Quiz IT certification exam

Question 1

A company wants to use Amazon ECS to provide a Docker container runtime environment. For compliance reasons, all Amazon EBS volumes used in the ECS cluster must be encrypted. Rolling updates will be made to the cluster instances and the company wants the instances drained of all tasks before being terminated.

How can these requirements be met? (Choose two.)

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

Copy the default AWS CloudFormation template that ECS uses to deploy cluster instances. Modify the template resource EBS configuration setting to set ‘Encrypted: True’ and include the AWS KMS alias: ‘aws/ebs’ to encrypt the AMI.

Accepted Answer

Create an Auto Scaling lifecycle hook backed by an AWS Lambda function that uses the AWS SDK to mark a terminating instance as DRAINING. Prevent the lifecycle hook from completing until the running tasks on the instance are zero.

Answer

Modify the default ECS AMI user data to create a script that executes docker rm –f {id} for all running container instances. Copy the script to the /etc/init.d/rc.d directory and execute chconfig enabling the script to run during operating system shutdown.

Answer

Use AWS CodePipeline to build a pipeline that discovers the latest Amazon-provided ECS AMI, then copies the image to an encrypted AMI outputting the encrypted AMI ID. Use the encrypted AMI ID when deploying the cluster.

Answer

Create an IAM role that allows the action ECS::EncryptedImage. Configure the AWS CLI and a profile to use this role. Start the cluster using the AWS CLI providing the --use-encrypted-image and --kms-key arguments to the create-cluster ECS command.

Question 2

A company is using AWS CodePipeline to deploy an application. A recent policy change requires that a member of the company's security team sign off on any application changes before they are deployed into production. The approval should be recorded and retained. Which combination of actions will meet these new requirements? (Choose two.)

Accepted Answer

Create an AWS CloudTrail trail to deliver logs to Amazon S3.

Accepted Answer

Create a manual approval CodePipeline action before the deployment step. Create a policy that grants the security team access to approve manual approval stages.

Answer

Configure CodePipeline with Amazon CloudWatch Logs to retain data.

Answer

Configure CodePipeline to deliver action logs to Amazon S3.

Answer

Create a custom CodePipeline action to invoke an AWS Lambda function for approval. Create a policy that gives the security team access to manage custom CodePipeline actions.

Question 3

You have an ELB setup in AWS with EC2 instances running behind it. You have been requested to monitor the incoming connections to the ELB. Which of the below options can suffice this requirement?

Accepted Answer

Enable access logs on the load balancer

Answer

Use AWSCIoudTrail with your load balancer

Answer

Use a CloudWatch Logs Agent

Answer

Create a custom metric CloudWatch filter on your load balancer

Question 4

You need to create a simple, holistic check for your system's general availablity and uptime. Your system presents itself as an HTTP-speaking API. What is the most simple tool on AWS to achieve this with?

Accepted Answer

Route53 Health Checks

Answer

CloudWatch Health Checks

Answer

AWS ELB Health Checks

Answer

EC2 Health Checks

Question 5

A company is using several AWS CloudFormation templates for deploying infrastructure as code. In most of the deployments, the company uses Amazon EC2 Auto Scaling groups. A DevOps Engineer needs to update the AMIs for the Auto Scaling group in the template if newer AMIs are available. How can these requirements be met?

Accepted Answer

Launch an Amazon EC2 m4.small instance and run a script on it to check for new AMIs. If new AMIs are available, the script should update the launch configuration resource block with the new AMI ID.

Answer

Manage the AMI mappings in the CloudFormation template. Use Amazon CloudWatch Events for detecting new AMIs and updating the mapping in the template. Reference the map in the launch configuration resource block.

Answer

Use conditions in the AWS CloudFormation template to check if new AMIs are available and return the AMI ID. Reference the returned AMI ID in the launch configuration resource block.

Answer

Use an AWS Lambda-backed custom resource in the template to fetch the AMI IDs. Reference the returned AMI ID in the launch configuration resource block.

Question 6

Which EBS volume type is best for high performance NoSQL cluster deployments?

Accepted Answer

io1

Answer

gp1

Answer

standard

Answer

gp2

Question 7

A company is using AWS Organizations and wants to implement a governance strategy with the following requirements:AWS resource access is restricted to the same two Regions for all accounts.AWS services are limited to a specific group of authorized services for all accounts.Authentication is provided by Active Directory.Access permissions are organized by job function and are identical in each account.Which solution will meet these requirements?

Accepted Answer

Establish an organizational unit (OU) with group policies in the master account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.

Answer

Establish a permission boundary in the master account to restrict Regions and authorized services. Use AWS CloudFormation StackSet to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.

Answer

Establish a service control in the master account to restrict Regions and authorized services. Use AWS Resource Access Manager to share master account roles with permissions for each job function, including AWS SSO for authentication in each account.

Answer

Establish a service control in the master account to restrict Regions and authorized services. Use CloudFormation StackSet to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.

Question 8

When running a playbook on a remote target host you receive a Python error similar to "[Errno 13] Permission denied:`/home/nick/.ansible/tmp'. What would be the most likely cause of this problem?

Accepted Answer

The user's home or `.ansible' directory on the Ansible remote host is not writeable by the user running the play

Answer

The user's home or `.ansible' directory on the Ansible system is not writeable by the user running the play.

Answer

The specified user does not exist on the remote system.

Answer

The user running `ansible-playbook' must run it from their own home directory.

Question 9

Which of the following tools does not directly support AWS OpsWorks, for monitoring your stacks?

Accepted Answer

AWS Config

Answer

Amazon CloudWatch Metrics

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 10

A developer tested an application locally and then deployed it to AWS Lambda. While testing the application remotely, the Lambda function fails with an access denied message. How can this issue be addressed?

Accepted Answer

Update the Lambda function’s execution role to include the missing permissions.

Answer

Update the Lambda function’s resource policy to include the missing permissions.

Answer

Include an IAM policy document at the root of the deployment package and redeploy the Lambda function.

Answer

Redeploy the Lambda function using an account with access to the AdministratorAccess policy.

Question 11

A company is using tagging to allocate AWS costs. The company has Amazon EC2 instances that run in Auto Scaling groups. The Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the EC2 instances are being created without the appropriate cost center tags. A DevOps engineer must ensure that the new EBS volumes are properly tagged. What is the MOST efficient solution that meets this requirement?

Accepted Answer

Update the Auto Scaling group to include the cost center tags. Set the PropagateAILaunch property to true.

Answer

Create a lifecycle hook on the autoscaling:EC2_INSTANCE_TERMINATING instance state that attaches the cost center tags to the EBS volumes.

Answer

Update the Auto Scaling group launch template to include the cost center tags for EBS volumes.

Answer

Use Tag Editor to search for EBS volumes that are missing the tags and to add the cost center tags to the volumes.

Question 12

When thinking of DynamoDB, what are true of Global Secondary Key properties?

Accepted Answer

The partition key and sort key can be different from the table.

Answer

Only the partition key can be different from the table.

Answer

Either the partition key or the sort key can be different from the table, but not both.

Answer

Only the sort key can be different from the table.

Question 13

You have an ASP.NET web application running in Amazon Elastic Beanstalk. Your next version of the application requires a third-party Windows Installer package to be installed on the instance on first boot and before the application launches.Which options are possible? (Choose two.)

Accepted Answer

In the source bundle's .ebextensions folder, create a file with a .config extension. In the file, under the "packages" section and "msi" package manager, include the package's URL.

Accepted Answer

In the environment's configuration, edit the instances configuration and add the package's URL to the "Packages" section.

Answer

In the application's Global.asax file, run msiexec.exe to install the package using Process.Start() in the Application Start event handler.

Answer

Launch a new Amazon EC2 instance from the AMI used by the environment. Log into the instance, install the package and run sysprep. Create a new AMI. Configure the environment to use the new AMI.

Answer

In the source bundle's .ebextensions folder, create a "Packages" folder. Place the package in the folder.

Question 14

The Ansible Inventory system allows many attributes to be defined within it. Which item below is not one of these?

Accepted Answer

Include vars

Answer

Group variables

Answer

Host groups

Answer

Children groups

Question 15

A DevOps Engineer must create a Linux AMI in an automated fashion. The newly created AMI identification must be stored in a location where other build pipelines can access the new identification programmatically What is the MOST cost-effective way to do this?

Accepted Answer

Launch an Amazon EC2 instance and install Packer. Then configure a Packer build with values defining how the image should be created. Build a Jenkins pipeline to invoke the Packer build when triggered to build an AMI. Store the AMI identification output in an Amazon DynamoDB table.

Answer

Build a pipeline in AWS CodePipeline to download and save the latest operating system Open Virtualization Format (OVF) image to an Amazon S3 bucket, then customize the image using the guestfish utility. Use the virtual machine (VM) import command to convert the OVF to an AMI, and store the AMI identification output as an AWS Systems Manager parameter.

Answer

Create an AWS Systems Manager automation document with values instructing how the image should be created. Then build a pipeline in AWS CodePipeline to execute the automation document to build the AMI when triggered. Store the AMI identification output as a Systems Manager parameter.

Answer

Build a pipeline in AWS CodePipeline to take a snapshot of an Amazon EC2 instance running the latest version of the application. Then start a new EC2 instance from the snapshot and update the running instance using an AWS Lambda function. Take a snapshot of the updated instance, then convert it to an AMI. Store the AMI identification output in an Amazon DynamoDB table.

Question 16

What is the correct syntax for the AWS command to create a single region trail?

Accepted Answer

aws cloudtrail create-trail --name trailname --s3-bucket-name bucketname

Answer

aws create-trail --name trailname --s3-object objectname

Answer

aws cloudtrail --s3-regionname IPaddress create-trail --name trailname

Answer

aws cloudtrail create-trail --name trailname --s3-portnumber IPaddress

Question 17

An IT department manages a portfolio with Windows and Linux (Amazon and Red Hat Enterprise Linux) servers both onpremises and on AWS. An audit reveals that there is no process for updating OS and core application patches, and that the servers have inconsistent patch levels.Which of the following provides the MOST reliable and consistent mechanism for updating and maintaining all servers at the recent OS and core application patch levels?

Accepted Answer

Use AWS Systems Manager Parameter Store to securely store credentials for each Linux and Windows server. Create Systems Manager Resource Groups. Use the Systems Manager Run Command to remotely deploy patch updates using the credentials in Systems Manager Parameter Store

Answer

Install AWS Systems Manager agent on all on-premises and AWS servers. Create Systems Manager Resource Groups. Use Systems Manager Patch Manager with a preconfigured patch baseline to run scheduled patch updates during maintenance windows.

Answer

Install the AWS OpsWorks agent on all on-premises and AWS servers. Create an OpsWorks stack with separate layers for each operating system, and get a recipe from the Chef supermarket to run the patch commands for each layer during maintenance windows.

Answer

Use a shell script to install the latest OS patches on the Linux servers using yum and schedule it to run automatically using cron. Use Windows Update to automatically patch Windows servers.

Question 18

A company uses AWS Organizations to manage multiple accounts. Information security policies require that all unencrypted Amazon EBS volumes be marked as non-compliant. A DevOps engineer needs to automatically deploy the solution and ensure that this compliance check is always present.With solution will accomplish this?

Accepted Answer

Create an AWS CloudFormation template that defines an AWS Inspector rule to check whether EBS encryption is enabled. Save the template to an Amazon S3 bucket that has been shared with all accounts within the company. Update the account creation script pointing to the CloudFormation template in Amazon S3.

Answer

Create an AWS Config organizational rule to check whether EBS encryption is enabled and deploy the rule using the AWS CLI. Create and apply an SCP to prohibit stopping and deleting AWS Config across the organization.

Answer

Create an SCP in Organizations. Set the policy to prevent the launch of Amazon EC2 instances without encryption on the EBS volumes using a conditional expression. Apply the SCP to all AWS accounts. Use Amazon Athena to analyze the AWS CloudTrail output, looking for events that deny an ec2:RunInstances action.

Answer

Deploy an IAM role to all accounts from a single trusted account. Build a pipeline with AWS CodePipeline with a stage in AWS Lambda to assume the IAM role, and list all EBS volumes in the account. Publish a report to Amazon S3.

Question 19

A company wants to ensure that their EC2 instances are secure. They want to be notified if any new vulnerabilities are discovered on their instances, and they also want an audit trail of all login activities on the instances. Which solution will meet these requirements?

Accepted Answer

Use AWS Systems Manager to detect vulnerabilities on the EC2 instances. Install the Systems Manager Agent to capture system logs and view login activity in the CloudTrail console.

Answer

Use AWS Systems Manager to detect vulnerabilities on the EC2 instances. Install the Amazon Kinesis Agent to capture system logs and deliver them to Amazon S3.

Answer

Configure Amazon CloudWatch to detect vulnerabilities on the EC2 instances. Install the AWS Config daemon to capture system logs and view them in the AWS Config console.

Answer

Configure Amazon Inspector to detect vulnerabilities on the EC2 instances. Install the Amazon CloudWatch Agent to capture system logs and record them via Amazon CloudWatch Logs.

Question 20

A company is adopting AWS CodeDeploy to automate its application deployments for a Java-Apache Tomcat application with an Apache webserver. The Development team started with a proof of concept, created a deployment group for a developer environment, and performed functional tests within the application. After completion, the team will create additional deployment groups for staging and production The current log level is configured within the Apache settings, but the team wants to change this configuration dynamically when the deployment occurs, so that they can set different log level configurations depending on the deployment group without having a different application revision for each group. How can these requirements be met with the LEAST management overhead and without requiring different script versions for each deployment group?

Accepted Answer

Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_NAME to identify which deployment group the instances is part of. Use this information to configure the log level settings. Reference this script as part of the BeforeInstall lifecycle hook in the appspec.yml file

Answer

Tag the Amazon EC2 instances depending on the deployment group. Then place a script into the application revision that calls the metadata service and the EC2 API to identify which deployment group the instance is part of. Use this information to configure the log level settings. Reference the script as part of the Afterinstall lifecycle hook in the appspec.yml file.

Answer

Create a CodeDeploy custom environment variable for each environment. Then place a script into the application revision that checks this environment variable to identify which deployment group the instance is part of. Use this information to configure the log level settings. Reference this script as part of the ValidateService lifecycle hook in the appspec.yml file.

Answer

Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ID to identify which deployment group the instance is part of to configure the log level settings. Reference this script as part of the Install lifecycle hook in the appspec.yml file.

Question 21

A company is using AWS Organizations to create separate AWS accounts for each of its departments. It needs to automate the following tasks:Updating the Linux AMIs with new patches periodically and generating a golden image Installing a new version of Chef agents in the golden image, if available Enforcing the use of the newly generated golden AMIs in the department's account Which option requires the LEAST management overhead?

Accepted Answer

Use AWS Systems Manager Automation to update the Linux AMI from the previous golden image, provide the URL for the script that will update the Chef agent, and then share only the newly generated AMI with the departments’ accounts.

Answer

Write a script to launch an Amazon EC2 instance from the previous golden AMI, apply the patch updates, install the new version of the Chef agent, generate a new golden AMI, and then modify the AMI permissions to share only the new image with the departments’ accounts.

Answer

Use an AWS Systems Manager Run Command to update the Chef agent first, use Amazon EC2 Systems Manager Automation to generate an updated AMI, and then assume an IAM role to copy the new golden AMI into the departments’ accounts.

Answer

Use AWS Systems Manager Automation to update the Linux AMI using the previous image, provide the URL for the script that will update the Chef agent, and then use AWS Organizations to replace the previous golden AMI into the departments’ accounts.

Question 22

You work for a company that automatically tags photographs using artificial neural networks (ANNs), which run on GPUs using C++. You receive millions of images at a time, but only 3 times per day on average. These images are loaded into an AWS S3 bucket you control for you in a batch, and then the customer publishes a JSON-formatted manifest into another S3 bucket you control as well. Each image takes 10 milliseconds to process using a full GPU. Your neural network software requires 5 minutes to bootstrap. Image tags are JSON objects, and you must publish them to an S3 bucket. Which of these is the best system architectures for this system?

Accepted Answer

Make an S3 notification configuration which publishes to AWS Lambda on the manifest bucket. Make the Lambda create a CloudFormation Stack which contains the logic to construct an autoscaling worker tier of EC2 G2 instances with the ANN code on each instance. Create an SQS queue of the images in the manifest. Tear the stack down when the queue is empty.

Answer

Create an OpsWorks Stack with two Layers. The first contains lifecycle scripts for launching and bootstrapping an HTTPAPI on G2 instances for ANN image processing, and the second has an alwayson instance which monitors the S3 manifestbucket for new files. When a new file is detected, request instances to boot on the ANN layer. When the instances arebooted and the HTTP APIs are up, submit processing requests to individual instances.

Answer

Deploy your ANN code to AWS Lambda as a bundled binary for the C++ extension. Make an S3 notification configuration on the manifest, which publishes to another AWS Lambda running controller code. This controller code publishes all the images in the manifest to AWS Kinesis. Your ANN code Lambda Function uses the Kinesis as an Event Source. The system automatically scales when the stream contains image events.

Answer

Create an Auto Scaling, Load Balanced Elastic Beanstalk worker tier Application and Environment. Deploy the ANN code to G2 instances in this tier. Set the desired capacity to 1. Make the code periodically check S3 for new manifests. When a new manifest is detected, push all of the images in the manifest into the SQS queue associated with the Elastic Beanstalk worker tier.

Question 23

Your application uses CloudFormation to orchestrate your application's resources. During your testing phase before the application went live, your Amazon RDS instance type was changed and caused the instance to be re-created, resulting In the loss of test data. How should you prevent this from occurring in the future?

Accepted Answer

In the AWS CloudFormation template, set the DeletionPolicy of the AWS::RDS::DBInstance's DeletionPolicy property to "Retain."

Answer

Within the AWS CloudFormation parameter with which users can select the Amazon RDS instance type, set AllowedValues to only contain the current instance type.

Answer

Use an AWS CloudFormation stack policy to deny updates to the instance. Only allow UpdateStack permission to IAM principals that are denied SetStackPolicy.

Answer

In the AWS CloudFormation template, set the AWS::RDS::DBInstance's DBlnstanceClass property to be read-only.

Answer

Subscribe to the AWS CloudFormation notification "BeforeResourceUpdate," and call CancelStackUpdate if the resource identified is the Amazon RDS instance.

Question 24

A company uses Amazon S3 to store proprietary information. The Development team creates buckets for new projects on a daily basis. The Security team wants to ensure that all existing and future buckets have encryption, logging, and versioning enabled. Additionally, no buckets should ever be publicly read or write accessible.What should a DevOps Engineer do to meet these requirements?

Accepted Answer

Enable AWS Config rules and configure automatic remediation using AWS Systems Manager documents.

Answer

Enable AWS CloudTrail and configure automatic remediation using AWS Lambda.

Answer

Enable AWS Trusted Advisor and configure automatic remediation using Amazon CloudWatch Events.

Answer

Enable AWS Systems Manager and configure automatic remediation using Systems Manager documents.

Question 25

Using the AWS CLI, which command retrieves CloudTrail trail settings, including the status of the trail itself?

Accepted Answer

aws cloudtrail describe-trails

Answer

aws cloudtrail return-trails

Answer

aws cloudtrail validate-settings

Answer

aws cloudtrail get-settings

Question 26

You are designing a system which needs, at minumum, 8 m4.large instances operating to service traffic. When designing a system for high availability in the us-east-1 region, which has 6 Availability Zones, you company needs to be able to handle death of a full availability zone. How should you distribute the servers, to save as much cost as possible, assuming all of the EC2 nodes are properly linked to an ELB? Your VPC account can utilize us-east-1's AZ's a through f, inclusive.

Accepted Answer

2 servers in each of AZ's a through e, inclusive.

Answer

3 servers in each of AZ's a through d, inclusive.

Answer

8 servers in each of AZ's a and b.

Answer

4 servers in each of AZ's a through c, inclusive.

Question 27

Your company operates an application consisting of an AWS CloudFormation stack that contains a load balancer, an Auto Scaling group of web servers, and an Amazon RDS instance. To save time and costs, you update the current test stack when testing minor changes, and create a new stack for major changes. As part of the testing procedure of your application, each version needs to be registered once and only once with a Configuration Management Database (CMDB).What cost-effective solution should you choose to perform this registration?

Accepted Answer

Define an AWS: :CloudFormation::CustomResource in the AWS CloudFormation template, with the application version as one of its properties. Modify the CMDB to subscribe to the resource's creation and update notifications.

Answer

Use Auto Scaling Leader Node functionality to notify the registration application from the UserData script of a single Instance. Use the AWS CloudFormation cfn-hup helper application to receive template updates on the leader node, which then notifies the CMDB.

Answer

Define an AWS::CloudFormation::HttpRequest in the AWS CloudFormation template, and configure it to notify the CMDBon stack creation and update.

Answer

Define an AWS::EC2::Instance resource in the AWS CloudFormation template that is configured to run a UserData script to notify the CMDB and then terminate itself on completion.

Question 28

What is a circular dependency in AWS CloudFormation?

Accepted Answer

When Resources form a DependOn loop.

Answer

When a Template references an earlier version of itself.

Answer

When Nested Stacks depend on each other.

Answer

When a Template references a region, which references the original Template.

Question 29

Your application uses Amazon SQS and Auto Scaling to process background jobs. The Auto Scaling policy is based on the number of messages in the queue, with a maximum Instance count of 100. Since the application was launched, the group has never scaled above 50. The Auto Scaling group has now scaled to 100, the queue size is increasing, and very few Jobs are being completed. The number of messages being sent to the queue is at normal levels. What should you do to identify why the queue size is unusually high, and to reduce it?

Accepted Answer

Analyze the application logs to identify possible reasons for message processing failure and resolve the cause for failures.

Answer

Temporarily increase the Auto Scaling group's desired value to 200. When the queue size has been reduced, reduce it to 50.

Answer

Create additional Auto Scaling groups, enabling the processing of the queue to be performed in parallel.

Answer

Analyze CloudTrail logs for Amazon SQS to ensure that the instances' Amazon EC2 role has permission to receive messages from the queue.

Question 30

An application that runs on Amazon EC2 instances behind an Application Load Balancer is deployed using AWS Elastic Beanstalk. During a recent rolling deployment, users experienced application errors even though application health checks were passing on all instances. A log analysis shows that the errors were caused by user requests being processed by two different versions of the application behind the same load balancer. The analysis also shows a recent change made the responses backward incompatible.Which deployment method will address these issues?

Accepted Answer

Update Elastic Beanstalk to deploy using the rolling with additional batch method.

Answer

Update Elastic Beanstalk to deploy using the all at once method.

Answer

Update Elastic Beanstalk to deploy using the blue/green method.

Answer

Update Elastic Beanstalk to deploy using the immutable method.

Question 31

A DevOps Engineer has a single Amazon DynamoDB table that receives shipping orders and tracks inventory. The Engineer has three AWS Lambda functions reading from a DymamoDB stream on that table. The Lambda functions perform various functions such as doing an item count, moving items to Amazon Kinesis Data Firehose, monitoring inventory levels, and creating vendor orders when parts are low. While reviewing logs, the Engineer notices the Lambda functions occasionally fail under increased load, receiving a stream throttling error. Which is the MOST cost-effective solution that requires the LEAST amount of operational management?

Accepted Answer

Create a fourth Lambda function and configure it to be the only Lambda reading from the stream. Then use this Lambda function to pass the payload to the other three Lambda functions.

Answer

Use AWS Glue integration to ingest the DynamoDB stream, then migrate the Lambda code to an AWS Fargate task.

Answer

Use Amazon Kinesis streams instead of DynamoDB streams, then use Kinesis analytics to trigger the Lambda functions.

Answer

Have the Lambda functions query the table directly and disable DynamoDB streams. Then have the Lambda functions query from a global secondary index.

Question 32

In which Docker Swarm model does the swarm manager distribute a specific number of replica tasks among the nodes based upon the scale you set in the desired state?

Accepted Answer

replicated services

Answer

distributed services

Answer

scaled services

Answer

global services

Question 33

You need to scale an RDS deployment. You are operating at 10% writes and 90% reads, based on your logging. How best can you scale this in a simple way?

Accepted Answer

Create read replicas for RDS since the load is mostly reads.

Answer

Create a second master RDS instance and peer the RDS groups.

Answer

Cache all the database responses on the read side with CloudFront.

Answer

Create a Multi-AZ RDS installs and route read traffic to standby.

Question 34

A web application for healthcare services runs on Amazon EC2 instances behind an ELB Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. A DevOps Engineer must create a mechanism in which an EC2 instance can be taken out of production so its system logs can be analyzed for issues to quickly troubleshoot problems on the web tier. How can the Engineer accomplish this task while ensuring availability and minimizing downtime?

Accepted Answer

Implement EC2 Auto Scaling groups with lifecycle hooks. Create an AWS Lambda function that can modify an EC2 instance lifecycle hook into a standby state, extract logs from the instance through a remote script execution, and place them in an Amazon S3 bucket for analysis.

Answer

Implement EC2 Auto Scaling groups cooldown periods. Use EC2 instance metadata to determine the instance state, and an AWS Lambda function to snapshot Amazon EBS volumes to preserve system logs.

Answer

Implement Amazon CloudWatch Events rules. Create an AWS Lambda function that can react to an instance termination to deploy the CloudWatch Logs agent to upload the system and access logs to Amazon S3 for analysis.

Answer

Terminate the EC2 instances manually. The Auto Scaling service will upload all log information to CloudWatch Logs for analysis prior to instance termination.

Question 35

A healthcare provider has a hybrid architecture that includes 120 on-premises VMware servers running RedHat and 50 Amazon EC2 instances running Amazon Linux. The company is in the middle of an all-in migration to AWS and wants to implement a solution for collecting information from the on-premises virtual machines and the EC2 instances for data analysis. The information includes:- Operating system type and version- Data for installed applications- Network configuration information, such as MAC and IP addresses- Amazon EC2 instance AMI ID and IAM profileHow can these requirements be met with the LEAST amount of administration?

Accepted Answer

Install AWS Systems Manager agents on both the on-premises virtual machines and the EC2 instances. Enable inventory collection and configure resource data sync to an Amazon S3 bucket to analyze the data with Amazon Athena.

Answer

Write a shell script to run as a cron job on EC2 instances to collect and push the data to Amazon S3. For on-premises resources, use VMware vSphere to collect the data and write it into a file gateway for storing the data in S3. Finally, use Amazon Athena on the S3 bucket for analytics.

Answer

Use a script on the on-premises virtual machines as well as the EC2 instances to gather and push the data into Amazon S3, and then use Amazon Athena for analytics.

Answer

Use AWS Application Discovery Service for deploying Agentless Discovery Connector in the VMware environment and Discovery Agents on the EC2 instances for collecting the data. Then use the AWS Migration Hub Dashboard for analytics.

Question 36

Which is the proper syntax for referencing a variable's value in an Ansible task?

Accepted Answer

"{{ variable_name }}"

Answer

${variable_name}

Answer

{ variable_name }

Answer

@variable_name

Question 37

The operations team and the development team want a single place to view both operating system and application logs. How should you implement this using AWS services? (Choose two.)

Accepted Answer

Using AWS CloudFormation, create a CloudWatch Logs LogGroup and send the operating system and application logs of interest using the CloudWatch Logs Agent.

Accepted Answer

Using configuration management, set up remote logging to send events to Amazon Kinesis and insert these into Amazon CloudSearch or Amazon Redshift, depending on available analytic tools.

Answer

Using AWS CloudFormation and configuration management, set up remote logging to send events via UDP packets to CloudTrail.

Answer

Using AWS CloudFormation, create a CloudWatch Logs LogGroup. Because the Cloudwatch Log agent automatically sends all operating system logs, you only have to configure the application logs for sending off-machine. Using AWS CloudFormation, merge the application logs with the operating system logs, and use IAM Roles to allow both teams to have access to view console output from Amazon EC2.

Question 38

What is the expected behavior if Ansible is called with ‘ansible-playbook -i localhost playbook.yml’?

Accepted Answer

Ansible will attempt to read the inventory file named ‘localhost’

Answer

Ansible will run the plays locally.

Answer

Ansible will run the playbook on the host named ‘localhost’

Answer

Ansible won't run, this is invalid command line syntax

Question 39

After presenting a working proof of concept for a new application that uses AWS API Gateway, a Developer must set up a team development environment for the project. Due to a tight timeline, the Developer wants to minimize time spent on infrastructure setup, and would like to reuse the code repository created for the proof of concept. Currently, all source code is stored in AWS CodeCommit. Company policy mandates having alpha, beta, and production stages with separate Jenkins servers to build code and run tests for every stage. The Development Manager must have the ability to block code propagation between admins at any time. The Security team wants to make sure that users will not be able to modify the environment without permission. How can this be accomplished?

Accepted Answer

Create an AWS CodePipeline pipeline that pulls code from the CodeCommit repository. Create alpha, beta, and production stages with Jenkins servers on CodePipeline.

Answer

Create API Gateway alpha, beta, and production stages. Create a CodeCommit trigger to deploy code to the different stages using an AWS Lambda function.

Answer

Create API Gateway alpha, beta, and production stages. Create an AWS CodePipeline that pulls code from the CodeCommit repository. Create CodePipeline actions to deploy code to the API Gateway stages.

Answer

Create Jenkins servers for the alpha, beta, and production stages on Amazon EC2 instances. Create multiple CodeCommit triggers to deploy code to different stages using an AWS Lambda function.

Question 40

A root account has created an IAM group and defined the policy as:<img alt="Amazon DOP-C01 image Question 200 3149 09162024005556000000"   width="403" height="163" src="https://examgecko.com/getfile/f80943b1-2e60-44fd-9d10-d33adb18736f">What will this policy do?

Accepted Answer

Allow an IAM user in this group to view the password policy and modify only his/her password

Answer

Allow this group to view the password policy of all the users added only to that group

Answer

Allow all the users of IAM to modify their password

Answer

Allow this group to view the password policy of all the IAM users

Amazon DOP-C01 Practice Test 5

Amazon DOP-C01 Practice Tests