Quiz IT certification exam

Question 1

You are experiencing performance issues writing to a DynamoDB table. Your system tracks high scores for video games on a marketplace. Your most popular game experiences all of the performance issues. What is the most likely problem?

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

You selected the Game ID or equivalent identifier as the primary partition key for the table.

Answer

DynamoDB's vector clock is out of sync, because of the rapid growth in request for the most popular game.

Answer

Users of the most popular video game each perform more read and write requests than average.

Answer

You did not provision enough read or write throughput to the table.

Question 2

You are running a Docker daemon on a Linux host and it becomes unresponsive. Which signal, when sent to a Docker process with the kill command, forces the full stack trace to be logged for debugging purposes?

Accepted Answer

-SIGUSER1

Answer

–TRACE

Answer

–IOTRACE

Answer

–KILLTRACE

Question 3

To access the AWS Security Token Service (STS) you can issue calls directly to the AWS STS Query API. This API is a web service interface that accepts ______ requests.

Accepted Answer

HTTPS

Answer

PUT

Answer

POST

Answer

GET

Question 4

A new zero-day vulnerability was found in OpenSSL requiring the immediate patching of a production web fleet running on Amazon Linux. Currently, OS updates are performed manually on a monthly basis and deployed using updates to the production Auto Scaling Group’s launch configuration.Which method should a DevOps Engineer use to update packages in-place without downtime?

Accepted Answer

Use Amazon EC2 Run Command to issue a package update command to all running production instances, and update the AMI for future deployments.

Answer

Use AWS CodePipline and AWS CodeBuild to generate new copies of these packages, and update the Auto Scaling group’s launch configuration.

Answer

Use AWS Inspector to run “yum upgrade” on all running production instances, and manually update the AMI for the next maintenance window.

Answer

Define a new AWS OpsWorks layer to match the running production instances, and use a recipe to issue a package update command to all running production instances.

Question 5

You have a playbook that includes a task to install a package for a service, put a configuration file for that package on the system and restart the service. The playbook is then run twice in a row. What would you expect Ansible to do on the second run?

Accepted Answer

Check if the package is installed, check if the file matches the source file, if not reinstall it; restart the service.

Answer

Remove the old package and config file and reinstall and then restart the service.

Answer

Take no action on the target host.

Answer

Attempt to reinstall the package, copy the file and restart the service.

Question 6

Fill the blanks: __________ helps us track AWS API calls and transitions, _________ helps to understand what resources we have now, and ________ allows auditing credentials and logins.

Accepted Answer

CloudTrail, AWS Config, IAM Credential Reports

Answer

AWS Config, CloudTrail, IAM Credential Reports

Answer

CloudTrail, IAM Credential Reports, AWS Config

Answer

AWS Config, IAM Credential Reports, CloudTrail

Question 7

A DevOps engineer is tasked with creating a more stable deployment solution for a web application in AWS. Previous deployments have resulted in user-facing bugs, premature user traffic, and inconsistencies between web servers running behind an Application Load Balancer. The current strategy uses AWS CodeCommit to store the code for the application. When developers push to the master branch of the repository, CodeCommit triggers an AWS Lambda deploy function, which invokes an AWS Systems Manager run command to build and deploy the new code to all Amazon EC2 instances. Which combination of actions should be taken to implement a more stable deployment solution? (Choose two.)

Accepted Answer

Create a pipeline in AWS CodePipeline with CodeCommit as a source provider. Create parallel pipeline stages to build and test the application. Pass the build artifact to AWS CodeDeploy.

Accepted Answer

Create individual Lambda functions to run all build, test, and deploy actions using AWS CodeDeploy instead of AWS Systems Manager.

Answer

Create a pipeline in AWS CodePipeline with CodeCommit as a source provider. Create separate pipeline stages to build and then test the application. Pass the build artifact to AWS CodeDeploy.

Answer

Create and use an AWS CodeDeploy application and deployment group to deploy code updates to the EC2 fleet. Select the Application Load Balancer for the deployment group.

Answer

Modify the Lambda function to build a single application package to be shared by all instances. Use AWS CodeDeploy instead of AWS Systems Manager to update the code on the EC2 fleet.

Question 8

For AWS Auto Scaling, what is the first transition state an instance enters after leaving steady state when scaling in due to health check failure or decreased load?

Accepted Answer

Terminating

Answer

Detaching

Answer

Terminating:Wait

Answer

EnteringStandby

Question 9

A company is deploying a container-based application using AWS CodeBuild. The Security team mandates that all containers are scanned for vulnerabilities prior to deployment using a password-protected endpoint. All sensitive information must be stored securely.Which solution should be used to meet these requirements?

Accepted Answer

Store the password in the AWS Systems Manager Parameter Store as a secure string. Add the Parameter Store key to the buildspec.yml file as an environment variable under the parameter-store mapping. Reference the environment variable to initiate scanning.

Answer

Encrypt the password using AWS KMS. Store the encrypted password in the buildspec.yml file as an environment variable under the variables mapping. Reference the environment variable to initiate scanning.

Answer

Import the password into an AWS CloudHSM key. Reference the CloudHSM key in the buildpec.yml file as an environment variable under the variables mapping. Reference the environment variable to initiate scanning.

Answer

Use the AWS Encryption SDK to encrypt the password and embed in the buildspec.yml file as a variable under the secrets mapping. Attach a policy to CodeBuild to enable access to the required decryption key.

Question 10

What is the scope of an EC2 security group?

Accepted Answer

Region

Answer

Availability Zone

Answer

Placement Group

Answer

VPC

Question 11

What is the maximum supported single-volume throughput on EBS?

Accepted Answer

320MiB/s

Answer

160MiB/s

Answer

40MiB/s

Answer

640MiB/s

Question 12

You have decided that you need to change the instance type of your production instances which are running as part of an AutoScaling group. The entire architecture is deployed using CloudFormation Template. You currently have 4 instances in Production. You cannot have any interruption in service and need to ensure 2 instances are always runningduring the update. Which of the options below listed can be used for this?

Accepted Answer

AutoScalingRollingUpdate

Answer

AutoScalingScheduledAction

Answer

AutoScalingReplacingUpdate

Answer

AutoScalinglntegrationUpdate

Question 13

A company is building a solution for storing files containing Personally Identifiable Information (PII) on AWS. Requirements state:All data must be encrypted at rest and in transit.All data must be replicated in at least two locations that are at least 500 miles apart.Which solution meets these requirements?

Accepted Answer

Create primary and secondary Amazon S3 buckets in two separate AWS Regions that are at least 500 miles apart. Use a bucket policy to enforce access to the buckets only through HTTPS. Use a bucket policy to enforce S3-Managed Keys (SSES3) on all objects uploaded to the bucket. Configure cross-region replication between the two buckets.

Answer

Create primary and secondary Amazon S3 buckets in two separate Availability Zones that are at least 500 miles apart. Use a bucket policy to enforce access to the buckets only through HTTPS. Use a bucket policy to enforce Amazon S3 SSECon all objects uploaded to the bucket. Configure cross-region replication between the two buckets.

Answer

Create primary and secondary Amazon S3 buckets in two separate AWS Regions that are at least 500 miles apart. Use an IAM role to enforce access to the buckets only through HTTPS. Use a bucket policy to enforce Amazon S3- Managed Keys (SSE-S3) on all objects uploaded to the bucket. Configure cross-region replication between the two buckets.

Answer

Create primary and secondary Amazon S3 buckets in two separate Availability Zones that are at least 500 miles apart. Use a bucket policy to enforce access to the buckets only through HTTPS. Use a bucket policy to enforce AWS KMSencryption on all objects uploaded to the bucket. Configure cross-region replication between the two buckets. Create a KMSCustomer Master Key (CMK) in the primary region for encrypting objects.

Question 14

A DevOps Engineer must track the health of a stateless RESTful service sitting behind a Classic ILoad Balancer. The deployment of new application revisions is through a CI/CD pipeline. If the service's latency increases beyond a defined threshold, deployment should be stopped until the service has recovered.Which of the following methods allow for the QUICKEST detection time?

Accepted Answer

Use AWS CodeDeploy's MinimumHealthyHosts setting to define thresholds for rolling back deployments. If these thresholds are breached, roll back the deployment.

Answer

Use Amazon CloudWatch metrics provided by Elastic Load Balancing to calculate average latency. Alarm and stop deployment when latency increases beyond the defined threshold.

Answer

Use AWS Lambda and Elastic Load Balancing access logs to detect average latency. Alarm and stop deployment when latency increases beyond the defined threshold.

Answer

Use Metric Filters to parse application logs in Amazon CloudWatch Logs. Create a filter for latency. Alarm and stop deployment when latency increases beyond the defined threshold.

Question 15

A company has multiple environments that run applications on Amazon EC2 instances. The company wants to track costs and has defined a new rule that states that all production EC2 instances must be tagged with a CostCenter tag. A DevOps engineer has created a tag policy to validate the use of the CostCenter tag, has activated the option to prevent noncompliant tagging operations for this tag, and has attached the policy to the production OU in AWS Organizations. The DevOps engineer generates a compliance report for the entire organization and ensures that all the deployed instances have the correct tags configured. The DevOps engineer also verifies that the CostCenter tag cannot be removed from an EC2 instance that runs in one of the production accounts.After some time, the DevOps engineer notices that several EC2 instances have been launched in the production accounts without the configuration of the CostCenter tag. What should the DevOps engineer do to ensure that all production EC2 instances are launched with the CostCenter tag configured?

Accepted Answer

In the AWS Billing and Cost Management console of the management account, activate the CostCenter tag as a cost allocation tag.

Answer

Attach the tag policy to the organization root to ensure that the policy applies to all EC2 instances.

Answer

Create an SCP that requires the CostCenter tag during the launch of EC2 instances.

Answer

Activate the AWS Config required-tags managed rule in all production accounts. Ensure that the rule evaluates the CostCenter tag.

Question 16

Ansible provides some methods for controlling how or when a task is ran. Which of the following is a valid method for controlling a task with a loop?

Accepted Answer

- with_items:

Answer

- with:

Answer

- only_when:

Answer

- items:

Question 17

You want to set up the CloudTrail Processing Library to log your bucket operations. Which command will build a .jar file from the CloudTrail Processing Library source code?

Accepted Answer

mvn clean install -Dgpg.skip=true

Answer

mvn javac mvn -install processor

Answer

jar install processor

Answer

build jar -Dgpg.processor

Question 18

A company has a single Developer writing code for an automated deployment pipeline. The Developer is storing source code in an Amazon S3 bucket for each project. The company wants to add more Developers to the team but is concerned about code conflicts and lost work. The company also wants to build a test environment to deploy newer versions of code for testing and allow Developers to automatically deploy to both environments when code is changed in the repository.What is the MOST efficient way to meet these requirements?

Accepted Answer

Create an AWS CodeCommit repository for each project, use the master branch for production code, and create a testing branch for code deployed to testing. Use feature branches to develop new features and pull requests to merge code to testing and master branches.

Answer

Create another S3 bucket for each project for testing code, and use an AWS Lambda function to promote code changes between testing and production buckets. Enable versioning on all buckets to prevent code conflicts.

Answer

Create an AWS CodeCommit repository for each project, and use the master branch for production and test code with different deployment pipelines for each environment. Use feature branches to develop new features.

Answer

Enable versioning and branching on each S3 bucket, use the master branch for production code, and create a testing branch for code deployed to testing. Have Developers use each branch for developing in each environment.

Question 19

Your application requires a fault-tolerant, low-latency and repeatable method to load configurations files via Auto Scaling when Amazon Elastic Compute Cloud (EC2) instances launch. Which approach should you use to satisfy these requirements?

Accepted Answer

Use an Amazon EC2 UserData script to copy the configurations from an Amazon Storage Services (S3) bucket.

Answer

Securely copy the content from a running Amazon EC2 instance.

Answer

Use a script via cfn-init to pull content hosted in an Amazon ElastiCache cluster.

Answer

Use a script via cfn-init to pull content hosted on your on-premises server.

Answer

Use an Amazon EC2 UserData script to pull content hosted on your on-premises server.

Question 20

Which of these is not a CloudFormation Helper Script?

Accepted Answer

cfn-request

Answer

cfn-signal

Answer

cfn-hup

Answer

cfn-get-metadata

Question 21

A development team manages website deployments using AWS CodeDeploy blue/green deployments. The application is running on Amazon EC2 instances behind an Application Load Balancer in an Auto Scaling group. When deploying a new revision, the team notices the deployment eventually fails, but it takes a long time to fail. After further inspection, the team discovers the AllowTraffic lifecycle event ran for an hour and eventually failed without providing any other information. The team wants to ensure failure notices are delivered more quickly while maintaining application availability even upon failure. Which combination of actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Change the deployment configuration to CodeDeployDefault.AllAtOnce to speed up the deployment process by deploying to all of the instances at the same time.

Accepted Answer

Reduce the HealthCheckIntervalSeconds and UnhealthyThresholdCount values within the target group health checks to decrease the amount of time it takes for the application to be considered unhealthy.

Answer

Create a CodeDeploy trigger for the deployment failure event and make the deployment fail as soon as a single health check failure is detected.

Answer

Use the appspec.yml file to run a script on the AllowTraffic hook to perform lighter health checks on the application instead of making CodeDeploy wait for the target group health checks to pass.

Answer

Use the appspec,yml file to run a script on the BeforeAllowTraffic hook to perform hearth checks on the application and fail the deployment if the health checks performed by the script are not successful.

Question 22

A government agency is storing highly confidential files in an encrypted Amazon S3 bucket. The agency has configured federated access and has allowed only a particular on-premises Active Directory user group to access this bucket. The agency wants to maintain audit records and automatically detect and revert any accidental changes administrators make to the IAM policies used for providing this restricted federated access. Which of the following options provide the FASTEST way to meet these requirements?

Accepted Answer

Configure an AWS Config rule to detect the configuration change and execute an AWS Lambda function to revert the change.

Answer

Configure an Amazon CloudWatch Events Event Bus on an AWS CloudTrail API for triggering the AWS Lambda function that detects and reverts the change.

Answer

Schedule an AWS Lambda function that will scan the IAM policy attached to the federated access role for detecting and reverting any changes.

Answer

Restrict administrators in the on-premises Active Directory from changing the IAM policies.

Question 23

A highly regulated company has a policy that DevOps Engineers should not log in to their Amazon EC2 instances except in emergencies. If a DevOps Engineer does log in, the Security team must be notified within 15 minutes of the occurrence.Which solution will meet these requirements?

Accepted Answer

Install the Amazon CloudWatch agent on each EC2 instance. Configure the agent to push all logs to Amazon CloudWatch Logs and set up a CloudWatch metric filter that searches for user logins. If a login is found, send a notification to the Security team using Amazon SNS.

Answer

Install the Amazon Inspector agent on each EC2 instance. Subscribe to Amazon CloudWatch Events notifications. Trigger an AWS Lambda function to check if a message is about user logins. If it is, send a notification to the Security team using Amazon SNS.

Answer

Set up AWS CloudTrail with Amazon CloudWatch Logs. Subscribe CloudWatch Logs to Amazon Kinesis. Attach AWS Lambda to Kinesis to parse and determine if a log contains a user login. If it does, send a notification to the Security team using Amazon SNS.

Answer

Set up a script on each Amazon EC2 instance to push all logs to Amazon S3. Set up an S3 event to trigger an AWS Lambda function, which triggers an Amazon Athena query to run. The Athena query checks for logins and sends the output to the Security team using Amazon SNS.

Question 24

What is the purpose of a Docker swarm worker node?

Accepted Answer

executing containers

Answer

scheduling services

Answer

service swarm node HTTP API endpoints

Answer

maintaining cluster state

Question 25

What is AWS CloudTrail Processing Library?

Accepted Answer

A Java library that makes it easy to build an application that reads and processes CloudTrail log files

Answer

A static library with CloudTrail log files in a movable format machine code that is directly executable

Answer

An object library with CloudTrail log files in a movable format machine code that is usually not directly executable

Answer

A PHP library that renders various generic containers needed for CloudTrail log files

Question 26

An online retail company based in the United States plans to expand its operations to Europe and Asia in the next six months. Its product currently runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. All data is stored in an Amazon Aurora database instance. When the product is deployed in multiple regions, the company wants a single product catalog across all regions, but for compliance purposes, its customer information and purchases must be kept in each region. How should the company meet these requirements with the LEAST amount of application changes?

Accepted Answer

Use Aurora with read replicas for the product catalog and additional local Aurora instances in each region for the customer information and purchases.

Answer

Use Amazon Redshift for the product catalog and Amazon DynamoDB tables for the customer information and purchases.

Answer

Use Amazon DynamoDB global tables for the product catalog and regional tables for the customer information and purchases.

Answer

Use Aurora for the product catalog and Amazon DynamoDB global tables for the customer information and purchases.

Question 27

You need to run a very large batch data processing job one time per day. The source data exists entirely in S3, and the output of the processing job should also be written to S3 when finished. If you need to version control this processing job and all setup and teardown logic for the system, what approach should you use?

Accepted Answer

Model an AWS EMR job in AWS CloudFormation.

Answer

Model an AWS EMR job in AWS Elastic Beanstalk.

Answer

Model an AWS EMR job in AWS OpsWorks.

Answer

Model an AWS EMR job in AWS CLI Composer.

Question 28

You are responsible for a large-scale video transcoding system that operates with an Auto Scaling group of video transcoding workers. The Auto Scaling group is configured with a minimum of 750 Amazon EC2 instances and a maximum of 1000 Amazon EC2 instances. You are using Amazon SQS to pass a message containing the URI for a video stored in Amazon S3 to the transcoding workers. An Amazon CloudWatch alarm has notified you that the queue depth is becoming very large. How can you resolve the alarm without the risk of increasing the time to transcode videos? (Choose two.)

Accepted Answer

Create a new Auto Scaling group with a launch configuration that has a larger Amazon EC2 instance type.

Accepted Answer

Adjust the Auto Scaling group configuration to increase the maximum number of Amazon EC2 instances.

Answer

Create a second queue in Amazon SQS.

Answer

Adjust the Amazon CloudWatch alarms for a higher queue depth.

Answer

Add an additional Availability Zone to the Auto Scaling group configuration.

Answer

Change the Amazon CloudWatch alarm so that it monitors the CPU utilization of the Amazon EC2 instances rather than the Amazon SQS queue depth.

Question 29

A company runs an application on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones in us-east-1. The application stores data in an Amazon RDS MySQL Multi-AZ DB instance.A DevOps engineer wants to modify the current solution and create a hot standby of the environment in another region to minimize downtime if a problem occurs in us-east-1. Which combination of steps should the DevOps engineer take to meet these requirements? (Choose three.)

Accepted Answer

Add a health check to the Amazon Route 53 alias record to evaluate the health of the primary region. Use AWS Lambda, configured with an Amazon CloudWatch Events trigger, to promote the Amazon RDS read replica in the disaster recovery region.

Accepted Answer

Create a new Application Load Balancer and Amazon EC2 Auto Scaling group in the disaster recovery region.

Accepted Answer

Deploy a read replica of the RDS instance in the disaster recovery region.

Answer

Extend the current Amazon EC2 Auto Scaling group to the subnets in the disaster recovery region.

Answer

Enable multi-region failover for the RDS configuration for the database instance.

Answer

Create an AWS Lambda function to evaluate the health of the primary region. If it fails, modify the Amazon Route 53 record to point at the disaster recovery region and promote the RDS read replica.

Question 30

A developer has written an application that writes data to Amazon DynamoDB. The DynamoDB table has been configured to use conditional writes. During peak usage times, writes are failing due to a ConditionalCheckFailedException error.How can the developer increase the application’s reliability when multiple clients are attempting to write to the same record?

Accepted Answer

Implement error retries and exponential backoff with jitter.

Answer

Write the data to an Amazon SNS topic.

Answer

Increase the amount of write capacity for the table to anticipate short-term spikes or bursts in write operations.

Answer

Implement a caching solution, such as DynamoDB Accelerator or Amazon ElastiCache.

Question 31

You need to perform ad-hoc business analytics queries on well-structured data. Data comes in constantly at a high velocity. Your business intelligence team can understand SQL. What AWS service(s) should you look to first?

Accepted Answer

Kinesis Firehose + RedShift

Answer

Kinesis Firehose + RDS

Answer

EMR using Hive

Answer

EMR running Apache Spark

Question 32

You need your CI to build AMIs with code pre-installed on the images on every new code push. You need to do this as cheaply as possible. How do you do this?

Accepted Answer

Bid on spot instances just above the asking price as soon as new commits come in, perform all instance configuration and setup, then create an AMI based on the spot instance.

Answer

Have the CI launch a new on-demand EC2 instance when new commits come in, perform all instance configuration and setup, then create an AMI based on the on-demand instance.

Answer

Purchase a Light Utilization Reserved Instance to save money on the continuous integration machine. Use these credits whenever your create AMIs on instances.

Answer

When the CI instance receives commits, attach a new EBS volume to the CI machine. Perform all setup on this EBS volume so you do not need a new EC2 instance to create the AMI.

Question 33

You work for a startup that has developed a new photo-sharing application for mobile devices. Over recent months, your application has increased in popularity; this has resulted in a decrease in the performance of the application clue to the increased load. Your application has a two-tier architecture that is composed of an Auto Scaling PHP application tier and a MySQL RDS instance initially deployed with AWS CloudFormation. Your Auto Scaling group has a min value of 4 and a max value of 8. The desired capacity is now at 8 because of the high CPU utilization of the instances. After some analysis, you are confident that the performance issues stem from a constraint in CPU capacity, although memory utilization remains low.You therefore decide to move from the general-purpose M3 instances to the compute-optimized C3 instances. How would you deploy this change while minimizing any interruption to your end users?

Accepted Answer

Update the launch configuration specified in the AWS CloudFormation template with the new C3 instance type. Also add an UpdatePolicy attribute to your Auto Scaling group that specifies AutoScalingRollingUpdate. Run a stack update with the new template.

Answer

Sign into the AWS Management Console, copy the old launch configuration, and create a new launch configuration that specifies the C3 instances. Update the Auto Scaling group with the new launch configuration. Auto Scaling will then update the instance type of all running instances.

Answer

Sign into the AWS Management Console, and update the existing launch configuration with the new C3 instance type. Add an UpdatePolicy attribute to your Auto Scaling group that specifies AutoScalingRollingUpdate.

Answer

Update the launch configuration specified in the AWS CloudFormation template with the new C3 instance type. Run a stack update with the new template. Auto Scaling will then update the instances with the new instance type.

Question 34

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts. The buildspec.yml file contains the following:<img alt="Amazon DOP-C01 image Question 234 3183 09162024005556000000"   width="382" height="116" src="https://examgecko.com/getfile/9aaf27c0-48f6-4232-811a-d85b296ab04b">The DevOps Engineer has noticed that anybody with an AWS account is able to download the artifacts. What steps should the DevOps Engineer take to stop this?

Accepted Answer

Modify the post_build to command to use –-acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only.

Answer

Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access.

Answer

Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal “*”

Answer

Modify the post_build command to remove –-acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only.

Question 35

A company is running an application on Amazon EC2 instances behind an ELB Application Load Balancer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones. After a recent application update, users are getting HTTP 502 Bad Gateway errors from the application URL. The DevOpsEngineer cannot analyze the problem because Auto Scaling is terminating all EC2 instances shortly after launch for beingunhealthy.What steps will allow the DevOps Engineer access to one of the unhealthy instances to troubleshoot the deployed application?

Accepted Answer

Add a lifecycle hook to your Auto Scaling group to move instances in the Terminating state to the Terminating:Wait state.

Answer

Create an image from the terminated instance and create a new instance from that image. The Application team can then log into the new instance.

Answer

As soon as a new instance is created by AutoScaling, put the instance into a Standby state as this will prevent the instance from being terminated.

Answer

Edit the Auto Scaling group to enable termination protection as this will protect unhealthy instances from being terminated.

Question 36

You have been tasked with deploying a solution for your company that will store images, which the marketing department will use for its campaigns. Employees are able to upload images via a web interface, and once uploaded, each image must be resized and watermarked with the company logo. Image resize and watermark is not time-sensitive and can be completed days after upload if required. How should you design this solution in the most highly available and cost- effective way?

Accepted Answer

Configure your web application to upload images to Amazon S3, and send the S3 object URI to an Amazon SQS queue. Create an Auto Scaling launch configuration that uses Spot instances, specifying a price you are willing to pay. Configure the instances in this Auto Scaling group to poll the Amazon SQS queue for new images and then resize and watermark the image before uploading the new images into Amazon S3 and deleting the message from the Amazon SQS queue.

Answer

Configure your web application to upload images to the Amazon Elastic Transcoder service. Use the Amazon Elastic Transcoder watermark feature to add the company logo as a watermark on your images and then to upload the final images into an Amazon S3 bucket.

Answer

Configure your web application to upload images to Amazon S3, and send the Amazon S3 bucket URI to an Amazon SQS queue. Create an Auto Scaling group and configure it to use Spot instances, specifying a price you are willing to pay.Configure the instances in this Auto Scaling group to poll the SQS queue for new images and then resize and watermark the image before uploading the final images into Amazon S3.

Answer

Configure your web application to upload images to the local storage of the web server. Create a cronjob to execute a script daily that scans this directory for new files and then uses the Amazon EC2 Service API to launch 10 new Amazon EC2 instances, which will resize and watermark the images daily.

Question 37

Your development team wants account-level access to production instances in order to do live debugging of a highly secure environment. Which of the following should you do?

Accepted Answer

Place each developer's own public key into a private S3 bucket, use instance profiles and configuration management to create a user account for each developer on all instances, and place the user's public keys into the appropriate account.

Answer

Place the credentials provided by Amazon Elastic Compute Cloud (EC2) into a secure Amazon Sample Storage Service (S3) bucket with encryption enabled. Assign AWS Identity and Access Management (IAM) users to each developer so they can download the credentials file.

Answer

Place an internally created private key into a secure S3 bucket with server-side encryption using customer keys and configuration management, create a service account on all the instances using this private key, and assign IAM users to each developer so they can download the file.

Answer

Place the credentials provided by Amazon EC2 onto an MFA encrypted USB drive, and physically share it with each developer so that the private key never leaves the office.

Question 38

A company is reviewing its IAM policies. One policy written by the DevOps Engineer has been flagged as too permissive. The policy is used by an AWS Lambda function that issues a stop command to Amazon EC2 instances tagged with Environment: NonProduction over the weekend. The current policy is:<img alt="Amazon DOP-C01 image Question 238 3187 09162024005556000000"   width="313" height="182" src="https://examgecko.com/getfile/b0871c12-e0e4-49ac-9a33-03116985d984">What changes should the Engineer make to achieve a policy of least permission? (Choose three.)

Accepted Answer

Accepted Answer

Question 39

An application is being deployed with two Amazon EC2 Auto Scaling groups, each configured with an Application Load Balancer. The application is deployed to one of the Auto Scaling groups and an Amazon Route 53 alias record is pointed to the Application Load Balancer of the last deployed Auto Scaling group. Deployments alternate between the two Auto Scaling groups. Home security devices are making requests into the application. The Development team notes that new requests are coming into the old stack days after the deployment. The issue is caused by devices that are not observing the Time to Live (TTL) setting on the Amazon Route 53 alias record.What steps should the DevOps Engineer take to address the issue with requests coming to the old stacks, while creating minimal additional resources?

Accepted Answer

Reduce the application to one Application Load Balancer. Create two target groups named Blue and Green. Create a rule on the Application Load Balancer pointed to a single target group. Add logic to the deployment to update the Application Load Balancer rule to the target group of the newly deployed Auto Scaling group.

Answer

Create a fleet of Amazon EC2 instances running HAProxy behind an Application Load Balancer. The HAProxy instances will proxy the requests to one of the existing Auto Scaling groups. After a deployment the HAProxy instances are updated to send requests to the newly deployed Auto Scaling group.

Answer

Move the application to an AWS Elastic Beanstalk application with two environments. Perform new deployments on the non-live environment. After a deployment, perform an Elastic Beanstalk CNAME swap to make the newly deployed environment the live environment.

Answer

Create an Amazon CloudFront distribution. Set the two existing Application Load Balancers as origins on the distribution. After a deployment, update the CloudFront distribution behavior to send requests to the newly deployed Auto Scaling group.

Question 40

You have a large number of web servers in an Auto Scaling group behind a load balancer. On an hourly basis, you want to filter and process the logs to collect data on unique visitors, and then put that data in a durable data store in order to run reports. Web servers in the Auto Scaling group are constantly launching and terminating based on your scaling policies, but you do not want to lose any of the log data from these servers during a stop/termination initiated by a user or by Auto Scaling.What two approaches will meet these requirements? (Choose two.)

Accepted Answer

Install an Amazon Cloudwatch Logs Agent on every web server during the bootstrap process. Create a CloudWatch log group and define Metric Filters to create custom metrics that track unique visitors from the streaming web server logs. Create a scheduled task on an Amazon EC2 instance that runs every hour to generate a new report based on the Cloudwatch custom metrics.

Accepted Answer

On the web servers, create a scheduled task that executes a script to rotate and transmit the logs to an Amazon S3 bucket. Ensure that the operating system shutdown procedure triggers a logs transmission when the Amazon EC2 instance is stopped/terminated. Use AWS Data Pipeline to move log data from the Amazon S3 bucket to Amazon Redshift In order to process and run reports every hour.

Answer

On the web servers, create a scheduled task that executes a script to rotate and transmit the logs to Amazon Glacier. Ensure that the operating system shutdown procedure triggers a logs transmission when the Amazon EC2 instance is stopped/terminated. Use Amazon Data Pipeline to process the data in Amazon Glacier and run reports every hour.

Answer

Install an AWS Data Pipeline Logs Agent on every web server during the bootstrap process. Create a log group object in AWS Data Pipeline, and define Metric Filters to move processed log data directly from the web servers to Amazon Redshift and run reports every hour.

Amazon DOP-C01 Practice Test 6

Amazon DOP-C01 Practice Tests