Free Amazon DOP-C02 Exam Questions

Question 1

A multinational insurance firm has recently consolidated its multiple AWS accounts using AWS Organizations with several Organizational units (OUs) that group each department of the firm. Their IT division consists of two teams: the DevOps team and the Release & Deployment team. The first one is responsible for protecting its cloud infrastructure and ensuring that all of its AWS resources are compliant, while the latter is responsible for deploying new applications to AWS Cloud. The DevOps team has been instructed to set up a system that regularly checks if all of the running EC2 instances are using an approved AMI. However, the solution should not stop the Release & Deployment team from deploying an EC2 instance running on a non-approved AMI for their release process. The DevOps team must build a notification system that sends the compliance state of the AWS resources to improve and maintain the security of their cloud resources.

Which of the following is the MOST suitable solution that the DevOps team should implement?

A : t up an AWS Config Managed Rule and specify a list of approved AMI IDs. Modify the rule to check whether the running Amazon EC2 instances are using specified AMIs. Configure AWS Config to stream configuration changes and notifications to an Amazon SNS topic which will send a notification to both teams for non-compliant instances.

B : rify whether the running EC2 instances in your VPCs are using approved AMIs using Trusted Advisor checks. Set up a CloudWatch alarm and integrate it with the Trusted Advisor metrics that will check all of the AMIs being used by your Amazon EC2 instances and that will send a notification to both teams if there is a running instance which uses an unapproved AMI.

C : tomatically check all of the AMIs that are being used by your EC2 instances using the Amazon Inspector service. Use an SNS topic that will send a notification to both the DevOps and Release & Deployment teams if there is a non-compliant EC2 instance running in their VPCs.

D : ign a Service Control Policy and an IAM policy that restricts the AWS accounts and the development team from launching an EC2 instance using an unapproved AMI. Set up a CloudWatch alarm that will automatically notify the DevOps team if there are non-compliant EC2 instances running in their VPCs.

Answer: A

Question 2

A DevOps engineer is implementing governance controls for a company that requires its infrastructure to be

housed within the United States. The engineer must restrict which AWS Regions can be used, and ensure an

alert is sent as soon as possible if any activity outside the governance policy takes place. The controls should

be automatically enabled on any new Region outside the United States (US).

Which combination of actions will meet these requirements? (Select TWO.)

A : Create an AWS Organizations SCP that denies access to all non-global services in non-US Regions. Attach the policy to the root of the organization.

B : Configure AWS CloudTrail to send logs to Amazon CloudWatch Logs and enable it for all Regions. Use a CloudWatch Logs metric filter to send an alert on any service activity in non-US Regions.

C : Use an AWS Lambda function that checks for AWS service activity and deploy it to all Regions. Write an Amazon EventBridge rule that runs the Lambda function every hour, sending an alert if activity is found in a non-US Region.

D : Use an AWS Lambda function to query Amazon Inspector to look for service activity in non-US Regions and send alerts if any activity is found.

E : Write an SCP using the aws: RequestedRegion condition key limiting access to US Regions. Apply the policy to all users, groups, and roles

Answer: A,B

Question 3

The company's DevOps engineer discovered that the errors were caused by RDS connection limits being reached. The DevOps engineer also discovered that more than 90% of the API requests are GET requests that read from the DB cluster. How should the DevOps engineer solve this problem with the LEAST development effort?

A : Migrate from Amazon RDS to Amazon DynamoDB. Add an Amazon CloudFront distribution in front of the API Gateway REST API.

B : Add a proxy from Amazon RDS Proxy in front of the RDS DB cluster. Enable API caching in API Gateway.

C : Add an Amazon RDS Proxy in front of the RDS database cluster. Provision an Amazon ElastiCache (Redis OSS) cluster.

D : Migrate from Amazon RDS to Amazon DynamoDB. Enable API caching in API Gateway.

Answer: B

Question 4

A company's DevOps engineer is creating an AWS Lambda function to process notifications from an Amazon Simple Notification Service (Amazon SNS) topic. The Lambda function will process the notification messages and will write the contents of the notification messages to an Amazon RDS Multi-AZ DB instance. During testing a database administrator accidentally shut down the DB instance. While the database was down the company lost several of the SNS notification messages that were delivered during that time. The DevOps engineer needs to prevent the loss of notification messages in the future Which solutions will meet this requirement? (Select TWO.)

A : Replace the RDS Multi-AZ DB instance with an Amazon DynamoDB table.

B : Configure an Amazon Simple Queue Service (Amazon SQS) queue as a destination of the Lambda function.

C : Configure an Amazon Simple Queue Service (Amazon SQS> dead-letter queue for the SNS topic.

D : Subscribe an Amazon Simple Queue Service (Amazon SQS) queue to the SNS topic Configure the Lambda function to process messages from the SQS queue.

E : Replace the SNS topic with an Amazon EventBridge event bus Configure an EventBridge rule on the new event bus to invoke the Lambda function for each event.

Answer: C,D

Question 5

A company’s DevOps engineer is working in a multi-account environment. The company uses AWS Transit Gateway to route all outbound traffic through a network operations account. In the network operations account, all account traffic passes through a firewall appliance for inspection before the traffic goes to an internet gateway.

The firewall appliance sends logs to Amazon CloudWatch Logs and includes event severities of CRITICAL, HIGH, MEDIUM, LOW, and INFO. The security team wants to receive an alert if any CRITICAL events occur.

What should the DevOps engineer do to meet these requirements?

A : eate an Amazon CloudWatch Synthetics canary to monitor the firewall state. If the firewall reaches a CRITICAL state or logs a CRITICAL event, use a CloudWatch alarm to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team’s email address to the topic.

B : eate an Amazon CloudWatch metric filter by using a search for CRITICAL events. Publish a custom metric for the finding. Use a CloudWatch alarm based on the custom metric to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team’s email address to the topic.

C : able Amazon GuardDuty in the network operations account. Configure GuardDuty to monitor flow logs. Create an Amazon EventBridge event rule that is invoked by GuardDuty events that are CRITICAL. Define an Amazon Simple Notification Service (Amazon SNS) topic as a target. Subscribe the security team’s email address to the topic.

D : AWS Firewall Manager to apply consistent policies across all accounts. Create an Amazon EventBridge event rule that is invoked by Firewall Manager events that are CRITICAL. Define an Amazon Simple Notification Service (Amazon SNS) topic as a target. Subscribe the security team’s email address to the topic.

Answer: B