Practice Exams | AWS Certified DevOps Engineer Professional

Practice Test 2: Full Practice Test - AWS Certified DevOps Engineer Professional - DOP-C02
Open

Practice Test 1: Mini Practice Test: AWS Certified…

Finish course

Set a certification due date

AWS Certified DevOps Engineer – Professional

Course content

AI Assistant

Practice tests

Start

Practice Test 1: Mini Practice Test: AWS Certified DevOps Engineer Professional - DOP-C02

Start

Practice Test 2: Full Practice Test - AWS Certified DevOps Engineer Professional - DOP-C02

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

AWS Certified DevOps: 120 high fidelity questions: AWS Certified DevOps Engineer Professional DOP-C02.

Rating: 4.5 out of 54.5
2,609 ratings

31,064

Students

120 questions

Total

Last updated May 2024

English

What you'll learn

120 original questions for AWS Certified DevOps Engineer Professional (DOP-C02)

Detailed explanations for each question, right and wrong answer

Similar difficulty to the actual exam.

Should be taken after doing the full AWS Certified DevOps Engineer Professional course

Description

Preparing for AWS Certified DevOps Engineer Professional Certification? This is THE practice exams course to give you the winning edge.

These practice exams have been co-authored by Stephane Maarek and Abhishek Singh who bring their collective experience of passing 18 AWS Certifications to the table.

The tone and tenor of the questions mimic the real exam. Along with the detailed description and “exam alert” provided within the explanations, we have also extensively referenced AWS documentation to get you up to speed on all domain areas being tested for the DOP-C02 exam.

FEATURED REVIEWS:

5 stars: Stephane did a great job with this practice exam. I used this as my final knowledge validation exercise before the actual exam. I passed the real test first time, and this course certainly helped to get me there. Thank Stephane! - Nick S.

5 stars: High quality course as well as the practice test, best way to prepare for the AWS DevOps Pro certification. - John L.

5 stars: I took both the DevOps course and practice exam and the exam is close to the real exam. I took this practice exam and passed the DevOps exam. Thanks Stephane for your good training resources. - Eric C.

Instructor

My name is Stéphane Maarek, I am passionate about Cloud Computing, and I will be your instructor in this course. I teach about AWS certifications, focusing on helping my students improve their professional proficiencies in AWS.

I have already taught 1,500,000+ students and gotten 500,000+ reviews throughout my career in designing and delivering these certifications and courses!

I'm delighted to welcome Abhishek Singh as my co-instructor for these practice exams!

The practice exams contain:

45 high-quality, high-fidelity and difficult questions in a mini practice test. These questions are representative of what you will be asked of at the AWS Certified DevOps Engineer Professional exam.

75 high-quality, high-fidelity and difficult questions in a full practice test. These questions are representative of what you will be asked of at the AWS Certified DevOps Engineer Professional exam.

These are NOT AWS Certified DevOps Engineer Professional dumps and should not be considered as such.

A detailed explanation is available for all questions, for the correct and wrong answers.

Happy learning and best of luck for your AWS Certified DevOps Engineer Professional exam!

Who this course is for:

Students wanting to pass the AWS Certified DevOps Engineer Professional (DOP-C02) exam

Show moreShow less

Instructors

Stephane Maarek | AWS Certified Cloud Practitioner,Solutions Architect,Developer

Best Selling Instructor, 11x AWS Certified, Kafka Guru

Stephane is a solutions architect, consultant and software developer that has a particular interest in all things related to Cloud & Big Data. He's also a many-times best seller instructor on Udemy for his courses in AWS and Apache Kafka.

[See FAQ below to see in which order you can take my courses]

Stéphane is recognized as an AWS Hero and is an AWS Certified Solutions Architect Professional & AWS Certified DevOps Professional. He loves to teach people how to use the AWS properly, to get them ready for their AWS certifications, and most importantly for the real world.

He also loves Apache Kafka. He used on the Program Committee organizing the Kafka Summit in New York, London and San Francisco. He also was an active member of the Apache Kafka community, and has authored blogs on Medium and the guest blog for Confluent. He also has co-founded Conduktor, a prominent company in the Kafka ecosystem.

During his spare time he enjoys cooking, practicing yoga, surfing, watching TV shows, and traveling to awesome destinations!

FAQ: In which order should you learn?...

AWS Cloud: Start with AWS Certified Cloud Practitioner or AWS Certified Solutions Architect Associate, then move on to AWS Certified Developer Associate and then AWS Certified SysOps Administrator. Afterwards you can either do AWS Certified Solutions Architect Professional or AWS Certified DevOps Professional, or a specialty certification of your choosing. You can also learn about AI with the AWS Certified AI Practitioner course!

Apache Kafka: Start with Apache Kafka for Beginners, then you can learn Connect, Streams and Schema Registry if you're a developer, and Setup and Monitoring courses if you're an admin. Both tracks are needed to pass the Confluent Kafka certification.

Show moreShow less

Abhishek Singh

Cloud Evangelist

Abhishek is an AWS veteran and has built successful SaaS and consumer solutions using AWS services since 2012. Over the course of his professional career, Abhishek has interviewed and mentored hundreds of candidates for entry-level and lateral positions for Cloud based IT solutions development. Abhishek is passionate about sharing his knowledge on AWS Cloud, Machine Learning and Big Data. He wants to help his fellow IT Professionals level-up their skills to ace the AWS Certifications and above all, get ready for the real world AWS ecosystem.

He is an AWS Certified Solutions Architect Professional, AWS Certified DevOps Engineer Professional, AWS Certified Machine Learning Specialist, AWS Certified Big Data Specialist and AWS Certified Database Specialist.

Overall, Abhishek has over 15 years of experience working on a diverse range of Enterprise Technologies based on AI/ML, Big Data and Analytics. He runs a successful AI/ML and Big Data Consultancy advocating solutions on AWS Cloud and has advised multiple clients in the US to architect and implement their AI/ML and Big Data solutions using the AWS suite of services.

Show moreShow less

Requirements

Study the full AWS Certified DevOps Engineer Professional course

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 2: Full Practice Test - AWS Certified DevOps Engineer Professional - DOP-C02

Full Practice Test - AWS Certified DevOps Engineer Professional - DOP-C02 - Results

Back to result overview
Attempt 1

All domains

All domains

Domain 3: Resilient Cloud Solutions

Domain 2: Configuration Management and IaC

Domain 6: Security and Compliance

Domain 5: Incident and Event Response

Domain 4: Monitoring and Logging

Domain 1: SDLC Automation

75 all

0 correct

0 incorrect

75 skipped

0 marked

Collapse all questions

Question 1Skipped

As a DevOps Engineer at a data analytics company, you're deploying a web application on EC2 using an Auto Scaling group. The data is stored in RDS MySQL Multi-AZ, and a caching layer using ElastiCache. The application configuration takes time and currently needs over 20 minutes to warm up. 10 of those minutes are spent installing and configuring the web application, and another 10 minutes are spent warming up the local instance data cache.

What can be done to improve the performance of the setup?

Create an AMI that contains the web application. Configure the dynamic part at runtime using an EC2 User Data script. Use AWS Lambda to configure the instance local cache at boot time

Create an AMI that contains the web application and a copy of the local data cache. Configure the dynamic part at runtime an EC2 User Data script

Correct answer

Create an AMI that contains the web application. Configure the dynamic part at runtime using an EC2 User Data script

Migrate from ElastiCache to DynamoDB. Create an AMI that contains the web application. Configure the dynamic part at runtime using an EC2 User Data script

Overall explanation

Correct option:

Create an AMI that contains the web application. Configure the dynamic part at runtime using an EC2 User Data script

A golden AMI is an AMI that you standardize through configuration, consistent security patching, and hardening. It also contains agents you approve for logging, security, performance monitoring, etc. For the given use-case, you can also add the web application as part of the golden AMI. You can think of it as an input base AMI for creating a standardized application-specific golden AMI.

Once you create a golden AMI for a product (a product can be a standardized OS-AMI that you want to distribute to accounts in your organization or an application-specific AMI you want to let your business unit(s) deploy in their environment), you can validate whether the AMI meets your expectations, and choose to approve or reject the AMI.

About the golden AMI pipeline:

via - https://aws.amazon.com/blogs/awsmarketplace/announcing-the-golden-ami-pipeline/

Incorrect options:

Create an AMI that contains the web application and a copy of the local data cache. Configure the dynamic part at runtime an EC2 User Data script - The local cache warmup can unfortunately not be improved, as caching is dynamic and data may change over time. So creating an AMI with a copy of the local data cache just serves as a distractor.

Migrate from ElastiCache to DynamoDB. Create an AMI that contains the web application. Configure the dynamic part at runtime using an EC2 User Data script - You cannot migrate from ElastiCache to DynamoDB for the given use-case, as it's primarily a NoSQL database and not a caching solution (You could use DAX as a caching solution with DynamoDB). Besides, the existing database is RDS MySQL which is a relational database, so DynamoDB does not really fit into this mix.

Create an AMI that contains the web application. Configure the dynamic part at runtime using an EC2 User Data script. Use AWS Lambda to configure the instance local cache at boot time - You cannot use Lambda to configure the instance local cache at boot time as caching is dynamic and data may change over time.

Reference:

https://aws.amazon.com/blogs/awsmarketplace/announcing-the-golden-ami-pipeline/

Domain

Domain 3: Resilient Cloud Solutions

Question 2Skipped

A Big Data analytics company is operating a distributed Cassandra cluster on EC2. Each instance in the cluster must have a list of all the other instance's IP to function correctly, store in a configuration file. As a Devops Engineer at the company, you would like this solution to adapt automatically when newer EC2 instances join the cluster, or when some EC2 instances are terminated.

Which of the following solutions would you recommend for the given requirement?

Correct answer

Manage the EC2 instances using OpsWorks. Include a chef cookbook on the configure lifecycle event that will update the configuration file accordingly

Manage the EC2 instances using OpsWorks. Include a chef cookbook on the setup lifecycle event that will update the configuration file accordingly

Manage the EC2 instances using an Auto Scaling Group. Include a lifecycle hook for the instance pending and termination that will trigger an AWS Lambda function. The Lambda function will issue an EC2 DescribeInstances API call and update the configuration file through SSH

Manage the EC2 instances using an Auto Scaling Group. Include a lifecycle hook for the instance pending and termination that will trigger an EC2 user-data script on the EC2 instances. The script issues an EC2 DescribeInstances API call and update the configuration file locally

Overall explanation

Correct option:

Manage the EC2 instances using OpsWorks. Include a chef cookbook on the configure lifecycle event that will update the configuration file accordingly

AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet. Chef and Puppet are automation platforms that allow you to use code to automate the configurations of your servers. OpsWorks lets you use Chef and Puppet to automate how servers are configured, deployed, and managed across your Amazon EC2 instances or on-premises compute environments.

A stack is the top-level AWS OpsWorks Stacks entity. It represents a set of instances that you want to manage collectively, typically because they have a common purpose such as serving PHP applications. In addition to serving as a container, a stack handles tasks that apply to the group of instances as a whole, such as managing applications and cookbooks.

Every stack contains one or more layers, each of which represents a stack component, such as a load balancer or a set of application servers. Each layer has a set of five lifecycle events, each of which has an associated set of recipes that are specific to the layer. When an event occurs on a layer's instance, AWS OpsWorks Stacks automatically runs the appropriate set of recipes.

The lifecycle hook that is called on ALL instances, whenever an instance comes up or another one goes down, is the configure hook. So this option is the best fit for the given use-case.

via - https://docs.aws.amazon.com/opsworks/latest/userguide/workingcookbook-events.html

Incorrect options:

Manage the EC2 instances using OpsWorks. Include a chef cookbook on the setup lifecycle event that will update the configuration file accordingly - As mentioned in the explanation above, the setup hook is only used when an instance is first created, so this option is incorrect.

Manage the EC2 instances using an Auto Scaling Group. Include a lifecycle hook for the instance pending and termination that will trigger an AWS Lambda function. The Lambda function will issue an EC2 DescribeInstances API call and update the configuration file through SSH - Lifecycle hooks on Auto Scaling Groups may seem like a good idea at first, but using AWS Lambda, the solution is not practicable as SSH'ing into the instance via Lambda will not work.

Manage the EC2 instances using an Auto Scaling Group. Include a lifecycle hook for the instance pending and termination that will trigger an EC2 user-data script on the EC2 instances. The script issues an EC2 DescribeInstances API call and update the configuration file locally - EC2 user-data scripts are only triggered on an instance's first launch, so this option just acts as a distractor.

References:

https://docs.aws.amazon.com/opsworks/latest/userguide/workingcookbook-events.html

https://aws.amazon.com/opsworks/

Domain

Domain 2: Configuration Management and IaC

Question 3Skipped

An e-commerce company would like to automate the patching of their hybrid fleet and distribute some patches through their internal patch repositories every week. As a DevOps Engineer at the company, you have been tasked to implement this most efficiently.

Which of the following options represents the BEST solution to meet this requirement?

Correct answer

Using SSM, implement a Custom Patch Baseline. Define a Maintenance window and include the Run Command RunPatchBaseline. Schedule the maintenance window with a weekly recurrence

Manage your instances with AWS OpsWorks. Define a maintenance window and define custom chef cookbooks for the 'configure' lifecycle hook that will patch the instances from the internal patch repositories. Schedule the window with a weekly recurrence

Using SSM, do a RunCommand to install the custom repositories in the OS' internal configuration files. Use the Default Patch Baseline. Define a Maintenance window and include the Run Command RunPatchBaseline. Schedule the maintenance window with a weekly recurrence

Using SSM Parameter Store, configure the custom repositories in the OS' internal configuration files. Use the Default Patch Baseline. Define a Maintenance window and include the Run Command RunPatchBaseline. Schedule the maintenance window with a weekly recurrence

Overall explanation

Correct option:

Using SSM, implement a Custom Patch Baseline. Define a Maintenance window and include the Run Command RunPatchBaseline. Schedule the maintenance window with a weekly recurrence

SSM Patch Manager automates the process of patching managed instances with both security-related and other types of updates. You can use Patch Manager to apply patches for both operating systems and applications. Patch Manager uses patch baselines, which include rules for auto-approving patches within days of their release, as well as a list of approved and rejected patches.

via - https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html

Patch Manager provides predefined patch baselines for each of the operating systems supported by Patch Manager. You can use these baselines as they are currently configured (you can't customize them) or you can create your own custom patch baselines. Custom patch baselines allow you greater control over which patches are approved or rejected for your environment.

When you use the default repositories configured on an instance for patching operations, Patch Manager scans for or installs security-related patches. This is the default behavior for Patch Manager.

On Linux systems, however, you can also use Patch Manager to install patches that are not related to security, or that are in a different source repository than the default one configured on the instance. You can specify alternative patch source repositories when you create a custom patch baseline. In each custom patch baseline, you can specify patch source configurations for up to 20 versions of a supported Linux operating system. You can then set up a weekly maintenance window and include the Run Command RunPatchBaseline.

via - https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-patch-baselines.html

Incorrect options:

Using SSM Parameter Store, configure the custom repositories in the OS' internal configuration files. Use the Default Patch Baseline. Define a Maintenance window and include the Run Command RunPatchBaseline. Schedule the maintenance window with a weekly recurrence - SSM Parameter Store is used to store parameter values but cannot write configuration files on EC2 instances (the EC2 instances would have to fetch the value from the Parameter Store instead).

Manage your instances with AWS OpsWorks. Define a maintenance window and define custom chef cookbooks for the 'configure' lifecycle hook that will patch the instances from the internal patch repositories. Schedule the window with a weekly recurrence - Using chef cookbooks via OpsWorks may work for what we need, but the Patch Manager of SSM is a better way of achieving this.

Using SSM, do a RunCommand to install the custom repositories in the OS' internal configuration files. Use the Default Patch Baseline. Define a Maintenance window and include the Run Command RunPatchBaseline. Schedule the maintenance window with a weekly recurrence - Using SSM RunCommand may work for what we need, but the Patch Manager of SSM is a better way of achieving this.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html

https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-patch-baselines.html

https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-how-it-works-alt-source-repository.html

Domain

Domain 6: Security and Compliance

Question 4Skipped

A retail company is finishing its migration to AWS and realizes that while some employees have passed the AWS Certified DevOps Engineer Professional certification and know AWS very well, other ones are still beginning and haven't passed their Associate-level certifications yet. The company has established architectural and tagging specific internal rules and would like to minimize the risk of the AWS-beginner employees launching uncompliant resources.

As a DevOps Engineer, how should you implement this requirement while allowing the employees to create the resources they need?

Define commonly used architectures as CloudFormation templates. Place the IAM users into a beginner group and allow the users to only launch stacks from these CloudFormation stacks, while restricting any write access to other services

Place the beginner IAM users into a group and create an IAM policy that requires conditional approvals from senior DevOps engineers upon resource creation. Hook an SNS topic into the IAM approval channel

Create AWS Config custom rules that will check for the compliance of your company's resources thanks to a Lambda Function. Update the Lambda Function over time while your company improves its architectural and tagging rules. Provide IAM users full access to AWS

Correct answer

Define commonly used architectures as CloudFormation templates. Create Service Catalog stacks from these templates, and ensure the tagging is done properly. Place the IAM users into a beginner group and allow the users to only launch stacks from Service Catalog, while restricting any write access to other services

Overall explanation

Correct option:

Define commonly used architectures as CloudFormation templates. Create Service Catalog stacks from these templates, and ensure the tagging is done properly. Place the IAM users into a beginner group and allow the users to only launch stacks from Service Catalog, while restricting any write access to other services

AWS Service Catalog allows IT administrators to create, manage, and distribute catalogs of approved products to end-users, who can then access the products they need in a personalized portal. Administrators can control which users have access to each product to enforce compliance with organizational business policies.

via - https://docs.aws.amazon.com/servicecatalog/latest/adminguide/introduction.html

A product is a service or application for end-users. A portfolio is a collection of products, with configuration information that determines who can use those products and how they can use them. A catalog is a collection of products that the administrator creates, adds to portfolios, and provides updates for using AWS Service Catalog. To create a Service Catalog product, you first need to create an AWS CloudFormation template by using an existing AWS CloudFormation template or creating a custom template. Then you can use the AWS Service Catalog console to upload the template and create the product.

Therefore, for the given use-case, we need to use Service Catalog as it was precisely designed for that purpose and give users only access to the stack they should be able to create in Service Catalog.

via - https://aws.amazon.com/servicecatalog/faqs/

via - https://aws.amazon.com/servicecatalog/faqs/

Incorrect options:

Define commonly used architectures as CloudFormation templates. Place the IAM users into a beginner group and allow the users to only launch stacks from these CloudFormation stacks, while restricting any write access to other services - If you let IAM users use the CloudFormation service directly, they will have the power to create any resource through their permissions. You cannot restrict templates using IAM policies in CloudFormation.

Create AWS Config custom rules that will check for the compliance of your company's resources thanks to a Lambda Function. Update the Lambda Function over time while your company improves its architectural and tagging rules. Provide IAM users full access to AWS - AWS Config Rules would be a way to "monitor" the situation but not prevent resources from being created the wrong way.

Place the beginner IAM users into a group and create an IAM policy that requires conditional approvals from senior DevOps engineers upon resource creation. Hook an SNS topic into the IAM approval channel - An IAM policy cannot have a "conditional approval", so this option is a distractor.

References:

https://aws.amazon.com/servicecatalog/faqs/

https://docs.aws.amazon.com/servicecatalog/latest/adminguide/introduction.html

https://aws.amazon.com/blogs/mt/how-to-launch-secure-and-governed-aws-resources-with-aws-cloudformation-and-aws-service-catalog/

Domain

Domain 6: Security and Compliance

Question 5Skipped

Your application is deployed on Elastic Beanstalk and you manage the configuration of the stack using a CloudFormation template. A new golden AMI is created every week and contains a hardened AMI that has all the necessary recent security patches. You have deployed over 100 applications using CloudFormation & Beanstalk this way and you would like to ensure the newer AMI used for EC2 instances is updated every week. There are no standardization or naming conventions made across all the CloudFormation templates.

As a DevOps Engineer, how would you implement a solution for this requirement?

Correct answer

Store the Golden AMI id in an SSM Parameter Store parameter. Create a CloudFormation parameter that points to the SSM Parameter Store, and is passed on to the configuration of the Elastic Beanstalk environment. Create a CloudWatch Event rule that is triggered every week that will launch a Lambda function. That Lambda function should trigger a refresh of all the CloudFormation templates using the UpdateStack API

Store the Golden AMI id in an SSM Parameter Store parameter. Create a CloudFormation parameter of type String, and is passed on to the configuration of the Elastic Beanstalk environment. Create a CloudWatch Event rule that is triggered every week that will launch a Lambda function. That Lambda function should fetch the parameter from the SSM Parameter Store and trigger a refresh of all the CloudFormation templates using the UpdateStack API while passing the new parameter

Store the Golden AMI id in an S3 object. Create a CloudFormation mapping to contain the last value of the Golden AMI id. That mapping is passed on to the configuration of the Elastic Beanstalk environment. Create a CloudWatch Event rule that is triggered every week that will launch a Lambda function. That Lambda function should update the mapping section of every CloudFormation template using a YAML parser, upload the new templates to S3 and trigger a refresh of all the CloudFormation templates using the UpdateStack API while passing the new parameter

Store the Golden AMI id in an S3 object. Create a CloudFormation parameter that points to the S3 object, and is passed on to the configuration of the Elastic Beanstalk environment. Create a CloudWatch Event rule that is triggered every week that will launch a Lambda function. That Lambda function should trigger a refresh of all the CloudFormation templates using the UpdateStack API

Overall explanation

Correct option:

Store the Golden AMI id in an SSM Parameter Store parameter. Create a CloudFormation parameter that points to the SSM Parameter Store, and is passed on to the configuration of the Elastic Beanstalk environment. Create a CloudWatch Event rule that is triggered every week that will launch a Lambda function. That Lambda function should trigger a refresh of all the CloudFormation templates using the UpdateStack API

AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data management and secrets management. You can store data such as passwords, database strings, Amazon Machine Image (AMI) IDs, and license codes as parameter values.

You can use the existing Parameters section of your CloudFormation template to define Systems Manager parameters, along with other parameters. CloudFormation will fetch values stored against these keys in Systems Manager in your account and use them for the current stack operation. When you use a template containing Systems Manager parameters to create/update your stacks, CloudFormation uses the values for these Systems Manager parameters at the time of the create/update operation. So, as parameters are updated in Systems Manager, you can have the new value of the parameter take effect by just executing a stack update operation using the UpdateStack API.

via - https://aws.amazon.com/blogs/mt/integrating-aws-cloudformation-with-aws-systems-manager-parameter-store/

This question is a hard one as many solutions are feasible with a degree of complexity. It's about identifying the simplest solution.

For the given use-case, by having the CloudFormation parameters directly pointing at SSM Parameter Store, on any refresh made to the CloudFormation template by the Lambda function which is in turn triggered by CloudWatch events, the template itself will fetch the latest value from the SSM Parameter Store and will apply it accordingly. So this solution is the best fit for the given requirement.

Incorrect options:

Store the Golden AMI id in an S3 object. Create a CloudFormation parameter that points to the S3 object, and is passed on to the configuration of the Elastic Beanstalk environment. Create a CloudWatch Event rule that is triggered every week that will launch a Lambda function. That Lambda function should trigger a refresh of all the CloudFormation templates using the UpdateStack API - Storing the AMI id in S3 is possible, but CloudFormation cannot source parameters from S3 and therefore there's no integration possible.

Store the Golden AMI id in an SSM Parameter Store parameter. Create a CloudFormation parameter of type String, and is passed on to the configuration of the Elastic Beanstalk environment. Create a CloudWatch Event rule that is triggered every week that will launch a Lambda function. That Lambda function should fetch the parameter from the SSM Parameter Store and trigger a refresh of all the CloudFormation templates using the UpdateStack API while passing the new parameter - Having a Lambda function fetch the parameter and pass it as a parameter to CloudFormation seems like a good idea, but if we remember the constraint that the parameters are not standardized and that there are no naming conventions, it is difficult for us to imagine a solution that would scale.

Store the Golden AMI id in an S3 object. Create a CloudFormation mapping to contain the last value of the Golden AMI id. That mapping is passed on to the configuration of the Elastic Beanstalk environment. Create a CloudWatch Event rule that is triggered every week that will launch a Lambda function. That Lambda function should update the mapping section of every CloudFormation template using a YAML parser, upload the new templates to S3 and trigger a refresh of all the CloudFormation templates using the UpdateStack API while passing the new parameter - Creating a Lambda function that would update the mapping section of each template would introduce changes to each template content at every update and would be highly complicated to implement. Additionally, the Lambda function would be hard to write and would have a lot of complexity in updating the mapping as there's no standardization.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-parameter.html

https://aws.amazon.com/blogs/mt/integrating-aws-cloudformation-with-aws-systems-manager-parameter-store/

Domain

Domain 2: Configuration Management and IaC

Question 6Skipped

As a DevOps Engineer at an IT company, you are looking to create a daily EBS backup workflow. That workflow must take an EBS volume, and create a snapshot from it. When the snapshot is created, it must be copied to another region. In case the other region is unavailable because of a disaster, then that backup should be copied to a third region. An email address must be notified of the final result. There's a requirement to keep an audit trail of all executions as well.

How can you implement this efficiently and in a fail-safe way?

Create an EC2 instance in the region where the EBS volume is. Create a CRON script that will invoke a Python script that performs all the steps and logic outlined above. For each step completion, write metadata to a DynamoDB table

Create an SSM Automation that will perform each action. Add failure logic between steps to deal with conditional cases

Create a CloudWatch Event rule that gets triggered every day. It triggers a Lambda function written in Python that performs all the steps and logic outlined above. Analyze the history of execution using AWS Config

Correct answer

Create an AWS Step Function. Implement each step as a Lambda function and add failure logic between the steps to deal with conditional cases

Overall explanation

Correct option:

Create an AWS Step Function. Implement each step as a Lambda function and add failure logic between the steps to deal with conditional cases

Step Functions is a fully managed service that makes it easy to coordinate the components of distributed applications and microservices using visual workflows.

How Step Functions Work:

via - https://aws.amazon.com/step-functions/

For the given use-case, you need to combine Step Functions, Lambda and CloudWatch Events into a single coherent solution. You can use the Step Functions to coordinate the business logic to automate the snapshot management flow with error handling, retry logic, and workflow logic all baked into the Step Functions definition. CloudWatch Events integrates with Step Functions and Lambda to let you execute your custom code when relevant events occur.

via - https://aws.amazon.com/blogs/compute/automating-amazon-ebs-snapshot-management-with-aws-step-functions-and-amazon-cloudwatch-events/

For a deep-dive on this solution, highly recommend the following reference material: https://aws.amazon.com/blogs/compute/automating-amazon-ebs-snapshot-management-with-aws-step-functions-and-amazon-cloudwatch-events/

Incorrect options:

Create an EC2 instance in the region where the EBS volume is. Create a CRON script that will invoke a Python script that performs all the steps and logic outlined above. For each step completion, write metadata to a DynamoDB table - Creating an EC2 instance may work, but if it gets terminated we have to re-create a new one. Failure scenarios may be tough to analyze and having the audit trail in DynamoDB probably won't be easy to use.

Create a CloudWatch Event rule that gets triggered every day. It triggers a Lambda function written in Python that performs all the steps and logic outlined above. Analyze the history of execution using AWS Config - Creating a CW event rule + Lambda function may work, but the Lambda function may have a timeout issue if the backup is taking longer than 15 minutes, and AWS Config cannot store the history of the execution. AWS Config only provides a detailed view of the resources associated with your AWS account, including how they are configured, how they are related to one another, and how the configurations and their relationships have changed over time.

Create an SSM Automation that will perform each action. Add failure logic between steps to deal with conditional cases - An SSM automation cannot contain complex logic to handle failures, although it would provide an execution history.

An SSM Automation document defines the actions that Systems Manager performs on your managed instances and other AWS resources when an automation execution runs. A document contains one or more steps that run in sequential order. Each step is built around a single action. The output from one step can be used as input in a later step. The process of running these actions and their steps is called the automation workflow.

Reference:

https://aws.amazon.com/blogs/compute/automating-amazon-ebs-snapshot-management-with-aws-step-functions-and-amazon-cloudwatch-events/

Domain

Domain 5: Incident and Event Response

Question 7Skipped

As a DevOps Engineer at an IT company, you have deployed a web application with a health check that currently checks if the application is running actively. The application is running in an ASG and the ALB health check integration is turned on. Recently your application has had issues with connecting to a backend database and as such the users of your website were experiencing issues accessing your website through the faulty instances.

How can you improve the user experience with the least effort?

Enhance the Health Check to report a JSON document that contains the health status of the connectivity to the database. Tune the ALB health check to look for a specific string in the health check result using a RegEx

Migrate the application to Elastic Beanstalk and enable advanced health monitoring

Correct answer

Enhance the health check so that the return status code corresponds to the connectivity to the database

Include the health check in a Route 53 record so that users going through the ALB are not routed to the unhealthy instances

Overall explanation

Correct option:

Enhance the health check so that the return status code corresponds to the connectivity to the database

Configuring health checks for the Application Load Balancer (ALB) is an important step to ensure that your AWS Cloud application runs smoothly. The ALB Health Check is configured with a protocol and port number to call on the target instances. A healthy EC2 instance is one that issues a response to a health check call with an HTTP 200 response code. Instances that return a status code that is other than the 2XX range or which time out are designated as being unhealthy and will not receive traffic from the ELB.

Each load balancer node routes requests only to the healthy targets in the enabled Availability Zones for the load balancer. Each load balancer node checks the health of each target, using the health check settings for the target groups with which the target is registered. After your target is registered, it must pass one health check to be considered healthy.

via - https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html

You could just add a simple health check endpoint to the ALB which accepts a request and immediately responds with an HTTP status of 200. This approach provides for a fast health check, but would not meet the requirement for the given use-case. You need to improve the quality of the health check and make sure it returns a proper status code. As the application depends on the database, you need to ensure that you include health checks for these components when determining the health of your service.

Incorrect options:

Migrate the application to Elastic Beanstalk and enable advanced health monitoring - Migrating to Beanstalk would require significant effort and even then it won't help gather detailed database-specific health checks.

Enhance the Health Check to report a JSON document that contains the health status of the connectivity to the database. Tune the ALB health check to look for a specific string in the health check result using a RegEx - Health Checks for the ALB are pretty basic and only work with the HTTP return status code, not the payload itself.

Include the health check in a Route 53 record so that users going through the ALB are not routed to the unhealthy instances - Route53 health checks can only be used to prevent DNS records from being returned from a DNS query, so it won't help for routing to specific instances behind an ALB (that's why we have health checks at the ALB level).

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html

https://d1.awsstatic.com/builderslibrary/pdfs/implementing-health-checks.pdf

Domain

Domain 3: Resilient Cloud Solutions

Question 8Skipped

A cyber-security company has had a dubious distinction of their own AWS account credentials being put in public GitHub repositories. The company wants to implement a workflow to be alerted in case credentials are leaked, generate a report of API calls made recently using the credentials, and de-activate the credentials. All executions of the workflow must be auditable.

The company has hired you as an AWS Certified DevOps Engineer Professional to build a robust solution for this requirement. Which of the following solutions would you implement?

Create a CloudWatch Event checking for AWS_RISK_CREDENTIALS_EXPOSED in the CloudTrail Service. Trigger a Lambda Function workflow that will issue API calls to IAM, CloudTrail, and SNS to achieve the desired requirements

Create a CloudWatch Event checking for AWS_RISK_CREDENTIALS_EXPOSED in the CloudTrail Service. Trigger a Step Function workflow that will issue API calls to IAM, CloudTrail, and SNS to achieve the desired requirements

Correct answer

Create a CloudWatch Event checking for AWS_RISK_CREDENTIALS_EXPOSED in the Health Service. Trigger a Step Function workflow that will issue API calls to IAM, CloudTrail, and SNS to achieve the desired requirements

Create a CloudWatch Event checking for AWS_RISK_CREDENTIALS_EXPOSED in the Health Service. Trigger a Lambda Function that will issue API calls to IAM, CloudTrail, and SNS to achieve the desired requirements

Overall explanation

Correct option:

Create a CloudWatch Event checking for AWS_RISK_CREDENTIALS_EXPOSED in the Health Service. Trigger a Step Function workflow that will issue API calls to IAM, CloudTrail, and SNS to achieve the desired requirements

Step Functions is a fully managed service that makes it easy to coordinate the components of distributed applications and microservices using visual workflows.

How Step Functions Work:

via - https://aws.amazon.com/step-functions/

AWS monitors popular code repository sites for IAM access keys that have been publicly exposed. AWS Health generates an AWS_RISK_CREDENTIALS_EXPOSED event when an IAM access key has been publicly exposed on GitHub. A CloudWatch Events rule further detects this event and invokes a Step Function that orchestrates the automated workflow to delete the exposed IAM access key, and summarize the recent API activity for the exposed key. The workflow will also issue API calls to IAM, CloudTrail, and SNS. The AWS_RISK_CREDENTIALS_EXPOSED is exposed by the Personal Health Dashboard service.

Mitigating security events using AWS Health and CloudTrail:

via - https://aws.amazon.com/blogs/compute/automate-your-it-operations-using-aws-step-functions-and-amazon-cloudwatch-events/

Incorrect options:

Create a CloudWatch Event checking for AWS_RISK_CREDENTIALS_EXPOSED in the Health Service. Trigger a Lambda Function that will issue API calls to IAM, CloudTrail, and SNS to achieve the desired requirements

Create a CloudWatch Event checking for AWS_RISK_CREDENTIALS_EXPOSED in the CloudTrail Service. Trigger a Lambda Function workflow that will issue API calls to IAM, CloudTrail, and SNS to achieve the desired requirements

As the way to react to that event is complex and may have retries, and you want to have a full audit trail of each workflow, you should use a Step Function instead of an AWS Lambda function. So both these options are incorrect.

Create a CloudWatch Event checking for AWS_RISK_CREDENTIALS_EXPOSED in the CloudTrail Service. Trigger a Step Function workflow that will issue API calls to IAM, CloudTrail, and SNS to achieve the desired requirements - AWS_RISK_CREDENTIALS_EXPOSED event is generated by AWS Health service and NOT CloudTrail, so this option is incorrect.

References:

https://aws.amazon.com/blogs/compute/automate-your-it-operations-using-aws-step-functions-and-amazon-cloudwatch-events/

https://docs.aws.amazon.com/health/latest/ug/getting-started-phd.html

Domain

Domain 5: Incident and Event Response

Question 9Skipped

A financial services company has a solution in place to track all the API calls made by users, applications, and SDK within the AWS account. Recently, it has experienced a hack and could find a user amongst the logs that did some compromising API calls. The company wants to know with 100% certainty that the log files represent the correct sequence of events and have not been altered. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution for this requirement.

Which of the following would you suggest as the most effective solution?

Turn on API calls logging using AWS CloudTrail. Deliver the logs in an S3 bucket and choose a lifecycle policy that archives file right away in Glacier. Implement a Glacier Vault Lock policy

Turn on AWS account configuration tracking using AWS Config. Deliver the logs in an S3 bucket and choose a lifecycle policy that archives the files right away in Glacier. Implement a Glacier Vault Lock policy

Turn on AWS account configuration tracking using AWS Config. Deliver the configuration logs into S3 and use the log verification integrity API to verify the log files

Correct answer

Turn on API calls logging using AWS CloudTrail. Deliver the logs in an S3 bucket, and use the log verification integrity API call to verify the log file

Overall explanation

Correct option:

Turn on API calls logging using AWS CloudTrail. Deliver the logs in an S3 bucket, and use the log verification integrity API call to verify the log file

CloudTrail provides visibility into user activity by recording actions taken on your account. CloudTrail records important information about each action, including who made the request, the services used, the actions performed, parameters for the actions, and the response elements returned by the AWS service. This information helps you to track changes made to your AWS resources and to troubleshoot operational issues.

How CloudTrail Works:

via - https://aws.amazon.com/cloudtrail/

To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation. This feature is built using industry-standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing.

via - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html

For the given use-case, to track API calls made within your account, you need to use AWS CloudTrail. Then the right way to verify log integrity would be to use the CloudTrail validate-logs command.

via - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-cli.html

Incorrect options:

Turn on API calls logging using AWS CloudTrail. Deliver the logs in an S3 bucket and choose a lifecycle policy that archives file right away in Glacier. Implement a Glacier Vault Lock policy - S3 Glacier Vault Lock allows you to easily deploy and enforce compliance controls for individual S3 Glacier vaults with a vault lock policy. You can specify controls such as “write once read many” (WORM) in a vault lock policy and lock the policy from future edits. Once locked, the policy can no longer be changed. Please note that while having a Glacier Lock Vault policy can help us guarantee that the files cannot be altered, it doesn't provide us the end-to-end guarantee that CloudTrail actually produced those files and then match them against a hash to ascertain that they have remained unaltered.

Turn on AWS account configuration tracking using AWS Config. Deliver the configuration logs into S3 and use the log verification integrity API to verify the log files - AWS Config is used to track resource configuration over time. Although Config has integration with CloudTrail to show who made API calls, Config on its own won't give us the information on who made the API calls.

Turn on AWS account configuration tracking using AWS Config. Deliver the logs in an S3 bucket and choose a lifecycle policy that archives the files right away in Glacier. Implement a Glacier Vault Lock policy - AWS Config is used to track resource configuration over time. Although Config has integration with CloudTrail to show who made API calls, Config on its own won't give us the information of who made the API calls. Please note that while having a Glacier Lock Vault policy can help us guarantee that the files cannot be altered, it doesn't provide us the end-to-end guarantee that CloudTrail actually produced those files and then match them against a hash to ascertain that they have remained unaltered.

References:

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-cli.html

https://aws.amazon.com/cloudtrail/faqs/

Domain

Domain 4: Monitoring and Logging

Question 10Skipped

As a DevOps Engineer at an e-commerce company, you have deployed a web application in an Auto Scaling group (ASG) that is being distributed by an Application Load Balancer (ALB). The web application is using RDS Multi-AZ as a back-end and has been experiencing some issues to connect to the database. The health check implemented in the application currently returns an un-healthy status if the application cannot connect to the database. The ALB / ASG health check integration has been enabled, and therefore the ASG keeps on terminating instances right after they're done booting up.

You need to be able to isolate one instance for troubleshooting for an undetermined amount of time, how should you proceed?

Suspend the Launch process

Create an autoscaling hook for instance termination. Troubleshoot the instance while it is in the Terminating:Wait state

Enable termination protection for EC2

Correct answer

Set an instance in Standby right after it has launched

Overall explanation

Correct option:

Set an instance in Standby right after it has launched

The Application Load Balancer periodically sends requests to its registered targets to test their status. These tests are called health checks. Each load balancer node routes requests only to the healthy targets in the enabled Availability Zones for the load balancer. Each load balancer node checks the health of each target, using the health check settings for the target groups with which the target is registered.

The default health checks for an Auto Scaling group are EC2 status checks only. If you configure the Auto Scaling group to use ELB health checks, it considers the instance unhealthy if it fails either the EC2 status checks or the ELB health checks.

via - https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-add-elb-healthcheck.html

via - https://docs.aws.amazon.com/autoscaling/ec2/userguide/AutoScalingGroupLifecycle.html

You can put an instance that is in the InService state into the Standby state, update or troubleshoot the instance, and then return the instance to service. Instances that are on standby are still part of the Auto Scaling group, but they do not actively handle application traffic.

via - https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-enter-exit-standby.html

Incorrect options:

Suspend the Launch process - Suspending the Launch process would prevent instances from being created, which wouldn't work here. Please note that suspending the terminate or health check processes may help the situation (but they're not options in this question)

Create an autoscaling hook for instance termination. Troubleshoot the instance while it is in the Terminating:Wait state - Auto Scaling Hooks may work but they come with a one-hour default timeout and therefore we may not get enough time to perform all the troubleshooting we need.

Enable termination protection for EC2 - Termination protection prevents users from terminating an instance but doesn't prevent the ASG from terminating instances. For the instances in an Auto Scaling group, use Amazon EC2 Auto Scaling features to protect an instance when a scale-in event occurs. If you want to protect your instance from being accidentally terminated, use Amazon EC2 termination protection.

via - https://aws.amazon.com/blogs/aws/new-instance-protection-for-auto-scaling/

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-add-elb-healthcheck.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/AutoScalingGroupLifecycle.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-enter-exit-standby.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-instance-termination.html

https://aws.amazon.com/blogs/aws/new-instance-protection-for-auto-scaling/

Domain

Domain 5: Incident and Event Response

Question 11Skipped

A graphics design company is experimenting with a new feature for an API and the objective is to pass the field "color" in the JSON payload to enable this feature. The new Lambda function should treat "color": "none" as a request from an older client. The company would like to only have to manage one Lambda function in the back-end while being able to support both old and new clients. The API Gateway API is currently deployed on the v1 stage. Old clients include Android applications which may take time to be updated. The technical requirements mandate that the solution should support the old clients for years to come.

As an AWS Certified DevOps Engineer Professional, which of the following options would you recommend as the best fit for the given use-case?

Correct answer

Create a new Lambda function version and release it. Create a new API Gateway Stage and deploy it to the v2 stage. Both use the same Lambda function as a backing route for the v1 and v2 stages. Add a static mapping on the v1 route to add "color": "none" on requests

Create a new Lambda function version and release it as a separate v2 function. Create a new API Gateway Stage and deploy it to the v2 stage. The v1 API gateway stage points to the v1 Lambda function and the v2 API Gateway stage to the v2 Lambda function. Implement redirection from the Lambda v1 function to the Lambda v2 function when the request is missing the "color" field

Enable API Gateway v1 API caching and delete the v1 AWS Lambda function. Deploy a v2 API Gateway backed by a newly released v2 AWS Lambda function. Add an API Gateway stage variable to enable the "color": "none" default value

Create a new Lambda function version and release it. Use API Gateway mapping documents to add a default value "color": "none" to the JSON request being passed on your API Gateway stage

Overall explanation

Correct option:

Create a new Lambda function version and release it. Create a new API Gateway Stage and deploy it to the v2 stage. Both use the same Lambda function as a backing route for the v1 and v2 stages. Add a static mapping on the v1 route to add "color": "none" on requests

Amazon API Gateway is an AWS service for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs at any scale. API Gateway handles tasks such as traffic management, authorization and access control, monitoring, and API version management. API Gateway acts as a "front door" for applications to access data, business logic, or functionality from your backend services, such as workloads running on Amazon Elastic Compute Cloud (Amazon EC2), code running on AWS Lambda, any web application, or real-time communication applications. Simply creating and developing an API Gateway API doesn't automatically make it callable by your users. To make it callable, you must deploy your API to a stage. A stage is a named reference to a deployment, which is a snapshot of the API.

How API Gateway Works:

via - https://aws.amazon.com/api-gateway/

For the given use-case, API Gateway mappings must be used. API Gateway lets you use mapping templates to map the payload from a method request to the corresponding integration request and from an integration response to the corresponding method response. As such, you must deploy a v2 API alongside the v1 API backed by the same Lambda function. Old clients will hit the v1 API, which will use a mapping template to add the static missing field "color": "none". Newer clients will hit the v2 API and will have that field value included.

via - https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-override-request-response-parameters.html

Incorrect options:

Create a new Lambda function version and release it as a separate v2 function. Create a new API Gateway Stage and deploy it to the v2 stage. The v1 API gateway stage points to the v1 Lambda function and the v2 API Gateway stage to the v2 Lambda function. Implement redirection from the Lambda v1 function to the Lambda v2 function when the request is missing the "color" field - If we release two separate Lambda functions (named lambda v1 and lambda v2), then we have to maintain them both and that would be going against the requirements of the given use-case.

Create a new Lambda function version and release it. Use API Gateway mapping documents to add a default value "color": "none" to the JSON request being passed on your API Gateway stage - API Gateway mapping templates do not support adding default values for fields as these only support static fields.

Enable API Gateway v1 API caching and delete the v1 AWS Lambda function. Deploy a v2 API Gateway backed by a newly released v2 AWS Lambda function. Add an API Gateway stage variable to enable the "color": "none" default value - You can enable API caching in Amazon API Gateway to cache your endpoint's responses. With caching, you can reduce the number of calls made to your endpoint and also improve the latency of requests to your API. For the given use-case, API Gateway caching is a distractor and should be disregarded.

References:

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-override-request-response-parameters.html

https://aws.amazon.com/api-gateway/

Domain

Domain 2: Configuration Management and IaC

Question 12Skipped

The DevOps team at a leading bitcoin wallet and exchange services company is trying to deploy a CloudFormation template that contains a Lambda Function, an S3 bucket, an IAM role, and a DynamoDB table from CodePipeline but the team is getting an InsufficientCapabilitiesException.

As an AWS Certified DevOps Engineer Professional, which of the following options would you suggest fixing this issue?

Increase the service limits for your S3 bucket limits as you've reached it

Update the CodePipeline IAM Role so it has permissions to create all the resources mentioned in the CloudFormation template

Correct answer

Enable the IAM Capability on the CodePipeline configuration for the Deploy CloudFormation stage action

Fix the CloudFormation template as there is circular dependency and CloudFormation does not have that capability

Overall explanation

Correct option:

Enable the IAM Capability on the CodePipeline configuration for the Deploy CloudFormation stage action

With AWS CloudFormation and CodePipeline, you can use continuous delivery to automatically build and test changes to your AWS CloudFormation templates before promoting them to production stacks. For example, you can create a workflow that automatically builds a test stack when you submit an updated template to a code repository. After AWS CloudFormation builds the test stack, you can test it and then decide whether to push the changes to a production stack. Use CodePipeline to build a continuous delivery workflow by building a pipeline for AWS CloudFormation stacks. CodePipeline has built-in integration with AWS CloudFormation, so you can specify AWS CloudFormation-specific actions, such as creating, updating, or deleting a stack, within a pipeline.

You can use IAM with AWS CloudFormation to control what users can do with AWS CloudFormation, such as whether they can view stack templates, create stacks, or delete stacks.

For the given use-case, InsufficientCapabilitiesException means that the CloudFormation stack is trying to create an IAM role but it doesn't have those specified capabilities. As such it must be configured in CodePipeline configuration for the Deploy CloudFormation stage action.

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html

Incorrect options:

Update the CodePipeline IAM Role so it has permissions to create all the resources mentioned in the CloudFormation template - The given exception is not related to the permissions of the user or the CodePipeline IAM Role running the CloudFormation template, so this option is incorrect.

Fix the CloudFormation template as there is circular dependency and CloudFormation does not have that capability - A circular dependency, as the name implies, means that two resources are dependent on each other or that a resource is dependent on itself.

via - https://aws.amazon.com/blogs/infrastructure-and-automation/handling-circular-dependency-errors-in-aws-cloudformation/

This option is incorrect as a circular dependency would trigger another error such as this:

via - https://aws.amazon.com/blogs/infrastructure-and-automation/handling-circular-dependency-errors-in-aws-cloudformation/

Increase the service limits for your S3 bucket limits as you've reached it - This option has been added as a distractor as the exception has nothing to do with service limits for the S3 bucket.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-capabilities

https://aws.amazon.com/blogs/infrastructure-and-automation/handling-circular-dependency-errors-in-aws-cloudformation/

Domain

Domain 2: Configuration Management and IaC

Question 13Skipped

As part of the CICD pipeline, a DevOps Engineer is performing a functional test using a CloudFormation template that will later get deployed to production. That CloudFormation template creates an S3 bucket and a Lambda function which transforms images uploaded into S3 into thumbnails. To test the Lambda function, a few images are automatically uploaded and the thumbnail output is expected from the Lambda function on the S3 bucket. As part of the clean-up of these functional tests, the CloudFormation stack is deleted, but right now the delete fails.

What's the reason and how could this issue be fixed?

A StackPolicy prevents the CloudFormation template to be deleted. Clear the Stack Policy and try again

Correct answer

The S3 bucket contains files and therefore cannot be deleted by CloudFormation. Create an additional Custom Resource backed by a Lambda function that performs a clean-up of the bucket

The S3 bucket contains files and therefore cannot be deleted by CloudFormation. Add the property Delete: Force to your CloudFormation template so that the S3 bucket is emptied before being deleted

The Lambda function is still using the S3 bucket and CloudFormation cannot, therefore, delete the S3 bucket. Place a WaitCondition on the Lambda function to fix the issue

Overall explanation

Correct option:

The S3 bucket contains files and therefore cannot be deleted by CloudFormation. Create an additional Custom Resource backed by a Lambda function that performs a clean-up of the bucket

In a CloudFormation template, you can use the AWS::CloudFormation::CustomResource or Custom::String resource type to specify custom resources. Custom resources provide a way for you to write custom provisioning logic in CloudFormation template and have CloudFormation run it during a stack operation, such as when you create, update or delete a stack.

Some resources must be empty before they can be deleted. For example, you must delete all objects in an Amazon S3 bucket or remove all instances in an Amazon EC2 security group before you can delete the bucket or security group.

For this use-case, the issue is that the S3 bucket is not empty before being deleted, therefore you must implement a Custom Resource backed by Lambda which will clean the bucket for you.

via - https://docs.amazonaws.cn/en_us/AWSCloudFormation/latest/UserGuide/aws-resource-cfn-customresource.html

Incorrect options:

The Lambda function is still using the S3 bucket and CloudFormation cannot, therefore, delete the S3 bucket. Place a WaitCondition on the Lambda function to fix the issue - CloudFormation can delete resources while they're being used, and a WaitCondition can be attached to EC2 instances and Auto Scaling Groups and NOT to Lambda function. AWS further recommends that for Amazon EC2 and Auto Scaling resources, you use a CreationPolicy attribute instead of wait conditions. Add a CreationPolicy attribute to those resources, and use the cfn-signal helper script to signal when an instance creation process has completed successfully.

The S3 bucket contains files and therefore cannot be deleted by CloudFormation. Add the property Delete: Force to your CloudFormation template so that the S3 bucket is emptied before being deleted - This option has been added as a distractor. To clean it, you cannot use a Delete: Force as this is not a feature of CloudFormation.

A StackPolicy prevents the CloudFormation template to be deleted. Clear the Stack Policy and try again - A stack policy is a JSON document that defines the update actions that can be performed on designated resources. Stack Policies are only used during CloudFormation stack updates.

References:

https://docs.amazonaws.cn/en_us/AWSCloudFormation/latest/UserGuide/aws-resource-cfn-customresource.html

https://stackoverflow.com/questions/40383470/can-i-force-cloudformation-to-delete-non-empty-s3-bucket

Domain

Domain 2: Configuration Management and IaC

Question 14Skipped

A multi-national retail company is in the process of capturing all of its infrastructure as code using CloudFormation. The infrastructure inventory is huge and will contain a networking stack, an application stack, a data stack, and so on. Some teams are ready to move ahead with the process while others are lagging, and there is a desire to keep all the infrastructure version controlled.

The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution to address this use-case. How would you implement this?

Create one template per logical element of your infrastructure. Create a master stack that contains all the other stacks as a nested template. Deploy the master template using CloudFormation every-time a nested stack template is updated in version control

Create one template per logical element of your infrastructure. Create a master stack that contains all the other stacks as a nested template. Deploy the master template once using CloudFormation and then update the nested stacks individually as new CloudFormation code is created

Correct answer

Create one template per logical element of your infrastructure. Deploy them using CloudFormation as they are ready. Use outputs and exports to reference values in the stacks. Keep each file separately in a version-controlled repository

Create one master template that contains all the stacks in your infrastructure. Collaborate on that template using pull requests and merges to the master branch in your code repository. Deploy the master template every-time it is updated

Overall explanation

Correct option:

Create one template per logical element of your infrastructure. Deploy them using CloudFormation as they are ready. Use outputs and exports to reference values in the stacks. Keep each file separately in a version-controlled repository

While using CloudFormation, you work with templates and stacks. You create templates to describe your AWS resources and their properties. When you use AWS CloudFormation, you manage related resources as a single unit called a stack. You create, update, and delete a collection of resources by creating, updating, and deleting stacks. All the resources in a stack are defined by the stack's AWS CloudFormation template.

In CloudFormation the best practice is to separate stacks into individual, separate logical components that have dependencies on each other. To link through these dependencies, the best is to use Exports and Imports. Each individual CloudFormation template must be a separate file.

CloudFormation best practices:

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html#cross-stack

Incorrect options:

Create one template per logical element of your infrastructure. Create a master stack that contains all the other stacks as a nested template. Deploy the master template using CloudFormation every-time a nested stack template is updated in version control

Create one template per logical element of your infrastructure. Create a master stack that contains all the other stacks as a nested template. Deploy the master template once using CloudFormation and then update the nested stacks individually as new CloudFormation code is created

The issue with both these options is that different teams are working on different pieces of the infrastructure with their own timelines, so it's difficult to combine all elements of the infrastructure into a single master template. It's much better to have one template per logical element of the infrastructure that is owned by the respective team and then use outputs and exports to reference values in the stacks. Nested Stacks can be helpful if a component configuration (such as a Load Balancer) can be reused across many stacks.

Create one master template that contains all the stacks in your infrastructure. Collaborate on that template using pull requests and merges to the master branch in your code repository. Deploy the master template every-time it is updated - Using outputs and exports for individual templates is much better than collaborating via pull requests at code repository level. Using individual templates gives ownership to the contributing team to make sure that the CloudFormation templates are always functional and ready to be referenced in other stacks.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-whatis-concepts.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html#cross-stack

Domain

Domain 2: Configuration Management and IaC

Question 15Skipped

An e-commerce company is managing its entire application stack and infrastructure using AWS OpsWorks Stacks. The DevOps team at the company has noticed that a lot of instances have been automatically replaced in the stack and the team would henceforth like to be notified via Slack notifications when these events happen.

As an AWS Certified DevOps Engineer Professional, which of the following options would you implement to meet this requirement?

Create a CloudWatch Events rule for aws.opsworks and set the initiated_by field to auto-scaling. Enable the CloudWatch Event Slack integration for sending out the notifications

Create a CloudWatch Events rule for aws.opsworks and set the initiated_by field to auto-scaling. Target a Lambda function that will send notifications out to the Slack channel

Subscribe your OpsWorks auto-healing notifications to an SNS topic. Subscribe a Lambda function that will send notifications out to the Slack channel

Correct answer

Create a CloudWatch Events rule for aws.opsworks and set the initiated_by field to auto-healing. Target a Lambda function that will send notifications out to the Slack channel

Overall explanation

Correct option:

Create a CloudWatch Event rule for aws.opsworks and set the initiated_by field to auto-healing. Target a Lambda function that will send notifications out to the Slack channel

AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet. Chef and Puppet are automation platforms that allow you to use code to automate the configurations of your servers. OpsWorks lets you use Chef and Puppet to automate how servers are configured, deployed and managed across your Amazon EC2 instances or on-premises compute environments.

A stack is the top-level AWS OpsWorks Stacks entity. It represents a set of instances that you want to manage collectively, typically because they have a common purpose such as serving PHP applications. In addition to serving as a container, a stack handles tasks that apply to the group of instances as a whole, such as managing applications and cookbooks.

Every stack contains one or more layers, each of which represents a stack component, such as a load balancer or a set of application servers. Each layer has a set of five lifecycle events, each of which has an associated set of recipes that are specific to the layer. When an event occurs on a layer's instance, AWS OpsWorks Stacks automatically runs the appropriate set of recipes.

OpsWorks Stacks provides an integrated management experience that spans the entire application lifecycle including resource provisioning, EBS volume setup, configuration management, application deployment, monitoring, and access control. You can send state changes in OpsWorks Stacks, such as instance stopped or deployment failed, to CloudWatch Events. The initiated_by field is only populated when the instance is in the requested, terminating, or stopping states. The initiated_by field can contain one of the following values.

user - A user requested the instance state change by using either the API or AWS Management Console.

auto-scaling - The AWS OpsWorks Stacks automatic scaling feature initiated the instance state change.

auto-healing - The AWS OpsWorks Stacks automatic healing feature initiated the instance state change.

For the given use-case, you need to use CloudWatch Events, and the value of initiated_by must be auto-healing. CloudWatch Events does not have a Slack integration, so you need to configure a Lambda function as the target for the CloudWatch rule which would in turn send the Slack notification.

via - https://aws.amazon.com/blogs/mt/how-to-set-up-aws-opsworks-stacks-auto-healing-notifications-in-amazon-cloudwatch-events/

Incorrect options:

Create a CloudWatch Events rule for aws.opsworks and set the initiated_by field to auto-scaling. Target a Lambda function that will send notifications out to the Slack channel - This option is incorrect as auto-scaling is just a supported value but it's not meant for the healing events, instead, it is used for the scaling events.

Subscribe your OpsWorks auto-healing notifications to an SNS topic. Subscribe a Lambda function that will send notifications out to the Slack channel - Opsworks does not send notifications to SNS directly for auto-healing, so this option is incorrect.

Create a CloudWatch Events rule for aws.opsworks and set the initiated_by field to auto-scaling. Enable the CloudWatch Event Slack integration for sending out the notifications - auto-scaling is just a supported value but it's not meant for the healing events, instead, it is used for the scaling events. Besides, CloudWatch Events does not have a direct integration with Slack , so this option is incorrect.

References:

https://aws.amazon.com/blogs/mt/how-to-set-up-aws-opsworks-stacks-auto-healing-notifications-in-amazon-cloudwatch-events/

https://docs.aws.amazon.com/opsworks/latest/userguide/workinginstances-autohealing.html

Domain

Domain 5: Incident and Event Response

Question 16Skipped

The DevOps team at a multi-national financial services company manages hundreds of accounts through AWS Organizations. As part of the security compliance requirements, the team must enforce the use of a security-hardened AMI in each AWS account. When a new AMI is created, the team wants to make sure new EC2 instances cannot be instantiated from the old AMI. Additionally, the team also wants to track and audit compliance of AMI usage across all the accounts.

The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution for this requirement. What do you recommend? (Select two)

Create an AWS Automation document to create that AMI and deploy it to all the accounts using AWS CloudFormation StackSets. Run the Automation in all the accounts to have the AMI created locally

Correct selection

Create an AWS Config Custom Rule in all the accounts using CloudFormation StackSets. Report the rule's result using an AWS Config aggregation

Create an AWS Automation document to create that AMI in a master account and copy the AMI into the other accounts. When a new AMI is created, copy it as well

Create an AWS Lambda function in all the accounts using CloudFormation StackSets, which will check the AMI id of all the EC2 instances in the account. Give it an IAM role that allows it to publish messages to an SNS topic in the master account

Correct selection

Create an AWS Automation document to create that AMI in a master account and share the AMI with the other accounts. When a new AMI is created, un-share the previous AMI and share the new one

Overall explanation

Correct options:

Create an AWS Automation document to create that AMI in a master account and share the AMI with the other accounts. When a new AMI is created, un-share the previous AMI and share the new one

The DevOps team needs to provide approved AMIs that include the latest operating system updates, hardening requirements, and required third-party software agents thereby enabling a repeatable, scalable, and approved application stack factory that increases innovation velocity and reduces effort. This solution uses Amazon EC2 Systems Manager Automation to drive the workflow.

AMI hardening process:

via - https://d1.awsstatic.com/whitepapers/aws-building-ami-factory-process-using-ec2-ssm-marketplace-and-service-catalog.pdf

After you have an approved AMI, you can distribute the AMI across AWS Regions, and then share it with any other AWS accounts. To do this, you use an Amazon EC2 Systems Manager Automation document that uses an AWS Lambda function to copy the AMIs across a specified list of regions, and then another Lambda function to share this copied AMI with the other accounts. The resulting AMI IDs can be stored in the SSM Parameter Store or Amazon DynamoDB for later consumption.

Copying and sharing across AWS Regions and accounts:

via - https://d1.awsstatic.com/whitepapers/aws-building-ami-factory-process-using-ec2-ssm-marketplace-and-service-catalog.pdf

Create an AWS Config Custom Rule in all the accounts using CloudFormation StackSets. Report the rule's result using an AWS Config aggregation

AWS Config provides a detailed view of the resources associated with your AWS account, including how they are configured, how they are related to one another, and how the configurations and their relationships have changed over time.

via - https://docs.aws.amazon.com/config/latest/developerguide/how-does-config-work.html

An AWS Config rule represents your desired configuration settings for specific AWS resources or an entire AWS account. AWS Config provides customizable, predefined rules to help you get started. If a resource violates a rule, AWS Config flags the resource and the rule as noncompliant, and AWS Config notifies you through Amazon SNS.

For the given use-case, you need to create a Config custom rule to check that only the new AMI is being used and then report the rule's result using an AWS Config aggregation.

via - https://docs.aws.amazon.com/config/latest/developerguide/config-concepts.html

An aggregator is an AWS Config resource type that collects AWS Config configuration and compliance data from the following:

Multiple accounts and multiple regions.

Single account and multiple regions.

An organization in AWS Organizations and all the accounts in that organization that have AWS Config enabled.

via - https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html

So to summarize, the key is to enforce AMI usage. As such, you don't want the AMI to be created or copied locally onto the other accounts, you want it to be available only in a central account and "shared" with other accounts. This way, if you have a new AMI, you unshare the previous one and share the new one. Finally, to monitor the EC2 instances and their AMI ID over time, an AWS Config custom rule is perfect for that.

Incorrect options:

Create an AWS Automation document to create that AMI in a master account and copy the AMI into the other accounts. When a new AMI is created, copy it as well - You don't want the AMI to be created in a master account and then copied locally onto the other accounts, you want it to be available only in a central account and "shared" with other accounts.

Create an AWS Automation document to create that AMI and deploy it to all the accounts using AWS CloudFormation StackSets. Run the Automation in all the accounts to have the AMI created locally - You can't create the AMI in a master account using AWS Automation document and then deploy it to all the accounts using AWS CloudFormation StackSets, rather you want it to be available only in a central account and then "share" it with other accounts.

Create an AWS Lambda function in all the accounts using CloudFormation StackSets, which will check the AMI id of all the EC2 instances in the account. Give it an IAM role that allows it to publish messages to an SNS topic in the master account - You could use the Lambda function in all accounts to check the AMI id of all the EC2 instances in the account, but it would not allow you to track as well as audit the compliance of AMI usage across all the accounts.

References:

https://d1.awsstatic.com/whitepapers/aws-building-ami-factory-process-using-ec2-ssm-marketplace-and-service-catalog.pdf

https://docs.aws.amazon.com/config/latest/developerguide/config-concepts.html

https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html

Domain

Domain 3: Resilient Cloud Solutions

Question 17Skipped

An IT company is creating an online booking system for hotels. The booking workflow that the company has implemented can take over 3 hours to complete as a manual verification step is required by a 3rd party provider to ensure big transactions are not fraudulent.

As a DevOps Engineer, you need to expose this as a secure API for the end customers. The website must be able to sustain 5000 requests at the same time. How should you implement this in the simplest possible way?

Create the booking workflow in AWS Lambda. Enable public invocations of the Lambda functions so that clients can start the booking process. The Lambda function will wait for the service provider's response and then issue the status back to the client. Secure the calls using IAM

Correct answer

Create the booking workflow in Step Functions. Create an API Gateway stage using a service integration with Step Functions. Secure your API using Cognito

Create the booking workflow in AWS Lambda. Create an API Gateway stage using a service integration with AWS Lambda. The Lambda function will wait for the service provider response and then issue the status back to API Gateway. Secure your API using Cognito

Create the booking workflow in Step Functions. Create an API Gateway stage using a service integration with AWS Lambda, which will, in turn, invoke the Step Function workflow. Secure your API using Cognito

Overall explanation

Correct option:

Create the booking workflow in Step Functions. Create an API Gateway stage using a service integration with Step Functions. Secure your API using Cognito

API Gateway APIs can directly invoke an AWS service and pass in a payload. It's a common way to provide a publicly available and secure API for your chosen AWS services.

Amazon API Gateway integrates with AWS Step Functions, allowing you to call Step Functions with APIs that you create to simplify and customize interfaces to your applications. Step Functions makes it easy to coordinate the components of distributed applications and microservices as a series of steps in a visual workflow. You create state machines in the Step Functions Console or through the Step Functions API to specify and execute the steps of your application at scale. API Gateway is a fully managed service that makes it easy for developers to publish, maintain, monitor, and secure APIs at any scale.

How API Gateway Works:

via - https://aws.amazon.com/api-gateway/

How Step Functions Work:

via - https://aws.amazon.com/step-functions/

For the given use-case, you need to implement the payment workflow using Step Functions. A key reason you need this integration is that AWS Lambda has a max concurrent execution of 1000, while API gateway has a max concurrent execution of 10000. By integrating API Gateway and Step Functions together, you bypass any limit Lambda would have imposed on you.

Incorrect options:

Create the booking workflow in Step Functions. Create an API Gateway stage using a service integration with AWS Lambda, which will, in turn, invoke the Step Function workflow. Secure your API using Cognito - AWS Lambda has a max concurrent execution of 1000, while API gateway has a max concurrent execution of 10000. By integrating API Gateway and Step Functions together, you bypass any limit Lambda would have imposed on you. So there is no need to use Lambda as an intermediary for this workflow.

Create the booking workflow in AWS Lambda. Create an API Gateway stage using a service integration with AWS Lambda. The Lambda function will wait for the service provider response and then issue the status back to API Gateway. Secure your API using Cognito

Create the booking workflow in AWS Lambda. Enable public invocations of the Lambda functions so that clients can start the booking process. The Lambda function will wait for the service provider's response and then issue the status back to the client. Secure the calls using IAM

Lambda functions cannot process the booking workflow as it may take 3 hours, which is more than the 15 minutes max timeout limit that Lambda supports. So both these options are incorrect.

References:

https://docs.aws.amazon.com/step-functions/latest/dg/tutorial-api-gateway.html

https://aws.amazon.com/step-functions/faqs/

Domain

Domain 2: Configuration Management and IaC

Question 18Skipped

An ed-tech company has created a paid-per-use API using API Gateway. This API is available at http://edtech.com/api/v1. The website's static files have been uploaded in S3 and now support a new API route http://edtech.com/api/v1/new-feature if available. Your team has decided it is safer to send a small amount of traffic to that route first and test if the metrics look okay. Your API gateway routes are backed by AWS Lambda.

As a DevOps Engineer, what steps should you take to enable this testing?

Create a new Lambda function alias. Enable Canary deployments on the Lambda alias. Deploy the new API to the Lambda alias and assign a small amount of traffic to the canary Lambda version. Enable new route redirection for AWS Lambda and track metrics data using Amazon ES

Correct answer

Create a new API Gateway Stage. Enable Canary deployments on the v1 stage. Deploy the new stage to the v1 stage and assign a small amount of traffic to the canary stage. Track metrics data using CloudWatch

Create a new API Gateway Stage. Enable Canary deployments on the v1 stage. Deploy the new stage to the v1 stage and assign a small amount of traffic to the canary stage. Track metrics data using Amazon ES

Create a new Lambda function alias. Enable Canary deployments on the Lambda alias. Deploy the new API to the Lambda alias and assign a small amount of traffic to the canary Lambda version. Enable new route redirection for AWS Lambda and track metrics data using CloudWatch

Overall explanation

Correct option:

Create a new API Gateway Stage. Enable Canary deployments on the v1 stage. Deploy the new stage to the v1 stage and assign a small amount of traffic to the canary stage. Track metrics data using CloudWatch

Amazon API Gateway is an AWS service for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs at any scale. API Gateway handles tasks such as traffic management, authorization and access control, monitoring, and API version management. API Gateway acts as a "front door" for applications to access data, business logic, or functionality from your backend services, such as workloads running on Amazon Elastic Compute Cloud (Amazon EC2), code running on AWS Lambda, any web application, or real-time communication applications.

How API Gateway Works:

via - https://aws.amazon.com/api-gateway/

Simply creating and developing an API Gateway API doesn't automatically make it callable by your users. To make it callable, you must deploy your API to a stage. A stage is a named reference to a deployment, which is a snapshot of the API. You can configure stage settings to enable caching, customize request throttling, configure logging, define stage variables, or attach a canary release for testing. In a canary release deployment, total API traffic is separated at random into a production release and a canary release with a preconfigured ratio. The updated API features are only visible to the canary release. The canary release receives a small percentage of API traffic and the production release takes up the rest.

via - https://docs.aws.amazon.com/apigateway/latest/developerguide/canary-release.html

For the given use-case, you must deploy API to a new stage called v1, enable canary deployment on this v1 stage and assign a small amount of traffic to this canary stage.

Incorrect options:

Create a new API Gateway Stage. Enable Canary deployments on the v1 stage. Deploy the new stage to the v1 stage and assign a small amount of traffic to the canary stage. Track metrics data using Amazon ES - API Gateway & AWS Lambda have a direct integration with CloudWatch and NOT with Amazon ES. So this option is incorrect.

Create a new Lambda function alias. Enable Canary deployments on the Lambda alias. Deploy the new API to the Lambda alias and assign a small amount of traffic to the canary Lambda version. Enable new route redirection for AWS Lambda and track metrics data using CloudWatch - When a new API route is implemented, you must create a new API Gateway stage and NOT a Lambda alias. Lambda aliases are only used to update the behavior of an existing route. Remember that one route in API Gateway is mapped to one AWS Lambda function (or another service).

Create a new Lambda function alias. Enable Canary deployments on the Lambda alias. Deploy the new API to the Lambda alias and assign a small amount of traffic to the canary Lambda version. Enable new route redirection for AWS Lambda and track metrics data using Amazon ES - When a new API route is implemented, you must create a new API Gateway stage and NOT a Lambda alias. In addition, API Gateway & AWS Lambda have a direct integration with CloudWatch and NOT with Amazon ES.

References:

https://docs.aws.amazon.com/apigateway/latest/developerguide/welcome.html

https://docs.aws.amazon.com/apigateway/latest/developerguide/canary-release.html

Domain

Domain 2: Configuration Management and IaC

Question 19Skipped

A healthcare technology company provides a Software as a Service (SaaS) solution to hospitals throughout the United States to use the company’s proprietary system to integrate their clinical documentation and coding workflows. The DevOps team at the company would like to enable a CICD pipeline that enables safe deployments to production and the ability to work on new features of the product roadmap.

As an AWS Certified DevOps Engineer, which solution would you recommend for the given use-case?

Correct answer

Create a CodeCommit repository and set the CICD pipeline to deploy the master branch. For each new feature being implemented, create a new branch and create pull requests to merge into master. Set an IAM policy on your developer group to prevent direct pushes to master

Create a CodeCommit repository and create a branch for each feature. Create a CICD pipeline for each branch, and the last step of the CICD pipeline should be to merge into master. Set an IAM policy on your developer group to prevent direct pushes to master

Create a CodeCommit repository and set the CICD pipeline to deploy the master branch. For each new feature being implemented, create a new branch and create pull requests to merge into master. Set a repository access policy on your repository to prevent direct pushes to master

Create the main CodeCommit repository and set the CICD pipeline to deploy the master branch. For each new feature being implemented, create a new CodeCommit repository and create pull requests to merge into the main repository. Set an IAM policy on your developer group to prevent direct pushes to the main repository

Overall explanation

Correct option:

Create a CodeCommit repository and set the CICD pipeline to deploy the master branch. For each new feature being implemented, create a new branch and create pull requests to merge into master. Set an IAM policy on your developer group to prevent direct pushes to master

CodeCommit is a secure, highly scalable, managed source control service that makes it easier for teams to collaborate on code. A CICD pipeline helps you automate steps in your software delivery process, such as initiating automatic builds and then deploying to Amazon EC2 instances. You may use AWS CodePipeline, a service that builds, tests, and deploys your code every time there is a code change, based on the release process models you define to orchestrate each step in your release process.

via - https://aws.amazon.com/getting-started/projects/set-up-ci-cd-pipeline/

It's a best practice to work with branches in your git repository to create features, as it's the intended usage of branches. Don't create separate repositories for features. To protect the master branch you need to set a Deny policy on the IAM group that the developer group should be assigned to.

via - https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-conditional-branch.html

Incorrect options:

Create the main CodeCommit repository and set the CICD pipeline to deploy the master branch. For each new feature being implemented, create a new CodeCommit repository and create pull requests to merge into the main repository. Set an IAM policy on your developer group to prevent direct pushes to the main repository - As mentioned in the explanation above, you should not create a separate repository for each new feature. So this option is incorrect.

Create a CodeCommit repository and set the CICD pipeline to deploy the master branch. For each new feature being implemented, create a new branch and create pull requests to merge into master. Set a repository access policy on your repository to prevent direct pushes to master - This option has been added as a distractor as there is no such thing as a repository access policy.

Create a CodeCommit repository and create a branch for each feature. Create a CICD pipeline for each branch, and the last step of the CICD pipeline should be to merge into master. Set an IAM policy on your developer group to prevent direct pushes to master - Although you can create a separate CICD pipeline for each branch, you cannot merge multiple pipelines into one to make it a "master" pipeline or merge multiple branches into a master branch as the last step of a CICD pipeline. So this option is incorrect.

References:

https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-conditional-branch.html

https://aws.amazon.com/codecommit/faqs/

https://aws.amazon.com/getting-started/projects/set-up-ci-cd-pipeline/

Domain

Domain 1: SDLC Automation

Question 20Skipped

An industrial appliances company would like to take advantage of AWS Systems Manager to manage their on-premise instances and their EC2 instances. This will allow them to run some SSM RunCommand across their hybrid fleet. The company would also like to effectively manage the size of the fleet. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution to address this requirement.

How would you set up the on-premise server to achieve this objective?

Create an IAM User for each on-premise server to be able to call the AssumeRole operation on the SSM service. Using the Access Key ID and the Secret Access Key ID, use the AWS CLI to register your on-premise servers. They will appear with the prefix 'mi-' in your SSM console

Correct answer

Create an IAM Service Role for instances to be able to call the AssumeRole operation on the SSM service. Generate an activation code and activation ID for your on-premise servers. Use these credentials to register your on-premise servers. They will appear with the prefix 'mi-' in your SSM console

Create an IAM Service Role for each instance to be able to call the AssumeRole operation on the SSM service. Generate a unique activation code and activation ID for each on-premise servers. Use these credentials to register your on-premise servers. They will appear with the prefix 'i-' in your SSM console

Create an IAM User for all on-premise servers to be able to call the AssumeRole operation on the SSM service. Using the Access Key ID and the Secret Access Key ID, use the AWS CLI to register your on-premise servers. They will appear with the prefix 'i-' in your SSM console

Overall explanation

Correct option:

Create an IAM Service Role for instances to be able to call the AssumeRole operation on the SSM service. Generate an activation code and activation ID for your on-premise servers. Use these credentials to register your on-premise servers. They will appear with the prefix 'mi-' in your SSM console

AWS Systems Manager allows you to centralize operational data from multiple AWS services and automate tasks across your AWS resources. You can create logical groups of resources such as applications, different layers of an application stack, or production versus development environments. With Systems Manager, you can select a resource group and view its recent API activity, resource configuration changes, related notifications, operational alerts, software inventory, and patch compliance status.

How Systems Manager Works:

via - https://aws.amazon.com/systems-manager/

Servers and virtual machines (VMs) in a hybrid environment require an IAM role to communicate with the Systems Manager service. The role grants AssumeRole trust to the Systems Manager service. You only need to create a service role for a hybrid environment once for each AWS account.

To set up servers and virtual machines (VMs) in your hybrid environment as managed instances, you need to create a managed-instance activation. After you complete the activation, you immediately receive an Activation Code and Activation ID. You specify this Code/ID combination when you install SSM agents on servers and VMs in your hybrid environment. The Code/ID provides secure access to the Systems Manager service from your managed instances.

In the Instance limit field, specify the total number of on-premises servers or VMs that you want to register with AWS as part of the activation. This means you don't need to create a unique activation Code/ID for each managed instance.

After you finish configuring your servers and VMs for Systems Manager, your hybrid machines are listed in the AWS Management Console and described as managed instances. Amazon EC2 instances configured for Systems Manager are also described as managed instances. In the console, however, the IDs of your hybrid instances are distinguished from Amazon EC2 instances with the prefix "mi-". Amazon EC2 instance IDs use the prefix "i-".

via - https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-managedinstances.html

Incorrect options:

Create an IAM Service Role for each instance to be able to call the AssumeRole operation on the SSM service. Generate a unique activation code and activation ID for each on-premise servers. Use these credentials to register your on-premise servers. They will appear with the prefix 'i-' in your SSM console - As mentioned in the explanation earlier, the on-premise instances use the prefix "mi-" whereas the Amazon EC2 instance IDs use the prefix "i-".

Create an IAM User for each on-premise server to be able to call the AssumeRole operation on the SSM service. Using the Access Key ID and the Secret Access Key ID, use the AWS CLI to register your on-premise servers. They will appear with the prefix 'mi-' in your SSM console

Create an IAM User for all on-premise servers to be able to call the AssumeRole operation on the SSM service. Using the Access Key ID and the Secret Access Key ID, use the AWS CLI to register your on-premise servers. They will appear with the prefix 'i-' in your SSM console

Both these options suggest using the Access Key ID and the Secret Access Key ID to register your on-premise servers which is considered a bad practice from a security perspective. Instead, you should use an IAM Service Role for instances to be able to call the AssumeRole operation on the SSM service.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-managed-instance-activation.html

https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-service-role.html

Domain

Domain 6: Security and Compliance

Question 21Skipped

A financial planning company runs a tax optimization application that allows people to enter their personal financial information and get recommendations. The company is committed to the maximum security for the Personally identifiable information (PII) data in S3 buckets, and as part of compliance requirements, it needs to implement a solution to be alerted in case of new PII and its access in S3.

As an AWS Certified DevOps Engineer, which solution would you recommend such that it needs MINIMUM development effort?

Set up an S3 bucket policy that filters requests containing PII data using a conditional statement

Create an Amazon Lambda function that is integrated with Amazon Sagemaker to detect PII data. Integrate the Lambda function with S3 events for PUT requests

Enable Amazon GuardDuty on the select S3 buckets. Setup alerting using CloudWatch Alarms

Correct answer

Enable Amazon Macie on the selected S3 buckets. Setup alerting using CloudWatch Events

Overall explanation

Correct option:

Enable Amazon Macie on the selected S3 buckets. Setup alerting using CloudWatch Events

Amazon Macie is a security service that uses machine learning to automatically discover, classify, and protect sensitive data in AWS. Macie automatically detects a large and growing list of sensitive data types, including personally identifiable information (PII) such as names, addresses, and credit card numbers. It also gives you constant visibility of the data security and data privacy of your data stored in Amazon S3.

How Macie Works:

via - https://aws.amazon.com/macie/

For the given use-case, you can enable Macie on specific S3 buckets and then configure SNS notifications via CloudWatch events for Macie alerts.

For a deep-dive on how to query PII data using Macie, please refer to this excellent blog: https://aws.amazon.com/blogs/security/how-to-query-personally-identifiable-information-with-amazon-macie/

Incorrect options:

Enable Amazon GuardDuty on the select S3 buckets. Setup alerting using CloudWatch Alarms - Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads.

How GuardDuty Works:

via - https://aws.amazon.com/guardduty/

Create an Amazon Lambda function that is integrated with Amazon Sagemaker to detect PII data. Integrate the Lambda function with S3 events for PUT requests - Amazon Lambda + Sagemager might work but it requires significant development effort and probably won't yield excellent results.

Set up an S3 bucket policy that filters requests containing PII data using a conditional statement - S3 bucket policies cannot be used to analyze the data payload in a request. This option has been added as a distractor.

References:

https://aws.amazon.com/blogs/security/how-to-query-personally-identifiable-information-with-amazon-macie/

https://aws.amazon.com/macie/

https://aws.amazon.com/guardduty/

Domain

Domain 5: Incident and Event Response

Question 22Skipped

A retail company is storing the users' information along with their purchase history in a DynamoDB table and it has also enabled the DynamoDB Streams. Three use cases are implemented for this table: a Lambda function reads the stream to send emails for new users subscriptions, another Lambda function which sends an email after a user has done their first purchase and finally the last Lambda function which awards discounts to users every 10 purchase. When there is a high volume of data on your DynamoDB table, the Lambda functions are experiencing a throttling issue. As you plan on adding future Lambda functions to read from that stream, you need to update the existing solution.

As a DevOps Engineer, which of the following options would you recommend?

Correct answer

Create a new Lambda function that will read from the stream and pass on the payload to SNS. Have the other three and upcoming Lambda functions directly read from the SNS topic

Increase the memory on the Lambda function so that they have an increased vCPU allocation and process the data faster while making fewer requests to DynamoDB

Create a DynamoDB DAX cluster to cache the reads

Increase the RCUs on your DynamoDB table to avoid throttling issues

Overall explanation

Correct option:

Create a new Lambda function that will read from the stream and pass on the payload to SNS. Have the other three and upcoming Lambda functions directly read from the SNS topic

DynamoDB Streams captures a time-ordered sequence of item-level modifications in any DynamoDB table and stores this information in a log for up to 24 hours. Applications can access this log and view the data items as they appeared before and after they were modified, in near-real-time. A DynamoDB stream is an ordered flow of information about changes to items in a DynamoDB table. When you enable a stream on a table, DynamoDB captures information about every modification to data items in the table.

via - https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Streams.html

via - https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Streams.html

DynamoDB is integrated with AWS Lambda so that you can create triggers—pieces of code that automatically respond to events in DynamoDB Streams. With triggers, you can build applications that react to data modifications in DynamoDB tables.

If you enable DynamoDB Streams on a table, you can associate the stream Amazon Resource Name (ARN) with a Lambda function that you write. Immediately after an item in the table is modified, a new record appears in the table's stream. AWS Lambda polls the stream and invokes your Lambda function synchronously when it detects new stream records.

No more than two processes at most should be reading from the same streams shard at the same time. Having more than two readers per shard can result in throttling. Therefore, you need to use a fan-out pattern for this, SNS being perfect for that.

Incorrect options:

Increase the RCUs on your DynamoDB table to avoid throttling issues - DynamoDB Streams operates asynchronously, so there is no performance impact on a table if you enable a stream. So, RCUs have no bearing on throttling issues and this option just acts as a distractor.

Create a DynamoDB DAX cluster to cache the reads - DAX won't help here, it's meant to improve reads on your DynamoDB table through a cache, and NOT for DynamoDB Streams.

Increase the memory on the Lambda function so that they have an increased vCPU allocation and process the data faster while making fewer requests to DynamoDB - The Lambda function memory won't help, the issue is that too many processes are reading from the same shard.

References:

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Streams.html

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Streams.Lambda.html

Domain

Domain 5: Incident and Event Response

Question 23Skipped

A multi-national retail company has defined tagging guidelines and standard for all its resources in AWS and would like to create a dashboard to visualize the compliance of all the resources with the ability to find out the non-compliant resources. The company has hired you as an AWS Certified DevOps Engineer Professional to develop a solution for this requirement.

Which of the following options would you suggest to address the use-case?

Track all your resources with AWS CloudTrail. Output the data in S3 and create a Quicksight dashboard

Use AWS Service Catalog to get an inventory of all the resources in your account. Use the integrated dashboard feature to track compliance

Use SSM to track resource groups without tags. Export that data using SSM inventory into S3, and build a QuickSight dashboard

Correct answer

Use AWS Config to track resources in your account. Use SNS to stream changes to a Lambda function that writes to S3. Create a QuickSight dashboard on top of it

Overall explanation

Correct option:

Use AWS Config to track resources in your account. Use SNS to stream changes to a Lambda function that writes to S3. Create a QuickSight dashboard on top of it

AWS Config is a fully managed service that provides you with an AWS resource inventory, configuration history, and configuration change notifications to enable security and governance. With AWS Config you can discover existing AWS resources, export a complete inventory of your AWS resources with all configuration details, and determine how a resource was configured at any point in time.

via - https://aws.amazon.com/config/

Here, we can use AWS Config to track resource configuration, and we could create a rule to track the tagging of these resources. All the changes to resource configuration as well as tagging of resources are streamed to an SNS topic.

A tag is a label that you assign to an AWS resource. Each tag consists of a key and an optional value, both of which you define. Tags make it easier to manage, search for, and filter resources. You can use tags to categorize your AWS resources in different ways, for example, by purpose, owner, or environment.

via - https://docs.aws.amazon.com/config/latest/developerguide/tagging.html

You can set up the Required-Tag managed rule for Config which requires up to 6 tags with optional values in a single rule. Previously, each rule accepted only a single tag/value combo. Additionally, the Required-Tag managed rule now accepts a comma-separated list of values for each checked tag. This allows for a rule to be compliant if any one of a supplied list of tags is present on the resource.

via - https://aws.amazon.com/blogs/devops/aws-config-checking-for-compliance-with-new-managed-rule-options/

Incorrect options:

Use AWS Service Catalog to get an inventory of all the resources in your account. Use the integrated dashboard feature to track compliance - AWS Service Catalog enabling AWS customers to create and deliver standardized services that provide the necessary control, while still empowering developers to choose the services that best fit their needs. You cannot use Service Catalog to get an inventory of all the resources in your account.

Use SSM to track resource groups without tags. Export that data using SSM inventory into S3, and build a QuickSight dashboard - SSM inventory will only help with understanding what is installed on your managed instances. To view Systems Manager Inventory history and change tracking for all of your managed instances, you need to use AWS Config itself.

Track all your resources with AWS CloudTrail. Output the data in S3 and create a Quicksight dashboard - CloudTrail is used to track API calls, not resources. So this option is incorrect.

References:

https://docs.aws.amazon.com/config/latest/developerguide/tagging.html

https://aws.amazon.com/blogs/devops/aws-config-checking-for-compliance-with-new-managed-rule-options/

Domain

Domain 4: Monitoring and Logging

Question 24Skipped

Your company has adopted CodeCommit and forces developers to create new branches and create pull requests before merging the code to master. The development team lead reviewing the pull request needs high confidence in the quality of the code and therefore would like the CICD system to automatically build a Pull Request to provide a testing badge with a pass/fail status.

How can you implement the validation of Pull Requests by CodeBuild efficiently?

Create a CloudWatch Event Rule with a scheduled rate of 5 minutes that invokes a Lambda function. This function checks for the creation and updates done to Pull Requests in the source repository, and invokes CodeBuild when needed. Create a CloudWatch Event rule to watch for CodeBuild build success or failure event and as a target invoke a Lambda function that will update the pull request with the Build outcome

Create a CloudWatch Event Rule with a scheduled rate of 5 minutes that invokes a Lambda function. This function checks for the creation and updates done to Pull Requests in the source repository, and invokes CodeBuild when needed. The function waits for CodeBuild to be done and then updates the Pull Request with a message with the build outcome

Create a CloudWatch Event Rule that reacts to the creation and updates done to Pull Requests in the source repository. The target of that rule should be AWS Lambda. This function invokes CodeBuild and waits for CodeBuild to be done and then updates the Pull Request with a message with the build outcome

Correct answer

Create a CloudWatch Event Rule that reacts to the creation and updates done to Pull Requests in the source repository. The target of that rule should be CodeBuild. Create a second CloudWatch Event rule to watch for CodeBuild build success or failure event and as a target invoke a Lambda function that will update the pull request with the Build outcome

Overall explanation

Correct option:

Create a CloudWatch Event Rule that reacts to the creation and updates done to Pull Requests in the source repository. The target of that rule should be CodeBuild. Create a second CloudWatch Event rule to watch for CodeBuild build success or failure event and as a target invoke a Lambda function that will update the pull request with the Build outcome

Amazon CloudWatch Events delivers a near real-time stream of system events that describe changes in Amazon Web Services (AWS) resources. Using simple rules that you can quickly set up, you can match events and route them to one or more target functions or streams. You can generate custom application-level events and publish them to CloudWatch Events. You can also set up scheduled events that are generated on a periodic basis. A rule matches incoming events and routes them to targets for processing.

CloudWatch Events Overview:

via - https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/WhatIsCloudWatchEvents.html

For the given use-case, we need to create two CloudWatch Event Rules. The first rule would trigger on CodeCommit Pull Request and have the target as CodeBuild.

The second rule would trigger on CodeBuild build success or failure event and have the target as a Lambda function that will update the pull request with the Build outcome

Incorrect options:

Create a CloudWatch Event Rule with a scheduled rate of 5 minutes that invokes a Lambda function. This function checks for the creation and updates done to Pull Requests in the source repository, and invokes CodeBuild when needed. Create a CloudWatch Event rule to watch for CodeBuild build success or failure event and as a target invoke a Lambda function that will update the pull request with the Build outcome - Using a scheduled rate of 5 minutes would work but would be inefficient. It is much better to configure a CloudWatch Event Rule that would trigger on CodeCommit Pull Request and carry out the rest of the solution workflow as outlined earlier.

Create a CloudWatch Event Rule with a scheduled rate of 5 minutes that invokes a Lambda function. This function checks for the creation and updates done to Pull Requests in the source repository, and invokes CodeBuild when needed. The function waits for CodeBuild to be done and then updates the Pull Request with a message with the build outcome

Create a CloudWatch Event Rule that reacts to the creation and updates done to Pull Requests in the source repository. The target of that rule should be AWS Lambda. This function invokes CodeBuild and waits for CodeBuild to be done and then updates the Pull Request with a message with the build outcome

For both these options, invoking a Lambda function to start CodeBuild would work, but having the function wait on CodeBuild has two issues: 1) The Lambda function may timeout and has a maximum timeout of 15 minutes. What if the test suite takes longer to run? 2) You will be billed for the Lambda function wait time.

Therefore both these options are incorrect.

Reference:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/WhatIsCloudWatchEvents.html

Domain

Domain 1: SDLC Automation

Question 25Skipped

The development team at a social media company is using AWS CodeCommit to store code. As a Lead DevOps Engineer at the company, you have defined a company-wide rule so that the team should not be able to push to the master branch. You have added all the developers in an IAM group developers and attached the AWS managed IAM policy arn:aws:iam::aws:policy/AWSCodeCommitPowerUser to the group. This policy provides full access to AWS CodeCommit repositories but does not allow repository deletion, however, your developers can still push to the master branch.

How should you prevent the developers from pushing to the master branch?

Correct answer

Add a new IAM policy attached to the group to Deny codecommit:GitPush with a condition on the master branch

Include a git commit pre-hook that invokes a Lambda function and checks if the push is done to master

Include a CodeCommit repository policy on each repository with an explicit Deny for codecommit:GitPush

Modify the AWS managed IAM policy attached to the group to Deny codecommit:GitPush with a condition on the master branch

Overall explanation

Correct option:

Add a new IAM policy attached to the group to Deny codecommit:GitPush with a condition on the master branch

Any CodeCommit repository user who has sufficient permissions to push code to the repository can contribute to any branch in that repository. You can configure a branch so that only some repository users can push or merge code to that branch. For example, you might want to configure a branch used for production code so that only a subset of senior developers can push or merge changes to that branch. Other developers can still pull from the branch, make their own branches, and create pull requests, but they cannot push or merge changes to that branch. You can configure this access by creating a conditional policy that uses a context key for one or more branches in IAM.

For the given use-case, you need to add an extra policy with an explicit Deny. Please note an Explicit Deny always has priority over anything else.

Limit pushes and merges to branches in AWS CodeCommit:

via - https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-conditional-branch.html

Incorrect options:

Include a CodeCommit repository policy on each repository with an explicit Deny for codecommit:GitPush - This option has been added as a distractor since CodeCommit repository policies do not exist.

Modify the AWS managed IAM policy attached to the group to Deny codecommit:GitPush with a condition on the master branch - You cannot modify an AWS managed IAM policy, so this option is incorrect.

Include a git commit pre-hook that invokes a Lambda function and checks if the push is done to master - Although it would be cool, CodeCommit still does not have a pre-hook feature to integrate with Lambda.

Reference:

https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-conditional-branch.html

Domain

Domain 5: Incident and Event Response

Question 26Skipped

As the Lead DevOps Engineer at a retail company, you have a Spring boot web application running in an Auto Scaling group and behind an Application Load Balancer. You must collect the logs before an instance is terminated to perform log analytics later on. It's also necessary to collect all the access logs. The analysis of these logs should be performed at a minimal cost, and only need to be run from time to time.

Which of the following options would you suggest to implement the MOST cost-optimal solution for this requirement? (Select three)

Correct selection

Enable Access Logs at the Application Load Balancer level

Correct selection

Analyze the logs using AWS Athena

Create an Auto Scaling Group Lifecycle Hook for the terminate action. Create a CloudWatch Event rule for that lifecycle hook and invoke a Lambda function. The Lambda function should use an SSM Run Command to install the CloudWatch Logs Agent and push the applications logs in S3

Analyze the logs using an EMR cluster

Enable Access Logs at the Target Group level

Correct selection

Create an Auto Scaling Group Lifecycle Hook for the terminate action. Create a CloudWatch Event rule for that lifecycle hook and invoke a Lambda function. The Lambda function should use an SSM Run Command to extract the application logs and store them in S3

Overall explanation

Correct options:

Create an Auto Scaling Group Lifecycle Hook for the terminate action. Create a CloudWatch Event rule for that lifecycle hook and invoke a Lambda function. The Lambda function should use an SSM Run Command to extract the application logs and store them in S3

Lifecycle hooks enable you to perform custom actions by pausing instances as an Auto Scaling group launches or terminates them. When a scale-in event occurs, the terminating instance is first deregistered from the load balancer and while the instance is in the wait state, you can, for example, connect to the instance and download logs or other data before the instance is fully terminated.

via - https://docs.aws.amazon.com/autoscaling/ec2/userguide/lifecycle-hooks.html

For the given use-case, you can configure a lifecycle hook to invoke the CloudWatch Event rule to trigger a Lambda function that launches an SSM Run Command to extract the application logs and store them in S3.

Enable Access Logs at the Application Load Balancer level

Access logging is an optional feature of Elastic Load Balancing that is disabled by default. After you enable access logging for your load balancer, Elastic Load Balancing captures the logs and stores them in the Amazon S3 bucket that you specify as compressed files. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses. You can use these access logs to analyze traffic patterns and troubleshoot issues.

Analyze the logs using AWS Athena

Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL. Athena is serverless, so there is no infrastructure to set up or manage, and you can start analyzing data immediately. You don’t even need to load your data into Athena, it works directly with data stored in S3. You can analyze the access logs stored in S3 via Athena.

Incorrect options:

Create an Auto Scaling Group Lifecycle Hook for the terminate action. Create a CloudWatch Event rule for that lifecycle hook and invoke a Lambda function. The Lambda function should use an SSM Run Command to install the CloudWatch Logs Agent and push the applications logs in S3 - CloudWatch Logs agent can only be used for continuous log streaming, and NOT for a one-time log extract to S3.

Enable Access Logs at the Target Group level - Please note that access logs are enabled at the ALB level and NOT at the target group level.

Analyze the logs using an EMR cluster - Analyzing logs at a low cost and in a serverless fashion should be done using AWS Athena. EMR clusters are usually long-running and cost a lot of money, and don't have serverless scaling capabilities.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/lifecycle-hooks.html

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

https://aws.amazon.com/athena/

Domain

Domain 3: Resilient Cloud Solutions

Question 27Skipped

As a DevOps Engineer at a social media company, you have deployed your application in an Auto Scaling group (ASG) using CloudFormation. You would like to update the Auto Scaling Group to have all the instances reference the newly created launch configuration, which upgrades the instance type. Your ASG currently contains 6 instances and you need at least 4 instances to be up at all times.

Which configuration should you use in the CloudFormation template?

AutoScalingReplacingUpdate

AutoScalingLaunchTemplateUpdate

AutoScalingLaunchConfigurationUpdate

Correct answer

AutoScalingRollingUpdate

Overall explanation

Correct option:

AutoScalingRollingUpdate

To specify how AWS CloudFormation handles rolling updates for an Auto Scaling group, use the AutoScalingRollingUpdate policy. Rolling updates enable you to specify whether AWS CloudFormation updates instances that are in an Auto Scaling group in batches or all at once. AutoScalingRollingUpdate is perfect for the given use case.

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-updatepolicy.html

Incorrect options:

AutoScalingReplacingUpdate - To specify how AWS CloudFormation handles replacement updates for an Auto Scaling group, you should use the AutoScalingReplacingUpdate policy. This policy enables you to specify whether AWS CloudFormation replaces an Auto Scaling group with a new one or replaces only the instances in the Auto Scaling group. This option will create a new ASG entirely, so this is ruled out.

AutoScalingLaunchTemplateUpdate

AutoScalingLaunchConfigurationUpdate

AutoScalingLaunchTemplateUpdate and AutoScalingLaunchConfigurationUpdate do not exist, so both these options are incorrect.

Reference:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-updatepolicy.html

Domain

Domain 3: Resilient Cloud Solutions

Question 28Skipped

A global health-care company has an EFS filesystem being used in eu-west-1. The company would like to plan for a disaster recovery strategy and backup that EFS file system in ap-southeast-2. It needs to have a hot copy of the data so that the applications can be re-deployed in ap-southeast-2 with a minimum RPO and RTO. The VPCs in each region are not peered with each other.

How should a DevOps engineer implement a solution for this use-case?

Correct answer

Create a replication cluster managed by EC2 with Auto Scaling in eu-west-1. Scale according to a Custom Metric you would publish with the application representing the lag in file reads. Replicate the data into Amazon S3 in ap-southeast-2. Create another replication cluster in ap-southeast-2 that reads from Amazon S3 and copies the files into a standby EFS cluster

Create a CloudWatch Event hourly rule that triggers an AWS Batch cluster in eu-west-1 to perform an incremental replication. Replicate the data into Amazon S3 in another region. Create an EC2 replication cluster in ap-southeast-2 that reads from Amazon S3 and copies the files into a standby EFS cluster

Create a replication cluster managed by EC2 with Auto Scaling in eu-west-1. Scale according to a Custom Metric you would publish with the application representing the lag in file reads. Create a standby EFS cluster in ap-southeast-2 and mount it on the same EC2 cluster. Let the replication software perform EFS to EFS replication

Create a CloudWatch Event hourly rule that triggers an AWS Batch cluster in eu-west-1 to perform an incremental replication. Replicate the data into Amazon S3 in another region. Create a Lambda Function in ap-southeast-2 for PUT on Amazon S3 and triggers an SSM Run Command to copy the files from S3 into EFS

Overall explanation

Correct option:

Create a replication cluster managed by EC2 with Auto Scaling in eu-west-1. Scale according to a Custom Metric you would publish with the application representing the lag in file reads. Replicate the data into Amazon S3 in ap-southeast-2. Create another replication cluster in ap-southeast-2 that reads from Amazon S3 and copies the files into a standby EFS cluster

Metrics are the fundamental concept in CloudWatch. A metric represents a time-ordered set of data points that are published to CloudWatch. Think of a metric as a variable to monitor, and the data points as representing the values of that variable over time. You can use these metrics to verify that your system is performing as expected.

Using custom metrics for your Auto Scaling groups and instances:

via - https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html

RPO and RTO explained:

via - https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/recovery-time-objective-rto-and-recovery-point-objective-rpo.html

For the given use-case, we need to create a custom metric via the application that captures the lag in file reads and then uses it for scaling the ASG managing the EC2 instances to replicate the source EFS cluster into S3. Use another ASG to copy data from S3 into EFS in the target AWS Region. Here we want minimum RPO so we want continuous replication, and minimum RTO so we want a hot EFS system ready to go. Please note that because the RPO and RTO are low, the cost of the solution will be very high.

Side note (for your knowledge) the AWS DataSync service (not covered in the exam) can achieve EFS to EFS replication in a much more native way.

Note: With this solution, as the files are copied to S3, the file Linux permissions would not be replicated.

Incorrect options:

Create a replication cluster managed by EC2 with Auto Scaling in eu-west-1. Scale according to a Custom Metric you would publish with the application representing the lag in file reads. Create a standby EFS cluster in ap-southeast-2 and mount it on the same EC2 cluster. Let the replication software perform EFS to EFS replication - As the VPCs are not peered, it's not possible to mount the EFS of two different regions onto the same EC2 cluster. We need to go through S3 for the replication.

Create a CloudWatch Event hourly rule that triggers an AWS Batch cluster in eu-west-1 to perform an incremental replication. Replicate the data into Amazon S3 in another region. Create an EC2 replication cluster in ap-southeast-2 that reads from Amazon S3 and copies the files into a standby EFS cluster

Create a CloudWatch Event hourly rule that triggers an AWS Batch cluster in eu-west-1 to perform an incremental replication. Replicate the data into Amazon S3 in another region. Create a Lambda Function in ap-southeast-2 for PUT on Amazon S3 and triggers an SSM Run Command to copy the files from S3 into EFS

As the target, EFS needs to have a hot copy of the data, so both these options are ruled out since there is a delay of an hour.

References:

https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/recovery-time-objective-rto-and-recovery-point-objective-rpo.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html

Domain

Domain 3: Resilient Cloud Solutions

Question 29Skipped

The DevOps team at an auditing firm has deployed its flagship application on Elastic Beanstalk that processes invoices uploaded by customers in CSV form. The invoices can be quite big, with up to 10MB and 1,000,000 records total. Processing is CPU intensive which results in slowing down the application. Customers are sent an email when the processing is done, through the use of a cron job. The auditing firm has hired you as an AWS Certified DevOps Engineer Professional to build a solution for this requirement.

What do you recommend for the application to ensure a good performance and address scalability requirements?

Create a separate Beanstalk tier within the same environment that's a worker configuration and processes invoices through an SQS queue. The invoices are directly sent into SQS after being gzipped by the web tier. The workers process these files. A cron job defined using the cron.yml file will send out the emails

Create a separate Beanstalk environment that's a worker environment and processes invoices through an SQS queue. The invoices are uploaded into S3 and a reference to it is sent to the SQS by the web tier. The worker tier processes these files. A cron job defined using the cron.yml file on the web tier will send out the emails

Correct answer

Create a separate Beanstalk environment that's a worker environment and processes invoices through an SQS queue. The invoices are uploaded into S3 and a reference to it is sent to the SQS by the web tier. The worker tier processes these files. A cron job defined using the cron.yml file will send out the emails

Create a separate Beanstalk tier within the same environment that's a worker configuration and processes invoices through an SQS queue. The invoices are directly sent into SQS after being gzipped by the web tier. The workers process these files. A cron job defined using the cron.yml file on the web tier will send out the emails

Overall explanation

Correct option:

Create a separate Beanstalk environment that's a worker environment and processes invoices through an SQS queue. The invoices are uploaded into S3 and a reference to it is sent to the SQS by the web tier. The worker tier processes these files. A cron job defined using the cron.yml file will send out the emails

With Elastic Beanstalk, you can quickly deploy and manage applications in the AWS Cloud without having to learn about the infrastructure that runs those applications. You simply upload your application, and Elastic Beanstalk automatically handles the details of capacity provisioning, load balancing, scaling, and application health monitoring.

AWS Elastic Beanstalk enables you to manage all of the resources that run your application as environments. An environment is a collection of AWS resources running an application version. When you launch an Elastic Beanstalk environment, you need to choose an environment tier. An application that serves HTTP requests runs in a web server environment tier. A backend environment that pulls tasks from an Amazon Simple Queue Service (Amazon SQS) queue runs in a worker environment tier.

Elastic Beanstalk Concepts:

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts.html

When you create a web server environment, Beanstalk provisions the resources required to run your application. AWS resources created for this type of environment include one elastic load balancer, an Auto Scaling group, and one or more Amazon Elastic Compute Cloud (Amazon EC2) instances.

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts-webserver.html

AWS resources created for a worker environment tier include an ASG, one or more Amazon EC2 instances, and an IAM role. For the worker environment tier, Beanstalk also creates and provisions an SQS queue if you don’t already have one. When you launch a worker environment, Beanstalk installs the necessary support files for your programming language of choice and a daemon on each EC2 instance in the ASG. The daemon reads messages from an SQS queue. The daemon sends data from each message that it reads to the web application running in the worker environment for processing.

For the given use-case, the worker tier is used to asynchronously process the invoices from an SQS queue. SQS size limit is 256KB and therefore the files must be uploaded to S3 and a reference to them should be sent to SQS by the web tier. Finally, the cron.yml file must be defined on the worker tier. Using this strategy we have decoupled our processing tier from our web tier, and CPU usage will go down as a result. The worker tier will also be able to easily scale in case many invoices are uploaded.

Elastic Beanstalk Worker environment:

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts-worker.html

Incorrect options:

Create a separate Beanstalk tier within the same environment that's a worker configuration and processes invoices through an SQS queue. The invoices are directly sent into SQS after being gzipped by the web tier. The workers process these files. A cron job defined using the cron.yml file will send out the emails - As mentioned in the explanation above, the worker tier must be a separate environment from the web tier, so this option is incorrect.

Create a separate Beanstalk environment that's a worker environment and processes invoices through an SQS queue. The invoices are uploaded into S3 and a reference to it is sent to the SQS by the web tier. The worker tier processes these files. A cron job defined using the cron.yml file on the web tier will send out the emails - The cron.yml file must be defined on the worker tier, it is not supported by the web tier, so this option is incorrect.

Create a separate Beanstalk tier within the same environment that's a worker configuration and processes invoices through an SQS queue. The invoices are directly sent into SQS after being gzipped by the web tier. The workers process these files. A cron job defined using the cron.yml file on the web tier will send out the emails - The worker tier must be a separate environment from the web tier, so this option is incorrect.

References:

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts.html

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts-webserver.html

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts-worker.html

Domain

Domain 2: Configuration Management and IaC

Question 30Skipped

As a DevOps Engineer at a social media company, you have implemented a CICD pipeline that takes code from a CodeCommit repository, builds it using CodeBuild thanks to the instructions in the local Dockerfile, and then pushes to ECR at 123456789.dkr.ecr.region.amazonaws.com/my-web-app. The last step of your CICD pipeline is to deploy to the application to your ECS cluster. It seems that while you do so, the application is only partly updated on some ECS instances which are running an older version of your image. You have found that terminating the instance or clearing the local Docker cache fixes the issue, but would like to implement something more robust that provides visibility and identification to track where container images are deployed.

How should you implement a solution to address this issue?

Correct answer

When creating a new task definition for your ECS service, ensure to add the sha256 hash in the full image name so that ECS pulls the correct image every time

After the deploy step in CodePipeline is done, include a Custom Step using a Lambda function that triggers an SSM Run Command. That command will clear the local Docker cache and stop the task

When creating a new task definition for your ECS service, ensure to add the latest tag in the full image name so that ECS pulls the correct image every time

After the deploy step in CodePipeline is done, include a Custom Step using a Lambda function that triggers an AWS Lambda function. That function will SSH onto your ECS instances and clear the local Docker cache and stop the task

Overall explanation

Correct option:

When creating a new task definition for your ECS service, ensure to add the sha256 hash in the full image name so that ECS pulls the correct image every time

Amazon ECS SHA Tracking provides visibility and identification to track where container images are deployed by using task state change events emitted to CloudWatch Events. SHA Tracking is integrated with Amazon ECR, ECS, Fargate and CloudWatch Events to support application lifecycle operations. You can use the IMAGEID property, which is the SHA digest for the Docker image used to start the container.

via - https://docs.aws.amazon.com/AmazonECS/latest/developerguide/container-metadata.html

The issue here is that the ECS instances do not detect that a newer image version is available, because the name 123456789.dkr.ecr.region.amazonaws.com/my-web-app is re-used. Therefore, by specifying the sha256 e.g.: aws_account_id.dkr.ecr.region.amazonaws.com/my-web-app@sha256:94afd1f2e64d908bc90dbca0035a5b567EXAMPLE, we are certain that newer versions of the Docker image will have a different hash value and therefore the ECS cluster will always pull the newest image at the end of our CICD Pipeline.

Incorrect options:

After the deploy step in CodePipeline is done, include a Custom Step using a Lambda function that triggers an SSM Run Command. That command will clear the local Docker cache and stop the task - SSM Run Command lets you remotely and securely manage the configuration of your managed instances. A managed instance is any EC2 instance or on-premises machine in your hybrid environment that has been configured for Systems Manager. SSM Run Command may work but it's not an elegant solution.

After the deploy step in CodePipeline is done, include a Custom Step using a Lambda function that triggers an AWS Lambda function. That function will SSH onto your ECS instances and clear the local Docker cache and stop the task - Lambda Functions can't SSH into EC2 instances, so this option is incorrect.

When creating a new task definition for your ECS service, ensure to add the latest tag in the full image name so that ECS pulls the correct image every time - Adding the latest tag won't help because 123456789.dkr.ecr.region.amazonaws.com/my-web-app is same as 123456789.dkr.ecr.region.amazonaws.com/my-web-app:latest. The latest tag cannot provide visibility and identification to track where container images are deployed.

References:

https://aws.amazon.com/about-aws/whats-new/2019/10/amazon-ecs-now-supports-ecs-image-sha-tracking/

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/container-metadata.html

Domain

Domain 2: Configuration Management and IaC

Question 31Skipped

A financial services company is using security-hardened AMI due to strong regulatory compliance requirements. The company must be able to check every day for AMI vulnerabilities based on the newly disclosed ones through the common vulnerabilities and exposures (CVEs) program. Currently, all the instances are launched through an Auto Scaling group (ASG) leveraging the latest security-hardened AMI.

As a DevOps Engineer, how can you implement this while minimizing cost and application disruption?

Create a CloudWatch Event with a daily schedule. Make the target of the rule being AWS Inspector and pass some extra data in the rule using the AMI ID to inspect. AWS Inspector will automatically launch an instance and terminate it upon assessment completion

Create a CloudWatch Event with a daily schedule. Invoke a Lambda Function that will start an AWS Inspector Run directly from the AMI reference in the API call. AWS Inspector will automatically launch an instance and terminate it upon assessment completion

Create a CloudWatch Event with a daily schedule, the target being a Lambda Function. Tag all the instances in your ASG with CheckVulnerabilities: True. The Lambda function should start an assessment in AWS Inspector targeting all instances having the tag

Correct answer

Create a CloudWatch Event with a daily schedule, the target being a Step Function. The Step Function should launch an EC2 instance from the AMI and tag it with CheckVulnerabilities: True. The Step Function then starts an AMI assessment template using AWS Inspector and the above tag. Terminate the instance afterward

Overall explanation

Correct option:

Create a CloudWatch Event with a daily schedule, the target being a Step Function. The Step Function should launch an EC2 instance from the AMI and tag it with CheckVulnerabilities: True. The Step Function then starts an AMI assessment template using AWS Inspector and the above tag. Terminate the instance afterward

AWS Step Functions is a fully managed service that makes it easy to coordinate the components of distributed applications and microservices using visual workflows.

A golden AMI is an AMI that contains the latest security patches, software, configuration, and software agents that you need to install for logging, security maintenance, and performance monitoring. A security best practice is to perform routine vulnerability assessments of your golden AMIs to identify if newly found vulnerabilities apply to them. If you identify a vulnerability, you can update your golden AMIs with the appropriate security patches, test the AMIs, and deploy the patched AMIs in your environment.

You can create an EC2 instance from the golden AMI and then run an Amazon Inspector security assessment on the created instance. Amazon Inspector performs security assessments of Amazon EC2 instances by using AWS managed rules packages such as the Common Vulnerabilities and Exposures (CVEs) package.

via - https://aws.amazon.com/blogs/security/how-to-set-up-continuous-golden-ami-vulnerability-assessments-with-amazon-inspector/

So to summarize, the most cost-effective and the least disruptive way to do an assessment is to create an EC2 instance from an AMI for that very purpose, run the assessment and then finally terminate the instance. Step Functions are perfect to orchestrate that workflow by targeting the instances tagged with CheckVulnerabilities: True.

Incorrect options:

Create a CloudWatch Event with a daily schedule. Invoke a Lambda Function that will start an AWS Inspector Run directly from the AMI reference in the API call. AWS Inspector will automatically launch an instance and terminate it upon assessment completion - AWS Inspector cannot run an assessment directly on an AMI, it will not launch an EC2 instance for you. Therefore, you need to make sure an EC2 instance is created in advance from that AMI, with the proper tag on the EC2 instance to match the assessment target.

Create a CloudWatch Event with a daily schedule. Make the target of the rule being AWS Inspector and pass some extra data in the rule using the AMI ID to inspect. AWS Inspector will automatically launch an instance and terminate it upon assessment completion - AWS Inspector cannot run an assessment directly on an AMI, it will not launch an EC2 instance for you. Therefore, you need to make sure an EC2 instance is created in advance from that AMI, with the proper tag on the EC2 instance to match the assessment target.

Create a CloudWatch Event with a daily schedule, the target being a Lambda Function. Tag all the instances in your ASG with CheckVulnerabilities: True. The Lambda function should start an assessment in AWS Inspector targeting all instances having the tag - If you launch an assessment on all the instances in an ASG, it will be problematic from a cost perspective as you will be testing the same AMI for as many instances that are part of the ASG. This will also incur extra AWS Inspector charges.

References:

https://aws.amazon.com/blogs/security/how-to-set-up-continuous-golden-ami-vulnerability-assessments-with-amazon-inspector/

https://aws.amazon.com/step-functions/faqs/

https://docs.aws.amazon.com/inspector/latest/userguide/inspector_cves.html

Domain

Domain 6: Security and Compliance

Question 32Skipped

As part of the CICD pipeline, the DevOps team at a retail company wants to deploy the latest application code to a staging environment and the team also wants to ensure it can execute an automated functional test suite before deploying to production. The code is managed via CodeCommit. Usually, the functional test suite runs for over two hours. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution for this requirement.

How would you create the CICD pipeline to run your test suite in the most efficient way?

Correct answer

Create a CodePipeline pointing to the master branch of your CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a CodeBuild build that will run the test suite. If the stage doesn't fail, the last stage will deploy the application to production

Create a CodePipeline pointing to the master branch of your CodeCommit repository and as a first stage run a CodeBuild build that will run the test suite against the staging environment. Upon passing, deploy to staging using CodeDeploy and if it succeeds, deploy to production

Create a CodePipeline pointing to the master branch of your CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a custom stage using a Lambda function that will run the test suite. If the stage doesn't fail, the last stage will deploy the application to production

Create a CodePipeline pointing to the master branch of your CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a custom stage using a Lambda function that will invoke a Step Function execution. The Step Function will run the test suite. Create a CloudWatch Event Rule on the execution termination of your Step Function to invoke a Lambda function and signal CodePipeline the success or failure. If the stage doesn't fail, the last stage will deploy the application to production

Overall explanation

Correct option:

Create a CodePipeline pointing to the master branch of your CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a CodeBuild build that will run the test suite. If the stage doesn't fail, the last stage will deploy the application to production

CodeCommit is a secure, highly scalable, managed source control service that makes it easier for teams to collaborate on code. A CICD pipeline helps you automate steps in your software delivery process, such as initiating automatic builds and then deploying to Amazon EC2 instances. You may use AWS CodePipeline, a service that builds, tests, and deploys your code every time there is a code change, based on the release process models you define to orchestrate each step in your release process.

Sample AWS CodePipeline pipeline architecture:

Highly recommend reading this excellent reference AWS DevOps blog on using CodePipeline with CodeBuild to automate testing - https://aws.amazon.com/blogs/devops/automating-your-api-testing-with-aws-codebuild-aws-codepipeline-and-postman/

AWS CodeBuild is a fully managed continuous integration service in the cloud. CodeBuild compiles source code, runs tests, and produces packages that are ready to deploy. CodeBuild eliminates the need to provision, manage, and scale your own build servers. CodeBuild automatically scales up and down and processes multiple builds concurrently, so your builds don’t have to wait in a queue. CodeBuild has recently announced the launch of a new feature in CodeBuild called Reports. This feature allows you to view the reports generated by functional or integration tests. The reports can be in the JUnit XML or Cucumber JSON format. You can view metrics such as Pass Rate %, Test Run Duration, and the number of Passed versus Failed/Error test cases in one location.

AWS CodeBuild Test Reports:

via - https://aws.amazon.com/blogs/devops/test-reports-with-aws-codebuild/

For the given use-case, you need to use a CodeBuild build to run the test suite, but you must first deploy to staging before running CodeBuild! It's common in the exam for multiple same steps to be shown in a different order, so be careful.

Incorrect options:

Create a CodePipeline pointing to the master branch of your CodeCommit repository and as a first stage run a CodeBuild build that will run the test suite against the staging environment. Upon passing, deploy to staging using CodeDeploy and if it succeeds, deploy to production - As mentioned in the explanation above, you cannot have the CodeBuild Test as a stage prior to deploying in the staging environment, so this option is incorrect.

Create a CodePipeline pointing to the master branch of your CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a custom stage using a Lambda function that will run the test suite. If the stage doesn't fail, the last stage will deploy the application to production - Lambda should be ruled out for running the test suite as the maximum timeout for a Lambda function is 15 minutes, so it will not support the given use-case since the functional test suite runs for over two hours.

Create a CodePipeline pointing to the master branch of your CodeCommit repository and automatically deploy to a staging environment using CodeDeploy. After that stage, invoke a custom stage using a Lambda function that will invoke a Step Function execution. The Step Function will run the test suite. Create a CloudWatch Event Rule on the execution termination of your Step Function to invoke a Lambda function and signal CodePipeline the success or failure. If the stage doesn't fail, the last stage will deploy the application to production - AWS Step Functions is a fully managed service that makes it easy to coordinate the components of distributed applications and microservices using visual workflows. While the solution involving Step Functions would work, it's extremely convoluted and not the most efficient solution.

How Step Functions Work:

via - https://aws.amazon.com/step-functions/

References:

https://aws.amazon.com/blogs/devops/automating-your-api-testing-with-aws-codebuild-aws-codepipeline-and-postman/

https://docs.aws.amazon.com/codebuild/latest/userguide/how-to-create-pipeline.html

https://aws.amazon.com/codebuild/faqs/

https://aws.amazon.com/blogs/devops/test-reports-with-aws-codebuild/

https://aws.amazon.com/step-functions/

Domain

Domain 1: SDLC Automation

Question 33Skipped

As the Lead DevOps Engineer at an analytics company, you are deploying a global application using a CICD pipeline comprising of AWS CodeCommit, CodeBuild, CodeDeploy and orchestrated by AWS CodePipeline. Your pipeline is currently setup in eu-west-1 and you would like to extend the pipeline to deploy your application in us-east-2. This will require a multi-step CodePipeline to be created there and invoked.

How would you implement a solution to address this use-case?

At the end of the pipeline in eu-west-1, include a CodePipeline step to invoke the CodePipeline in us-east-2. Ensure the CodePipeline in us-east-2 has the necessary IAM permission to read the artifacts in S3 in eu-west-1

At the end of the pipeline in eu-west-1, include a CodeDeploy step to deploy the application to the CodePipeline in us-east-2

At the end of the pipeline in eu-west-1, include a CodeCommit step to push the changes to the code into the master branch of another CodeCommit repository in us-east-2. Make the CodePipeline in us-east-2 source files from CodeCommit

Correct answer

At the end of the pipeline in eu-west-1, include an S3 step to copy the artifacts being used by CodeDeploy to an S3 bucket in us-east-2. Make the CodePipeline in us-east-2 source files from S3

Overall explanation

Correct option:

At the end of the pipeline in eu-west-1, include an S3 step to copy the artifacts being used by CodeDeploy to an S3 bucket in us-east-2. Make the CodePipeline in us-east-2 source files from S3

AWS CodePipeline is a continuous delivery service you can use to model, visualize, and automate the steps required to release your software. You can quickly model and configure the different stages of a software release process. CodePipeline automates the steps required to release your software changes continuously.

CodePipeline Overview:

via - https://docs.aws.amazon.com/codepipeline/latest/userguide/welcome-introducing.html

CodePipeline Key Concepts:

via - https://docs.aws.amazon.com/codepipeline/latest/userguide/concepts.html

For the given use-case, you can use an S3 deploy step to copy artifacts into another bucket. Then CodePipeline in the other region will respond to an event and source the files from the other bucket and kickstart the deployment pipeline there.

via - https://docs.aws.amazon.com/codepipeline/latest/userguide/integrations-action-type.html

Incorrect options:

At the end of the pipeline in eu-west-1, include a CodeDeploy step to deploy the application to the CodePipeline in us-east-2 - CodeDeploy cannot deploy to AWS CodePipeline. CodeDeploy can only deploy to EC2, on-premise, Lambda, and ECS.

At the end of the pipeline in eu-west-1, include a CodeCommit step to push the changes to the code into the master branch of another CodeCommit repository in us-east-2. Make the CodePipeline in us-east-2 source files from CodeCommit - CodePipeline can only source from CodeCommit, it cannot push commits to it.

At the end of the pipeline in eu-west-1, include a CodePipeline step to invoke the CodePipeline in us-east-2. Ensure the CodePipeline in us-east-2 has the necessary IAM permission to read the artifacts in S3 in eu-west-1 - CodePipeline cannot invoke another CodePipeline directly. This is something you might be able to achieve using a Custom Action and a Lambda function, but you would need to make sure artifacts are copied locally as well.

References:

https://docs.aws.amazon.com/codepipeline/latest/userguide/welcome-introducing.html

https://docs.aws.amazon.com/codepipeline/latest/userguide/integrations-action-type.html

Domain

Domain 5: Incident and Event Response

Question 34Skipped

An IT company is deploying a Python Flask based application and would like to ensure that it has a base AMI that contains the necessary Python runtime, as well as OS patches. That AMI must be used able to be referenced programmatically from across all regions in your account in a scalable way. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution to address this requirement.

Which of the following options would you recommend for this use-case? (Select two)

Use AWS Inspector to create a patched AMI using the latest working AMI

Correct selection

Create an SSM Automation document to create the AMI in a repeatable manner

Store the AMI ID in the SSM parameter store in one region, and create a Step Function that copies the value of that AMI ID across all the other regions. Use the same parameter store name so it can be re-used across regions

Use AWS Lambda to create a patched AMI using the latest working AMI

Correct selection

Store the AMI ID in the SSM parameter store in one region, and have a Lambda function that copies the AMI across all the other regions, and stores the corresponding AMI ID in SSM. Use the same parameter store name so it can be re-used across regions

Overall explanation

Correct options:

Create an SSM Automation document to create the AMI in a repeatable manner

An SSM Automation document defines the actions that Systems Manager performs on your managed instances and other AWS resources when an automation execution runs. A document contains one or more steps that run in sequential order. Each step is built around a single action. The output from one step can be used as input in a later step. The process of running these actions and their steps is called the automation workflow.

You can use AWS Systems Manager to create a maintenance window, and then register an Automation task to automate the creation of the AMIs. This process is applicable for both Windows and Linux instances.

via - https://aws.amazon.com/premiumsupport/knowledge-center/ec2-systems-manager-ami-automation/

Store the AMI ID in the SSM parameter store in one region, and have a Lambda function that copies the AMI across all the other regions, and stores the corresponding AMI ID in SSM. Use the same parameter store name so it can be re-used across regions

The AMI ID is region-scoped, so the AMI must be copied across regions and therefore each SSM parameter store will have different AMI ID values. But you can still use the same SSM Parameter Store key across all regions.

Incorrect options:

Store the AMI ID in the SSM parameter store in one region, and create a Step Function that copies the value of that AMI ID across all the other regions. Use the same parameter store name so it can be re-used across regions - The AMI ID is region-scoped and the AMI must be copied across regions for the solution to work. This option only copies the value of the AMI ID across regions but the AMI itself stays in one region. So this option is incorrect.

Use AWS Inspector to create a patched AMI using the latest working AMI - AWS Inspector can be leveraged to analyze EC2 instance OS and network vulnerabilities. You cannot use Inspector to create a patched AMI.

Use AWS Lambda to create a patched AMI using the latest working AMI - AWS Lambda cannot be used to create AMIs, so this option is incorrect.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-documents.html

https://aws.amazon.com/premiumsupport/knowledge-center/ec2-systems-manager-ami-automation/

Domain

Domain 6: Security and Compliance

Question 35Skipped

An analytics company is capturing metrics for its AWS services and applications using CloudWatch metrics. It needs to be able to go back up to 7 years in time for visualizing these metrics due to regulatory requirements. As a DevOps Engineer at the company, you have been tasked with designing a solution that will help the company comply with the regulations.

Which of the following options requires the minimum development effort to address the given requirements?

Create a CloudWatch event rule to trigger every 15 minutes. The target of the rule should be a Lambda Function that will run an API call to export the metrics and put them in S3. Create a CloudWatch dashboard on top of the metrics in S3

Create a CloudWatch dashboard on top of CloudWatch metrics. Enable 'Extended Retention' on CloudWatch metrics, and implement an AWS Config rule that checks for this setting. If the AWS Config rule is non-compliant, use an Auto Remediation to turn it back on

Correct answer

Create a CloudWatch metrics stream and direct it to Kinesis Firehose Firehose delivery stream. Send all the metrics data into S3 using Firehose, and create a QuickSight dashboard to visualize the metrics. Use Athena to query for specific time ranges

Create a CloudWatch event rule to trigger every 15 minutes. The target of the rule should be a Lambda Function that will run an API call to export the metrics and put them in Amazon ES. Create a Kibana dashboard on top to visualize the metrics

Overall explanation

Correct option:

Create a CloudWatch metrics stream and direct it to Kinesis Firehose Firehose delivery stream. Send all the metrics data into S3 using Firehose, and create a QuickSight dashboard to visualize the metrics. Use Athena to query for specific time ranges

You can use metric streams to continually stream CloudWatch metrics to a destination of your choice, with near-real-time delivery and low latency. Supported destinations include AWS destinations such as Amazon Simple Storage Service and several third-party service provider destinations.

You can create a metric stream and direct it to an Amazon Kinesis Data Firehose delivery stream that delivers your CloudWatch metrics to a data lake such as Amazon S3. You can then use tools such as Amazon Athena to get insight into cost optimization, resource performance, and resource utilization for given data ranges. In additon, you can use a QuickSight dashboard to visualize the metrics.

The Kinesis Data Firehose delivery stream must trust CloudWatch through an IAM role that has write permissions to Kinesis Data Firehose. These permissions can be limited to the single Kinesis Data Firehose delivery stream that the CloudWatch metric stream uses. The IAM role must trust the streams.metrics.cloudwatch.amazonaws.com service principal.

Incorrect options:

Create a CloudWatch event rule to trigger every 15 minutes. The target of the rule should be a Lambda Function that will run an API call to export the metrics and put them in Amazon ES. Create a Kibana dashboard on top to visualize the metrics

A CloudWatch metric represents a time-ordered set of data points that are published to CloudWatch. Think of a metric as a variable to monitor, and the data points as representing the values of that variable over time. For example, the CPU usage of a particular EC2 instance is one metric provided by Amazon EC2. The data points themselves can come from any application or business activity from which you collect data.

Metrics cannot be deleted, but they automatically expire after 15 months if no new data is published to them. Data points older than 15 months expire on a rolling basis; as new data points come in, data older than 15 months is dropped.

via - https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html

As the CloudWatch metrics can only be retained for 15 months, we need to use a CloudWatch Event rule and trigger a Lambda function to extract metrics and send them for long term retention to facilitate visual analysis. Here, the only solution that works end-to-end is to send the data to Amazon ES, and use Kibana to create graphs.

Amazon Elasticsearch (ES) Service is a managed service that makes it easy to deploy, operate, and scale Elasticsearch clusters in the AWS Cloud.

How Amazon ElasticSearch Works:

via - https://aws.amazon.com/elasticsearch-service/

ES is commonly deployed as part of the ELK stack which is an acronym used to describe a stack that comprises three popular open-source projects: Elasticsearch, Logstash, and Kibana. The ELK stack gives you the ability to aggregate logs from all your systems and applications, analyze these logs, and create visualizations for application and infrastructure monitoring, faster troubleshooting, security analytics, and more.

via - https://aws.amazon.com/elasticsearch-service/the-elk-stack/

As this option requires you to create a Lambda function that will execute a custom API to export the metrics into an ES cluster, so it's not the best fit for the given requirement as it involves significant development effort.

Create a CloudWatch dashboard on top of CloudWatch metrics. Enable 'Extended Retention' on CloudWatch metrics, and implement an AWS Config rule that checks for this setting. If the AWS Config rule is non-compliant, use an Auto Remediation to turn it back on - This option has been added as a distractor as CloudWatch metrics do not have an 'Extended Retention' feature.

Create a CloudWatch event rule to trigger every 15 minutes. The target of the rule should be a Lambda Function that will run an API call to export the metrics and put them in S3. Create a CloudWatch dashboard on top of the metrics in S3 - S3 based data can be integrated easily with QuickSight, however, CloudWatch dashboards can only consume CloudWatch metrics and NOT data/metrics from S3.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Metric-Streams.html

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-trustpolicy.html

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html

https://aws.amazon.com/elasticsearch-service/

https://aws.amazon.com/elasticsearch-service/the-elk-stack/

Domain

Domain 4: Monitoring and Logging

Question 36Skipped

An online coding platform wants to fully customize the build tasks and automatically run builds concurrently to take the pain out of managing the build environments. The DevOps team at the company wants to use CodeBuild for all build-tasks and would like the artifacts created by CodeBuild to be named based on the branch being tested. The team wants this solution to be scalable to newer branches with a minimal amount of rework.

As a DevOps Engineer, how would you go about implementing the simplest possible solution to address the given use-case?

Create a unique buildspec.yml file that will be the same for each branch and will name the artifacts the same way. When the artifact is uploaded into S3, create an S3 Event that will trigger a Lambda function that will issue an API call against CodeBuild, extract the branch name from it and rename the file on S3

Create a buildspec.yml file that will be different for every single branch. Create a new CodeBuild for each branch. Upon adding a new branch, ensure to edit the buildspec.yml file

Correct answer

Create a buildspec.yml file that will look for the environment variable CODEBUILD_SOURCE_VERSION at runtime. Use the variable in the artifacts section of your buildspec.yml file

Create a buildspec.yml file that will look for the environment variable BRANCH_NAME at runtime. For each existing branch and new branch, create a separate CodeBuild and set the BRANCH_NAME variable accordingly. Use the variable in the artifacts section of your buildspec.yml file

Overall explanation

Correct option:

Create a buildspec.yml file that will look for the environment variable CODEBUILD_SOURCE_VERSION at runtime. Use the variable in the artifacts section of your buildspec.yml file

AWS CodeBuild is a fully managed continuous integration service in the cloud. CodeBuild compiles source code, runs tests, and produces packages that are ready to deploy. CodeBuild eliminates the need to provision, manage, and scale your own build servers.

A buildspec is a collection of build commands and related settings, in YAML format, that CodeBuild uses to run a build. You can include a buildspec as part of the source code or you can define a buildspec when you create a build project.

via - https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html

via - https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html

For the given use-case, we need to use environment variables. The variable CODEBUILD_SOURCE_VERSION is exposed at runtime directly within CodeBuild and represents the branch name of the code being tested for CodeCommit. This is the best solution.

via - https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-env-vars.html

Incorrect options:

Create a buildspec.yml file that will look for the environment variable BRANCH_NAME at runtime. For each existing branch and new branch, create a separate CodeBuild and set the BRANCH_NAME variable accordingly. Use the variable in the artifacts section of your buildspec.yml file - Providing the branch name as BRANCH_NAME and creating separate CodeBuild would be highly tedious to maintain and error-prone. This is certainly not the simplest solution possible.

Create a buildspec.yml file that will be different for every single branch. Create a new CodeBuild for each branch. Upon adding a new branch, ensure to edit the buildspec.yml file - Maintaining a different buildspec.yml for each branch is not efficient and it's error-prone. So this option is incorrect.

Create a unique buildspec.yml file that will be the same for each branch and will name the artifacts the same way. When the artifact is uploaded into S3, create an S3 Event that will trigger a Lambda function that will issue an API call against CodeBuild, extract the branch name from it and rename the file on S3 - The answer involving a Lambda function would work but is highly convoluted. This is something that can be directly accomplished using the CODEBUILD_SOURCE_VERSION environment variable.

References:

https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html

https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-env-vars.html

Domain

Domain 1: SDLC Automation

Question 37Skipped

A mobility company connects people with taxi drivers and the DevOps team at the company uses CodeCommit as a backup and disaster recovery service for several of its DevOps processes. The team is creating a CICD pipeline so that your code in the CodeCommit master branch automatically gets packaged as a Docker container and published to ECR. The team would then like that image to be automatically deployed to an ECS cluster using a Blue/Green strategy.

As an AWS Certified DevOps Engineer, which of the following options would you recommend as the most efficient solution to meet the given requirements?

Create a CodePipeline that will invoke a CodeBuild stage. The CodeBuild stage should acquire ECR credentials using the CLI helpers, build the image, and then push it to ECR. Create a CloudWatch Event Rule that will react to pushes to ECR and invoke CodeDeploy, the target of which should be the ECS cluster

Create a CodePipeline that will invoke a CodeBuild stage. The CodeBuild stage should acquire ECR credentials using the CLI helpers, build the image, and then push it to ECR. Upon the success of that CodeBuild stage, create a new task definition automatically using CodeCommit and apply that task definition to the ECS service using a CloudFormation action

Create a CodePipeline that will invoke a CodeBuild stage. The CodeBuild stage should acquire ECR credentials using the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables passed in through CodeBuild configuration, the values being those from your user. Upon the success of that CodeBuild stage, create a new task definition automatically using CodePipeline and apply that task definition to the ECS service using a CloudFormation action

Correct answer

Create a CodePipeline that will invoke a CodeBuild stage. The CodeBuild stage should acquire ECR credentials using the CLI helpers, build the image, and then push it to ECR. Upon the success of that CodeBuild stage, start a CodeDeploy stage with a target being your ECS service

Overall explanation

Correct option:

Create a CodePipeline that will invoke a CodeBuild stage. The CodeBuild stage should acquire ECR credentials using the CLI helpers, build the image, and then push it to ECR. Upon the success of that CodeBuild stage, start a CodeDeploy stage with a target being your ECS service

AWS CodePipeline is a continuous delivery service that enables you to model, visualize, and automate the steps required to release your software. With AWS CodePipeline, you model the full release process for building your code, deploying to pre-production environments, testing your application and releasing it to production.

CodeBuild is a fully managed continuous integration service in the cloud. CodeBuild compiles source code, runs tests, and produces packages that are ready to deploy. CodeBuild eliminates the need to provision, manage, and scale your own build servers. A buildspec is a collection of build commands and related settings, in YAML format, that CodeBuild uses to run a build. You can include a buildspec as part of the source code or you can define a buildspec when you create a build project.

You can use CodeBuild to acquire ECR credentials using the CLI helpers, build the image, and then push it to ECR. You should note that acquiring ECR credentials must be done using IAM roles and CLI helpers on CodeBuild, not environment variables, especially not via your user access and secret key.

via - https://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html

Incorrect options:

Create a CodePipeline that will invoke a CodeBuild stage. The CodeBuild stage should acquire ECR credentials using the CLI helpers, build the image, and then push it to ECR. Upon the success of that CodeBuild stage, create a new task definition automatically using CodeCommit and apply that task definition to the ECS service using a CloudFormation action - You should note that both CodeDeploy and CloudFormation can support blue/green deployment for ECS. However, you cannot create a new task definition using CodeCommit, so this option is incorrect.

via - https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-type-bluegreen.html

Create a CodePipeline that will invoke a CodeBuild stage. The CodeBuild stage should acquire ECR credentials using the CLI helpers, build the image, and then push it to ECR. Create a CloudWatch Event Rule that will react to pushes to ECR and invoke CodeDeploy, the target of which should be the ECS cluster - CloudWatch Event Rule does not support CodeDeploy as a target, therefore CodeDeploy must be invoked from your CodePipeline.

Create a CodePipeline that will invoke a CodeBuild stage. The CodeBuild stage should acquire ECR credentials using the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables passed in through CodeBuild configuration, the values being those from your user. Upon the success of that CodeBuild stage, create a new task definition automatically using CodePipeline and apply that task definition to the ECS service using a CloudFormation action - As mentioned in the explanation above, ECR credentials must be acquired using IAM roles and CLI helpers on CodeBuild, not environment variables, especially not via your AWS access key ID and secret access key.

References:

https://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-type-bluegreen.html

https://aws.amazon.com/codepipeline/faqs/

https://aws.amazon.com/about-aws/whats-new/2020/05/aws-cloudformation-now-supports-blue-green-deployments-for-amazon-ecs/

Domain

Domain 1: SDLC Automation

Question 38Skipped

The DevOps team at a social media company has created a CodePipeline pipeline and the final step is to use CodeDeploy to update an AWS Lambda function. As a DevOps Engineering Lead at the company, you have decided that for every deployment, the new Lambda function must sustain a small amount of traffic for 10 minutes and then shift all the traffic to the new function. It has also been decided that safety must be put in place to automatically roll-back if the Lambda function experiences too many crashes.

Which of the following recommendations would you provide to address the given use-case? (Select two)

Choose a deployment configuration of LambdaLinear10PercentEvery10Minutes

Correct selection

Choose a deployment configuration of LambdaCanary10Percent10Minutes

Choose a deployment configuration of LambdaAllAtOnce

Correct selection

Create a CloudWatch Alarm on the Lambda CloudWatch metrics and associate it with the CodeDeploy deployment

Create a CloudWatch Event for the Lambda Deployment Monitoring and associate it with the CodeDeploy deployment

Overall explanation

Correct options:

Create a CloudWatch Alarm on the Lambda CloudWatch metrics and associate it with the CodeDeploy deployment

You can monitor and automatically react to changes in your AWS CodeDeploy deployments using Amazon CloudWatch alarms. Using CloudWatch with CodeDeploy, you can monitor metrics for Amazon EC2 instances or Auto Scaling groups being managed by CodeDeploy and then invoke an action if the metric you are tracking crosses a certain threshold for a defined period of time. You can monitor metrics such as instance CPU utilization. If the alarm is activated, CloudWatch initiates actions such as sending a notification to Amazon Simple Notification Service, stopping a CodeDeploy deployment, or changing the state of an instance (e.g. reboot, terminate, recover). You can also automatically roll back a deployment when a deployment fails or when a CloudWatch alarm is activated.

For the given use-case, the CodeDeploy deployment must be associated with a CloudWatch Alarm for automated rollbacks.

via - https://docs.aws.amazon.com/codedeploy/latest/userguide/monitoring-create-alarms.html

Configure advanced options for a deployment group:

via - https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-groups-configure-advanced-options.html

Choose a deployment configuration of LambdaCanary10Percent10Minutes

A deployment configuration is a set of rules and success and failure conditions used by CodeDeploy during a deployment. When you deploy to an AWS Lambda compute platform, the deployment configuration specifies the way traffic is shifted to the new Lambda function versions in your application.

via - https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-configurations.html

For canary deployments, the traffic is shifted in two increments. You can choose from predefined canary options that specify the percentage of traffic shifted to your updated Lambda function version in the first increment and the interval, in minutes, before the remaining traffic is shifted in the second increment.

A canary deployment of LambdaCanary10Percent10Minutes means the traffic is 10% on the new function for 10 minutes, and then all the traffic is shifted to the new version after the time has elapsed.

Incorrect options:

Choose a deployment configuration of LambdaAllAtOnce - An all at once deployment means all the traffic is shifted to the new function right away and this option does not meet the given requirements.

Choose a deployment configuration of LambdaLinear10PercentEvery10Minutes - For linear deployments, traffic is shifted in equal increments with an equal number of minutes between each increment. For example, a linear deployment of LambdaLinear10PercentEvery10Minutes would shift 10 percent of traffic every minute until all traffic is shifted.

Create a CloudWatch Event for the Lambda Deployment Monitoring and associate it with the CodeDeploy deployment - The CodeDeploy deployment must be associated with a CloudWatch Alarm and not CloudWatch Event for automated rollbacks to work.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/monitoring-create-alarms.html

https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-groups-configure-advanced-options.html

https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-configurations.html

Domain

Domain 2: Configuration Management and IaC

Question 39Skipped

A data intelligence and analytics company enables publishers to measure, analyze, and improve the impact of the advertising across their range of online deliverables. The DevOps team at the company wants to use CodePipeline to deploy code from CodeCommit with CodeDeploy. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution for this requirement.

How would you configure the EC2 instances to facilitate the deployment?

Create an EC2 instance with an IAM role giving access to the CodeCommit repository where CodeDeploy is deploying from. CodeDeploy will install the agent on the EC2 instance

Create an EC2 instance with an IAM user access credentials giving access to the S3 bucket where CodeDeploy is deploying from. Ensure that the EC2 instance also has the CodeDeploy agent installed. Tag the instance to have it part of a deployment group

Create an EC2 instance with an IAM user access credentials giving access to the CodeCommit repository where CodeDeploy is deploying from. Ensure that the EC2 instance also has the CodeDeploy agent installed. Tag the instance to have it part of a deployment group

Correct answer

Create an EC2 instance with an IAM role giving access to the S3 bucket where CodeDeploy is deploying from. Ensure that the EC2 instance also has the CodeDeploy agent installed. Tag the instance to have it part of a deployment group

Overall explanation

Correct option:

Create an EC2 instance with an IAM role giving access to the S3 bucket where CodeDeploy is deploying from. Ensure that the EC2 instance also has the CodeDeploy agent installed. Tag the instance to have it part of a deployment group

AWS CodeDeploy is a service that automates code deployments to any instance, including Amazon EC2 instances and instances running on-premises. AWS CodeDeploy makes it easier for you to rapidly release new features, helps you avoid downtime during deployment, and handles the complexity of updating your applications.

CodeDeploy Concepts:

via - https://aws.amazon.com/codedeploy/faqs/

The CodeDeploy agent is a software package that, when installed and configured on an instance, makes it possible for that instance to be used in CodeDeploy deployments. A configuration file is placed on the instance when the agent is installed. This file is used to specify how the agent works. This configuration file specifies directory paths and other settings for AWS CodeDeploy to use as it interacts with the instance.

For the given use-case, you can have the CodePipeline chain CodeCommit and CodeDeploy and have the source code available as a zip file in an S3 bucket to be used as a CodePipeline artifact. The EC2 instance must have an IAM role, and not an IAM user, to pull that file from S3. Finally, the EC2 instance must be properly tagged to be part of the correct deployment group and have the CodeDeploy agent installed on it.

Incorrect options:

Create an EC2 instance with an IAM user access credentials giving access to the S3 bucket where CodeDeploy is deploying from. Ensure that the EC2 instance also has the CodeDeploy agent installed. Tag the instance to have it part of a deployment group - It's a best practice to avoid using the IAM user access credentials to give the EC2 instance access to the S3 bucket where CodeDeploy is deploying from. You must leverage an IAM role to facilitate this access for the EC2 instance.

Create an EC2 instance with an IAM role giving access to the CodeCommit repository where CodeDeploy is deploying from. CodeDeploy will install the agent on the EC2 instance - CodeDeploy cannot automatically install the agent on the EC2 instance. You must ensure that the EC2 instance has the CodeDeploy agent installed. You must also tag the instance to have it part of a deployment group.

Create an EC2 instance with an IAM user access credentials giving access to the CodeCommit repository where CodeDeploy is deploying from. Ensure that the EC2 instance also has the CodeDeploy agent installed. Tag the instance to have it part of a deployment group - It's a best practice to avoid using the IAM user access credentials to give the EC2 instance access to the S3 bucket where CodeDeploy is deploying from. You must leverage an IAM role to facilitate this access for the EC2 instance.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/primary-components.html

https://docs.aws.amazon.com/codedeploy/latest/userguide/codedeploy-agent.html

https://docs.aws.amazon.com/codedeploy/latest/userguide/instances-ec2-configure.html

Domain

Domain 1: SDLC Automation

Question 40Skipped

A health-care services company has strong regulatory requirements and it has come to light recently that some of the EBS volumes have not been encrypted. It is necessary for the company to monitor and audit compliance over time and alert the corresponding teams if unencrypted EBS volumes are detected.

How should a DevOps Engineer implement an alert for the unencrypted EBS volumes with the least administrative overhead?

Create an AWS Config managed rule checking for EBS volume encryption. Connect the rule to an SNS topic to provide alerting

Create an AWS Config custom rule checking for the EC2 instances, and their EBS attachments. Connect the rule to an SNS topic to provide alerting

Correct answer

Create an AWS Config managed rule checking for EBS volume encryption. Use a CloudWatch Event rule to provide alerting

Create an AWS Lambda Function that is triggered by a CloudWatch Event rule. The rule is monitoring for new EBS volumes being created. The Lambda function should send a notification to SNS in case of a compliance check

Overall explanation

Correct option:

Create an AWS Config managed rule checking for EBS volume encryption. Use a CloudWatch Event rule to provide alerting

AWS Config provides AWS managed rules, which are predefined, customizable rules that AWS Config uses to evaluate whether your AWS resources comply with common best practices. For example, you could use a managed rule to quickly start assessing whether your EBS volumes are encrypted or whether specific tags are applied to your resources. You can set up and activate these rules without writing the code to create an AWS Lambda function, which is required if you want to create custom rules.

AWS Config uses Amazon SNS to deliver notifications to subscription endpoints. These notifications provide the delivery status for configuration snapshots and configuration histories, and they provide each configuration item that AWS Config creates when the configurations of recorded AWS resources change. AWS Config also sends notifications that show whether your resources are compliant with your rules. SNS topics when directly integrated with Config can only be used to stream all the notifications and configuration changes and NOT selectively for a given rule.

AWS Config has a managed rule to check for EBS volume encryption. For the given use-case, you need to isolate alerts for this managed rule, so you have to use CloudWatch Events which can then have a specific SNS topic as a target for alerting.

via - https://docs.aws.amazon.com/config/latest/developerguide/encrypted-volumes.html

Incorrect options:

Create an AWS Config managed rule checking for EBS volume encryption. Connect the rule to an SNS topic to provide alerting

Create an AWS Config custom rule checking for the EC2 instances, and their EBS attachments. Connect the rule to an SNS topic to provide alerting

As mentioned in the explanation above, SNS topics in Config can only be used to stream all the notifications and configuration changes. To isolate alerts for a single rule, you have to use CloudWatch Events. Therefore both these options are incorrect.

Create an AWS Lambda Function that is triggered by a CloudWatch Event rule. The rule is monitoring for new EBS volumes being created. The Lambda function should send a notification to SNS in case of a compliance check - Using AWS Lambda may work, but it will not provide you the auditing capability that AWS Config provides (a timeline dashboard with compliance over time).

References:

https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html

https://docs.aws.amazon.com/config/latest/developerguide/encrypted-volumes.html

https://aws.amazon.com/premiumsupport/knowledge-center/config-resource-non-compliant/

Domain

Domain 6: Security and Compliance

Question 41Skipped

The technology team at a leading bank is using software that has a license type that gets billed based on the number of CPU sockets that are being used. The team would like to ensure that they are using the most appropriate EC2 launch mode and create a compliance dashboard that highlights any violation of that decision. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution for this requirement.

Which of the following solutions would you recommend as the best fit?

Correct answer

Launch the EC2 instances on Dedicated Hosts and create a tag for the application. Deploy an AWS Config custom rule backed by a Lambda function that will check the application tag and ensure the instance is launched on the correct launch mode

Launch the EC2 instances on Reserved Instances and create a tag for the application. Deploy an AWS Config custom rule backed by a Lambda function that will check the application tag and ensure the instance is launched on the correct launch mode

Launch the EC2 instances on Reserved Instance and create a tag for the application. Deploy an AWS Service Catalog rule backed by a Lambda function to track that the application is always launched on an EC2 instance with the correct mode

Launch the EC2 instances on Dedicated Hosts and create a tag for the application. Deploy an AWS Service Catalog rule backed by a Lambda function to track that the application is always launched on an EC2 instance with the correct mode

Overall explanation

Correct option:

Launch the EC2 instances on Dedicated Hosts and create a tag for the application. Deploy an AWS Config custom rule backed by a Lambda function that will check the application tag and ensure the instance is launched on the correct launch mode

An Amazon EC2 Dedicated Host is a physical server with EC2 instance capacity fully dedicated for your use. When you bring your own licenses to Amazon EC2 Dedicated Hosts, you can let AWS take care of all these administrative tasks on your behalf. AWS gives administrators the option to perform a one-time onboarding set up in AWS License Manager.

via - https://aws.amazon.com/ec2/dedicated-hosts/faqs/

To get access to the CPU sockets for billing purposes, you need to use EC2 Dedicated Hosts. Reserved Instances are here to save cost on a yearly utilization of EC2. Reserved Instances (RI) provide a significant discount (up to 72%) compared to On-Demand pricing and provide a capacity reservation when used in a specific Availability Zone.

AWS Config provides a detailed view of the resources associated with your AWS account, including how they are configured, how they are related to one another, and how the configurations and their relationships have changed over time. An AWS Config rule represents your desired configuration settings for specific AWS resources or an entire AWS account. AWS Config provides customizable, predefined rules to help you get started. If a resource violates a rule, AWS Config flags the resource and the rule as noncompliant, and AWS Config notifies you through Amazon SNS.

For the given use-case, you need to create a Config custom rule that will check the application tag and ensure the instance is launched as a Dedicated Host.

via - https://docs.aws.amazon.com/config/latest/developerguide/how-does-config-work.html

via - https://docs.aws.amazon.com/config/latest/developerguide/config-concepts.html

Incorrect options:

Launch the EC2 instances on Dedicated Hosts and create a tag for the application. Deploy an AWS Service Catalog rule backed by a Lambda function to track that the application is always launched on an EC2 instance with the correct mode - Service Catalog is used to create stacks backed by CloudFormation through a service portal. To track compliance over time, you must use AWS Config.

Launch the EC2 instances on Reserved Instances and create a tag for the application. Deploy an AWS Config custom rule backed by a Lambda function that will check the application tag and ensure the instance is launched on the correct launch mode - Reserved Instances can only be used to save cost on a yearly utilization of EC2 for example. To get access to the CPU sockets for billing purposes, you need to use EC2 Dedicated Hosts.

Launch the EC2 instances on Reserved Instance and create a tag for the application. Deploy an AWS Service Catalog rule backed by a Lambda function to track that the application is always launched on an EC2 instance with the correct mode - Service Catalog is used to create stacks backed by CloudFormation through a service portal. To track compliance over time, you must use AWS Config. Besides, Reserved Instances can only be used to save cost on a yearly utilization of EC2 for example. To get access to the CPU sockets for billing purposes, you need to use EC2 Dedicated Hosts.

References:

https://aws.amazon.com/ec2/dedicated-hosts/faqs/

https://docs.aws.amazon.com/config/latest/developerguide/how-does-config-work.html

https://docs.aws.amazon.com/config/latest/developerguide/config-concepts.html

Domain

Domain 6: Security and Compliance

Question 42Skipped

An e-commerce company has deployed a Spring application on Elastic Beanstalk running the Java platform. As a DevOps Engineer at the company, you are referencing an RDS PostgreSQL database through an environment variable so that your application can use it for storing its data. You are using a library to perform a database migration in case the schema changes. Upon deploying updates to Beanstalk, you have seen the migration fail because all the EC2 instances running the new version try to run the migration on the RDS database.

How can you fix this issue?

Create an .ebextensions/db-migration.config file in your code repository and set a commands block. Set your migration command there and use the lock_mode: true attribute

Create an .ebextensions/db-migration.config file in your code repository and set a container_commands block. Set your migration command there and use the lock_mode: true attribute

Correct answer

Create an .ebextensions/db-migration.config file in your code repository and set a container_commands block. Set your migration command there and use the leader_only: true attribute

Create an .ebextensions/db-migration.config file in your code repository and set a commands block. Set your migration command there and use the leader_only: true attribute

Overall explanation

Correct option:

Create an .ebextensions/db-migration.config file in your code repository and set a container_commands block. Set your migration command there and use the leader_only: true attribute

You can use Elastic Beanstalk configuration files (.ebextensions) with your web application's source code to configure your environment and customize the AWS resources that it contains. Configuration files are YAML- or JSON-formatted documents with a .config file extension that you place in a folder named .ebextensions and deploy in your application source bundle. You can use the option_settings key to modify the environment configuration. You can choose from general options for all environments and platform-specific options.

You may want to customize and configure the software that your application depends on. You can use the commands key to execute commands on the EC2 instance. The commands run before the application and web server are set up and the application version file is extracted.

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers-ec2.html

You can use the container_commands key to execute commands that affect your application source code. Container commands run after the application and web server have been set up and the application version archive has been extracted, but before the application version is deployed. You can use leader_only to only run the command on a single instance, or configure a test to only run the command when a test command evaluates to true.

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers-ec2.html

If you specify a commands block, every EC2 instance will run it and it does not support the leader_only attribute. Therefore you must use container_commands.

Incorrect options:

Create an .ebextensions/db-migration.config file in your code repository and set a commands block. Set your migration command there and use the leader_only: true attribute - As mentioned earlier, if you specify a commands block, every EC2 instance will run it and it does not support the leader_only attribute. So this option is incorrect.

Create an .ebextensions/db-migration.config file in your code repository and set a container_commands block. Set your migration command there and use the lock_mode: true attribute

Create an .ebextensions/db-migration.config file in your code repository and set a commands block. Set your migration command there and use the lock_mode: true attribute

The lock_mode: true attribute has been added as a distractor and it does not exist. So both these options are incorrect.

References:

https://stackoverflow.com/questions/35788499/what-is-difference-between-commands-and-container-commands-in-elasticbean-talk/40096352#40096352

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers-ec2.html

Domain

Domain 2: Configuration Management and IaC

Question 43Skipped

A multi-national retail company is operating a multi-account strategy using AWS Organizations. Each account produces logs to CloudWatch Logs and the company would like to aggregate these logs under a single centralized account for archiving purposes. It needs the solution to be secure and centralized. The target destination for the logs should have little to no provisioning on the storage side.

As a DevOps Engineer, how would you implement a solution to meet these requirements?

Create a log destination in the centralized account, and create a log subscription on that destination. Create a Lambda function on that log subscription, and implement a script to send the data to Amazon ES

Create a log destination in the centralized account, and create a log subscription on that destination. Create a Kinesis Streams and subscribe it to the destination. Create a Kinesis Firehose delivery stream and subscribe it to the Kinesis Stream. The target of the Kinesis Firehose should be Amazon ES

Create a log destination in the centralized account, and create a log subscription on that destination. Create a Kinesis Streams and subscribe it to the destination. Create a Kinesis Firehose delivery stream and subscribe it to the Kinesis Stream. The target of the Kinesis Firehose should be Amazon Redshift

Correct answer

Create a log destination in the centralized account, and create a log subscription on that destination. Create a Kinesis Firehose delivery stream and subscribe it to the log destination. The target of Kinesis Firehose should be Amazon S3

Overall explanation

Correct option:

Create a log destination in the centralized account, and create a log subscription on that destination. Create a Kinesis Firehose delivery stream and subscribe it to the log destination. The target of Kinesis Firehose should be Amazon S3

You can use subscriptions to get access to a real-time feed of log events from CloudWatch Logs and have it delivered to other services such as an Amazon Kinesis stream, an Amazon Kinesis Data Firehose stream, or AWS Lambda for custom processing, analysis, or loading to other systems. When log events are sent to the receiving service, they are Base64 encoded and compressed with the gzip format.

For cross-account log data sharing with subscriptions, you can collaborate with an owner of a different AWS account and receive their log events on your AWS resources, such as an Amazon Kinesis or Amazon Kinesis Data Firehose stream (this is known as cross-account data sharing). For example, this log event data can be read from a centralized Kinesis or Kinesis Data Firehose stream to perform custom processing and analysis. Therefore we have to subscribe the log destination to a Kinesis Firehose delivery stream, which in turn has a destination of S3.

via - https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CrossAccountSubscriptions.html

Incorrect options:

Create a log destination in the centralized account, and create a log subscription on that destination. Create a Kinesis Streams and subscribe it to the destination. Create a Kinesis Firehose delivery stream and subscribe it to the Kinesis Stream. The target of the Kinesis Firehose should be Amazon Redshift - The issue with this option is that the target for Kinesis Firehose is set as Amazon Redshift which is not a serverless service and requires provisioning.

Create a log destination in the centralized account, and create a log subscription on that destination. Create a Kinesis Streams and subscribe it to the destination. Create a Kinesis Firehose delivery stream and subscribe it to the Kinesis Stream. The target of the Kinesis Firehose should be Amazon ES - The issue with this option is that the target for Kinesis Firehose is set as Amazon ES which is not a serverless service and requires provisioning.

Create a log destination in the centralized account, and create a log subscription on that destination. Create a Lambda function on that log subscription, and implement a script to send the data to Amazon ES - If the log destination is a Lambda function, this could work, but it will be a problem as this Lambda function sends the data to Amazon ES, which is not a serverless service and requires provisioning.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CrossAccountSubscriptions.html

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Subscriptions.html

Domain

Domain 4: Monitoring and Logging

Question 44Skipped

A multi-national retail company is planning for disaster recovery and needs the data to be stored in Amazon S3 in two different regions that are in different continents. The data is written at a high rate of 10000 objects per second. For regulatory reasons, the data also needs to be encrypted in transit and at rest. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution for this requirement.

Which of the following solutions would you recommend?

Correct answer

Create a bucket policy to create a condition for Denying any request that is "aws:SecureTransport": "false". Encrypt the objects at rest using SSE-S3. Setup Cross-Region Replication

Create a bucket policy to create a condition for Denying any request that is "aws:SecureTransport": "true". Encrypt the objects at rest using SSE-S3. Setup Cross-Region Replication

Create a bucket policy to create a condition for Denying any request that is "aws:SecureTransport": "true". Encrypt the objects at rest using SSE-KMS. Setup Cross-Region Replication

Create a bucket policy to create a condition for Denying any request that is "aws:SecureTransport": "false". Encrypt the objects at rest using SSE-KMS. Setup Cross-Region Replication

Overall explanation

Correct option:

*Create a bucket policy to create a condition for Denying any request that is "aws:SecureTransport": "false". Encrypt the objects at rest using SSE-S3. Setup Cross-Region Replication *

By default, Amazon S3 allows both HTTP and HTTPS requests. To comply with the requirements, confirm that your bucket policies explicitly deny access to HTTP requests. Bucket policies that allow HTTPS requests without explicitly denying HTTP requests might not comply with the rule.

To determine HTTP or HTTPS requests in a bucket policy, use a condition that checks for the key "aws:SecureTransport". When this key is true, this means that the request is sent through HTTPS. Create a bucket policy that explicitly denies access when the request meets the condition "aws:SecureTransport": "false". This policy explicitly denies access to HTTP requests.

Finally, if we encrypt using KMS, we may get throttled at 10000 objects per second. SSE-S3 is a better choice in this case.

Incorrect options:

Create a bucket policy to create a condition for Denying any request that is "aws:SecureTransport": "true". Encrypt the objects at rest using SSE-S3. Setup Cross-Region Replication - As mentioned in the explanation above, you need to set the condition "aws:SecureTransport": "false" for the solution to work.

Create a bucket policy to create a condition for Denying any request that is "aws:SecureTransport": "false". Encrypt the objects at rest using SSE-KMS. Setup Cross-Region Replication

Create a bucket policy to create a condition for Denying any request that is "aws:SecureTransport": "true". Encrypt the objects at rest using SSE-KMS. Setup Cross-Region Replication

If we encrypt using KMS, we may get throttled at 10000 objects per second. So both these options are incorrect.

References:

https://aws.amazon.com/blogs/security/how-to-use-bucket-policies-and-apply-defense-in-depth-to-help-secure-your-amazon-s3-data/

https://docs.aws.amazon.com/kms/latest/developerguide/resource-limits.html

Domain

Domain 3: Resilient Cloud Solutions

Question 45Skipped

The DevOps team at a retail company has deployed its flagship application on EC2 instances using CodeDeploy and uses an RDS PostgreSQL database to store the data, while it uses DynamoDB to store the user sessions. As the Lead DevOps Engineer at the company, you would like the application to securely access RDS & DynamoDB.

How can you do this most securely?

Store the RDS credentials & DynamoDB credentials in Secrets Manager and create an IAM instance role for EC2 to access Secrets Manager

Store IAM user credentials & RDS credentials in Secrets Manager and create an IAM instance role for EC2 to access Secrets Manager

Correct answer

Store the RDS credentials in Secrets Manager and create an IAM instance role for EC2 to access Secrets Manager and DynamoDB

Store the RDS credentials in a DynamoDB table and create an IAM instance role for EC2 to access DynamoDB

Overall explanation

Correct option:

Store the RDS credentials in Secrets Manager and create an IAM instance role for EC2 to access Secrets Manager and DynamoDB

AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. This service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.

You can use Secrets Manager to natively rotate credentials for Amazon Relational Database Service (RDS), Amazon DocumentDB, and Amazon Redshift. You can extend Secrets Manager to rotate other secrets, such as credentials for Oracle databases hosted on EC2 or OAuth refresh tokens, by modifying sample AWS Lambda functions available in the Secrets Manager documentation.

To access PostgreSQL, you can use database credentials and they're best stored in Secrets Manager from a security best-practices perspective. Access to Secrets Manager itself is regulated using an IAM role with the requisite policy. You must write this IAM policy permitting your application on EC2 instances to access specific secrets. Then, in the application source code, you can replace secrets in plain text with code to retrieve these secrets programmatically using the Secrets Manager APIs. To access the DynamoDB table, you should also add the appropriate policy to this IAM role.

Incorrect options:

Store the RDS credentials & DynamoDB credentials in Secrets Manager and create an IAM instance role for EC2 to access Secrets Manager - As mentioned in the explanation above, Secrets Manager does NOT support DynamoDB, so this option is incorrect.

Store the RDS credentials in a DynamoDB table and create an IAM instance role for EC2 to access DynamoDB - It's not recommended to store RDS credentials in a DynamoDB, as it can be accessed by everyone who has access to the underlying table. This constitutes a serious security threat.

Store IAM user credentials & RDS credentials in Secrets Manager and create an IAM instance role for EC2 to access Secrets Manager - Storing IAM user credentials in Secrets Manager is a distractor as IAM user credentials are not required to build a solution for this use-case. You can just use an IAM instance role for EC2 to access Secrets Manager.

Reference:

https://aws.amazon.com/secrets-manager/faqs/

Domain

Domain 6: Security and Compliance

Question 46Skipped

As the Lead DevOps Engineer at an e-commerce company, you would like to upgrade the major version of your MySQL database, which is managed by CloudFormation with AWS::RDS::DBInstance and setup using Multi-AZ.

You have a requirement to minimize the downtime as much as possible, what steps should you take to achieve this?

Upgrade the RDS database by updating the EngineVersion to the next major version, then run an UpdateStack Operation

Upgrade the RDS database by updating the DBEngineVersion to the next major version, then run an UpdateStack Operation

Create an RDS Read Replica in a CloudFormation template by specifying SourceDBInstanceIdentifier and wait for it to be created. Afterward, upgrade the RDS Read Replica DBEngineVersion to the next major version. Then promote the Read Replica and use it as your new master database

Correct answer

Create an RDS Read Replica in a CloudFormation template by specifying SourceDBInstanceIdentifier and wait for it to be created. Afterward, upgrade the RDS Read Replica EngineVersion to the next major version. Then promote the Read Replica and use it as your new master database

Overall explanation

Correct option:

Create an RDS Read Replica in a CloudFormation template by specifying SourceDBInstanceIdentifier and wait for it to be created. Afterward, upgrade the RDS Read Replica EngineVersion to the next major version. Then promote the Read Replica and use it as your new master database

You can minimize downtime on an upgrade by using a rolling upgrade using read replicas. Amazon RDS doesn’t fully automate one-click rolling upgrades. However, you can still perform a rolling upgrade by creating a read replica, upgrading the replica by using the property EngineVersion, promoting the replica, and then routing traffic to the promoted replica. If you want to create a Read Replica DB instance, specify the ID of the source DB instance. The SourceDBInstanceIdentifier property determines whether a DB instance is a Read Replica.

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html

You should also note that a Multi-AZ configuration does not prevent downtime during an upgrade. Multi-AZ is only recommended for a high availability use-case. However, in the case of a MySQL or MariaDB engine upgrade, Multi-AZ doesn’t eliminate downtime. The slow shutdown and the physical changes made on the active server by the mysql_upgrade program require this downtime.

via - https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-for-mysql-and-amazon-rds-for-mariadb/

Incorrect options:

Create an RDS Read Replica in a CloudFormation template by specifying SourceDBInstanceIdentifier and wait for it to be created. Afterward, upgrade the RDS Read Replica DBEngineVersion to the next major version. Then promote the Read Replica and use it as your new master database - You should remember that the property is EngineVersion, not DBEngineVersion, so this option is incorrect.

Upgrade the RDS database by updating the EngineVersion to the next major version, then run an UpdateStack Operation - If you update the EngineVersion property of an AWS::RDS::DBInstance resource type, AWS CloudFormation creates a new resource and replaces the current DB instance resource with the new one, so this option is incorrect.

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html

Upgrade the RDS database by updating the DBEngineVersion to the next major version, then run an UpdateStack Operation - Also, you should remember that the property is EngineVersion, not DBEngineVersion, so this option is incorrect.

References:

https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-for-mysql-and-amazon-rds-for-mariadb/

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.MySQL.html#USER_UpgradeDBInstance.MySQL.ReducedDowntime

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html#cfn-rds-dbinstance-engineversion

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html

Domain

Domain 5: Incident and Event Response

Question 47Skipped

The DevOps team at an analytics company is deploying an Apache Kafka cluster that contains 6 instances and is distributed across 3 Availability Zones (AZs). Apache Kafka is a stateful service and needs to store its data in an EBS volume. Therefore each instance must have the auto-healing capability and always attach the correct EBS volumes.

As an AWS Certified DevOps Engineer Professional, which of the following solutions would you suggest for the given requirement?

Create an Auto Scaling Group in CloudFormation with a min/max desired capacity of 6 instances spread across 3 AZs, and 6 EBS volumes also across the 3 AZs. Create a user data script so that instances launching from the ASG automatically acquire an available EBS volume in the corresponding AZ

Create 6 EC2 instances using CloudFormation with EBS volumes. Define the attachments in the CloudFormation template. If the EC2 instance is terminated, it will be automatically re-created by CloudFormation with the correct EBS attachment

Create 6 EC2 instances using CloudFormation with EBS volumes. Define the attachments in the CloudFormation template. If the EC2 instance is terminated, launch a drift detection in CloudFormation and then use CloudFormation remediation

Correct answer

Create a CloudFormation template with an ASG of min/max capacity of 1, and an EBS volume. Tag the ASG and EBS volume. Create a User Data script that will acquire the EBS volume at boot time. Use a master CloudFormation template and reference the nested template 6 times

Overall explanation

Correct option:

Create a CloudFormation template with an ASG of min/max capacity of 1, and an EBS volume. Tag the ASG and EBS volume. Create a User Data script that will acquire the EBS volume at boot time. Use a master CloudFormation template and reference the nested template 6 times

You can use CloudFormation to create a template that describes all the AWS resources that you want (like Amazon EC2 instances or Amazon RDS DB instances), and AWS CloudFormation takes care of provisioning and configuring those resources for you.

Auto Scaling group enables you to automatically scale Amazon EC2 instances, either with scaling policies or with scheduled scaling. Auto Scaling groups are collections of Amazon EC2 instances that enable automatic scaling and fleet management features, such as health checks and integration with Elastic Load Balancing.

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-autoscaling.html

For the given use-case, you need to leverage CloudFormation to set up 6 ASGs of 1 instance each and EBS volumes with the appropriate tags and then use an EC2 user data script to attach the corresponding EBS volumes correctly.

Incorrect options:

Create an Auto Scaling Group in CloudFormation with a min/max desired capacity of 6 instances spread across 3 AZs, and 6 EBS volumes also across the 3 AZs. Create a user data script so that instances launching from the ASG automatically acquire an available EBS volume in the corresponding AZ - If you use an ASG of 6 instances, this may seem like a good idea but then you may get into a situation where an AZ is down and 3 instances are created in the other 2 AZ. EBS volumes cannot transfer cross regions and you'll be stuck.

Create 6 EC2 instances using CloudFormation with EBS volumes. Define the attachments in the CloudFormation template. If the EC2 instance is terminated, it will be automatically re-created by CloudFormation with the correct EBS attachment - If you define 6 instances and attachments in CloudFormation, in case an instance is terminated it won't come back automatically.

Create 6 EC2 instances using CloudFormation with EBS volumes. Define the attachments in the CloudFormation template. If the EC2 instance is terminated, launch a drift detection in CloudFormation and then use CloudFormation remediation - If you define 6 instances and attachments in CloudFormation, in case an instance is terminated it won't come back automatically. Drift detection will allow you to see what has changed, but it will not allow you to fix it through CloudFormation.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-autoscaling.html

Domain

Domain 5: Incident and Event Response

Question 48Skipped

A social media company has multiple EC2 instances that are behind an Auto Scaling group (ASG) and you would like to retrieve all the log files within the instances before they are terminated. You would like to also build a metadata index of all the log files so you can efficiently find them by instance id and date range.

As a DevOps Engineer, which of the following options would you recommend to address the given requirements? (Select three)

Create a termination hook for your ASG and create a CloudWatch Events rule to trigger an AWS Lambda function. The Lambda function should invoke an SSM Run Command to send the log files from the EC2 instance to CloudWatch Logs. Create a log subscription to send it to Firehose and then S3

Correct selection

Create a DynamoDB table with a primary key of instance-id and a sort key of datetime

Create a DynamoDB table with a primary key of datetime and a sort key of instance-id

Correct selection

Create a termination hook for your ASG and create a CloudWatch Events rule to trigger an AWS Lambda function. The Lambda function should invoke an SSM Run Command to send the log files from the EC2 instance to S3

Create a Lambda function that is triggered by CloudWatch Events for PUT. Write to the DynamoDB table

Correct selection

Create a Lambda function that is triggered by S3 events for PUT. Write to the DynamoDB table

Overall explanation

Correct options:

Create a termination hook for your ASG and create a CloudWatch Events rule to trigger an AWS Lambda function. The Lambda function should invoke an SSM Run Command to send the log files from the EC2 instance to S3

Lifecycle hooks enable you to perform custom actions by pausing instances as an ASG launches or terminates them. For example, when a scale-in event occurs, the terminating instance is first deregistered from the load balancer (if the Auto Scaling group is being used with Elastic Load Balancing). Then, a lifecycle hook pauses the instance before it is terminated. While the instance is in the wait state, you can, for example, connect to the instance and download logs or other data before the instance is fully terminated.

via - https://docs.aws.amazon.com/autoscaling/ec2/userguide/lifecycle-hooks.html

You can use a CloudWatch Events rule to invoke a Lambda function when a lifecycle action occurs. The Lambda function is invoked when Amazon EC2 Auto Scaling submits an event for a lifecycle action to CloudWatch Events. The event contains information about the instance that is launching or terminating and a token that you can use to control the lifecycle action. Finally, the Lambda function can invoke an SSM Run Command to send the log files from the EC2 instance to S3. SSM Run Command lets you remotely and securely manage the configuration of your managed instances.

Create a Lambda function that is triggered by S3 events for PUT. Write to the DynamoDB table

You can use Lambda to process event notifications from Amazon Simple Storage Service. Amazon S3 can send an event to a Lambda function when an object is created or deleted. Amazon S3 invokes your function asynchronously with an event that contains details about the object. The Lambda would further write the event information into the DynamoDB table.

Create a DynamoDB table with a primary key of instance-id and a sort key of datetime

When you create a DynamoDB table, in addition to the table name, you must specify the primary key of the table. The primary key uniquely identifies each item in the table, so that no two items can have the same key. For the given use-case, you need to set the primary key as a combination of partition key of instance-id and a sort key of datetime as we are looking for a specific instance id and a date range.

via - https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.html#HowItWorks.CoreComponents.PrimaryKey

Incorrect options:

Create a termination hook for your ASG and create a CloudWatch Events rule to trigger an AWS Lambda function. The Lambda function should invoke an SSM Run Command to send the log files from the EC2 instance to CloudWatch Logs. Create a log subscription to send it to Firehose and then S3 - We must send the log files to S3 directly from the EC2 instance instead of through CloudWatch, as we're doing a one time dump of them. CloudWatch Logs are a good solution for streaming logs as they are created.

Create a Lambda function that is triggered by CloudWatch Events for PUT. Write to the DynamoDB table - We need to have the Lambda function triggered by S3 events instead of CloudWatch Events, as for CloudWatch Events we would need to also have a CloudTrail trail recording action on the specific S3 bucket.

Create a DynamoDB table with a primary key of datetime and a sort key of instance-id - As mentioned in the explanation above, since the use-case requires looking up for a specific instance id and a date range, you should use instance-id as the Partition Key and datetime as the Sort Key. So this option is incorrect.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/lifecycle-hooks.html

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.html#HowItWorks.CoreComponents.PrimaryKey

Domain

Domain 4: Monitoring and Logging

Question 49Skipped

The DevOps team at an e-commerce company is working with the in-house security team to improve the security workflow of the code release process. The DevOps team would like to initiate a 3rd party code vulnerability analysis tool for every push done to code in your CodeCommit repository. The code has to be sent via an external API.

As an AWS Certified DevOps Engineer, how would you implement this most efficiently?

Correct answer

Create a CloudWatch Event rule on your CodeCommit repository that reacts to pushes. As a target, choose an AWS Lambda function that will request the code from CodeCommit, zip it and send it to the 3rd party API

Create a CodeCommit hook on an EC2 instance that streams changes from CodeCommit into the local filesystem. A cron job on the EC2 instance will zip the code and send it to the 3rd party API upon changes being detected

Create a CloudWatch Event rule on your CodeCommit repository that reacts to pushes. As a target, choose an S3 bucket so that the code will be automatically zipped into S3. Create an S3 Event rule to trigger a Lambda function that will retrieve the zipped code from S3 and send it to the 3rd party API

Create a CloudWatch Event rule on a schedule of 5 minutes that triggers a Lambda function that will check for new commits done on your CodeCommit repository. If new commits are detected, download and zip the code and then send it to the 3rd party API

Overall explanation

Correct option:

Create a CloudWatch Event rule on your CodeCommit repository that reacts to pushes. As a target, choose an AWS Lambda function that will request the code from CodeCommit, zip it and send it to the 3rd party API

Amazon CloudWatch Events delivers a near real-time stream of system events that describe changes in Amazon Web Services (AWS) resources. Using simple rules that you can quickly set up, you can match events and route them to one or more target functions or streams. You can generate custom application-level events and publish them to CloudWatch Events. You can also set up scheduled events that are generated on a periodic basis. A rule matches incoming events and routes them to targets for processing.

CloudWatch Events Overview:

via - https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/WhatIsCloudWatchEvents.html

For the given use-case, you can set up a CloudWatch Event rule for every push to the CodeCommit repository that would trigger the Lambda function configured as a target. The Lambda function would in turn request the code from CodeCommit, zip it and send it to the 3rd party API.

CloudWatch Events Configuration:

Incorrect options:

Create a CloudWatch Event rule on your CodeCommit repository that reacts to pushes. As a target, choose an S3 bucket so that the code will be automatically zipped into S3. Create an S3 Event rule to trigger a Lambda function that will retrieve the zipped code from S3 and send it to the 3rd party API - CloudWatch Event Rules cannot have S3 buckets as a target. Although you can set an S3 trigger as a target, eventually you would still need to invoke the Lambda function via an S3 trigger to process the code via the API. Therefore it's efficient to directly invoke the Lambda function from the CloudWatch Event rule.

Create a CloudWatch Event rule on a schedule of 5 minutes that triggers a Lambda function that will check for new commits done on your CodeCommit repository. If new commits are detected, download and zip the code and then send it to the 3rd party API - CloudWatch Event rules on a schedule would introduce lag and would be inefficient. So this option is ruled out.

Create a CodeCommit hook on an EC2 instance that streams changes from CodeCommit into the local filesystem. A cron job on the EC2 instance will zip the code and send it to the 3rd party API upon changes being detected - The EC2 CodeCommit hook is a distractor and does not exist.

Reference:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/WhatIsCloudWatchEvents.html

Domain

Domain 1: SDLC Automation

Question 50Skipped

A retail company is implementing a CodePipeline pipeline in which every push to the CodeCommit master branch gets deployed to development, staging, and production environment consisting of EC2 instances. When deploying to production, traffic should be deployed on a few instances so that metrics can be gathered before a manual approval step is done to deploy to all the instances.

The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution to address this use-case. How would you implement this?

In CodeDeploy, create four deployment groups - one for development, one for staging, one for the canary testing instances in production and one for the entire production instances. Create separate CodePipeline for each deployment group all having the same source being your code repository. Introducing a manual approval step in the pipeline that deploys to production

Correct answer

In CodeDeploy, create four deployment groups - one for development, one for staging, one for the canary testing instances in production and one for the entire production instances. Create one CodePipeline and chain up these stages together, introducing a manual approval step after the deployment to the canary instances

In CodeDeploy, create three deployment groups - one for development, one for staging, and one for the entire production instances. Create three separate CodePipeline for each deployment group having all the same sources being your code repository. For the deployment to production, enable the Canary deployment setting for CodeDeploy, and introduce a manual step after the canary deployment that will pause the rest of the deployment. Upon approval, the rest of the instances in production will have a deployment made to them

In CodeDeploy, create three deployment groups - one for development, one for staging, and one for the entire production instances. Create one CodePipeline and chain up these together. For the deployment to production, enable the Canary deployment setting for CodeDeploy, and introduce a manual step after the canary deployment that will pause the rest of the deployment. Upon approval, the rest of the instances in production will have a deployment made to them

Overall explanation

Correct option:

In CodeDeploy, create four deployment groups - one for development, one for staging, one for the canary testing instances in production and one for the entire production instances. Create one CodePipeline and chain up these stages together, introducing a manual approval step after the deployment to the canary instances

CodeDeploy is a fully managed deployment service that automates software deployments to a variety of compute services such as Amazon EC2, AWS Fargate, AWS Lambda, and your on-premises servers. AWS CodeDeploy makes it easier for you to rapidly release new features, helps you avoid downtime during deployment, and handles the complexity of updating your applications.

CodeDeploy components overview:

via - https://docs.amazonaws.cn/en_us/codedeploy/latest/userguide/welcome.html

For the given use-case, you should create four deployment groups for development, staging, canary testing, production and then chain these together using CodePipeline. For EC2, to do a canary deployment, you must create a small deployment group made of few instances from production and deploy to these. Add a manual step after the deployment to the canary testing stage.

Sample workflow for CI/CD with AWS CodeCommit, AWS CodeBuild, AWS CodeDeploy, and AWS CodePipeline:

via - https://aws.amazon.com/blogs/devops/complete-ci-cd-with-aws-codecommit-aws-codebuild-aws-codedeploy-and-aws-codepipeline/

Exam Alert:

The exam may try to trap you on some of the following details on deployment-related processes. Be aware of what's possible.

A deployment group contains individually tagged Amazon EC2 instances, Amazon EC2 instances in Amazon EC2 Auto Scaling groups, or both.

Deployments that use the EC2/On-Premises compute platform manage the way in which traffic is directed to instances by using an in-place or blue/green deployment type. During an in-place deployment, CodeDeploy performs a rolling update across Amazon EC2 instances. During a blue/green deployment, the latest application revision is installed on replacement instances.

If you use an EC2/On-Premises compute platform, be aware that blue/green deployments work with Amazon EC2 instances only.

You CANNOT use canary, linear, or all-at-once configuration for EC2/On-Premises compute platform.

You can manage the way in which traffic is shifted to the updated Lambda function versions during deployment by choosing a canary, linear, or all-at-once configuration.

You can deploy an Amazon ECS containerized application as a task set. You can manage the way in which traffic is shifted to the updated task set during deployment by choosing a canary, linear, or all-at-once configuration.

Amazon ECS blue/green deployments are supported using both CodeDeploy and AWS CloudFormation. For blue/green deployments through AWS CloudFormation, you don't create a CodeDeploy application or deployment group.

Your deployable content and the AppSpec file are combined into an archive file (also known as application revision) and then upload it to an Amazon S3 bucket or a GitHub repository. Remember these two locations. AWS Lambda revisions can be stored in Amazon S3 buckets. EC2/On-Premises revisions are stored in Amazon S3 buckets or GitHub repositories.

AWS Lambda and Amazon ECS deployments CANNOT use an in-place deployment type.

Incorrect options:

In CodeDeploy, create four deployment groups - one for development, one for staging, one for the canary testing instances in production and one for the entire production instances. Create separate CodePipeline for each deployment group all having the same source being your code repository. Introducing a manual approval step in the pipeline that deploys to production - Creating separate CodePipelines is not a good idea and won't allow you to create manual approval steps before deploying to production.

In CodeDeploy, create three deployment groups - one for development, one for staging, and one for the entire production instances. Create one CodePipeline and chain up these together. For the deployment to production, enable the Canary deployment setting for CodeDeploy, and introduce a manual step after the canary deployment that will pause the rest of the deployment. Upon approval, the rest of the instances in production will have a deployment made to them - While CodeDeploy does have a Canary Deployment setting, it's only meant for AWS Lambda and ECS platforms and there's no option to pause it manually through an approval step.

In CodeDeploy, create three deployment groups - one for development, one for staging, and one for the entire production instances. Create three separate CodePipeline for each deployment group having all the same sources being your code repository. For the deployment to production, enable the Canary deployment setting for CodeDeploy, and introduce a manual step after the canary deployment that will pause the rest of the deployment. Upon approval, the rest of the instances in production will have a deployment made to them - While CodeDeploy does have a Canary Deployment setting, it's only meant for AWS Lambda and ECS platforms. In addition, creating separate CodePipelines is not a good idea and won't allow you to create manual approval steps before deploying to production.

References:

https://docs.amazonaws.cn/en_us/codedeploy/latest/userguide/welcome.html

https://aws.amazon.com/blogs/devops/complete-ci-cd-with-aws-codecommit-aws-codebuild-aws-codedeploy-and-aws-codepipeline/

Domain

Domain 1: SDLC Automation

Question 51Skipped

A 3D modeling company would like to deploy applications on Elastic Beanstalk with support for various programming languages with predictable and standardized deployment strategies. Some of these languages are supported (such as Node.js, Java, Golang) but others such as Rust are not supported. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution for this requirement.

Which of the following options would you recommend as the MOST efficient solution for this use-case?

Correct answer

Deploy to Elastic Beanstalk using a Multi-Docker container configuration. Package each application as a Docker container in ECR

Run Opsworks on top of Elastic Beanstalk to bring the missing compatibility layer

Package each application as a standalone AMI that contains the OS, the application runtime and the application itself. To update a Beanstalk environment, provide a new AMI

Create a custom platform for each language that is not supported. Package each application in S3 before deploying to Elastic Beanstalk

Overall explanation

Correct option:

Deploy to Elastic Beanstalk using a Multi-Docker container configuration. Package each application as a Docker container in ECR

Elastic Beanstalk supports the deployment of web applications from Docker containers. With Docker containers, you can define your own runtime environment. You can also choose your own platform, programming language, and any application dependencies (such as package managers or tools), which typically aren't supported by other platforms. Elastic Beanstalk can deploy a Docker image and source code to EC2 instances running the Elastic Beanstalk Docker platform. The platform offers multi-container (and single-container) support.

A Dockerrun.aws.json file is an Elastic Beanstalk–specific JSON file that describes how to deploy a set of Docker containers as an Elastic Beanstalk application. You can use a Dockerrun.aws.json file for a multi-container Docker environment. Dockerrun.aws.json describes the containers to deploy to each container instance (Amazon EC2 instance that hosts Docker containers) in the environment as well as the data volumes to create on the host instance for the containers to mount.

Here, the most simple solution is to create a Docker container for each application. By using a Multi-Docker container configuration, we will be able to have a standardized deployment system across all the languages that we want to support.

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/create_deploy_docker_ecs.html

Incorrect options:

Create a custom platform for each language that is not supported. Package each application in S3 before deploying to Elastic Beanstalk - Creating custom platforms and packaging applications in S3 will be cumbersome across a wide array of platforms. Using a multi-Docker container configuration is more efficient.

Package each application as a standalone AMI that contains the OS, the application runtime and the application itself. To update a Beanstalk environment, provide a new AMI - Packaging each application as an AMI might work but it's not going to help you standardize the way applications are deployed.

Run Opsworks on top of Elastic Beanstalk to bring the missing compatibility layer - AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet. Chef and Puppet are automation platforms that allow you to use code to automate the configurations of your servers. OpsWorks is a distractor in the question and doesn't have integration with Elastic Beanstalk.

References:

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/create_deploy_docker_ecs.html

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/create_deploy_docker_v2config.html

Domain

Domain 2: Configuration Management and IaC

Question 52Skipped

You are working as a DevOps Engineer at an e-commerce company and have a deployed a Node.js application on Elastic Beanstalk. You would like to track error rates and specifically, you need to ensure by looking at the application log, that you do not have more than 100 errors in a 5 minutes interval. In case you are getting too many errors, you would like to be alerted via email.

Which of the following options represents the most efficient solution in your opinion?

Use the Elastic Beanstalk Health Metrics to monitor the application health and track the error rates. Create a CloudWatch alarm on top of the metric and use SNS as a target. Create an email subscription on SNS

Implement custom logic in your Node.js application to track the number of errors it has received in the last 5 minutes. In case the number exceeds the threshold, use the SetAlarmState API to trigger a CloudWatch alarm. Make the CloudWatch Alarm use SNS as a target. Create an email subscription on SNS

Correct answer

Create a CloudWatch Logs Metric Filter and assign a CloudWatch Metric. Create a CloudWatch Alarm linked to the metric and use SNS as a target. Create an email subscription on SNS

Create a CloudWatch Logs Metric Filter with a target being a CloudWatch Alarm. Make the CloudWatch Alarm use SNS as a target. Create an email subscription on SNS

Overall explanation

Correct option:

Create a CloudWatch Logs Metric Filter and assign a CloudWatch Metric. Create a CloudWatch Alarm linked to the metric and use SNS as a target. Create an email subscription on SNS

You can search and filter the log data by creating one or more metric filters. Metric filters define the terms and patterns to look for in log data as it is sent to CloudWatch Logs. CloudWatch Logs uses these metric filters to turn log data into numerical CloudWatch metrics that you can graph or set an alarm on. Filters do not retroactively filter data. Filters only publish the metric data points for events that happen after the filter was created.

You can use metric filters to search for and match terms, phrases, or values in your log events. When a metric filter finds one of the terms, phrases, or values in your log events, you can increment the value of a CloudWatch metric. For example, you can create a metric filter to search for and count the occurrence of the word ERROR in your log events.

CloudWatch Logs Metric Filter Concepts:

via - https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.html

For the given use-case, you can have Beanstalk send the logs to CloudWatch Logs, and then create a metric filter. This will create a metric for us (and not an alarm), and on top of the metric, you can create a CloudWatch Alarm. This alarm will send a notification to SNS, which will, in turn, send us emails.

Incorrect options:

Create a CloudWatch Logs Metric Filter with a target being a CloudWatch Alarm. Make the CloudWatch Alarm use SNS as a target. Create an email subscription on SNS - You cannot directly set a CloudWatch Alarm as a target for a CloudWatch Logs Metric Filter. You will first need to create a metric filter which can then be used to create a CloudWatch metric to be eventually used in a CloudWatch Alarm.

Use the Elastic Beanstalk Health Metrics to monitor the application health and track the error rates. Create a CloudWatch alarm on top of the metric and use SNS as a target. Create an email subscription on SNS - The Elastic Beanstalk Health Metrics will not track the errors sent out to a log file, so it does not meet the requirements of the use-case. Besides, CloudWatch alarm cannot be used to work on top of the Elastic Beanstalk Health Metrics.

Implement custom logic in your Node.js application to track the number of errors it has received in the last 5 minutes. In case the number exceeds the threshold, use the SetAlarmState API to trigger a CloudWatch alarm. Make the CloudWatch Alarm use SNS as a target. Create an email subscription on SNS - Implementing custom logic in your Node.js application may seem like a good idea, but then you have to remember that your application can be distributed amongst many servers with Beanstalk, and as such it will not be possible to track the "100 errors" across all instances using this methodology.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.html

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

Domain

Domain 4: Monitoring and Logging

Question 53Skipped

A gaming company would like to be able to receive near real-time notifications when the API call DeleteTable is invoked in DynamoDB.

As a DevOps Engineer at the company, how would you implement this at a minimal cost?

Correct answer

Enable CloudTrail. Create a CloudWatch Event rule to track an AWS API call via CloudTrail and use SNS as a target

Send CloudTrail Logs to CloudWatch Logs and use an AWS Lambda function to be triggered on a CloudWatch Logs metrics filter. Use the Lambda function to send an SNS notification

Enable DynamoDB Streams, and have a Lambda function consuming that stream. Send alerts to SNS whenever a record is being deleted

Create a CloudTrail event filter and hook it up to a Lambda function. Use the Lambda function to send an SNS notification

Overall explanation

Correct option:

Enable CloudTrail. Create a CloudWatch Event rule to track an AWS API call via CloudTrail and use SNS as a target

CloudTrail provides visibility into user activity by recording actions taken on your account. CloudTrail records important information about each action, including who made the request, the services used, the actions performed, parameters for the actions, and the response elements returned by the AWS service. This information helps you to track changes made to your AWS resources and to troubleshoot operational issues.

via - https://aws.amazon.com/cloudtrail/

To create a rule that triggers on an action by an AWS service that does not emit events, you can base the rule on API calls made by that service. The API calls are recorded by AWS CloudTrail. Rules in CloudWatch Events work only in the Region in which they are created. If you configure CloudTrail to track API calls in multiple Regions, and you want a rule-based on CloudTrail to trigger in each of those Regions, you must create a separate rule in each Region that you want to track.

For the given use-case, we can use the 'AWS API Call via CloudTrail' feature of CloudWatch Events and set up SNS as a target to achieve the desired outcome.

Incorrect options:

Enable DynamoDB Streams, and have a Lambda function consuming that stream. Send alerts to SNS whenever a record is being deleted - A DynamoDB stream is an ordered flow of information about changes to items in a DynamoDB table. When you enable a stream on a table, DynamoDB captures information about every modification to data items in the table. DynamoDB Streams do not capture DeleteTable API calls, they only capture item-level events.

Send CloudTrail Logs to CloudWatch Logs and use an AWS Lambda function to be triggered on a CloudWatch Logs metrics filter. Use the Lambda function to send an SNS notification - Sending CloudTrail Logs to CloudWatch Logs and creating a filter on those will work but will be expensive, as we're streaming all the logs from CloudTrail just to extract a single event.

Create a CloudTrail event filter and hook it up to a Lambda function. Use the Lambda function to send an SNS notification - CloudTrail trails do not have event filters and cannot be directly sent to a Lambda function.

References:

https://aws.amazon.com/cloudtrail/

https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-CloudTrail-Rule.html

Domain

Domain 4: Monitoring and Logging

Question 54Skipped

An Internet-of-Things (IoT) solutions company has decided to release every single application as a Docker container and to use ECS classic (on EC2) as the container orchestration system and ECR as the Docker registry. Part of implementing a monitoring pipeline is to ensure all application logs can be stored in CloudWatch logs.

The company has hired you as an AWS Certified DevOps Engineer Professional to provide the simplest possible instructions to accomplish this objective. What are these instructions?

Create ECS task definitions for your applications, with a sidecar container which contains the CloudWatch Agent tracking the /var/log/containers directory. Map the application's /var/log directory onto the sidecar filesystem. Set an IAM task role in the task definition with the necessary permissions to write to CloudWatch logs

Create ECS task definitions for your applications, with a mapping of the /var/log directory onto the local filesystem of the EC2 instance. Install the CloudWatch Agent on the EC2 instance using user-data and track the /var/log/containers directory. Create an EC2 instance role with the necessary permissions to write to CloudWatch logs

Correct answer

Create ECS task definitions that include the awslogs driver. Set an IAM instance role on the EC2 instance with the necessary permissions to write to CloudWatch logs

Create ECS task definitions that include the awslogs driver. Set an IAM task role in the task definition with the necessary permissions to write to CloudWatch logs

Overall explanation

Correct option:

Create ECS task definitions that include the awslogs driver. Set an IAM instance role on the EC2 instance with the necessary permissions to write to CloudWatch logs

Here many solutions may work but we're looking for the simplest possible solution. The important thing to remember is that the ECS task definitions can include the awslogs driver and write to CloudWatch Logs natively. But the EC2 instance will be the one writing to CloudWatch, and therefore it must have an EC2 Instance Role with the appropriate permissions to write to CloudWatch. Your Amazon ECS container instances also require logs:CreateLogStream and logs:PutLogEvents permission on the IAM role with which you launch your container instances

via - https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html

Incorrect options:

Create ECS task definitions that include the awslogs driver. Set an IAM task role in the task definition with the necessary permissions to write to CloudWatch logs - As mentioned in the explanation above, you need to provide the appropriate permissions to the EC2 Instance Role and not to the IAM task role to write to CloudWatch logs.

Create ECS task definitions for your applications, with a mapping of the /var/log directory onto the local filesystem of the EC2 instance. Install the CloudWatch Agent on the EC2 instance using user-data and track the /var/log/containers directory. Create an EC2 instance role with the necessary permissions to write to CloudWatch logs - This is a roundabout way of getting the container logs to the CloudWatch Logs, so not the best fit for the given use-case.

Create ECS task definitions for your applications, with a sidecar container which contains the CloudWatch Agent tracking the /var/log/containers directory. Map the application's /var/log directory onto the sidecar filesystem. Set an IAM task role in the task definition with the necessary permissions to write to CloudWatch logs - Sidecar containers are a common software pattern that has been embraced by engineering organizations. It’s a way to keep server-side architecture easier to understand by building with smaller, modular containers that each serve a simple purpose. Just like an application can be powered by multiple microservices, each microservice can also be powered by multiple containers that work together. A sidecar container is simply a way to move part of the core responsibility of a service out into a containerized module that is deployed alongside a core application container. This again seems to be a roundabout way of getting the container logs to the CloudWatch Logs, but it's not correct for the given use-case. You should note that you need to provide the appropriate permissions to the EC2 Instance Role and not to the IAM task role to write to CloudWatch logs.

References:

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_cloudwatch_logs.html

Domain

Domain 4: Monitoring and Logging

Question 55Skipped

A social media company is running its flagship application via an Auto-Scaling group (ASG) which has 15 EC2 instances spanning across 3 Availability Zones (AZs). The current average CPU utilization of the group sits at 15% off-peak time. During peak time, it goes all the way to 45%, and these peak times happen predictably during business hours. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution for this requirement.

How can you improve the instance utilization while reducing cost and maintaining application availability?

Correct answer

Create a scaling policy that tracks the CPU utilization with a target of 75%. Create a scheduled action that increases the number of minimum instances to 6 during peak times and a second scheduled action that reduces the number of minimum instances to 3 off-peak times

Use a CloudFormation UpdatePolicy to define how the Auto Scaling Group should behave off and on peaks. Ensure the ASG invokes the CloudFormation using SNS notifications relay

Create a Lambda function that terminates 9 instances at the end of business hours. Create a second Lambda function that creates instances when peak time starts. Schedule the functions using CloudWatch Events

Create a scaling policy that tracks the CPU utilization with a target of 75%. Create a scheduled action that invokes a Lambda function which will terminate 9 instances after peak times

Overall explanation

Correct option:

Create a scaling policy that tracks the CPU utilization with a target of 75%. Create a scheduled action that increases the number of minimum instances to 6 during peak times and a second scheduled action that reduces the number of minimum instances to 3 off-peak times

With target tracking scaling policies, you choose a scaling metric and set a target value. Application Auto Scaling creates and manages the CloudWatch alarms that trigger the scaling policy and calculates the scaling adjustment based on the metric and the target value. The scaling policy adds or removes capacity as required to keep the metric at, or close to, the specified target value.

Target tracking scaling policies for Amazon EC2 Auto Scaling:

via - https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html

The scheduled action tells Amazon EC2 Auto Scaling to perform a scaling action at specified times. To create a scheduled scaling action, you specify the start time when the scaling action should take effect, and the new minimum, maximum, and desired sizes for the scaling action. At the specified time, Amazon EC2 Auto Scaling updates the group with the values for minimum, maximum, and desired size that are specified by the scaling action. For the given use-case, you can create two separate scheduled actions that take care of the required minimum capacity during both peak and off-peak times.

Here, we need a scaling policy that tracks a good CPU usage of 75% and adjusts the minimum desired capacity through scheduled actions so it doesn't disrupt the number of EC2 instances negatively at any time.

via - https://docs.aws.amazon.com/autoscaling/ec2/userguide/schedule_time.html

Incorrect options:

Create a Lambda function that terminates 9 instances at the end of business hours. Create a second Lambda function that creates instances when peak time starts. Schedule the functions using CloudWatch Events

Create a scaling policy that tracks the CPU utilization with a target of 75%. Create a scheduled action that invokes a Lambda function which will terminate 9 instances after peak times

If a Lambda function terminates 9 instances because they're in an ASG, the desired capacity won't have changed and the ASG will re-create instances automatically. Therefore both these options are incorrect.

Use a CloudFormation UpdatePolicy to define how the Auto Scaling Group should behave off and on peaks. Ensure the ASG invokes the CloudFormation using SNS notifications relay - UpdatePolicy for CloudFormation cannot help define Scheduled Actions. There's a special ScheduledActions property for that.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/schedule_time.html

Domain

Domain 5: Incident and Event Response

Question 56Skipped

The DevOps team at a yoga-inspired apparel company wants to stand up development environments for testing new features. The team would like to receive all CodePipeline pipeline failures to be sent to the company's #devops Slack channel. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution to address this use-case.

Which of the following options would you suggest? (Select two)

Correct selection

The target of the rule should be a Lambda function that will invoke a 3rd party Slack webhook

Correct selection

Create a CloudWatch Event Rule with the source corresponding to

{
"source": [
"aws.codepipeline"
],
"detail-type": [
"CodePipeline Pipeline Execution State Change"
],
"detail": {
"state": [
"FAILED"
]
}
}

The target of the rule should be a 'Slack send'. Provide the channel name and webhook URL

Create a CloudWatch Event Rule with the source corresponding to

{
"source": [
"aws.codepipeline"
],
"detail-type": [
"CodePipeline Action Execution State Change"
],
"detail": {
"state": [
"FAILED"
]
}
}

Create a CloudWatch Event rule with the source corresponding to

{
"source": [
"aws.codepipeline"
],
"detail-type": [
"CodePipeline Stage Execution State Change"
],
"detail": {
"state": [
"FAILED"
]
}
}

Overall explanation

Correct options:

** Create a CloudWatch Event Rule with the source corresponding to

{
"source": [
"aws.codepipeline"
],
"detail-type": [
"CodePipeline Pipeline Execution State Change"
],
"detail": {
"state": [
"FAILED"
]
}
}

**

The target of the rule should be a Lambda function that will invoke a 3rd party Slack webhook

AWS CodePipeline is a continuous delivery service that enables you to model, visualize, and automate the steps required to release your software. With AWS CodePipeline, you model the full release process for building your code, deploying to pre-production environments, testing your application and releasing it to production.

Understand how a pipeline execution state change rule works:

via - https://docs.aws.amazon.com/codepipeline/latest/userguide/detect-state-changes-cloudwatch-events.html

Here we are only interested in pipeline failures, so we need to choose CodePipeline Pipeline Execution State Change. Finally, CloudWatch Event rules do not support Slack as a target, therefore we must create a Lambda function for it.

Incorrect options:

The target of the rule should be a 'Slack send'. Provide the channel name and webhook URL - CloudWatch Event rules do not support Slack as a target, so this option is incorrect.

** Create a CloudWatch Event Rule with the source corresponding to

{
"source": [
"aws.codepipeline"
],
"detail-type": [
"CodePipeline Action Execution State Change"
],
"detail": {
"state": [
"FAILED"
]
}
}

**

** Create a CloudWatch Event rule with the source corresponding to

{
"source": [
"aws.codepipeline"
],
"detail-type": [
"CodePipeline Stage Execution State Change"
],
"detail": {
"state": [
"FAILED"
]
}
}

**

Here we are only interested in pipeline failures, so we just need to choose CodePipeline Pipeline Execution State Change. Therefore both these options are incorrect.

References:

https://aws.amazon.com/codepipeline/faqs/

https://docs.aws.amazon.com/codepipeline/latest/userguide/detect-state-changes-cloudwatch-events.html

Domain

Domain 1: SDLC Automation

Question 57Skipped

A Silicon Valley based startup runs a news discovery web application and it uses CodeDeploy to deploy the web application on a set of 20 EC2 instances behind an Application Load Balancer. The ALB is integrated with CodeDeploy. The DevOps teams at the startup would like the deployment to be gradual and to automatically rollback in case of unusually high maximum CPU utilization for the EC2 instances while traffic is being served.

How can you implement this?

Create a CloudWatch metric for the maximum CPU utilization of your Application Load Balancer. Create a deployment in CodeDeploy that has rollback enabled, integrated with the CloudWatch metric

Correct answer

Create a CloudWatch metric for the maximum CPU utilization of your EC2 instances. Create a CloudWatch Alarm on top of that metric. Create a deployment in CodeDeploy that has rollback enabled, integrated with the CloudWatch alarm

In the ValidateService hook in appspec.yml, measure the CPU utilization for 5 minutes. Configure CodeDeploy to rollback on deployment failures. In case the hook fails, then CodeDeploy will rollback

Create a CloudWatch metric for the maximum CPU utilization of your EC2 instances. Create a deployment in CodeDeploy that has rollback enabled, integrated with the CloudWatch metric

Overall explanation

Correct option:

Create a CloudWatch metric for the maximum CPU utilization of your EC2 instances. Create a CloudWatch Alarm on top of that metric. Create a deployment in CodeDeploy that has rollback enabled, integrated with the CloudWatch alarm

You can monitor and automatically react to changes in your AWS CodeDeploy deployments using Amazon CloudWatch alarms. Using CloudWatch with CodeDeploy, you can monitor metrics for Amazon EC2 instances or Auto Scaling groups being managed by CodeDeploy and then invoke an action if the metric you are tracking crosses a certain threshold for a defined period of time. You can monitor metrics such as instance CPU utilization. If the alarm is activated, CloudWatch initiates actions such as sending a notification to Amazon Simple Notification Service, stopping a CodeDeploy deployment, or changing the state of an instance (e.g. reboot, terminate, recover). You can also automatically roll back a deployment when a deployment fails or when a CloudWatch alarm is activated. CodeDeploy will redeploy the last known working version of the application when it rolls back. Previously, you needed to manually initiate a deployment if you wanted to roll back a deployment. For the given use-case, you should use the underlying metric as the maximum CPU for your EC2 instances.

via - https://docs.aws.amazon.com/codedeploy/latest/userguide/monitoring-create-alarms.html

Configure advanced options for a deployment group:

via - https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-groups-configure-advanced-options.html

Incorrect options:

In the ValidateService hook in appspec.yml, measure the CPU utilization for 5 minutes. Configure CodeDeploy to rollback on deployment failures. In case the hook fails, then CodeDeploy will rollback - If you are using the ValidateService hook because your CodeDeploy is integrated with the ALB, traffic will not be served and you won't observe high CPU utilization.

Create a CloudWatch metric for the maximum CPU utilization of your EC2 instances. Create a deployment in CodeDeploy that has rollback enabled, integrated with the CloudWatch metric - CodeDeploy rollbacks only work with CloudWatch alarms, not CloudWatch metrics. So this option is incorrect.

Create a CloudWatch metric for the maximum CPU utilization of your Application Load Balancer. Create a deployment in CodeDeploy that has rollback enabled, integrated with the CloudWatch metric - This option has been added as a distractor as you would want to watch out for the maximum CPU utilization of the EC2 instances and not the Application Load Balancer. In addition, CodeDeploy rollbacks only work with CloudWatch alarms, not CloudWatch metrics.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/monitoring-create-alarms.html

https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-groups-configure-advanced-options.html

Domain

Domain 1: SDLC Automation

Question 58Skipped

The DevOps team at a geological hazard monitoring agency maintains an application that provides near real-time notifications to Android and iOS devices during tremors, volcanic eruptions and tsunamis. The team has created a CodePipeline pipeline, which consists of CodeCommit and CodeBuild, and the application is deployed on Elastic Beanstalk. The team would like to enable Blue/Green deployments for Beanstalk through CodePipeline.

As a DevOps Engineer, how would you implement a solution for this requirement?

Make CodePipeline deploy to the current Beanstalk environment using a rolling with additional batch strategy. Add a CodeDeploy stage action afterward to enable Blue / Green

Make CodePipeline deploy to a new Beanstalk environment. After that stage action, create another stage action to invoke a CloudFormation template that will perform a CNAME swap

Make CodePipeline deploy to the current Beanstalk environment using an immutable strategy. Add a CodeStar stage action afterward to enable Blue / Green configured through the template.yml file

Correct answer

Make CodePipeline deploy to a new Beanstalk environment. After that stage action, create another stage action to invoke a Custom Job using AWS Lambda, which will perform the API call to swap the CNAME of the environments

Overall explanation

Correct option:

Make CodePipeline deploy to a new Beanstalk environment. After that stage action, create another stage action to invoke a Custom Job using AWS Lambda, which will perform the API call to swap the CNAME of the environments

AWS Elastic Beanstalk makes it easier for developers to quickly deploy and manage applications in the AWS Cloud. Developers simply upload their application, and Elastic Beanstalk automatically handles the deployment details of capacity provisioning, load balancing, auto-scaling, and application health monitoring.

When an application is developed and deployed to an AWS Elastic Beanstalk environment, having two separate, but identical, environments — blue and green — increases availability and reduces risk. The blue environment is the production environment that normally handles live traffic. The CI/CD pipeline architecture creates a clone (green) of the live Elastic Beanstalk environment (blue). The pipeline then swaps the URLs between the two environments. While CodePipeline deploys application code to the original environment — and testing and maintenance take place — the temporary clone environment handles the live traffic. Once deployment to the blue environment is successful, and code review and code testing are done, the pipeline again swaps the URLs between the green and blue environments. The blue environment starts serving the live traffic again, and the pipeline terminates the green environment.

Blue-Green Deployments to AWS Elastic Beanstalk using Code Pipeline:

via - https://aws-quickstart.s3.amazonaws.com/quickstart-codepipeline-bluegreen-deployment/doc/blue-green-deployments-to-aws-elastic-beanstalk-on-the-aws-cloud.pdf

To perform Blue/Green in Elastic Beanstalk, you need to deploy to a new environment and do a CNAME swap. The CNAME swap feature is not supported by CloudFormation itself, therefore you need to create a custom Lambda function that will perform that API call for you and invoke it as part of a Custom Job in CodePipeline.

Incorrect options:

Make CodePipeline deploy to the current Beanstalk environment using a rolling with additional batch strategy. Add a CodeDeploy stage action afterward to enable Blue / Green

Make CodePipeline deploy to the current Beanstalk environment using an immutable strategy. Add a CodeStar stage action afterward to enable Blue / Green configured through the template.yml file

As explained above, to perform Blue/Green in Elastic Beanstalk, you need to deploy to a new environment and NOT to the current environment. So both these options are incorrect. You should also note that CodeStar is not a stage actor, it's a service that wraps up all CICD services from AWS into one simple UI to use as a developer.

Make CodePipeline deploy to a new Beanstalk environment. After that stage action, create another stage action to invoke a CloudFormation template that will perform a CNAME swap - As mentioned in the explanation above, The CNAME swap feature is not supported by CloudFormation itself, so this option is incorrect.

Reference:

https://aws-quickstart.s3.amazonaws.com/quickstart-codepipeline-bluegreen-deployment/doc/blue-green-deployments-to-aws-elastic-beanstalk-on-the-aws-cloud.pdf

Domain

Domain 1: SDLC Automation

Question 59Skipped

A data analytics company would like to create an automated solution to be alerted in case of EC2 instances being under-utilized for over 24 hours in order to save some costs. The solution should require a manual intervention of an operator validating the assessment before proceeding for instance termination.

As a DevOps Engineer, how would you implement a solution with the LEAST development effort?

Create a CloudWatch Event rule that triggers every 5 minutes and use a Lambda function as a target. The Lambda function should issue API calls to AWS CloudWatch Metrics and store the information in DynamoDB. Use a DynamoDB Stream to detect a stream of the low-utilized event for a period of 24 hours and trigger a Lambda function. The Lambda function should trigger an SSM Automation document with a manual approval step. Upon approval, the SSM document proceeds with the instance termination

Correct answer

Enable Trusted Advisor and ensure the check for low-utilized EC2 instances are on. Create a CloudWatch Event that tracks the events created by Trusted Advisor and use a Lambda Function as a target for that event. The Lambda function should trigger an SSM Automation document with a manual approval step. Upon approval, the SSM document proceeds with the instance termination

Enable Trusted Advisor and ensure the check for low-utilized EC2 instances are on. Connect Trusted Advisor to an SNS topic for that check and use a Lambda Function as a subscriber to the SNS topic. The Lambda function should trigger an SSM Automation document with a manual approval step. Upon approval, the SSM document proceeds with the instance termination

Create a CloudWatch Alarm tracking the minimal CPU utilization across all your EC2 instances. Connect the CloudWatch Alarm to an SNS topic and use the Lambda Function as a subscriber to the SNS topic. The Lambda function should trigger an SSM Automation document with a manual approval step. Upon approval, the SSM document proceeds with the instance termination

Overall explanation

Correct option:

Enable Trusted Advisor and ensure the check for low-utilized EC2 instances are on. Create a CloudWatch Event that tracks the events created by Trusted Advisor and use a Lambda Function as a target for that event. The Lambda function should trigger an SSM Automation document with a manual approval step. Upon approval, the SSM document proceeds with the instance termination

Trusted Advisor inspects your AWS infrastructure across all AWS Regions, and then presents a summary of check results. It recommends stopping or terminating EC2 instances with low utilization. You can also choose to scale your instances using Amazon EC2 Auto Scaling.

Trusted Advisor cost optimization check allows you to check EC2 instances that were running at any time during the last 14 days and alerts you if the daily CPU utilization was 10% or less and network I/O was 5 MB or less on 4 or more days. Running instances generate hourly usage charges. Estimated monthly savings are calculated by using the current usage rate for On-Demand Instances and the estimated number of days the instance might be underutilized.

You can use Amazon CloudWatch Events to detect and react to changes in the status of Trusted Advisor checks. Then, based on the rules that you create, CloudWatch Events invokes one or more target actions when a check status changes to the value you specify in a rule. Depending on the type of status change, you might want to send notifications, capture status information, take corrective action, initiate events, or take other actions. Finally, SSM Automation can have a manual approval step and terminate instances.

Monitoring Trusted Advisor check results with Amazon CloudWatch Events:

via - https://docs.aws.amazon.com/awssupport/latest/user/cloudwatch-events-ta.html

Sample CloudWatch Event for Trusted Advisor check for Low Utilization Amazon EC2 Instances:

{
"version": "0",
"id": "8dee56b0-b19f-441a-a05c-aa26e583c6c4",
"detail-type": "Trusted Advisor Check Item Refresh Notification",
"source": "aws.trustedadvisor",
"account": "123456789012",
"time": "2016-11-13T13:31:34Z",
"region": "us-east-1",
"resources": [],
"detail": {
"check-name": "Low Utilization Amazon EC2 Instances",
"check-item-detail": {
"Day 1": "0.0% 0.00MB",
"Day 2": "0.0% 0.00MB",
"Day 3": "0.0% 0.00MB",
"Region/AZ": "eu-central-1a",
"Estimated Monthly Savings": "$10.80",
"14-Day Average CPU Utilization": "0.0%",
"Day 14": "0.0% 0.00MB",
"Day 13": "0.0% 0.00MB",
"Day 12": "0.0% 0.00MB",
"Day 11": "0.0% 0.00MB",
"Day 10": "0.0% 0.00MB",
"14-Day Average Network I/O": "0.00MB",
"Number of Days Low Utilization": "14 days",
"Instance Type": "t2.micro",
"Instance ID": "i-917b1a5f",
"Day 8": "0.0% 0.00MB",
"Instance Name": null,
"Day 9": "0.0% 0.00MB",
"Day 4": "0.0% 0.00MB",
"Day 5": "0.0% 0.00MB",
"Day 6": "0.0% 0.00MB",
"Day 7": "0.0% 0.00MB"
},
"status": "WARN",
"resource_id": "arn:aws:ec2:eu-central-1:123456789012:instance/i-917b1a5f",
"uuid": "6ba6d96a-d3dd-4fca-8020-350bbee4719c"
}
}

Incorrect options:

Enable Trusted Advisor and ensure the check for low-utilized EC2 instances are on. Connect Trusted Advisor to an SNS topic for that check and use a Lambda Function as a subscriber to the SNS topic. The Lambda function should trigger an SSM Automation document with a manual approval step. Upon approval, the SSM document proceeds with the instance termination - As mentioned in the explanation above, you need to use CloudWatch Events to track the events for a particular rule and NOT SNS.

Create a CloudWatch Event rule that triggers every 5 minutes and use a Lambda function as a target. The Lambda function should issue API calls to AWS CloudWatch Metrics and store the information in DynamoDB. Use a DynamoDB Stream to detect a stream of the low-utilized event for a period of 24 hours and trigger a Lambda function. The Lambda function should trigger an SSM Automation document with a manual approval step. Upon approval, the SSM document proceeds with the instance termination - The workflow using Lambda as described in this option will involve significant development effort. Also, this option uses resources such as DynamoDB streams which are really not required to build a solution.

Create a CloudWatch Alarm tracking the minimal CPU utilization across all your EC2 instances. Connect the CloudWatch Alarm to an SNS topic and use the Lambda Function as a subscriber to the SNS topic. The Lambda function should trigger an SSM Automation document with a manual approval step. Upon approval, the SSM document proceeds with the instance termination - CloudWatch Alarm won't work as it won't allow you to track the CPU utilization of each individual instance if you create one aggregated one tracking the minimal CPU utilization. Side note, it'll be very expensive to create an Alarm for each EC2 instance as well.

References:

https://docs.aws.amazon.com/awssupport/latest/user/cloudwatch-events-ta.html

https://aws.amazon.com/premiumsupport/technology/trusted-advisor/best-practice-checklist/

Domain

Domain 6: Security and Compliance

Question 60Skipped

The DevOps team at your company is using CodeDeploy to deploy new versions of a Lambda function after it has passed a CodeBuild check via your CodePipeline. Before deploying, the CodePipeline has a step in which it optionally kickstarts a restructuring of files on an S3 bucket that is forward compatible. That restructuring is done using a Step Function execution which invokes a Fargate task. The new Lambda function cannot work until the restructuring task has fully completed.

As a DevOps Engineer, how can you ensure traffic isn't served to your new Lambda function until the task is completed?

Include an extra step in the Step Function to signal to CodeDeploy the completion of the restructuring and serve new traffic to the new Lambda function

Correct answer

In your appspec.yml file, include a BeforeAllowTraffic hook that checks on the completion of the Step Function execution

In your appspec.yml file, include an AfterAllowTraffic hook that checks on the completion of the Step Function execution

Enable Canary Deployment in CodeDeploy so that only a fraction of the service is served by the new Lambda function while the restructuring is happening

Overall explanation

Correct option:

In your appspec.yml file, include a BeforeAllowTraffic hook that checks on the completion of the Step Function execution

The AppSpec file is used to manage each deployment as a series of lifecycle event hooks, which are defined in the file. During deployment, the CodeDeploy agent looks up the name of the current event in the hooks section of the AppSpec file. If the event is not found, the CodeDeploy agent moves on to the next step. If the event is found, the CodeDeploy agent retrieves the list of scripts to execute. The scripts are run sequentially, in the order in which they appear in the file.

For AWS Lambda compute platform applications, the AppSpec file is used by CodeDeploy to determine:

Which Lambda function version to deploy.

Which Lambda functions to use as validation tests.

via - https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-example.html#appspec-file-example-lambda

via - https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html#appspec-hooks-lambda

The BeforeAllowTraffic hook is used to run tasks before traffic is shifted to the deployed Lambda function version. So for the given use-case, you can use this hook to check that the restructuring task has fully completed and then shift traffic to the newly deployed Lambda function version.

Incorrect options:

In your appspec.yml file, include an AfterAllowTraffic hook that checks on the completion of the Step Function execution - If you use an AfterAllowTraffic hook the new Lambda function will already serve traffic, so this option is incorrect.

Enable Canary Deployment in CodeDeploy so that only a fraction of the service is served by the new Lambda function while the restructuring is happening - Canary Deployments will send some traffic to the new Lambda function while the restructuring in S3 is still happening so that won't work.

Include an extra step in the Step Function to signal to CodeDeploy the completion of the restructuring and serve new traffic to the new Lambda function - There's no API to tell CodeDeploy to switch traffic to the new version of the Lambda function, therefore adding a step in your Step Function won't help.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-example.html#appspec-file-example-lambda

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html#appspec-hooks-lambda

Domain

Domain 1: SDLC Automation

Question 61Skipped

Your company has adopted a git repository technology to store and have version control on the application code. Your company would like to make sure the production branch of the code is deployed to the production environment, but also would like to enable other versions of the code to be deployed to the development and staging environments for performing various kinds of user acceptance testing.

As a DevOps Engineer, which solution would you implement for the given requirement?

Create a CodeCommit repository for the development code and create a CodePipeline pipeline that will deploy any changes to the master branch to the development and staging environment. Create a second CodeCommit repository and CodePipeline pipeline that will deploy changes from the production branch to the production environment after the code is merged through a pull request

Create a CodeCommit repository and create a CodePipeline pipeline that will deploy any changes to the master branch to the development and staging environment. Create a manual approval step after the deployment to staging to ensure the application is reviewed before being deployed to production in the last pipeline stage

Create a CodeCommit repository for the development code and create a CodePipeline pipeline that will deploy any changes to the master branch to the development and staging environment. Create a second CodeCommit repository and CodePipeline pipeline that will deploy changes from the production branch to the production environment after a manual approval step has happened in the first CodePipeline

Correct answer

Create a CodeCommit repository and create a CodePipeline pipeline that will deploy any changes to the master branch to the development and staging environment. Create a second CodePipeline pipeline that will deploy changes to the production branch to the production environment after the code is merged through a pull request

Overall explanation

Correct option:

Create a CodeCommit repository and create a CodePipeline pipeline that will deploy any changes to the master branch to the development and staging environment. Create a second CodePipeline pipeline that will deploy changes to the production branch to the production environment after the code is merged through a pull request

CodeCommit is a secure, highly scalable, managed source control service that makes it easier for teams to collaborate on code. A CICD pipeline helps you automate steps in your software delivery process, such as initiating automatic builds and then deploying to Amazon EC2 instances. You may use AWS CodePipeline, a service that builds, tests, and deploys your code every time there is a code change, based on the release process models you define to orchestrate each step in your release process.

via - https://aws.amazon.com/getting-started/projects/set-up-ci-cd-pipeline/

Here you only need one git repository and create a production branch for deploys to production. The other key requirement of the given use-case is that two versions of the code need to be deployed to different environments. As such, you will need two CodePipelines. If you had one with a manual approval step at the end, then the code deployed to production would be coming from the master branch instead of the production branch. Here, we specifically need code in the production branch to be deployed to production, so, therefore, we need a second CodePipeline and to merge code from master to production through Pull Requests.

Code Pipeline Overview:

via - https://aws.amazon.com/codepipeline/faqs/

Incorrect options:

Create a CodeCommit repository and create a CodePipeline pipeline that will deploy any changes to the master branch to the development and staging environment. Create a manual approval step after the deployment to staging to ensure the application is reviewed before being deployed to production in the last pipeline stage - As mentioned in the explanation above, a key requirement is that two versions of the code need to be deployed to different environments. If you use a manual approval step after the deployment to staging then the same version of the code from the master branch would also be deployed to the production environment. Instead, you need to maintain a production branch of the code that can be deployed to the production environment.

Create a CodeCommit repository for the development code and create a CodePipeline pipeline that will deploy any changes to the master branch to the development and staging environment. Create a second CodeCommit repository and CodePipeline pipeline that will deploy changes from the production branch to the production environment after the code is merged through a pull request - It's a best practice to work with branches in your git repository to create features, as it's the intended usage of branches. Don't create separate repositories for features. You should not maintain separate repositories to manage two versions of the code that need to be deployed to different environments. The reference to merging through a pull request has been added as a distractor.

Create a CodeCommit repository for the development code and create a CodePipeline pipeline that will deploy any changes to the master branch to the development and staging environment. Create a second CodeCommit repository and CodePipeline pipeline that will deploy changes from the production branch to the production environment after a manual approval step has happened in the first CodePipeline - It's a best practice to work with branches in your git repository to create features, as it's the intended usage of branches. Don't create separate repositories for features. You should not maintain separate repositories to manage two versions of the code that need to be deployed to different environments. The reference to the manual approval step has been added as a distractor.

References:

https://aws.amazon.com/codecommit/faqs/

https://aws.amazon.com/getting-started/projects/set-up-ci-cd-pipeline/

https://aws.amazon.com/codepipeline/faqs/

Domain

Domain 1: SDLC Automation

Question 62Skipped

An e-commerce company has deployed its flagship application in two Auto Scaling groups (ASGs) and two Application Load Balancers (ALBs). You have a Route 53 record that points to the ALB+ASG group where the application has been the most recently deployed. Deployments are alternating between the two groups, and every time a deployment happens it is done on the non-active ALB+ASG group. Finally, the Route53 record is updated. It turns out that some of your clients are not behaving correctly towards the DNS record and thus making requests to the inactive ALB+ASG group.

The company would like to improve this behavior at a minimal cost and also reduce the complexity of the solution. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution for this requirement. What of the following would you suggest?

Deploy the application to Elastic Beanstalk under two environments. To do a deployment, deploy to the older environment, then perform a CNAME swap

Change the TTL of the Route53 to 1 minute before doing a deployment. Do the deployment and then increase the TTL back to the old value

Correct answer

Remove one ALB and keep the two ASG. When new deployments happen, deploy to the older ASG, and then swap the target group in the ALB rule. Keep the Route53 record pointing to the ALB

Deploy a set of NGINX proxy onto each application instance so that if requests are made through the inactive ALB, they are proxied onto the correct ALB

Overall explanation

Correct option:

Remove one ALB and keep the two ASG. When new deployments happen, deploy to the older ASG, and then swap the target group in the ALB rule. Keep the Route53 record pointing to the ALB

An ALB distributes incoming application traffic across multiple targets, such as EC2 instances, in multiple Availability Zones. A listener checks for connection requests from clients, using the protocol and port that you configure. The rules that you define for a listener determine how the load balancer routes the requests to its registered targets. Each target group routes requests to one or more registered targets, such as EC2 instances, using the protocol and port number that you specify. You can register a target with multiple target groups.

via - https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html

The issue is because of using the second load balancer for the second application stack and then changing the DNS route to direct the traffic to the other stack when required. The correct solution is to replace only the infrastructure behind the load balancer. To summarize, we can migrate to one ALB only and then just use one target group at a time behind each ASG for correct routing. This will have the added benefit that we won't need to pre-warm each ALB at each deployment.

via - https://aws.amazon.com/blogs/aws/new-application-load-balancer-simplifies-deployment-with-weighted-target-groups/

Incorrect options:

Deploy a set of NGINX proxy onto each application instance so that if requests are made through the inactive ALB, they are proxied onto the correct ALB - Deploying an NGINX proxy will work but will be tedious to manage and will complicate the deployments.

Change the TTL of the Route53 to 1 minute before doing a deployment. Do the deployment and then increase the TTL back to the old value - Changing the TTL won't help as the clients are misbehaving already regarding the way they handle DNS records.

Deploy the application to Elastic Beanstalk under two environments. To do a deployment, deploy to the older environment, then perform a CNAME swap - Migrating to Elastic Beanstalk will not help either as CNAME swap is a DNS record change and clients do not seem to respect the DNS responses.

References:

https://aws.amazon.com/blogs/aws/new-application-load-balancer-simplifies-deployment-with-weighted-target-groups/

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html

Domain

Domain 3: Resilient Cloud Solutions

Question 63Skipped

A global financial services company manages over 100 accounts using AWS Organizations and it has recently come to light that several accounts and regions did not have AWS CloudTrail enabled. It also wants to be able to track the compliance of the CloudTrail enablement as a dashboard, and automatically be alerted in case of issues. The company has hired you as an AWS Certified DevOps Engineer Professional to build a solution for this requirement.

How would you go about implementing a solution for this use-case?

Correct answer

Create a CloudFormation template to enable CloudTrail. Create a StackSet and deploy that StackSet in all your accounts and regions under the AWS organization. Create another CloudFormation StackSet to enable AWS Config, and create a Config rule to track if CloudTrail is enabled. Create an AWS Config aggregator for a centralized account to track compliance. Create a CloudWatch Event to generate events when compliance is breached, and subscribe a Lambda function to it, that will send out notifications

Create a CloudFormation template to enable CloudTrail. Create a StackSet and deploy it in all your accounts and regions under the AWS organization. Create another StackSet to enable AWS Config, and create a Config rule to track if CloudTrail is enabled. Create an AWS Config aggregator for a centralized account to track compliance across all the other accounts. Create an SQS topic to get notifications when compliance is breached, and subscribe a Lambda function to it, that will send out these notifications

Create a CloudFormation template to enable CloudTrail. Create a StackSet and deploy that StackSet in all your accounts and regions under the AWS organization. Create one CloudFormation template in a centralized account to enable AWS Config, and create a Config rule to track if CloudTrail is enabled. Create an AWS Config aggregator for a centralized account to track compliance across all the other accounts. Create a CloudWatch Event to generate events when compliance is breached, and subscribe a Lambda function to it, that will send out notifications

Create a CloudFormation template to enable CloudTrail. Create a StackSet and deploy that StackSet in all your accounts and regions under the AWS organization. Create one CloudFormation template in a centralized account to enable AWS Config, and create a Config rule to track if CloudTrail is enabled. Create an AWS Config aggregator for a centralized account to track compliance across all the other accounts. Create an SNS topic to get notifications when compliance is breached, and subscribe a Lambda function to it, that will send out these notifications

Overall explanation

Correct option:

Create a CloudFormation template to enable CloudTrail. Create a StackSet and deploy that StackSet in all your accounts and regions under the AWS organization. Create another CloudFormation StackSet to enable AWS Config, and create a Config rule to track if CloudTrail is enabled. Create an AWS Config aggregator for a centralized account to track compliance. Create a CloudWatch Event to generate events when compliance is breached, and subscribe a Lambda function to it, that will send out notifications

CloudFormation StackSets extends the functionality of stacks by enabling you to create, update, or delete stacks across multiple accounts and regions with a single operation. Using an administrator account, you define and manage an AWS CloudFormation template, and use the template as the basis for provisioning stacks into selected target accounts across specified regions.

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html

An aggregator is an AWS Config resource type that collects AWS Config configuration and compliance data from the following:

Multiple accounts and multiple regions.

Single account and multiple regions.

An organization in AWS Organizations and all the accounts in that organization that have AWS Config enabled.

via - https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html

For the given use-case, we need to enable CloudTrail and AWS Config in all accounts and all regions. For this, we'll need separate StackSets to create CloudTrail and enable Config in all accounts and all regions. Note that we'll also need an AWS Config aggregator in a centralized account. Finally, compliance breaches would generate CloudWatch events that can be subscribed by a Lambda function to further send out notifications.

Incorrect options:

Create a CloudFormation template to enable CloudTrail. Create a StackSet and deploy that StackSet in all your accounts and regions under the AWS organization. Create one CloudFormation template in a centralized account to enable AWS Config, and create a Config rule to track if CloudTrail is enabled. Create an AWS Config aggregator for a centralized account to track compliance across all the other accounts. Create a CloudWatch Event to generate events when compliance is breached, and subscribe a Lambda function to it, that will send out notifications - The issue with this option is that CloudFormation template is being used only in a centralized account to enable AWS Config, whereas the correct solution must leverage a StackSet to enable Config in all accounts and all regions.

Create a CloudFormation template to enable CloudTrail. Create a StackSet and deploy that StackSet in all your accounts and regions under the AWS organization. Create one CloudFormation template in a centralized account to enable AWS Config, and create a Config rule to track if CloudTrail is enabled. Create an AWS Config aggregator for a centralized account to track compliance across all the other accounts. Create an SNS topic to get notifications when compliance is breached, and subscribe a Lambda function to it, that will send out these notifications - The issue with this option is that CloudFormation template is being used only in a centralized account to enable AWS Config, whereas the correct solution must leverage a StackSet to enable Config in all accounts and all regions.

Create a CloudFormation template to enable CloudTrail. Create a StackSet and deploy it in all your accounts and regions under the AWS organization. Create another StackSet to enable AWS Config, and create a Config rule to track if CloudTrail is enabled. Create an AWS Config aggregator for a centralized account to track compliance across all the other accounts. Create an SQS topic to get notifications when compliance is breached, and subscribe a Lambda function to it, that will send out these notifications - This option has been added as a distractor. There is no such thing as an SQS topic.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html

https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html

Domain

Domain 4: Monitoring and Logging

Question 64Skipped

The DevOps team at a presentation software company is deploying their flagship application using Elastic Beanstalk. The application is deployed using a Deploy stage in a CodePipeline pipeline. The technical requirements mandate changing the configuration of the Application Load Balancer tied to Elastic Beanstalk by adding an HTTP to HTTPS redirection rule.

As a DevOps Engineer, you don't have the permissions to directly edit the Elastic Beanstalk environment, how can you proceed?

Using the EB CLI, create a .elasticbeanstalk/saved_configs/config.yml, and specify the rules for the key aws:elbv2:listener:default. Run a deploy using the EB CLI from your computer onto the Elastic Beanstalk Environment

Create a file named .ebextensions/alb.config in your code repository and add a container_commands block for which you will specify a container command that will run in leader_only mode. The EC2 instance will issue an API call to the Load Balancer to add the redirection rule

Using the EB CLI, create a .elasticbeanstalk/saved_configs/config.yml, and specify the rules for the key aws:elbv2:listener:default. Configure CodePipeline to deploy to Elastic Beanstalk using the EB CLI and push the code

Correct answer

Create a file named .ebextensions/alb.config in your code repository and add an option_settings block for which you will specify the Rules for the key aws:elbv2:listener:default. Push your code and let the CodePipeline run

Overall explanation

Correct option:

Create a file named .ebextensions/alb.config in your code repository and add an option_settings block for which you will specify the Rules for the key aws:elbv2:listener:default. Push your code and let the CodePipeline run

You can use Elastic Beanstalk configuration files (.ebextensions) with your web application's source code to configure your environment and customize the AWS resources that it contains. Configuration files are YAML- or JSON-formatted documents with a .config file extension that you place in a folder named .ebextensions and deploy in your application source bundle. You can use the option_settings key to modify the environment configuration. You can choose from general options for all environments and platform-specific options.

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/ebextensions.html

Note: Recommended values are applied when you create or update an environment on the Elastic Beanstalk API by a client. For example, the client could be the AWS Management Console, Elastic Beanstalk Command Line Interface (EB CLI), AWS Command Line Interface (AWS CLI), or SDKs. Recommended values are directly set at the API level and have the highest precedence. The configuration setting applied at the API level can't be changed using option_settings, as the API has the highest precedence.

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options.html

Configuration changes made to your Elastic Beanstalk environment won't persist if you use the following configuration methods:

Configuring an Elastic Beanstalk resource directly from the console of a specific AWS service.

Installing a package, creating a file, or running a command directly from your Amazon EC2 instance.

For the given use-case, using a .ebextensions file and configuring the rules in the option_settings block is the right option.

Incorrect options:

Using the EB CLI, create a .elasticbeanstalk/saved_configs/config.yml, and specify the rules for the key aws:elbv2:listener:default. Configure CodePipeline to deploy to Elastic Beanstalk using the EB CLI and push the code - This option has been added as a distractor as you cannot configure CodePipeline to deploy using the EB CLI.

Using the EB CLI, create a .elasticbeanstalk/saved_configs/config.yml, and specify the rules for the key aws:elbv2:listener:default. Run a deploy using the EB CLI from your computer onto the Elastic Beanstalk Environment - Using the EB CLI on your computer would normally work, but here the question specifies that we don't have the necessary permissions to make direct changes against the Beanstalk environment. We, therefore, have to use CodePipeline.

Create a file named .ebextensions/alb.config in your code repository and add a container_commands block for which you will specify a container command that will run in leader_only mode. The EC2 instance will issue an API call to the Load Balancer to add the redirection rule - Using a container_command may work, but it wouldn't be best practice as the EC2 would issue a command to the ALB and therefore the configuration of it would be different from the one specified by Beanstalk itself, and the EC2 instance may not have enough permissions through IAM role to issue that command in the first place. So this option is incorrect.

References:

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/ebextensions.html

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options.html

Domain

Domain 2: Configuration Management and IaC

Question 65Skipped

The DevOps team at a business travel solutions company wants to use CodeDeploy to ensure zero downtime during deployments through rolling updates. The team wants to deploy the company's flagship web application on a set of 5 EC2 instances running behind an Application Load Balancer. The team would like the deployment to be gradual and to automatically rollback in case of a failed deployment, which is determined by the application not being able to pass health checks.

As a DevOps Engineer, which of the following options would you recommend for the given use-case?

In the AfterInstall hook in appspec.yml, verify the service is properly running. Configure CodeDeploy to rollback on deployment failures. In case the hook fails, then CodeDeploy will rollback

Correct answer

In the ValidateService hook in appspec.yml, verify the service is properly running. Configure CodeDeploy to rollback on deployment failures. In case the hook fails, then CodeDeploy will rollback

Create a CloudWatch Event rule on CodeDeploy to invoke a Lambda function upon deployment on every instance. The Lambda function tests the health check, and if it fails, stops the CodeDeploy deployment using the StopDeployment API, and then start a new deployment of the old version using the CreateDeployment API

Integrate CodeDeploy with the Application Load Balancer. In case the Application Load Balancers fails the health checks on the instances where the new version has been deployed, it will notify CodeDeploy. Configure CodeDeploy to rollback on deployment failures

Overall explanation

Correct option:

In the ValidateService hook in appspec.yml, verify the service is properly running. Configure CodeDeploy to rollback on deployment failures. In case the hook fails, then CodeDeploy will rollback

CodeDeploy is a fully managed deployment service that automates software deployments to a variety of compute services such as Amazon EC2, AWS Fargate, AWS Lambda, and your on-premises servers. AWS CodeDeploy makes it easier for you to rapidly release new features, helps you avoid downtime during deployment, and handles the complexity of updating your applications.

The AppSpec file is used to manage each deployment as a series of lifecycle event hooks, which are defined in the file. During deployment, the CodeDeploy agent looks up the name of the current event in the hooks section of the AppSpec file. If the event is not found, the CodeDeploy agent moves on to the next step. If the event is found, the CodeDeploy agent retrieves the list of scripts to execute. The scripts are run sequentially, in the order in which they appear in the file.

Sample appspec file:

via - https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file.html

List of Lifecycle Event hooks for EC2 deployment:

via - https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html

Lifecycle Event hooks availability for EC2 deployment and rollback scenarios:

via - https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html

For the given use-case, you can use ValidateService hook to verify that the deployment was completed successfully. This is the last deployment lifecycle event. You can configure CodeDeploy to rollback if this hook fails.

Incorrect options:

Integrate CodeDeploy with the Application Load Balancer. In case the Application Load Balancers fails the health checks on the instances where the new version has been deployed, it will notify CodeDeploy. Configure CodeDeploy to rollback on deployment failures - Integrating CodeDeploy with the Application Load Balancer will ensure traffic isn't forwarded to the instances that CodeDeploy is currently deploying to, but the health check feature is not integrated with CodeDeploy and therefore you cannot rollback when the Application Load Balancers fails the health check.

In the AfterInstall hook in appspec.yml, verify the service is properly running. Configure CodeDeploy to rollback on deployment failures. In case the hook fails, then CodeDeploy will rollback - The AfterInstall hook in appspec.yml is before StartApplication and therefore won't be able to test the application's health checks. You can use the AfterInstall hook for tasks such as configuring your application or changing file permissions.

Create a CloudWatch Event rule on CodeDeploy to invoke a Lambda function upon deployment on every instance. The Lambda function tests the health check, and if it fails, stops the CodeDeploy deployment using the StopDeployment API, and then start a new deployment of the old version using the CreateDeployment API - The CloudWatch Event rule won't work as it is not granular at each instance's level, and CodeDeploy has a native feature for doing rollbacks, instead of doing API calls via StopDeployment and CreateDeployment.

References:

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file.html

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html

Domain

Domain 1: SDLC Automation

Question 66Skipped

A media streaming solutions company has deployed an application that allows its customers to view movies in real-time. The application connects to an Amazon Aurora database, and the entire stack is currently deployed in the United States. The company has plans to expand to Europe and Asia for its operations. It needs the movies table to be accessible globally but needs the users and movies_watched table to be regional only.

As a DevOps Engineer, how would you implement this with minimal application refactoring?

Use an Amazon Aurora Global Database for the movies table and use DynamoDB for the users and movies_watched tables

Correct answer

Use an Amazon Aurora Global Database for the movies table and use Amazon Aurora for the users and movies_watched tables

Use a DynamoDB Global Table for the movies table and use Amazon Aurora for the users and movies_watched tables

Use a DynamoDB Global Table for the movies table and use DynamoDB for the users and movies_watched tables

Overall explanation

Correct option:

Use an Amazon Aurora Global Database for the movies table and use Amazon Aurora for the users and movies_watched tables

Amazon Aurora is a MySQL and PostgreSQL-compatible relational database built for the cloud, that combines the performance and availability of traditional enterprise databases with the simplicity and cost-effectiveness of open source databases. Amazon Aurora features a distributed, fault-tolerant, self-healing storage system that auto-scales up to 64TB per database instance. Aurora is not an in-memory database.

Amazon Aurora Global Database is designed for globally distributed applications, allowing a single Amazon Aurora database to span multiple AWS regions. It replicates your data with no impact on database performance, enables fast local reads with low latency in each region, and provides disaster recovery from region-wide outages. Amazon Aurora Global Database is the correct choice for the given use-case.

For the given use-case, we, therefore, need to have two Aurora clusters, one for the global table (movies table) and the other one for the local tables (users and movies_watched tables).

Incorrect options:

Use an Amazon Aurora Global Database for the movies table and use DynamoDB for the users and movies_watched tables

Use a DynamoDB Global Table for the movies table and use Amazon Aurora for the users and movies_watched tables

Use a DynamoDB Global Table for the movies table and use DynamoDB for the users and movies_watched tables

Here, we want minimal application refactoring. DynamoDB and Aurora have a completely different API, due to Aurora being SQL and DynamoDB being NoSQL. So all three options are incorrect, as they have DynamoDB as one of the components.

Reference:

https://aws.amazon.com/rds/aurora/faqs/

Domain

Domain 3: Resilient Cloud Solutions

Question 67Skipped

As part of your CodePipeline, you are running multiple test suites. Two are bundled as Docker containers and run directly on CodeBuild, while another one runs as a Lambda function executing Python code. All these test suites are based on HTTP requests and upon analyzing, these are found to be network bound, not CPU bound. Right now, the CodePipeline takes a long time to execute as these actions happen one after the other. They prevent the company from adding further tests. The whole pipeline is managed by CloudFormation.

As a DevOps Engineer, which of the following would you recommend improving the completion time of your pipeline?

Correct answer

Change the runOrder of your actions so that they have the same value

Enable CloudFormation StackSets to run the actions in parallel

Increase the number of vCPU assigned to the CodeBuild builds and the RAM assigned to your Lambda function

Migrate all the test suites to Jenkins and use the ECS plugin

Overall explanation

Correct option:

Change the runOrder of your actions so that they have the same value

AWS CodePipeline is a continuous delivery service that enables you to model, visualize, and automate the steps required to release your software. With AWS CodePipeline, you model the full release process for building your code, deploying to pre-production environments, testing your application and releasing it to production.

via - https://docs.aws.amazon.com/codepipeline/latest/userguide/welcome-introducing.html

The pipeline structure format is used to build actions and stages in a pipeline. An action type consists of an action category and provider type. Valid action providers for each action category:

via - https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html

You can use the runOrder to specify parallel actions and use the same integer for each action you want to run in parallel. The default runOrder value for an action is 1. The value must be a positive integer (natural number). You cannot use fractions, decimals, negative numbers, or zero. Here, you need to specify a common runOrder value in your CloudFormation template so that all the stage actions happen in parallel.

via - https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html

Incorrect options:

Increase the number of vCPU assigned to the CodeBuild builds and the RAM assigned to your Lambda function - As the test suites are HTTP and network-bound, increasing the RAM for Lambda and vCPU capacity of CodeBuild won't affect the performance (the bottleneck remains the network latency between each HTTP calls).

Enable CloudFormation StackSets to run the actions in parallel - CloudFormation StackSets extends the functionality of stacks by enabling you to create, update, or delete stacks across multiple accounts and regions with a single operation.

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html

CloudFormation StackSets is a distractor here, as they do not enable parallel actions.

Migrate all the test suites to Jenkins and use the ECS plugin - Migrating to Jenkins also would not solve the problem, as the test suites would still happen sequentially.

References:

https://docs.aws.amazon.com/codepipeline/latest/userguide/welcome-introducing.html

https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html

Domain

Domain 1: SDLC Automation

Question 68Skipped

The engineering team at a multi-national retail company is deploying its flagship web application onto an Auto Scaling Group (ASG) using CodeDeploy. The team has chosen a strategy of a rolling update so that instances are updated in small batches in the ASG. At the end of the deployment, the ASG has five instances running. It seems that three instances are running the new version of the application, while the other two are running the old version. CodeDeploy is reporting a successful deployment.

As a DevOps Engineer, what is the most likely reason that you would attribute for this issue?

The auto-scaling group launch configuration has not been updated

A CloudWatch alarm has been triggered during the deployment

Correct answer

Two new instances were created during the deployment due to an Auto Scaling scale out event

Two instances are having an IAM permissions issue and cannot download the new code revision from S3

Overall explanation

Correct option:

Two new instances were created during the deployment due to an Auto Scaling scale out event

If an Amazon EC2 Auto Scaling scale-up event occurs while a deployment is underway, the new instances will be updated with the application revision that was most recently deployed, not the application revision that is currently being deployed. If the deployment succeeds, the old instances and the newly scaled-up instances will be hosting different application revisions.

via - https://docs.aws.amazon.com/codedeploy/latest/userguide/integrations-aws-auto-scaling.html#integrations-aws-auto-scaling-behaviors

To resolve this problem after it occurs, you can redeploy the newer application revision to the affected deployment groups.

To avoid this issue, AWS recommends suspending the Amazon EC2 Auto Scaling scale-up processes while deployments are taking place (Only the CodeDeployDefault.OneAtATime deployment configuration supports this functionality). You can do this through a setting in the common_functions.sh script that is used for load balancing with CodeDeploy. If HANDLE_PROCS=true, the following Amazon EC2 Auto Scaling events are suspended automatically during the deployment process:

AZRebalance

AlarmNotification

ScheduledActions

ReplaceUnhealthy

Incorrect options:

Two instances are having an IAM permissions issue and cannot download the new code revision from S3 - IAM permissions issue would result in the overall deployment status being returned as a failure, but CodeDeploy does report the status as a success. This option is just a distractor.

The auto-scaling group launch configuration has not been updated - Launch configuration would affect all instances in the same way and not just 2 instances. So this option is incorrect.

A CloudWatch alarm has been triggered during the deployment - This is another distractor added to the mix of options. CloudWatch alarm would have no bearing on the version of the CodeDeploy application deployed to the instances.

Reference:

https://docs.aws.amazon.com/codedeploy/latest/userguide/integrations-aws-auto-scaling.html#integrations-aws-auto-scaling-behaviors

Domain

Domain 5: Incident and Event Response

Question 69Skipped

A Big Data analytics company has deployed a stream processing application using KCL to read records from Kinesis Data Streams configured with multiple shards. The application is running on one EC2 instance. It seems that the consuming application is lagging under a large load and therefore records are not processed in time and eventually dropped from the stream.

As a DevOps Engineer, you have been tasked with improving the reliability of this application with minimal changes, what should you do? (Select two)

Correct selection

Increase the stream data retention period

Migrate the application to AWS Lambda

Decrease the numbers of shards in Kinesis to decrease the load

Correct selection

Run the application in an Auto Scaling Group and scale based on the CloudWatch Metric MillisBehindLatest

Increase the number of shards in Kinesis to increase throughput

Overall explanation

Correct options:

Run the application in an Auto Scaling Group and scale based on the CloudWatch Metric MillisBehindLatest

In a typical Kinesis Data Streams architecture, you have producers that continually push data to Kinesis Data Streams, and the consumers process the data in real-time. Consumers (such as a custom application running on Amazon EC2 or an Amazon Kinesis Data Firehose delivery stream) can store their results using an AWS service such as Amazon DynamoDB, Amazon Redshift, or Amazon S3.

via - https://docs.aws.amazon.com/streams/latest/dev/key-concepts.html

Key concepts for Kinesis Data Streams:

via - https://docs.aws.amazon.com/streams/latest/dev/key-concepts.html

The Kinesis Client Library (KCL) ensures that for every shard, there is a record processor running and processing that shard. The library also simplifies reading data from the stream. The Kinesis Client Library uses an Amazon DynamoDB table to store control data.

For the given use-case, you need to run KCL on multiple EC2 instances behind an ASG. Running more KCL processes is the key here, and we need for that to have an Auto Scaling Group based on the metric MillisBehindLatest, which represents the time that the current iterator is behind from the latest record (tip) in the shard. The Kinesis Client Library (KCL) for Amazon Kinesis Data Streams publishes custom Amazon CloudWatch metrics on your behalf, using the name of your KCL application as the namespace.

via - https://docs.aws.amazon.com/streams/latest/dev/monitoring-with-kcl.html

Increase the stream data retention period

The retention period is the length of time that data records are accessible after they are added to the stream. A stream’s retention period is set to a default of 24 hours after creation. To avoid records being dropped, it's good to increase the stream retention time and allow ourselves a higher margin to process the records. The maximum retention you can set is 7 days.

Incorrect options:

Migrate the application to AWS Lambda - Migrating the application to AWS Lambda will not help with the processing time, as eventually, the same processing code would run under EC2 or Lambda.

Increase the number of shards in Kinesis to increase throughput - Increasing the number of shards in Kinesis can increase the total throughput of the stream, but this does not impact the processing performance of your processes (which is bound by what you do with the messages). Increasing the number of shards though would help you increase the number of processing processes in KCL if that was already an upper bound (but currently we only have one KCL process running so it's not running at capacity).

Decrease the numbers of shards in Kinesis to decrease the load - Decrease the number of shards would decrease the throughput but again would have no effect on processing applications regarding their performance.

References:

https://docs.aws.amazon.com/streams/latest/dev/key-concepts.html

https://docs.aws.amazon.com/streams/latest/dev/monitoring-with-kcl.html

Domain

Domain 5: Incident and Event Response

Question 70Skipped

The technology team at a health-care solutions company has developed a REST API which is deployed in an Auto Scaling Group behind an Application Load Balancer. The API stores the data payload in DynamoDB and the static content is served through S3. Upon doing some analytics, it's found that 85% of the read requests are shared across all users.

As a DevOps Engineer, how can you improve the application performance while decreasing the cost?

Enable ElastiCache Redis for DynamoDB and CloudFront for S3

Enable DAX for DynamoDB and ElastiCache Memcached for S3

Enable ElastiCache Redis for DynamoDB and ElastiCache Memcached for S3

Correct answer

Enable DynamoDB Accelerator (DAX) for DynamoDB and CloudFront for S3

Overall explanation

Correct option:

Enable DynamoDB Accelerator (DAX) for DynamoDB and CloudFront for S3

DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache for Amazon DynamoDB that delivers up to a 10 times performance improvement—from milliseconds to microseconds—even at millions of requests per second.

DAX is tightly integrated with DynamoDB—you simply provision a DAX cluster, use the DAX client SDK to point your existing DynamoDB API calls at the DAX cluster, and let DAX handle the rest. Because DAX is API-compatible with DynamoDB, you don't have to make any functional application code changes. DAX is used to natively cache DynamoDB reads.

CloudFront is a content delivery network (CDN) service that delivers static and dynamic web content, video streams, and APIs around the world, securely and at scale. By design, delivering data out of CloudFront can be more cost-effective than delivering it from S3 directly to your users.

When a user requests content that you serve with CloudFront, their request is routed to a nearby Edge Location. If CloudFront has a cached copy of the requested file, CloudFront delivers it to the user, providing a fast (low-latency) response. If the file they’ve requested isn’t yet cached, CloudFront retrieves it from your origin – for example, the S3 bucket where you’ve stored your content.

So, you can use CloudFront to improve application performance to serve static content from S3.

Incorrect options:

Enable ElastiCache Redis for DynamoDB and CloudFront for S3

Amazon ElastiCache for Redis is a blazing fast in-memory data store that provides sub-millisecond latency to power internet-scale real-time applications. Amazon ElastiCache for Redis is a great choice for real-time transactional and analytical processing use cases such as caching, chat/messaging, gaming leaderboards, geospatial, machine learning, media streaming, queues, real-time analytics, and session store.

ElastiCache for Redis Overview:

via - https://aws.amazon.com/elasticache/redis/

Although, you can integrate Redis with DynamoDB, it's much more involved than using DAX which is a much better fit.

Enable DAX for DynamoDB and ElastiCache Memcached for S3

Enable ElastiCache Redis for DynamoDB and ElastiCache Memcached for S3

Amazon ElastiCache for Memcached is a Memcached-compatible in-memory key-value store service that can be used as a cache or a data store. Amazon ElastiCache for Memcached is a great choice for implementing an in-memory cache to decrease access latency, increase throughput, and ease the load off your relational or NoSQL database.

ElastiCache cannot be used as a cache to serve static content from S3, so both these options are incorrect.

References:

https://aws.amazon.com/dynamodb/dax/

https://aws.amazon.com/blogs/networking-and-content-delivery/amazon-s3-amazon-cloudfront-a-match-made-in-the-cloud/

https://aws.amazon.com/elasticache/redis/

Domain

Domain 3: Resilient Cloud Solutions

Question 71Skipped

The compliance department at a Wall Street trading firm has hired you as an AWS Certified DevOps Engineer Professional to help with several strategic DevOps initiatives. The department has asked you to regularly generate the list of all the software packages installed on the EC2 instances. The solution needs to be able to extend to future instances in the AWS account and send notifications if the instances are not set up correctly to track their software.

Which of the following options are the best-fit solutions that require the least effort to meet the given requirements? (Select two)

Correct selection

Create a CloudWatch Event rule to trigger a Lambda function on an hourly basis. Do a comparison of the instances that are running in EC2 and those tracked by SSM

Use an SSM Run Command to have the SSM service find which instances are not currently tracked by SSM

Use AWS Inspector to track the installed package list on your EC2 instances. Visualize the metadata directly in the AWS Inspector Insights console

Correct selection

Install the SSM agent on the instances. Run an SSM Inventory to collect the metadata and send them to Amazon S3

Install the SSM agent on the instances. Run an SSM Automation during maintenance windows to get the list of all the packages using yum list installed. Write the output to Amazon S3

Overall explanation

Correct options:

Install the SSM agent on the instances. Run an SSM Inventory to collect the metadata and send them to Amazon S3

SSM Agent is an Amazon software that can be installed and configured on an EC2 instance, an on-premises server, or a virtual machine (VM). SSM Agent makes it possible for Systems Manager to update, manage, and configure these resources. The agent processes requests from the Systems Manager service in the AWS Cloud, and then run them as specified in the request. SSM Agent then sends status and execution information back to the Systems Manager service by using the Amazon Message Delivery Service (service prefix: ec2messages).

SSM Inventory provides visibility into your Amazon EC2 and on-premises computing environment. You can use Inventory to collect metadata from your managed instances. You can store this metadata in a central Amazon Simple Storage Service (Amazon S3) bucket, and then use built-in tools to query the data and quickly determine which instances are running the software and configurations required by your software policy, and which instances need to be updated.

Sample Inventory Cards:

via - https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-inventory.html

Create a CloudWatch Event rule to trigger a Lambda function on an hourly basis. Do a comparison of the instances that are running in EC2 and those tracked by SSM

Since SSM does not have any native capability to find out which instances are not currently tracked by it, so here we would need to create a custom Lambda function for this and send notifications if any new untracked instances are detected. We can trigger the Lambda function using CloudWatch Events.

Incorrect options:

Use an SSM Run Command to have the SSM service find which instances are not currently tracked by SSM - SSM does not have any native capability to find out which instances are not currently tracked by the SSM service.

Install the SSM agent on the instances. Run an SSM Automation during maintenance windows to get the list of all the packages using yum list installed. Write the output to Amazon S3 - You can use SSM Automation to build Automation workflows to configure and manage instances and AWS resources. You can also create custom workflows or use pre-defined workflows maintained by AWS. For the given requirement, SSM Automation could be used to get the list of packages but it would require a lot of manual work, so it is not the best fit for the given use-case.

Use AWS Inspector to track the installed package list on your EC2 instances. Visualize the metadata directly in the AWS Inspector Insights console - Inspector is meant to find security vulnerabilities on EC2 instances, not to get a metadata list of your installed packages.

References:

https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-inventory.html

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html

Domain

Domain 4: Monitoring and Logging

Question 72Skipped

The DevOps team at a leading travel-booking services company is using a CloudFormation template to deploy a Lambda function. The Lambda function code is uploaded into S3 into a file named s3://my-bucket/my-lambda-code.zip by CodePipeline after having passed all the required build checks. CodePipeline then invokes the CloudFormation template to deploy the new code. The team has found that although the CloudFormation template successfully runs, the Lambda function is not updated.

As a DevOps Engineer, what can you do to quickly fix this issue? (Select three)

Add a pause of 3 seconds before starting the CloudFormation job. This is an eventual consistency issue due to overwriting PUT

Correct selection

Enable S3 versioning and provide an S3ObjectVersion key

Correct selection

Upload the code every time to a new S3 bucket

Enable the SAM Framework option

Correct selection

Upload the code every time with a new filename in the same bucket

Clear the Lambda cache with a Custom Job in CodePipeline before the CloudFormation step

Overall explanation

Correct options:

Upload the code every time to a new S3 bucket

Upload the code every time with a new filename in the same bucket

Enable S3 versioning and provide an S3ObjectVersion key

You can use CloudFormation to deploy and update compute, database, and many other resources in a simple, declarative style that abstracts away the complexity of specific resource APIs. CloudFormation is designed to allow resource lifecycles to be managed repeatably, predictably, and safely, while allowing for automatic rollbacks, automated state management, and management of resources across accounts and regions.

via - https://aws.amazon.com/cloudformation/

Here, the issue is that CloudFormation does not detect a new file has been uploaded to S3 unless one of these parameters change: - S3Bucket - S3Key - S3ObjectVersion

Changes to a deployment package in Amazon S3 are not detected automatically during stack updates. To update the function code, you need to change the object key or version in the template.

via - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-code.html

Incorrect options:

Clear the Lambda cache with a Custom Job in CodePipeline before the CloudFormation step - This option has been added as a distractor as there's no such thing as a Lambda cache.

Add a pause of 3 seconds before starting the CloudFormation job. This is an eventual consistency issue due to overwriting PUT - This option has been added as a distractor as there's no such thing as an eventual consistency for CloudFormation.

Enable the SAM Framework option - The AWS Serverless Application Model (AWS SAM) is an open-source framework for building serverless applications. It provides shorthand syntax to express functions, APIs, databases, and event source mappings. You define the application you want with just a few lines per resource and model it using YAML. Enabling SAM would require a re-write of the template, which won't be quick.

References:

https://aws.amazon.com/cloudformation/

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-code.html

Domain

Domain 2: Configuration Management and IaC

Question 73Skipped

The DevOps team at a financial services company is deploying the flagship application in highly available mode using Elastic Beanstalk which has created an ASG and an ALB. The team has also specified a .ebextensions file to create an associated DynamoDB table. As a DevOps Engineer in the team, you would like to perform an update to the application but you need to make sure the DNS name won't change and that no new resources will be created. The application needs to remain available during the update.

Which of the following options would you suggest to address the given requirements?

Use in-place

Correct answer

Use a rolling update with 20% at a time

Use immutable

Use a blue/green deployment and swap CNAMEs

Overall explanation

Correct option:

Use a rolling update with 20% at a time

AWS Elastic Beanstalk provides several options for how deployments are processed, including deployment policies (All at once, Rolling, Rolling with additional batch, Immutable, and Traffic splitting) and options that let you configure the batch size and health check behavior during deployments. By default, your environment uses all-at-once deployments. If you created the environment with the EB CLI and it's a scalable environment (you didn't specify the --single option), it uses rolling deployments.

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.deploy-existing-version.html

Comparison of deployment method properties:

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.deploy-existing-version.html

With rolling deployments, Elastic Beanstalk splits the environment's Amazon EC2 instances into batches (for this requirement, we shall use a batch with 20% of the instances) and deploys the new version of the application to one batch at a time. It leaves the rest of the instances in the environment running the old version of the application. During a rolling deployment, some instances serve requests with the old version of the application, while instances in completed batches serve other requests with the new version. Therefore, for the given use-case, we should use a rolling update, which will keep our ASG, our instances, and ensure our application can still serve traffic.

via - https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.rolling-version-deploy.html

Incorrect options:

Use a blue/green deployment and swap CNAMEs - In a blue/green deployment, you deploy the new version to a separate environment, and then swap CNAMEs of the two environments to redirect traffic to the new version instantly. A blue/green deployment would create a new load balancer and ASG, but the CNAME swap would allow us to keep the same DNS name. So it does not meet the requirements for the given use-case.

Use immutable - Immutable deployments perform an immutable update to launch a full set of new instances running the new version of the application in a separate Auto Scaling group, alongside the instances running the old version. So this option does not meet the requirements for the given use-case.

Use in-place - In-place would not work even though it doesn't create any new resources because your application will be unavailable as all your instances will be updated at the same time.

References:

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.deploy-existing-version.html

https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.rolling-version-deploy.html

Domain

Domain 2: Configuration Management and IaC

Question 74Skipped

A retail company uses the open-source tool Jenkins on its on-premise infrastructure to perform CICD. It has decided to move to AWS and take advantage of the elasticity properties of the cloud provider to have more efficient workloads. It needs to ensure the Jenkins setup is highly available, fault-tolerant and also elastic to perform builds. The company has hired you as an AWS Certified DevOps Engineer Professional to build the most cost-effective solution for this requirement.

Which of the following solutions would you recommend?

Deploy Jenkins as a multi-master setup across multiple AZ. Create an Auto Scaling Group made of EC2 instances that are Jenkins slave. Configure Jenkins to launch build on these slaves

Deploy Jenkins as a multi-master setup across one AZ, managed by an Auto Scaling Group. Configure Jenkins to launch build on these slaves

Correct answer

Deploy Jenkins as a multi-master setup across multiple AZ. Enable the CodeBuild Plugin for Jenkins so that builds are launched as CodeBuild builds

Deploy Jenkins as a multi-master setup across one AZ, managed by an Auto Scaling Group. Enable the CodeBuild Plugin for Jenkins so that builds are launched as CodeBuild builds

Overall explanation

Correct option:

Deploy Jenkins as a multi-master setup across multiple AZ. Enable the CodeBuild Plugin for Jenkins so that builds are launched as CodeBuild builds

In the AWS Cloud, a web-accessible application like Jenkins is typically designed for high availability and fault tolerance by spreading instances across multiple AZs and fronting them with an Elastic Load Balancing (ELB) load balancer. Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances in the cloud. It enables you to achieve greater levels of fault tolerance in your applications and seamlessly provides the required amount of load balancing capacity needed to distribute application traffic. If your business requirements demand a fault-tolerant Jenkins environment, your preferred setup might be a scenario in which multiple masters with their own workers are placed in separate Availability Zones.

You can use the Jenkins plugin for AWS CodeBuild to integrate CodeBuild with your Jenkins build jobs. Instead of sending your build jobs to Jenkins build nodes, you use the plugin to send your build jobs to CodeBuild. This eliminates the need for you to provision, configure, and manage Jenkins build nodes.

via - https://aws.amazon.com/blogs/devops/setting-up-a-ci-cd-pipeline-by-integrating-jenkins-with-aws-codebuild-and-aws-codedeploy/

For the given use-case, Jenkins must be deployed as a multi-master across multi-AZ to be highly available and fault-tolerant. The Jenkins CodeBuild plugin allows to elastically start CodeBuild builds that run a special docker image that works as a Jenkins slave. It allows you to be fully elastic in the cloud with Jenkins, and only pay exactly for the resources you have used.

Incorrect options:

Deploy Jenkins as a multi-master setup across one AZ, managed by an Auto Scaling Group. Enable the CodeBuild Plugin for Jenkins so that builds are launched as CodeBuild builds

Deploy Jenkins as a multi-master setup across multiple AZ. Create an Auto Scaling Group made of EC2 instances that are Jenkins slave. Configure Jenkins to launch build on these slaves

Deploy Jenkins as a multi-master setup across one AZ, managed by an Auto Scaling Group. Configure Jenkins to launch build on these slaves

As mentioned in the explanation above, if configured with EC2 instances in an Auto Scaling Group, the setup will be elastic in some ways, but probably expensive if the EC2 instances are not fully utilized at capacity. So these three options are not the best fit for the given use-case.

References:

https://aws.amazon.com/blogs/devops/setting-up-a-ci-cd-pipeline-by-integrating-jenkins-with-aws-codebuild-and-aws-codedeploy/

https://docs.aws.amazon.com/codebuild/latest/userguide/jenkins-plugin.html

https://d1.awsstatic.com/whitepapers/DevOps/Jenkins_on_AWS.pdf

Domain

Domain 1: SDLC Automation

Question 75Skipped

A cyber forensics company would like to ensure that CloudTrail is always enabled in its AWS account. It also needs to have an audit trail of the status for CloudTrail. In the case of compliance breaches, the company would like to automatically resolve them.

As a DevOps Engineer, how can you implement a solution for this requirement?

Correct answer

Create an AWS Config rule to track if CloudTrail is enabled. Create a CloudWatch Event rule to get alerted in case of breaches, and trigger a Lambda function that will re-enable CloudTrail

Place all your AWS IAM users under an IAM group named 'everyone'. Create an IAM deny policy on that group to prevent users from using the DeleteTrail API. Create an AWS Config rule that tracks if every user is in that IAM group. Create a CloudWatch Event rule to get alerted in case of breaches, and trigger a Lambda function that will add users to the 'everyone' group automatically

Place all your AWS IAM users under an IAM group named 'everyone'. Create an IAM deny policy on that group to prevent users from using the DeleteTrail API. Create a CloudWatch Event rule that will trigger a Lambda function every 5 minutes. That Lambda function will check if CloudTrail is enabled using an API call and enable it back if necessary

Create a CloudWatch Event rule that will trigger a Lambda function every 5 minutes. That Lambda function will check if CloudTrail is enabled using an API call and enable it back if necessary

Overall explanation

Correct option:

Create an AWS Config rule to track if CloudTrail is enabled. Create a CloudWatch Event rule to get alerted in case of breaches, and trigger a Lambda function that will re-enable CloudTrail

CloudTrail provides visibility into user activity by recording actions taken on your account. CloudTrail records important information about each action, including who made the request, the services used, the actions performed, parameters for the actions, and the response elements returned by the AWS service. This information helps you to track changes made to your AWS resources and to troubleshoot operational issues.

via - https://aws.amazon.com/cloudtrail/

AWS Config is a fully managed service that provides you with an AWS resource inventory, configuration history, and configuration change notifications to enable security and governance. With AWS Config you can discover existing AWS resources, export a complete inventory of your AWS resources with all configuration details, and determine how a resource was configured at any point in time.

via - https://aws.amazon.com/config/

via - https://aws.amazon.com/config/faq/

You need to have an AWS Config rule to maintain auditability and track compliance over time. You can use the cloudtrail-enabled Config managed rule to check whether AWS CloudTrail is enabled in your AWS account. You can use cloudtrail-security-trail-enabled Config managed rules to check that there is at least one AWS CloudTrail trail defined with security best practices. To be alerted of compliance issues, use a CloudWatch Event rule and then hook it to a Lambda function that will re-enable CloudTrail automatically.

via - https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-enabled.html

via - https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-security-trail-enabled.html

Incorrect options:

Place all your AWS IAM users under an IAM group named 'everyone'. Create an IAM deny policy on that group to prevent users from using the DeleteTrail API. Create an AWS Config rule that tracks if every user is in that IAM group. Create a CloudWatch Event rule to get alerted in case of breaches, and trigger a Lambda function that will add users to the 'everyone' group automatically

Place all your AWS IAM users under an IAM group named 'everyone'. Create an IAM deny policy on that group to prevent users from using the DeleteTrail API. Create a CloudWatch Event rule that will trigger a Lambda function every 5 minutes. That Lambda function will check if CloudTrail is enabled using an API call and enable it back if necessary

IAM users in a group with a deny policy sounds like a great idea at first, but then you have to remember you can create IAM roles, and they won't have that restriction, and as such you will be able to assume these roles and then issue API calls on CloudTrail to de-activate it. This solution won't work and therefore both these options are incorrect.

Create a CloudWatch Event rule that will trigger a Lambda function every 5 minutes. That Lambda function will check if CloudTrail is enabled using an API call and enable it back if necessary - You need to have an AWS Config rule to maintain auditability and track compliance over time, as using the Lambda function to trigger an API call would tell you about the CloudTrail status only at that point in time.

References:

https://aws.amazon.com/cloudtrail/faqs/

https://aws.amazon.com/config/faq/

https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-enabled.html

https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-security-trail-enabled.html

Domain

Domain 4: Monitoring and Logging

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Practice Test 1: Mini Practice Test: AWS Certified DevOps Engineer Professional - DOP-C02

Practice Test 2: Full Practice Test - AWS Certified DevOps Engineer Professional - DOP-C02

Expanded view

Beta

0 / 10used queries