Free AWS DOP-C02 Practice Questions & Answers 2026 Part2

Question #1

A company wants to migrate its content sharing web application hosted on Amazon EC2 to a serverless architecture. The company currently deploys changes to its application by creating a new Auto Scaling group of EC2 instances and a new Elastic Load Balancer, and then shifting the tra c away using an Amazon Route53 weighted routing policy.For its new serverless application, the company is planning to use Amazon API Gateway and AWS Lambda. The company will need to update its deployment processes to work with the new application. It will also need to retain the ability to test new features on a small number of users before rolling the features out to the entire user base.Which deployment strategy will meet these requirements?

A. Use AWS CDK to deploy API Gateway and Lambda functions

B. Use AWS CloudFormation to deploy API Gateway and Lambda functions using Lambda function versions

C. Use AWS Elastic Beanstalk to deploy API Gateway and Lambda functions

D. Use AWS OpsWorks to deploy API Gateway in the service layer and Lambda functions in a custom layer

View answer

Correct Answer: B

Question #2

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #3

A DevOps engineer needs to apply a core set of security controls to an existing set of AWS accounts. The accounts are in an organization in AWS Organizations. Individual teams will administer individual accounts by using the AdministratorAccess AWS managed policy. For all accounts. AWS CloudTrail and AWS Config must be turned on in all available AWS Regions. Individual account administrators must not be able to edit or delete any of the baseline resources. However, individual account administrators must be able to edit or delete theirown CloudTrail trails and AWS Config rules.Which solution will meet these requirements in the MOST operationally efficient way?

A. Create an AWS CloudFormation template that defines the standard account resources

B. Enable AWS Control Tower

C. Designate an AWS Config management account

D. Create an AWS CloudFormation template that defines the standard account resources

View answer

Correct Answer: D

Question #4

A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account.The company has created an AWS Key Management Service (AWS KMS) key in the source account.Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)

A. n the source account, copy the unencrypted AMI to an encrypted AMI

B. n the source account, copy the unencrypted AMI to an encrypted AMI

C. n the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account

D. n the source account, modify the key policy to give the target account permissions to create a grant

E. n the source account, share the unencrypted AMI with the target account

F. n the source account, share the encrypted AMI with the target account

View answer

Correct Answer: ADF

Question #5

A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration

D. Use AWS Elastic Beanstalk with the con guration set to Immutable

View answer

Correct Answer: D

Question #6

A development team wants to use AWS CloudFormation stacks to deploy an application. However, the developer IAM role does not have the required permissions to provision the resources that are specified in the AWS CloudFormation template. A DevOps engineer needs to implement a solution that allows the developers to deploy the stacks. The solution must follow the principle of least privilege.Which solution will meet these requirements?

A. Create an IAM policy that allows the developers to provision the required resources

B. Create an IAM policy that allows full access to AWS CloudFormation

C. Create an AWS CloudFormation service role that has the required permissions

D. Create an AWS CloudFormation service role that has the required permissions

View answer

Correct Answer: D

Question #7

A DevOps team manages an API running on-premises that serves as a backend for an Amazon API Gateway endpoint. Customers have been complaining about high response latencies, which the development team has veri ed using the API Gateway latency metrics in Amazon CloudWatch. To identify the cause, the team needs to collect relevant data without introducing additional latency.Which actions should be taken to accomplish this? (Choose two.)

A. Install the CloudWatch agent server side and con gure the agent to upload relevant logs to CloudWatch

B. Enable AWS X-Ray tracing in API Gateway, modify the application to capture request segments, and upload those segments to X-Ray during each request

C. Enable AWS X-Ray tracing in API Gateway, modify the application to capture request segments, and use the X-Ray daemon to upload segments to X-Ray

D. Modify the on-premises application to send log information back to API Gateway with each request

E. Modify the on-premises application to calculate and upload statistical data relevant to the API service requests to CloudWatch metrics

View answer

Correct Answer: AC

Question #8

A DevOps engineer is creating an AWS CloudFormation template to deploy a web service. The web service will run on Amazon EC2 instances in a private subnet behind an Application Load Balancer (ALB). The DevOps engineer must ensure that the service can accept requests from clients that have IPv6 addresses.What should the DevOps engineer do with the CloudFormation template so that IPv6 clients can access theweb service?

A. Add an IPv6 CIDR block to the VPC and the private subnet for the EC2 instances

B. Assign each EC2 instance an IPv6 Elastic IP address

C. Replace the ALB with a Network Load Balancer (NLB)

D. Add an IPv6 CIDR block to the VPC and subnets for the ALB

View answer

Correct Answer: D

Question #9

A company that uses electronic health records is running a fleet of Amazon EC2 instances with an Amazon Linux operating system. As part of patient privacy requirements, the company must ensure continuous compliance for patches for operating system and applications running on the EC2 instances.How can the deployments of the operating system and application patches be automated using a default and custom repository?

A. se AWS Systems Manager to create a new patch baseline including the custom repository

B. se AWS Direct Connect to integrate the corporate repository and deploy the patches using Amazon CloudWatch scheduled events, then use the CloudWatch dashboard to create reports

C. se yum-config-manager to add the custom repository under /etc/yum

D. se AWS Systems Manager to create a new patch baseline including the corporate repository

View answer

Correct Answer: A

Question #10

A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?

A. Use AWS Systems Manager Con guration Compliance

B. Use custom Java code running on an EC2 instance

C. Use AWS Con g

D. Use AWS CloudTrail

View answer

Correct Answer: C

Question #11

A company is implementing an Amazon Elastic Container Service (Amazon ECS) cluster to run its workload. The company architecture will run multiple ECS services on the cluster. The architecture includes an Application Load Balancer on the front end and uses multiple target groups to route traffic.A DevOps engineer must collect application and access logs. The DevOps engineer then needs to send the logs to an Amazon S3 bucket for near-real-time analysis.Which combination of steps must the DevOps engineer take to meet these requirements? (Choose three.)

A. Download the Amazon CloudWatch Logs container instance from AWS

B. Install the Amazon CloudWatch Logs agent on the ECS instances

C. Use Amazon EventBridge to schedule an AWS Lambda function that will run every 60 seconds and will run the Amazon CloudWatch Logs create-export-task command

D. Activate access logging on the ALB

E. Activate access logging on the target groups that the ECS services use

F. Create an Amazon Kinesis Data Firehose delivery stream that has a destination of the logging S3 bucket

View answer

Correct Answer: BDF

Question #12

A development team is using AWS CodeCommit to version control application code and AWS CodePipeline to orchestrate software deployments. The team has decided to use a remote main branch as the trigger for the pipeline to integrate code changes. A developer has pushed code changes to the CodeCommit repository, but noticed that the pipeline had no reaction, even after 10 minutes.Which of the following actions should be taken to troubleshoot this issue?

A. Check that an Amazon EventBridge rule has been created for the main branch to trigger the pipeline

B. Check that the CodePipeline service role has permission to access the CodeCommit repository

C. Check that the developer's IAM role has permission to push to the CodeCommit repository

D. Check to see if the pipeline failed to start because of CodeCommit errors in Amazon CloudWatch Logs

View answer

Correct Answer: A

Question #13

A space exploration company receives telemetry data from multiple satellites. Small packets of data are received through Amazon API Gateway and are placed directly into an Amazon Simple Queue Service (Amazon SQS) standard queue. A custom application is subscribed to the queue and transforms the data into a standard format.Because of inconsistencies in the data that the satellites produce, the application is occasionally unable to transform the data. In these cases, the messages remain in the SQS queue. A DevOps engineer must develop a solution that retains the failed messages and makes them available to scientists for review and future processing.Which solution will meet these requirements?

A. Configure AWS Lambda to poll the SQS queue and invoke a Lambda function to check whether the queue messages are valid

B. Convert the SQS standard queue to an SQS FIFO queue

C. Create an SQS dead-letter queue

D. Configure API Gateway to send messages to different SQS virtual queues that are named for each of the satellites

View answer

Correct Answer: C

Question #14

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #15

A company requires that its internally facing web application be highly available. The architecture is made up of one Amazon EC2 web server instance and one NAT instance that provides outbound internet access for updates and accessing public data.Which combination of architecture adjustments should the company implement to achieve high availability? (Choose two.)

A. Add the NAT instance to an EC2 Auto Scaling group that spans multiple Availability Zones

B. Create additional EC2 instances spanning multiple Availability Zones

C. Configure an Application Load Balancer in front of the EC2 instance

D. Replace the NAT instance with a NAT gateway in each Availability Zone

E. Replace the NAT instance with a NAT gateway that spans multiple Availability Zones

View answer

Correct Answer: BD

Question #16

A company has an on-premises application that is written in Go. A DevOps engineer must move the application to AWS. The company's development team wants to enable blue/green deployments and perform A/B testing.Which solution will meet these requirements?

A. Deploy the application on an Amazon EC2 instance, and create an AMI of the instance

B. Use Amazon Lightsail to deploy the application

C. Use AWS CodeArtifact to store the application code

D. Use AWS Elastic Beanstalk to host the application

View answer

Correct Answer: D

Question #17

A video-sharing company stores its videos in Amazon S3. The company has observed a sudden increase in video access requests, but the company does not know which videos are most popular. The company needs to identify the general access pattern for the video files. This pattern includes the number of users who access a certain file on a given day, as well as the number of pull requests for certain files.How can the company meet these requirements with the LEAST amount of effort?

A. Activate S3 server access logging

B. Activate S3 server access logging

C. Invoke an AWS Lambda function for every S3 object access event

D. Record an Amazon CloudWatch Logs log message for every S3 object access event

View answer

Correct Answer: B

Question #18

A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration

D. Use AWS Elastic Beanstalk with the con guration set to Immutable

View answer

Correct Answer: D

Question #19

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #20

A company is creating a software solution that executes a speci c parallel-processing mechanism. The software can scale to tens of servers in some special scenarios. This solution uses a proprietary library that is license-based, requiring that each individual server have a single, dedicated license installed. The company has 200 licenses and is planning to run 200 server nodes concurrently at most.The company has requested the following features:A mechanism to automate the use of the licenses at scale.Creation of a dashboard to use in the future to verify which licenses are available at any moment.What is the MOST effective way to accomplish these requirements?

A. Upload the licenses to a private Amazon S3 bucket

B. Upload the licenses to an Amazon DynamoDB table

C. Upload the licenses to a private Amazon S3 bucket

D. Upload the licenses to an Amazon DynamoDB table

View answer

Correct Answer: B

Question #21

A company has an organization in AWS Organizations. The organization includes workload accounts that contain enterprise applications. The company centrally manages users from an operations account. No users can be created in the workload accounts. The company recently added an operations team and must provide the operations team members with administrator access to each workload account.Which combination of actions will provide this access? (Choose three.)

A. Create a SysAdmin role in the operations account

B. Create a SysAdmin role in each workload account

C. Create an Amazon Cognito identity pool in the operations account

D. In the operations account, create an IAM user for each operations team member

E. In the operations account, create an IAM user group that is named SysAdmins

F. Create an Amazon Cognito user pool in the operations account

View answer

Correct Answer: BDE

Question #22

A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet regulatory compliance requirements. The security team wants to be notified when any keys have not been rotated after 90 days.Which solution will accomplish this?

A. Configure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old

B. Configure an Amazon EventBridge event to launch an AWS Lambda function to call the AWS Trusted Advisor API and publish to an Amazon Simple Notification Service (Amazon SNS) topic

C. Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old

D. Configure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old

View answer

Correct Answer: C

Question #23

A company's DevOps engineer is working in a multi-account environment. The company uses AWS Transit Gateway to route all outbound tra c through a network operations account. In the network operations account, all account tra c passes through a rewall appliance for inspection before the tra c goes to an internet gateway.The rewall appliance sends logs to Amazon CloudWatch Logs and includes event severities of CRITICAL, HIGH, MEDIUM, LOW, and INFO. The security team wants to receive an alert if any CRITICAL events occur.What should the DevOps engineer do to meet these requirements?

A. Create an Amazon CloudWatch Synthetics canary to monitor the rewall state

B. Create an Amazon CloudWatch mettic lter by using a search for CRITICAL events

C. Enable Amazon GuardDuty in the network operations account

D. Use AWS Firewall Manager to apply consistent policies across all accounts

View answer

Correct Answer: B

Question #24

A company's application is currently deployed to a single AWS Region. Recently, the company opened a new office on a different continent. The users in the new office are experiencing high latency. The company's application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) and uses Amazon DynamoDB as the database layer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones. A DevOps engineer is tasked with minimizing application response times and improving availability for users in both Regions.Which combination of actions should be taken to address the latency issues? (Choose three.)

A. Create a new DynamoDB table in the new Region with cross-Region replication enabled

B. Create new ALB and Auto Scaling group global resources and configure the new ALB to direct traffic to the new Auto Scaling group

C. Create new ALB and Auto Scaling group resources in the new Region and configure the new ALB to direct traffic to the new Auto Scaling group

D. Create Amazon Route 53 records, health checks, and latency-based routing policies to route to the ALB

E. Create Amazon Route 53 aliases, health checks, and failover routing policies to route to the ALB

F. Convert the DynamoDB table to a global table

View answer

Correct Answer: CDF

Question #25

A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, dally, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes.A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified.Which solution will meet these requirements?

A. Set up AWS Config in the account

B. Set up AWS Config in the account

C. Turn on AWS CloudTrail in the account

D. Turn on AWS CloudTrail in the account

View answer

Correct Answer: B

Question #26

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #27

A company is using AWS CodePipeline to automate its release pipeline. AWS CodeDeploy is being used in the pipeline to deploy an application to Amazon ECS using the blue/green deployment model. The company wants to implement scripts to test the green version of the application before shifting tra c. These scripts will complete in 5 minutes or less. If errors are discovered during these tests, the application must be rolled back.Which strategy will meet these requirements?

A. Add a stage to the CodePipeline pipeline between the source and deploy stages

B. Add a stage to the CodePipeline pipeline between the source and deploy stages

C. Add a hooks section to the CodeDeploy AppSpec le

D. Add a hooks section to the CodeDeploy AppSpec le

View answer

Correct Answer: C

Question #28

A DevOps engineer is supporting early-stage development for a developer platform running on Amazon EKS.Recently, the platform has experienced an increased rate of container restart failures. The DevOps engineer wants diagnostic information to isolate and resolve issues.Which solution will meet this requirement?

A. onfigure Amazon CloudWatch Container Insights for the EKS cluster by enabling the CloudWatch Observability add-on

B. onfigure CloudTrail Insights for the EKS cluster

C. onfigure CloudWatch dashboards using default EKS service metrics

D. onfigure AWS CloudTrail for the EKS cluster

View answer

Correct Answer: A

Question #29

A company wants to set up a continuous delivery pipeline. The company stores application code in a private GitHub repository. The company needs to deploy the application components to Amazon Elastic Container Service (Amazon ECS), Amazon EC2, and AWS Lambda. The pipeline must support manual approval actions.Which solution will meet these requirements?

A. Use AWS CodePipeline with Amazon ECS, Amazon EC2, and Lambda as deploy providers

B. Use AWS CodePipeline with AWS CodeDeploy as the deploy provider

C. Use AWS CodePipeline with AWS Elastic Beanstalk as the deploy provider

D. Use AWS CodeDeploy with GitHub integration to deploy the application

View answer

Correct Answer: B

Question #30

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #31

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #32

A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?

A. Auto Scaling groups can create new instances in a single AZ only

B. The EC2 instances have not been manually associated to the AL

C. The ALB should be replaced with a Network Load Balancer (NLB)

D. The new AZ has not been added to the ALB

View answer

Correct Answer: D

Question #33

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #34

A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?

A. Use AWS Systems Manager Con guration Compliance

B. Use custom Java code running on an EC2 instance

C. Use AWS Con g

D. Use AWS CloudTrail

View answer

Correct Answer: C

Question #35

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #36

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?

A. Failed deploy and build actions across all the pipelines

B. All rejected or failed approval actions across all the pipelines

C. All the events across all pipelines

D. Approval actions across all the pipelines

View answer

Correct Answer: B

Question #37

A company’s security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are included in a single organization in AWS Organizations. The company has configured AWS Config for the organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS WAF web ACLs.Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)

A. Delegate AWS Firewall Manager to a security account

B. Delegate Amazon GuardDuty to a security account

C. Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

D. Create an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

E. Configure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

View answer

Correct Answer: AC

Question #38

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #39

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?

A. Failed deploy and build actions across all the pipelines

B. All rejected or failed approval actions across all the pipelines

C. All the events across all pipelines

D. Approval actions across all the pipelines

View answer

Correct Answer: B

Question #40

A company runs an application on an Amazon Elastic Container Service (Amazon ECS) service by using the AWS Fargate launch type. The application consumes messages from an Amazon Simple Queue Service (Amazon SQS) queue. The application can take several minutes to process each message from the queue.When the application processes a message, the application reads a file from an Amazon S3 bucket and processes the data in the file. The application writes the processed output to a second S3 bucket. The company uses Amazon CloudWatch Logs to monitor processing errors and to ensure that the application processes messages successfully.The SQS queue typically receives a low volume of messages. However, occasionally the queue receives higher volumes of messages. A DevOps engineer needs to implement a solution to reduce the processing time of message bursts.Which solution will meet this requirement in the MOST cost-effective way?

A. egister the ECS service as a scalable target in AWS Application Auto Scaling

B. end messages to an Amazon EventBridge event bus instead of the SQS queue

C. ncrease the maximum number of messages that Amazon SQS requests to batch messages together

D. reate an Auto Scaling group of EC2 instances

View answer

Correct Answer: A

Question #41

A DevOps engineer is building a continuous deployment pipeline for a serverless application that uses AWS Lambda functions. The company wants to reduce the customer impact of an unsuccessful deployment. The company also wants to monitor for issues.Which deploy stage configuration will meet these requirements?

A. Use an AWS Serverless Application Model (AWS SAM) template to define the serverless application

B. Use AWS CloudFormation to publish a new stack update, and include Amazon CloudWatch alarms on all resources

C. Use AWS CloudFormation to publish a new version on every stack update, and include Amazon CloudWatch alarms on all resources

D. Use AWS CodeBuild to add sample event payloads for testing to the Lambda functions

View answer

Correct Answer: A

Question #42

A company has deployed an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 node groups. The company's DevOps team uses the Kubernetes Horizontal Pod Autoscaler and recently installed a supported EKS cluster Autoscaler.The DevOps team needs to implement a solution to collect metrics and logs of the EKS cluster to establish a baseline for performance. The DevOps team will create an initial set of thresholds for specific metrics and will update the thresholds over time as the cluster is used. The DevOps team must receive an Amazon Simple Notification Service (Amazon SNS) email notification if the initial set of thresholds is exceeded or if the EKS cluster Autoscaler is not functioning properly.The solution must collect cluster, node, and pod metrics. The solution also must capture logs in Amazon CloudWatch.Which combination of steps should the DevOps team take to meet these requirements? (Select THREE.)

A. Deploy the CloudWatch agent and Fluent Bit to the cluster

B. Deploy AWS Distro for OpenTelemetry to the cluster

C. Create CloudWatch alarms to monitor the CPU, memory, and node failure metrics of the cluster

D. Create a CloudWatch composite alarm to monitor a metric log filter of the CPU, memory, and node metrics of the cluster

E. Create a CloudWatch alarm to monitor the logs of the Autoscaler deployments for errors

F. Create a CloudWatch alarm to monitor a metric log filter of the Autoscaler deployments for errors

View answer

Correct Answer: ACF

Question #43

A company hosts its staging website using an Amazon EC2 instance backed with Amazon EBS storage. The company wants to recover quickly with minimal data losses in the event of network connectivity issues or power failures on the EC2 instance.Which solution will meet these requirements?

A. dd the instance to an EC2 Auto Scaling group with the minimum, maximum, and desired capacity set to 1

B. dd the instance to an EC2 Auto Scaling group with a lifecycle hook to detach the EBS volume when the EC2 instance shuts down or terminates

C. reate an Amazon CloudWatch alarm for the StatusCheckFailed System metric and select the EC2 action to recover the instance

D. reate an Amazon CloudWatch alarm for the StatusCheckFailed Instance metric and select the EC2 action to reboot the instance

View answer

Correct Answer: C

Question #44

A company is implementing an Amazon Elastic Container Service (Amazon ECS) cluster to run its workload. The company architecture will run multiple ECS services on the cluster. The architecture includes an Application Load Balancer on the front end and uses multiple target groups to route traffic.A DevOps engineer must collect application and access logs. The DevOps engineer then needs to send the logs to an Amazon S3 bucket for near-real-time analysis.Which combination of steps must the DevOps engineer take to meet these requirements? (Choose three.)

A. ownload the Amazon CloudWatch Logs container instance from AWS

B. nstall the Amazon CloudWatch Logs agent on the ECS instances

C. se Amazon EventBridge to schedule an AWS Lambda function that will run every 60 seconds and will run the Amazon CloudWatch Logs create-export-task command

D. ctivate access logging on the ALB

E. ctivate access logging on the target groups that the ECS services use

F. reate an Amazon Kinesis Data Firehose delivery stream that has a destination of the logging S3 bucket

View answer

Correct Answer: BDF

Question #45

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #46

A DevOps engineer used an AWS CloudFormation custom resource to set up AD Connector. The AWS Lambda function executed and created AD Connector, butCloudFormation is not transitioning from CREATE_IN_PROGRESS to CREATE_COMPLETE.Which action should the engineer take to resolve this issue?

A. Ensure the Lambda function code has exited successfully

B. Ensure the Lambda function code returns a response to the pre-signed URL

C. Ensure the Lambda function IAM role has cloudformation:UpdateStack permissions for the stack ARN

D. Ensure the Lambda function IAM role has ds:ConnectDirectory permissions for the AWS account

View answer

Correct Answer: B

Question #47

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #48

A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?

A. Auto Scaling groups can create new instances in a single AZ only

B. The EC2 instances have not been manually associated to the AL

C. The ALB should be replaced with a Network Load Balancer (NLB)

D. The new AZ has not been added to the ALB

View answer

Correct Answer: D

Question #49

A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, dally, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes.A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified.Which solution will meet these requirements?

A. et up AWS Config in the account

B. et up AWS Config in the account

C. urn on AWS CloudTrail in the account

D. urn on AWS CloudTrail in the account

View answer

Correct Answer: B

Question #50

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #51

A company is using Amazon EC2 for various workloads. Company policy requires that instances be managed centrally to standardize con gurations. These con gurations include standard logging, metrics, security assessments, and weekly patching.How can the company meet these requirements? (Choose three.)

A. Use AWS Con g to ensure all EC2 instances are managed by Amazon Inspector

B. Use AWS Con g to ensure all EC2 instances are managed by AWS Systems Manager

C. Use AWS Systems Manager to install and manage Amazon Inspector, Systems Manager Patch Manager, and the Amazon CloudWatch agent on all instances

D. Use Amazon Inspector to install and manage AWS Systems Manager, Systems Manager Patch Manager, and the Amazon CloudWatch agent on all instances

E. Use AWS Systems Manager maintenance windows with Systems Manager Run Command to schedule Systems Manager Patch Manager tasks

F. Use AWS Systems Manager maintenance windows with Systems Manager Run Command to schedule Systems Manager Patch Manager tasks

View answer

Correct Answer: BCF

Question #52

A company has started using AWS across several teams. Each team has multiple accounts and unique security profiles. The company manages the accounts in an organization in AWS Organizations. Each account has its own configuration and security controls.

A. Use Organizations to create OUs that have appropriate SCPs attached for each team

B. Create an AWS Control Tower landing zone

C. Create AWS CloudFormation stack sets in the organization's management account

D. Configure AWS Config to manage the AWS Config rules across all AWS accounts in the organization

View answer

Correct Answer: B

Question #53

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #54

A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?

A. Auto Scaling groups can create new instances in a single AZ only

B. The EC2 instances have not been manually associated to the AL

C. The ALB should be replaced with a Network Load Balancer (NLB)

D. The new AZ has not been added to the ALB

View answer

Correct Answer: D

Question #55

A company uses a series of individual Amazon Cloud Formation templates to deploy its multi-Region Applications. These templates must be deployed in a specific order. The company is making more changes to the templates than previously expected and wants to deploy new templates more efficiently. Additionally, the data engineering team must be notified of all changes to the templates.What should the company do to accomplish these goals?

A. Create an AWS Lambda function to deploy the Cloud Formation templates m the required order Use stack policies to alert the data engineering team

B. Host the Cloud Formation templates in Amazon S3 Use Amazon S3 events to directly trigger CloudFormation updates and Amazon SNS notifications

C. Implement CloudFormation StackSets and use drift detection to trigger update alerts to the data engineering team

D. Leverage CloudFormation nested stacks and stack sets (or deployments Use Amazon SNS to notify the data engineering team

View answer

Correct Answer: D

Question #56

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #57

A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?

A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3

B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs

C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place

D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3

View answer

Correct Answer: D

Question #58

A company is implementing a well-architected design for its globally accessible API stack. The design needs to ensure both high reliability and fast response times for users located in North America and Europe.The API stack contains the following three tiers:Amazon API GatewayAWS LambdaAmazon DynamoDBWhich solution will meet the requirements?

A. Configure Amazon Route 53 to point to API Gateway APIs in North America and Europe using health checks

B. Configure Amazon Route 53 to point to API Gateway APIs in North America and Europe using latency- based routing and health checks

C. Configure Amazon Route 53 to point to API Gateway in North America, create a disaster recovery API in Europe, and configure both APIs to forward requests to the Lambda functions in that Region

D. Configure Amazon Route 53 to point to API Gateway API in North America using latency-based routing

View answer

Correct Answer: B

Question #59

A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?

A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3

B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs

C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place

D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3

View answer

Correct Answer: D

Question #60

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #61

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

A. Filter the data through AWS X-Ray to visualize the data

B. Filter the data through Amazon QuickSight to visualize the data

C. Query the data with Amazon Athena

D. Query the data with Amazon Redshift

E. Use AWS Glue as the persistent metadata store

F. Use Amazon S3 as the persistent metadata store

View answer

Correct Answer: BCE

Question #62

A DevOps engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2 Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second fleet of instances with the same capacity as the original fleet.Maintains the original fleet unchanged while the second fleet is launched.Transitions traffic to the second fleet when the second fleet is fully deployed.Terminates the original fleet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group configured with a blue/green deployment configuration Select the option Terminate the original instances in the deployment group with a waiting period of 1 hour

D. Use AWS Elastic Beanstalk with the configuration set to Immutable

View answer

Correct Answer: C

Question #63

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

A. Filter the data through AWS X-Ray to visualize the data

B. Filter the data through Amazon QuickSight to visualize the data

C. Query the data with Amazon Athena

D. Query the data with Amazon Redshift

E. Use AWS Glue as the persistent metadata store

F. Use Amazon S3 as the persistent metadata store

View answer

Correct Answer: BCE

Question #64

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #65

A company's application development team uses Linux-based Amazon EC2 instances as bastion hosts. Inbound SSH access to the bastion hosts is restricted to specific IP addresses, as defined in the associated security groups. The company's security team wants to receive a notification if the security group rules are modified to allow SSH access from any IP address.What should a DevOps engineer do to meet this requirement?

A. Create an Amazon EventBridge rule with a source of aws

B. Enable Amazon GuardDuty and check the findings for security groups in AWS Security Hub

C. Create an AWS Config rule by using the restricted-ssh managed rule to check whether security groups disallow unrestricted incoming SSH traffic

D. Enable Amazon Inspector

View answer

Correct Answer: C

Question #66

A DevOps engineer is building a multistage pipeline with AWS CodePipeline to build, verify, stage, test, and deploy an application. A manual approval stage is required between the test stage and the deploy stage. The development team uses a custom chat tool with webhook support that requires near-real-time notifications.How should the DevOps engineer configure status updates for pipeline activity and approval requests to post to the chat tool?

A. Create an Amazon CloudWatch Logs subscription that filters on CodePipeline Pipeline Execution State Change

B. Create an AWS Lambda function that is invoked by AWS CloudTrail events

C. Create an Amazon EventBridge rule that filters on CodePipeline Pipeline Execution State Change

D. Modify the pipeline code to send the event details to the chat webhook URL at the end of each stage

View answer

Correct Answer: C

Question #67

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #68

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #69

A DevOps Engineer must track the health of a stateless RESTful service sitting behind a Classic Load Balancer. The deployment of new application revisions is through a CI/CD pipeline. If the service's latency increases beyond a de ned threshold, deployment should be stopped until the service has recovered.Which of the following methods allow for the QUICKEST detection time?

A. Use Amazon CloudWatch metrics provided by Elastic Load Balancing to calculate average latency

B. Use AWS Lambda and Elastic Load Balancing access logs to detect average latency

C. Use AWS CodeDeploy's MinimumHealthyHosts setting to de ne thresholds for rolling back deployments

D. Use Metric Filters to parse application logs in Amazon CloudWatch Logs

View answer

Correct Answer: A

Question #70

A company has deployed an application in a production VPC in a single AWS account. The application is popular and is experiencing heavy usage. The company's security team wants to add additional security, such as AWS WAF, to the application deployment. However, the application's product manager is concerned about cost and does not want to approve the change unless the security team can prove that additional security is necessary.The security team believes that some of the application's demand might come from users that have IP addresses that are on a deny list. The security team provides the deny list to a DevOps engineer. If any of the IP addresses on the deny list access the application, the security team wants to receive automated notification in near real time so that the security team can document that the application needs additional security. The DevOps engineer creates a VPC flow log for the production VPC.Which set of additional steps should the DevOps engineer take to meet these requirements MOST cost- effectively?

A. Create a log group in Amazon CloudWatch Logs

B. Create an Amazon S3 bucket for log files

C. Create an Amazon S3 bucket for log files

D. Create a log group in Amazon CloudWatch Logs

View answer

Correct Answer: A

Question #71

A company runs an application on one Amazon EC2 instance. Application metadata is stored in Amazon S3 and must be retrieved if the instance is restarted. The instance must restart or relaunch automatically if the instance becomes unresponsive.Which solution will meet these requirements?

A. Create an Amazon CloudWatch alarm for the StatusCheckFailed metric

B. Configure AWS OpsWorks, and use the auto healing feature to stop and start the instance

C. Use EC2 Auto Recovery to automatically stop and start the instance in case of a failure

D. Use AWS CloudFormation to create an EC2 instance that includes the UserData property for the EC2 resource

View answer

Correct Answer: B

Question #72

A company that uses electronic health records is running a fleet of Amazon EC2 instances with an Amazon Linux operating system. As part of patient privacy requirements, the company must ensure continuous compliance for patches for operating system and applications running on the EC2 instances.How can the deployments of the operating system and application patches be automated using a default and custom repository?

A. Use AWS Systems Manager to create a new patch baseline including the custom repository

B. Use AWS Direct Connect to integrate the corporate repository and deploy the patches using Amazon CloudWatch scheduled events, then use the CloudWatch dashboard to create reports

C. Use yum-config-manager to add the custom repository under /etc/yum

D. Use AWS Systems Manager to create a new patch baseline including the corporate repository

View answer

Correct Answer: A

Question #73

A company requires that its internally facing web application be highly available. The architecture is made up of one Amazon EC2 web server instance and one NAT instance that provides outbound internet access for updates and accessing public data.Which combination of architecture adjustments should the company implement to achieve high availability? (Choose two.)

A. dd the NAT instance to an EC2 Auto Scaling group that spans multiple Availability Zones

B. reate additional EC2 instances spanning multiple Availability Zones

C. onfigure an Application Load Balancer in front of the EC2 instance

D. eplace the NAT instance with a NAT gateway in each Availability Zone

E. eplace the NAT instance with a NAT gateway that spans multiple Availability Zones

View answer

Correct Answer: BD

Question #74

On which local address does the Docker DNS server listen?

A. 127

B. 127

C. 127

D. 127

View answer

Correct Answer: D

Question #75

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?

A. Failed deploy and build actions across all the pipelines

B. All rejected or failed approval actions across all the pipelines

C. All the events across all pipelines

D. Approval actions across all the pipelines

View answer

Correct Answer: B

Question #76

A company hosts its staging website using an Amazon EC2 instance backed with Amazon EBS storage. The company wants to recover quickly with minimal data losses in the event of network connectivity issues or power failures on the EC2 instance.Which solution will meet these requirements?

A. Add the instance to an EC2 Auto Scaling group with the minimum, maximum, and desired capacity set to 1

B. Add the instance to an EC2 Auto Scaling group with a lifecycle hook to detach the EBS volume when the EC2 instance shuts down or terminates

C. Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric and select the EC2 action to recover the instance

D. Create an Amazon CloudWatch alarm for the StatusCheckFailed_Instance metric and select the EC2 action to reboot the instance

View answer

Correct Answer: C

Question #77

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #78

A company is using an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured with a single DB instance. The application performs read and write operations on the database by using the cluster's instance endpoint.The company has scheduled an update to be applied to the cluster during an upcoming maintenance window. The cluster must remain available with the least possible interruption during the maintenance window.What should a DevOps engineer do to meet these requirements?

A. Add a reader instance to the Aurora cluster

B. Add a reader instance to the Aurora cluster

C. Turn on the Multi-AZ option on the Aurora cluster

D. Turn on the Multi-AZ option on the Aurora cluster

View answer

Correct Answer: A

Question #79

A company uses an Amazon Aurora PostgreSQL global database that has two secondary AWS Regions. A DevOps engineer has configured the database parameter group to guarantee an RPO of 60 seconds. Write operations on the primary cluster are occasionally blocked because of the RPO setting.The DevOps engineer needs to reduce the frequency of blocked write operations.Which solution will meet these requirements?

A. Add an additional secondary cluster to the global database

B. Enable write forwarding for the global database

C. Remove one of the secondary clusters from the global database

D. Configure synchronous replication for the global database

View answer

Correct Answer: C

Question #80

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

A. Filter the data through AWS X-Ray to visualize the data

B. Filter the data through Amazon QuickSight to visualize the data

C. Query the data with Amazon Athena

D. Query the data with Amazon Redshift

E. Use AWS Glue as the persistent metadata store

F. Use Amazon S3 as the persistent metadata store

View answer

Correct Answer: BCE

Question #81

A video-sharing company stores its videos in an Amazon S3 bucket. The company needs to analyze user access patterns such as the number of users who access a specific video each month. Which solution will meet these requirements with the LEAST development effort? Amazon S3 can generate server access logs that record detailed information about each request, including requester, bucket, key, operation, time, and status. These logs are written as objects to an S3 bucket. To analyze access patterns, the simplest and most serverless approach is to use Amazon Athena directly on those logs without building ingestion pipelines or databases. Option B enables S3 server access logging and then creates an Athena external table over the log bucket. AWS provides standard log formats and even example schemas for S3 access logs. The analytics team can run ad hoc SQL queries to count the number of accesses per object per time period, filter by user, and perform aggregations, all without provisioning compute or managing databases. Option A requires ingesting logs into Aurora, which adds ETL complexity and ongoing database management. Option C requires a Lambda function for every access event plus DB writes, which is more complex and potentially expensive at scale. Option D uses CloudWatch Logs and Managed Flink, which is more suited for streaming analytics and is significantly more complex than necessary for monthly summary reports. Therefore, Option B provides the required analysis with the least development and operational effort.

A. Enable Amazon S3 server access logging

B. Enable Amazon S3 server access logging

C. Invoke an AWS Lambda function for every S3 object access event

D. Record a log message in Amazon CloudWatch Logs for every S3 object access event

View answer

Correct Answer: B

Question #82

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #83

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #84

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #85

A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?

A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3

B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs

C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place

D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3

View answer

Correct Answer: D

Question #86

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #87

A company has enabled all features for its organization in AWS Organizations. The organization contains 10 AWS accounts. The company has turned on AWS CloudTrail in all the accounts. The company expects the number of AWS accounts in the organization to increase to 500 during the next year. The company plans to use multiple OUs for these accounts.The company has enabled AWS Config in each existing AWS account in the organization. A DevOps engineer must implement a solution that enables AWS Config automatically for all future AWS accounts that are created in the organization.Which solution will meet this requirement?

A. In the organization's management account, create an Amazon EventBridge rule that reacts to a CreateAccount API call

B. In the organization's management account, create an AWS CloudFormation stack set to enable AWS Config

C. In the organization's management account, create an SCP that allows the appropriate AWS Config API calls to enable AWS Config

D. In the organization's management account, create an Amazon EventBridge rule that reacts to a CreateAccount API call

View answer

Correct Answer: B

Question #88

A company requires an RPO of 2 hours and an RTO of 10 minutes for its data and application at all times. An application uses a MySQL database and AmazonEC2 web servers. The development team needs a strategy for failover and disaster recovery. Which combination of deployment strategies will meet these requirements? (Choose two.)

A. Create an Amazon Aurora cluster in one Availability Zone across multiple Regions as the data store

B. Create an Amazon Aurora global database in two Regions as the data store

C. Create an Amazon Aurora multi-master cluster across multiple Regions as the data store

D. Set up the application in two Regions and use Amazon Route 53 failover-based routing that points to the Application Load Balancers in both Regions

E. Set up the application in two Regions and use a multi-Region Auto Scaling group behind Application Load Balancers to manage the capacity based on demand

View answer

Correct Answer: BD

Question #89

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #90

A DevOps engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2 Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second fleet of instances with the same capacity as the original fleet.Maintains the original fleet unchanged while the second fleet is launched.Transitions traffic to the second fleet when the second fleet is fully deployed.Terminates the original fleet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group configured with a blue/green deployment configuration Select the option Terminate the original instances in the deployment group with a waiting period of 1 hour

D. Use AWS Elastic Beanstalk with the configuration set to Immutable

View answer

Correct Answer: C

Question #91

An online retail company based in the United States plans to expand its operations to Europe and Asia in the next six months. Its product currently runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. All data is stored in an Amazon Aurora database instance.When the product is deployed in multiple regions, the company wants a single product catalog across all regions, but for compliance purposes, its customer information and purchases must be kept in each region.How should the company meet these requirements with the LEAST amount of application changes?

A. Use Amazon Redshift for the product catalog and Amazon DynamoDB tables for the customer information and purchases

B. Use Amazon DynamoDB global tables for the product catalog and regional tables for the customer information and purchases

C. Use Aurora with read replicas for the product catalog and additional local Aurora instances in each region for the customer information and purchases

D. Use Aurora for the product catalog and Amazon DynamoDB global tables for the customer information and purchases

View answer

Correct Answer: C

Question #92

A DevOps engineer needs to back up sensitive Amazon S3 objects that are stored within an S3 bucket with a private bucket policy using S3 cross-Region replication functionality. The objects need to be copied to a target bucket in a different AWS Region and account.Which combination of actions should be performed to enable this replication? (Choose three.)

A. reate a replication IAM role in the source account

B. reate a replication I AM role in the target account

C. dd statements to the source bucket policy allowing the replication IAM role to replicate objects

D. dd statements to the target bucket policy allowing the replication IAM role to replicate objects

E. reate a replication rule in the source bucket to enable the replication

F. reate a replication rule in the target bucket to enable the replication

View answer

Correct Answer: ADE

Question #93

A DevOps engineer needs to back up sensitive Amazon S3 objects that are stored within an S3 bucket with a private bucket policy using S3 cross-Region replication functionality. The objects need to be copied to a target bucket in a different AWS Region and account.Which combination of actions should be performed to enable this replication? (Choose three.)

A. Create a replication IAM role in the source account

B. Create a replication IAM role in the target account

C. Add statements to the source bucket policy allowing the replication IAM role to replicate objects

D. Add statements to the target bucket policy allowing the replication IAM role to replicate objects

E. Create a replication rule in the source bucket to enable the replication

F. Create a replication rule in the target bucket to enable the replication

View answer

Correct Answer: ADE

Question #94

A company's application development team uses Linux-based Amazon EC2 instances as bastion hosts. Inbound SSH access to the bastion hosts is restricted to specific IP addresses, as defined in the associated security groups. The company's security team wants to receive a notification if the security group rules are modified to allow SSH access from any IP address.What should a DevOps engineer do to meet this requirement?

A. reate an Amazon EventBridge rule with a source of aws

B. nable Amazon GuardDuty and check the findings for security groups in AWS Security Hub

C. reate an AWS Config rule by using the restricted-ssh managed rule to check whether security groups disallow unrestricted incoming SSH traffic

D. nable Amazon Inspector

View answer

Correct Answer: C

Question #95

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #96

A company is hosting a web application in an AWS Region. For disaster recovery purposes, a second region is being used as a standby. Disaster recovery requirements state that session data must be replicated between regions in near-real time and 1% of requests should route to the secondary region to continuously verify system functionality. Additionally, if there is a disruption in service in the main region, traffic should be automatically routed to the secondary region, and the secondary region must be able to scale up to handle all traffic. How should a DevOps engineer meet these requirements?

A. In both regions, deploy the application on AWS Elastic Beanstalk and use Amazon DynamoDB global tables for session data

B. In both regions, launch the application in Auto Scaling groups and use DynamoDB for session data

C. In both regions, deploy the application in AWS Lambda, exposed by Amazon API Gateway, and use Amazon RDS for PostgreSQL with cross-region replication for session data

D. In both regions, launch the application in Auto Scaling groups and use DynamoDB global tables for session data

View answer

Correct Answer: D

Question #97

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?

A. Failed deploy and build actions across all the pipelines

B. All rejected or failed approval actions across all the pipelines

C. All the events across all pipelines

D. Approval actions across all the pipelines

View answer

Correct Answer: B

Question #98

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #99

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #100

A company has many applications. Different teams in the company developed the applications by using multiple languages and frameworks. The applications run on premises and on different servers with different operating systems. Each team has its own release protocol and process. The company wants to reduce the complexity ofthe release and maintenance of these applications.The company is migrating its technology stacks, including these applications, to AWS. The company wants centralized control of source code, a consistent and automatic delivery pipeline, and as few maintenance tasks as possible on the underlying infrastructure.What should a DevOps engineer do to meet these requirements?

A. Create one AWS CodeCommit repository for all applications

B. Create one AWS CodeCommit repository for each of the applications

C. Create one AWS CodeCommit repository for each of the applications

D. Create one AWS CodeCommit repository for each of the applications

View answer

Correct Answer: D

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free AWS DOP-C02 Practice Questions & Answers 2026 Part2

View The Updated DOP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free AWS DOP-C02 Practice Questions & Answers 2026 Part2

View The Updated DOP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now