auto Scaling group to move instances in the Terminating state to the Terminating:Wait state. In this state, the engineer can access instances before they're terminated, and then troubleshoot why they were marked as unhealthy.

By default, an instance remains in the Terminating:Wait state for 3600 seconds (1 hour). To increase this time, you can use the heartbeat-timeout parameter in the put-lifecycle-hook API call. The maximum time that you can keep an instance in the Terminating:Wait state is 48 hours or 100 times the heartbeat timeout, whichever is smaller.

CORRECT: "Add a lifecycle hook to your Auto Scaling group to move instances in the Terminating state to the Terminating:Wait state" is the correct answer (as explained above.)

INCORRECT: "Suspend the AZRebalance auto scaling process to prevent instances from being terminated" is incorrect.

This would not stop instances that are unhealthy from being terminated. This simply prevents Auto Scaling rebalancing the instances across AZs.

INCORRECT: "Take a snapshot of the attached EBS volumes. Create an image from the snapshot and launch an instance from the image" is incorrect.

It may not be possible to take a snapshot from an instance that is being terminated. Also, the state of the instance would not be captured, only the contents of the EBS volume.

INCORRECT: "Edit the Auto Scaling group to enable termination protection as this will protect unhealthy instances from being terminated" is incorrect.

This will only prevent the Auto Scaling group from being deleted, it does not have any effect on how instances are terminated.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/auto-scaling-delay-termination/

Save time with our exam-specific cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 17Skipped

A company uses a tagging strategy to allocate usage costs for AWS resources. An application runs on Amazon EC2 instances in an Auto scaling group. The Amazon EBS volumes that are attached to instances are being created without the correct cost center tags. A DevOps engineer must correct the configuration to ensure the EBS volumes are tagged appropriately.

What is the MOST efficient solution that meets this requirement?

Use AWS Config to enforce tagging at EBS volume creation time and deny creation of any volumes that do not have the appropriate cost center tags.

Update the Auto Scaling group to include the cost center tags. Set the PropagateAtLaunch property to true.

Use Tag Editor to scan the account for EBS volumes that are missing the tags and then add the cost center tags to the volumes.

Correct answer

Update the Auto Scaling group launch template to include the cost center tags for EBS volumes.

Overall explanation

You can tag new or existing Auto Scaling groups. You can also propagate tags from an Auto Scaling group to the EC2 instances that it launches.

Tags are not propagated to Amazon EBS volumes. To add tags to Amazon EBS volumes, specify the tags in a launch template.

CORRECT: "Update the Auto Scaling group launch template to include the cost center tags for EBS volumes" is the correct answer (as explained above.)

INCORRECT: "Update the Auto Scaling group to include the cost center tags. Set the PropagateAtLaunch property to true" is incorrect.

As noted above, you cannot propagate tags from an Auto Scaling group to EBS volumes.

INCORRECT: "Use AWS Config to enforce tagging at EBS volume creation time and deny creation of any volumes that do not have the appropriate cost center tags" is incorrect.

AWS Config can be used to report on compliance but cannot stop volume creation.

INCORRECT: "Use Tag Editor to scan the account for EBS volumes that are missing the tags and then add the cost center tags to the volumes" is incorrect.

Tag Editor is not an efficient solution as it would involve manual work. The correct solution is fully automated.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-tagging.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Management & Governance

Question 18Skipped

When deploying a newly developed application on AWS, a DevOps team notices an intermittent error when attempting to make a connection to the application.

The application has a two-tier architecture with an AWS Lambda function backed by an Amazon API gateway and a NoSQL database as the data store.

The DevOps team noticed that sometime after deployment the error stops occurring. This application is deployed by AWS CodeDeploy and the Lambda function is deployed as the last step of pipeline.

What is the most efficient way for a DevOps engineer to resolve the issue?

Correct answer

Add a BeforeAllowTraffic hook to the AppSpec file which tests and waits for any necessary database changes before traffic can flow to the new version of the Lambda function.

Use DownloadBundle event hook in which CodeDeploy agent copies the application revision files to a temporary location which can be analyzed.

Add an AfterAllowTraffic hook to the AppSpec file that forces traffic to wait for any pending database changes before allowing the new version of the Lambda function to respond.

Use the ValidateService hook to validate that the deployment was completed successfully.

Overall explanation

An AWS Lambda hook is one Lambda function specified with a string on a new line after the name of the lifecycle event. Each hook is executed once per deployment. Here are descriptions of the hooks available for use in your AppSpec file.

· BeforeAllowTraffic – Use to run tasks before traffic is shifted to the deployed Lambda function version.

· AfterAllowTraffic – Use to run tasks after all traffic is shifted to the deployed Lambda function version.

CORRECT: "Add a BeforeAllowTraffic hook to the AppSpec file which tests and waits for any necessary database changes before traffic can flow to the new version of the Lambda function" is the correct answer (as explained above.)

INCORRECT: "Add an AfterAllowTraffic hook to the AppSpec file that forces traffic to wait for any pending database changes before allowing the new version of the Lambda function to respond" is incorrect.

You can use this deployment lifecycle event to run tasks on instances after they are deregistered from a load balancer.

INCORRECT: "Use DownloadBundle event hook in which CodeDeploy agent copies the application revision files to a temporary location which can be analyzed" is incorrect.

Since the error resolves after some time, the issue will most likely be resolved by ensuring the application is not brought online until it is ready.

INCORRECT: "Use the ValidateService hook to validate that the deployment was completed successfully" is incorrect.

This is used to verify the deployment was completed successfully, this will only detect deployment status and will not help in this scenario.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html#appspec-hooks-lambda

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-developer-tools/

Domain

AWS Developer Tools

Question 19Skipped

A critical application runs on Amazon EC2 instances in an Auto Scaling group. A script runs on the instances every 10 seconds to check application availability. A DevOps engineer must use this information returned by the script to monitor the application and trigger an alarm if there is an issue. The data should be collected every 1-minute and the solution must be cost-effective.

Which action should the engineer take?

Use a default CloudWatch metric with a standard resolution, use a dimension to publish data sets every 1-minute.

Use a custom Amazon CloudWatch metric with a high resolution and publish the data every 10 seconds.

Correct answer

Use a custom Amazon CloudWatch metric and configure a statistic set that aggregates data points and publishes the data every 1-minute.

Use a default CloudWatch metric with a high resolution, aggregate multiple data points, and publish the data every 1-minute.

Overall explanation

You can create custom metrics to send to Amazon CloudWatch. With custom metrics you can choose standard or high resolution and you can aggregate multiple data points and publish data as a statistic set to reduce cost and increase efficiency.

Each metric is one of the following:

Standard resolution, with data having a one-minute granularity.

High resolution, with data at a granularity of one second.

Metrics produced by AWS services are standard resolution by default. When you publish a high-resolution metric, CloudWatch stores it with a resolution of 1 second, and you can read and retrieve it with a period of 1 second, 5 seconds, 10 seconds, 30 seconds, or any multiple of 60 seconds.

You can aggregate your data before you publish to CloudWatch. When you have multiple data points per minute, aggregating data minimizes the number of calls to put-metric-data.

Therefore, the engineer can use statistic sets to aggregate and publish the data every one minute. This is the most cost-effective solution that meets the requirements.

CORRECT: "Use a custom Amazon CloudWatch metric and configure a statistic set that aggregates data points and publishes the data every 1-minute" is the correct answer (as explained above.)

INCORRECT: "Use a default CloudWatch metric with a high resolution, aggregate multiple data points, and publish the data every 1-minute" is incorrect.

You cannot use high resolution with a default CloudWatch metric and a default CloudWatch metric would not be available for the application availability data.

INCORRECT: "Use a custom Amazon CloudWatch metric with a high resolution and publish the data every 10 seconds" is incorrect.

This would be less efficient and more costly as the put-metric-data API action would be run every 10 seconds. Fewer API calls means lower cost so aggregating into a statistic set is better and publishing every 1-minute.

INCORRECT: "Use a default CloudWatch metric with a standard resolution, use a dimension to publish data sets every 1-minute" is incorrect.

There would not be a default metric available that uses the data returned from the application availability script. A dimension is used for organizing and clarifying what the metric data is and what it stores.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/publishingMetrics.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Management & Governance

Question 20Skipped

An online sales application is being migrated to AWS with the application layer hosted on Amazon EC2 instances and the database layer on a PostgreSQL database. It is mandated that the application must have minimal downtime as it receives traffic 24/7 and any downtime may reduce business revenue. The application must also be fault tolerant including the data layer.

Concerns have been raised around performance of the database layer during sales events and other peak periods. The application must also be continually scanned for vulnerabilities.

Which option will meet the above requirements?

Correct answer

Create an Auto Scaling group of EC2 instances in a multi-AZ configuration. Deploy an Application Load Balancer to serve traffic to the Auto Scaling group. For the database, use Amazon Aurora for improved throughput in a multi-master configuration for high availability. Use Amazon Inspector to perform automatic security assessments.

Create an Auto Scaling group of EC2 instances in a multi-AZ configuration. Deploy an Application Load Balancer to serve traffic to the Auto Scaling group. For the database, use Amazon Aurora for improved throughput in a multi-master configuration. Use Amazon GuardDuty to perform automatic security assessments.

Create an Auto Scaling group of EC2 instances in a multi-AZ configuration. Deploy an Application Load Balancer to serve traffic to the Auto Scaling group. For the database, use RDS PostgreSQL for improved throughput in a multi-master configuration for high availability. Use Amazon Inspector to perform automatic security assessments.

Create an Auto Scaling group of EC2 instances in a multi-AZ configuration. Deploy an Application Load Balancer to serve traffic to the Auto Scaling group. For the database, use Amazon Aurora for improved throughput in a multi-master configuration. Use Amazon Macie to perform automatic security assessments.

Overall explanation

The above question clearly mandates three requirements:

1. Performance- Create an Auto Scaling group of EC2 instances in a multi-AZ configuration. Deploy an Application Load Balancer to serve traffic to the Auto Scaling group

2. Database performance- Amazon Aurora will perform better than PostgreSQL since it provides multi-master configuration and can be scaled better than RDS on a global scale.

3. Vulnerability assessment- Amazon Inspector is the right fit for the scanning. The difference between Amazon Inspector and Amazon GuardDuty is that the former "checks what happens when you actually get an attack" and the latter "analyzes the actual logs to check if a threat exists". The purpose of Amazon Inspector is to test whether you are addressing common security risks in the target AWS.

Database categorization and selection parameters:

· If your scaling needs are for standard/ general purpose applications, RDS is the better option. You can auto-scale the database to max capacity with just a few clicks on the AWS console.

· You also have the option of Aurora Serverless that can scale up or scale down well, you have to be aware of several restrictions that apply in the Serverless mode.

· If you must handle a very high volume of read/write requests, DynamoDB is a better choice. It scales seamlessly with no impact on performance. You can run these database servers in on-demand or provisioned capacity mode.

If you have heavy write workloads and require more than five read replicas, Aurora is a better choice. Since Aurora uses shared storage for writer and readers, there is minimal replica lag. RDS allows only up to five replicas and the replication process is slower than Aurora.

CORRECT: "Create an Auto Scaling group of EC2 instances in a multi-AZ configuration. Deploy an Application Load Balancer to serve traffic to the Auto Scaling group. For the database, use Amazon Aurora for improved throughput in a multi-master configuration for high availability. Use Amazon Inspector to perform automatic security assessments" is the correct answer (as explained above.)

INCORRECT: "Create an Auto Scaling group of EC2 instances in a multi-AZ configuration. Deploy an Application Load Balancer to serve traffic to the Auto Scaling group. For the database, use RDS PostgreSQL for improved throughput in a multi-master configuration for high availability. Use Amazon Inspector to perform automatic security assessments" is incorrect.

Amazon Aurora is a better fit for this use case as described above.

INCORRECT: "Create an Auto Scaling group of EC2 instances in a multi-AZ configuration. Deploy an Application Load Balancer to serve traffic to the Auto Scaling group. For the database, use Amazon Aurora for improved throughput in a multi-master configuration. Use Amazon Macie to perform automatic security assessments" is incorrect.

Amazon Inspector should be used for performing the security assessments.

INCORRECT: "Create an Auto Scaling group of EC2 instances in a multi-AZ configuration. Deploy an Application Load Balancer to serve traffic to the Auto Scaling group. For the database, use Amazon Aurora for improved throughput in a multi-master configuration. Use Amazon GuardDuty to perform automatic security assessments" is incorrect.

Amazon Inspector should be used for performing the security assessments.

References:

https://aws.amazon.com/guardduty/

https://aws.amazon.com/blogs/database/is-amazon-rds-for-postgresql-or-amazon-aurora-postgresql-a-better-choice-for-me/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries