Free AWS DOP-C02 Practice Questions & Answers 2026 Part4

Question #1

A company has a legacy API that runs on a fleet of Amazon EC2 instances behind a public Application Load Balancer (ALB). The ALB has access logging enabled and stores the access logs in Amazon S3. The API is available through the hostname api.example.com. The company uses Amazon Route 53 to manage the hostname.Developers have rebuilt five of the API endpoints by using a different AWS Lambda function for each endpoint. A DevOps engineer wants to test the new versions of the Lambda functions with a limited number of random customers. To ensure compatibility with an existing log processing service, the test must not affect the ALB access logs.How should the DevOps engineer perform the test to meet these requirements?

A. Add the five Lambda functions as targets to the existing target group for the EC2 instances

B. Create a single target group that includes all the Lambda functions as individual targets

C. Create a new ALB and a new target group for each Lambda function

D. Create a new target group for each Lambda function

View answer

Correct Answer: d

Question #2

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #3

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #4

A rapidly growing company wants to scale for developer demand for AWS development environments. Development environments are created manually in the AWS Management Console. The networking team uses AWS CloudFormation to manage the networking infrastructure, exporting stack output values for the Amazon VPC and all subnets. The development environments have common standards, such as Application Load Balancers, Amazon EC2 Auto Scaling groups, security groups, and Amazon DynamoDB tables.To keep up with demand, the DevOps engineer wants to automate the creation of development environments. Because the infrastructure required to support the application is expected to grow, there must be a way to easily update the deployed infrastructure. CloudFormation will be used to create a template for the development environments.Which approach will meet these requirements and quickly provide consistent AWS environments for developers?

A. Use Fn::ImportValue intrinsic functions in the Resources section of the template to retrieve Virtual Private Cloud (VPC) and subnet values

B. Use nested stacks to define common infrastructure components

C. Use nested stacks to define common infrastructure components

D. Use Fn::ImportValue intrinsic functions in the Parameters section of the root template to retrieve Virtual Private Cloud (VPC) and subnet values

View answer

Correct Answer: C

Question #5

A company is using AWS CodePipeline to automate its release pipeline. AWS CodeDeploy is being used in the pipeline to deploy an application to Amazon Elastic Container Service (Amazon ECS) using the blue/green deployment model. The company wants to implement scripts to test the green version of the application before shifting traffic. These scripts will complete in 5 minutes or less. If errors are discovered during these tests, the application must be rolled back.Which strategy will meet these requirements?

A. Add a stage to the CodePipeline pipeline between the source and deploy stages

B. Add a stage to the CodePipeline pipeline between the source and deploy stages

C. Add a hooks section to the CodeDeploy AppSpec file

D. Add a hooks section to the CodeDeploy AppSpec file

View answer

Correct Answer: C

Question #6

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #7

A software company wants to automate the build process for a project where the code is stored in GitHub. When the repository is updated, source code should be compiled, tested, and pushed to Amazon S3.Which combination of steps would address these requirements? (Choose three.)

A. Add a buildspec

B. Con gure a GitHub webhook to trigger a build every time a code change is pushed to the repository

C. Create an AWS CodeBuild project with GitHub as the source repository

D. Create an AWS CodeDeploy application with the Amazon EC2/On-Premises compute platform

E. Create an AWS OpsWorks deployment with the install dependencies command

F. Provision an Amazon EC2 instance to perform the build

View answer

Correct Answer: ABC

Question #8

A company has an on-premises application that is written in Go. A DevOps engineer must move the application to AWS. The company's development team wants to enable blue/green deployments and perform A/B testing.Which solution will meet these requirements?

A. Deploy the application on an Amazon EC2 instance, and create an AMI of the instance

B. Use Amazon Lightsail to deploy the application

C. Use AWS CodeArtifact to store the application code

D. Use AWS Elastic Beanstalk to host the application

View answer

Correct Answer: D

Question #9

A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?

A. Use AWS Systems Manager Con guration Compliance

B. Use custom Java code running on an EC2 instance

C. Use AWS Con g

D. Use AWS CloudTrail

View answer

Correct Answer: C

Question #10

A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?

A. Auto Scaling groups can create new instances in a single AZ only

B. The EC2 instances have not been manually associated to the AL

C. The ALB should be replaced with a Network Load Balancer (NLB)

D. The new AZ has not been added to the ALB

View answer

Correct Answer: D

Question #11

A company uses AWS Organizations and AWS Control Tower to manage all the company's AWS accounts.The company uses the Enterprise Support plan.A DevOps engineer is using Account Factory for Terraform (AFT) to provision new accounts. When new accounts are provisioned, the DevOps engineer notices that the support plan for the new accounts is set to the Basic Support plan. The DevOps engineer needs to implement a solution to provision the new accounts with the Enterprise Support plan.Which solution will meet these requirements?

A. Use an AWS Config conformance pack to deploy the account-part-of-organizations AWS Config rule and to automatically remediate any noncompliant accounts

B. Create an AWS Lambda function to create a ticket for AWS Support to add the account to the Enterprise Support plan

C. Add an additional value to the control_tower_parameters input to set the AWSEnterpriseSupport parameter as the organization's management account number

D. Set the aft_feature_enterprise_support feature flag to True in the AFT deployment input configuration

View answer

Correct Answer: D

Question #12

A DevOps engineer has automated a web service deployment by using AWS CodePipeline with the following steps:1. An AWS CodeBuild project compiles the deployment artifact and runs unit tests.2. An AWS CodeDeploy deployment group deploys the web service to Amazon EC2 instances in the staging environment.3. A CodeDeploy deployment group deploys the web service to EC2 instances in the production environment.The quality assurance (QA) team requests permission to inspect the build artifact before the deployment to the production environment occurs. The QA team wants to run an internal penetration testing tool to conduct manual tests. The tool will be invoked by a REST API call.Which combination of actions should the DevOps engineer take to fulfill this request? (Choose two.)

A. Insert a manual approval action between the test actions and deployment actions of the pipeline

B. Modify the buildspec

C. Update the CodeDeploy deployment groups so that they require manual approval to proceed

D. Update the pipeline to directly call the REST API for the penetration testing tool

E. Update the pipeline to invoke an AWS Lambda function that calls the REST API for the penetration testing tool

View answer

Correct Answer: AE

Question #13

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #14

A company uses AWS CodePipeline pipelines to automate releases of its application A typical pipeline consists of three stages build, test, and deployment. The company has been using a separate AWS CodeBuild project to run scripts for each stage. However, the company now wants to use AWS CodeDeploy to handle the deployment stage of the pipelines.The company has packaged the application as an RPM package and must deploy the application to a fleet of Amazon EC2 instances. The EC2 instances are in an EC2 Auto Scaling group and are launched from a common AMI.Which combination of steps should a DevOps engineer perform to meet these requirements? (Choose two.)

A. Create a new version of the common AMI with the CodeDeploy agent installed

B. Create a new version of the common AMI with the CodeDeploy agent installed

C. Create an application in CodeDeploy

D. Create an application in CodeDeploy

E. Create an application in CodeDeploy

View answer

Correct Answer: AD

Question #15

A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet regulatory compliance requirements. The security team wants to be notified when any keys have not been rotated after 90 days.Which solution will accomplish this?

A. onfigure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old

B. onfigure an Amazon EventBridge event to launch an AWS Lambda function to call the AWS Trusted Advisor API and publish to an Amazon Simple Notification Service (Amazon SNS) topic

C. evelop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old

D. onfigure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old

View answer

Correct Answer: C

Question #16

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?

A. Failed deploy and build actions across all the pipelines

B. All rejected or failed approval actions across all the pipelines

C. All the events across all pipelines

D. Approval actions across all the pipelines

View answer

Correct Answer: B

Question #17

A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?

A. Use AWS Systems Manager Con guration Compliance

B. Use custom Java code running on an EC2 instance

C. Use AWS Con g

D. Use AWS CloudTrail

View answer

Correct Answer: C

Question #18

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #19

A development team is using AWS CodeCommit to version control application code and AWS CodePipeline to orchestrate software deployments. The team has decided to use a remote master branch as the trigger for the pipeline to integrate code changes. A developer has pushed code changes to the CodeCommit repository, but noticed that the pipeline had no reaction, even after 10 minutes.Which of the following actions should be taken to troubleshoot this issue?

A. Check that an Amazon CloudWatch Events rule has been created for the master branch to trigger the pipeline

B. Check that the CodePipeline service role has permission to access the CodeCommit repository

C. Check that the developer's IAM role has permission to push to the CodeCommit repository

D. Check to see if the pipeline failed to start because of CodeCommit errors in Amazon CloudWatch Logs

View answer

Correct Answer: A

Question #20

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #21

A company has migrated its container-based applications to Amazon EKS and want to establish automated email notifications. The notifications sent to each email address are for specific activities related to EKS components. The solution will include Amazon SNS topics and an AWS Lambda function to evaluate incoming log events and publish messages to the correct SNS topic.Which logging solution will support these requirements?

A. nable Amazon CloudWatch Logs to log the EKS components

B. nable Amazon CloudWatch Logs to log the EKS components

C. nable Amazon S3 logging for the EKS components

D. nable Amazon S3 logging for the EKS components

View answer

Correct Answer: A

Question #22

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #23

A security review has identified that an AWS CodeBuild project is downloading a database population script from an Amazon S3 bucket using an unauthenticated request. The security team does not allow unauthenticated requests to S3 buckets for this project.How can this issue be corrected in the MOST secure manner?

A. dd the bucket name to the AllowedBuckets section of the CodeBuild project settings

B. odify the S3 bucket settings to enable HTTPS basic authentication and specify a token

C. emove unauthenticated access from the S3 bucket with a bucket policy

D. emove unauthenticated access from the S3 bucket with a bucket policy

View answer

Correct Answer: C

Question #24

A security review has identified that an AWS CodeBuild project is downloading a database population script from an Amazon S3 bucket using an unauthenticated request. The security team does not allow unauthenticated requests to S3 buckets for this project.How can this issue be corrected in the MOST secure manner?

A. Add the bucket name to the AllowedBuckets section of the CodeBuild project settings

B. Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token

C. Remove unauthenticated access from the S3 bucket with a bucket policy

D. Remove unauthenticated access from the S3 bucket with a bucket policy

View answer

Correct Answer: C

Question #25

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #26

A company has multiple accounts in an organization in AWS Organizations. The company's SecOps teamneeds to receive an Amazon Simple Notification Service (Amazon SNS) notification if any account in the organization turns off the Block Public Access feature on an Amazon S3 bucket. A DevOps engineer must implement this change without affecting the operation of any AWS accounts. The implementation must ensure that individual member accounts in the organization cannot turn off the notification.Which solution will meet these requirements?

A. Designate an account to be the delegated Amazon GuardDuty administrator account

B. Create an AWS CloudFormation template that creates an SNS topic and subscribes the SecOps team's email address to the SNS topic

C. Turn on AWS Config across the organization

D. Turn on Amazon Inspector across the organization

View answer

Correct Answer: C

Question #27

A DevOps engineer needs to back up sensitive Amazon S3 objects that are stored within an S3 bucket with a private bucket policy using S3 cross-Region replication functionality. The objects need to be copied to a target bucket in a different AWS Region and account.Which combination of actions should be performed to enable this replication? (Choose three.)

A. Create a replication IAM role in the source account

B. Create a replication IAM role in the target account

C. Add statements to the source bucket policy allowing the replication IAM role to replicate objects

D. Add statements to the target bucket policy allowing the replication IAM role to replicate objects

E. Create a replication rule in the source bucket to enable the replication

F. Create a replication rule in the target bucket to enable the replication

View answer

Correct Answer: ADE

Question #28

A company provides an application to customers. The application has an Amazon API Gateway REST API that invokes an AWS Lambda function. On initialization, the Lambda function loads a large amount of data from an Amazon DynamoDB table. The data load process results in long cold-start times of 8-10 seconds. The DynamoDB table has DynamoDB Accelerator (DAX) configured.Customers report that the application intermittently takes a long time to respond to requests. The application receives thousands of requests throughout the day. In the middle of the day, the application experiences 10 times more requests than at any other time of the day. Near the end of the day, the application's request volume decreases to 10% of its normal total.A DevOps engineer needs to reduce the latency of the Lambda function at all times of the day.Which solution will meet these requirements?

A. Configure provisioned concurrency on the Lambda function with a concurrency value of 1

B. Configure reserved concurrency on the Lambda function with a concurrency value of 0

C. Configure provisioned concurrency on the Lambda function

D. Configure reserved concurrency on the Lambda function

View answer

Correct Answer: C

Question #29

A company's security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are included in a single organization in AWS Organizations. The company has configured AWS Config for the organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS WAF web ACLs.Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)

A. Delegate AWS Firewall Manager to a security account

B. Delegate Amazon GuardDuty to a security account

C. Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

D. Create an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

E. Configure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

View answer

Correct Answer: AC

Question #30

A company has an application that is using a MySQL-compatible Amazon Aurora Multi-AZ DB cluster as the database. A cross-Region read replica has been created for disaster recovery purposes. A DevOps engineer wants to automate the promotion of the replica so it becomes the primary database instance in the event of a failure.Which solution will accomplish this?

A. onfigure a latency-based Amazon Route 53 CNAME with health checks so it points to both the primary and replica endpoints

B. reate an Aurora custom endpoint to point to the primary database instance

C. reate an AWS Lambda function to modify the application's AWS CloudFormation template to promote the replica, apply the template to update the stack, and point the application to the newly promoted instance

D. tore the Aurora endpoint in AWS Systems Manager Parameter Store

View answer

Correct Answer: D

Question #31

A company has chosen AWS to host a new application. The company needs to implement a multi-account strategy. A DevOps engineer creates a new AWS account and an organization in AWS Organizations. The DevOps engineer also creates the OU structure for the organization and sets up a landing zone by using AWS Control Tower.The DevOps engineer must implement a solution that automatically deploys resources for new accounts that users create through AWS Control Tower Account Factory. When a user creates a new account, the solution must apply AWS CloudFormation templates and SCPs that are customized for the OU or the account to automatically deploy all the resources that are attached to the account. All the OUs are enrolled in AWS Control Tower.Which solution will meet these requirements in the MOST automated way?

A. Use AWS Service Catalog with AWS Control Tower

B. Deploy CloudFormation stack sets by using the required templates

C. Create an Amazon EventBridge rule to detect the CreateManagedAccount event

D. Deploy the Customizations for AWS Control Tower (CfCT) solution

View answer

Correct Answer: D

Question #32

A company's security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are included in a single organization in AWS Organizations. The company has configured AWS Config for the organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS WAF web ACLs.Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)

A. Delegate AWS Firewall Manager to a security account

B. Delegate Amazon GuardDuty to a security account

C. Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

D. Create an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

E. Configure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs

View answer

Correct Answer: AC

Question #33

A company that uses electronic health records is running a fleet of Amazon EC2 instances with an Amazon Linux operating system. As part of patient privacy requirements, the company must ensure continuous compliance for patches for operating system and applications running on the EC2 instances.How can the deployments of the operating system and application patches be automated using a default and custom repository?

A. Use AWS Systems Manager to create a new patch baseline including the custom repository

B. Use AWS Direct Connect to integrate the corporate repository and deploy the patches using Amazon CloudWatch scheduled events, then use the CloudWatch dashboard to create reports

C. Use yum-config-manager to add the custom repository under /etc/yum

D. Use AWS Systems Manager to create a new patch baseline including the corporate repository

View answer

Correct Answer: A

Question #34

A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?

A. Use AWS Systems Manager Con guration Compliance

B. Use custom Java code running on an EC2 instance

C. Use AWS Con g

D. Use AWS CloudTrail

View answer

Correct Answer: C

Question #35

A company has multiple member accounts that are part of an organization in AWS Organizations. The security team needs to review every Amazon EC2 security group and their inbound and outbound rules. The security team wants to programmatically retrieve this information from the member accounts using an AWS Lambda function in the management account of the organization.Which combination of access changes will meet these requirements? (Choose three.)

A. Create a trust relationship that allows users in the member accounts to assume the management account IAM role

B. Create a trust relationship that allows users in the management account to assume the IAM roles of the member accounts

C. Create an IAM role in each member account that has access to the AmazonEC2ReadOnlyAccess managed policy

D. Create an IAM role in each member account to allow the sts:AssumeRole action against the management account IAM role's ARN

E. Create an IAM role in the management account that allows the sts:AssumeRole action against the member account IAM role's ARN

F. Create an IAM role in the management account that has access to the AmazonEC2ReadOnlyAccess managed policy

View answer

Correct Answer: BCE

Question #36

A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet regulatory compliance requirements. The security team wants to be notified when any keys have not been rotated after 90 days.Which solution will accomplish this?

A. Configure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old

B. Configure an Amazon EventBridge event to launch an AWS Lambda function to call the AWS Trusted Advisor API and publish to an Amazon Simple Notification Service (Amazon SNS) topic

C. Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old

D. Configure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old

View answer

Correct Answer: C

Question #37

An IT team has built an AWS CloudFormation template so others in the company can quickly and reliably deploy and terminate an application. The template creates an Amazon EC2 instance with a user data script to install the application and an Amazon S3 bucket that the application uses to serve static webpages while it is running.All resources should be removed when the CloudFormation stack is deleted. However, the team observes that CloudFormation reports an error during stack deletion, and the S3 bucket created by the stack is not deleted.How can the team resolve the error in the MOST efficient manner to ensure that all resources are deleted without errors?

A. Add a DelelionPolicy attribute to the S3 bucket resource, with the value Delete forcing the bucket to be removed when the stack is deleted

B. Add a custom resource with an AWS Lambda function with the DependsOn attribute specifying the S3 bucket, and an IAM role

C. Identify the resource that was not deleted

D. Replace the EC2 and S3 bucket resources with a single AWS OpsWorks Stacks resource

View answer

Correct Answer: B

Question #38

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #39

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

A. Filter the data through AWS X-Ray to visualize the data

B. Filter the data through Amazon QuickSight to visualize the data

C. Query the data with Amazon Athena

D. Query the data with Amazon Redshift

E. Use AWS Glue as the persistent metadata store

F. Use Amazon S3 as the persistent metadata store

View answer

Correct Answer: BCE

Question #40

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

A. Filter the data through AWS X-Ray to visualize the data

B. Filter the data through Amazon QuickSight to visualize the data

C. Query the data with Amazon Athena

D. Query the data with Amazon Redshift

E. Use AWS Glue as the persistent metadata store

F. Use Amazon S3 as the persistent metadata store

View answer

Correct Answer: BCE

Question #41

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #42

A company is performing vulnerability scanning for all Amazon EC2 instances across many accounts. The accounts are in an organization in AWS Organizations. Each account's VPCs are attached to a shared transit gateway. The VPCs send traffic to the internet through a central egress VPC. The company has enabled Amazon Inspector in a delegated administrator account and has enabled scanning for all member accounts.A DevOps engineer discovers that some EC2 instances are listed in the "not scanning" tab in Amazon Inspector.Which combination of actions should the DevOps engineer take to resolve this issue? (Choose three.)

A. Verify that AWS Systems Manager Agent is installed and is running on the EC2 instances that Amazon Inspector is not scanning

B. Associate the target EC2 instances with security groups that allow outbound communication on port 443 to the AWS Systems Manager service endpoint

C. Grant inspector:StartAssessmentRun permissions to the IAM role that the DevOps engineer is using

D. Configure EC2 Instance Connect for the EC2 instances that Amazon Inspector is not scanning

E. Associate the target EC2 instances with instance profiles that grant permissions to communicate with AWS Systems Manager

F. Create a managed-instance activation

View answer

Correct Answer: ABE

Question #43

A company runs an application on Amazon EKS. The company needs comprehensive logging for control plane and nodes, analyze API requests, and monitor container performance with minimal operational overhead.

A. Enable CloudTrail for control plane logging; deploy Logstash as a ReplicaSet on nodes; use OpenSearch to store and analyze logs

B. Enable control plane logging for EKS and send logs to CloudWatch; use CloudWatch Container Insights for node and container logs; use CloudWatch Logs Insights to query logs

C. Enable API server control plane logging and send to S3; deploy Kubernetes Event Exporter on nodes; send logs to S3; use Athena and QuickSight for analysis

D. Use AWS Distro for OpenTelemetry; stream logs to Firehose; analyze data in Redshift

View answer

Correct Answer: B

Question #44

A company has migrated its container-based applications to Amazon EKS and want to establish automated email notifications. The notifications sent to each email address are for specific activities related to EKS components. The solution will include Amazon SNS topics and an AWS Lambda function to evaluate incoming log events and publish messages to the correct SNS topic.Which logging solution will support these requirements?

A. Enable Amazon CloudWatch Logs to log the EKS components

B. Enable Amazon CloudWatch Logs to log the EKS components

C. Enable Amazon S3 logging for the EKS components

D. Enable Amazon S3 logging for the EKS components

View answer

Correct Answer: A

Question #45

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #46

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #47

A DevOps engineer is developing an application for a company. The application needs to persist les to Amazon S3. The application needs to upload les with different security classi cations that the company de nes. These classi cations include con dential, private, and public. Files that have a con dential classi cation must not be viewable by anyone other than the user who uploaded them. The application uses the IAM role of the user to call the S3 API operations.The DevOps engineer has modi ed the application to add a DataClassi cation tag with the value of con dential and an Owner tag with the uploading user's ID to each con dential object that is uploaded to Amazon S3. Which set of additional steps must the DevOps engineer take to meet the company's requirements?

A. Modify the S3 bucket's ACL to grant bucket-owner-read access to the uploading user's IAM role

B. Modify the S3 bucket policy to allow the s3:GetObject action when aws:ResourceTag/DataClassi cation equals con dential, ands3:ExistingObjectTag/Owner equals ${aws:userid}

C. Modify the S3 bucket policy to allow the s3:GetObject action when aws:ResourceTag/DataClassi cation equals con dential, and aws:RequesttTag/Owner equals ${aws:userid}

D. Modify the S3 bucket's ACL to grant authenticated-read access when aws:ResourceTag/DataClassi cation equals con dential, ands3:ExistingObjectTag/Owner equals ${aws:userid}

View answer

Correct Answer: B

Question #48

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?

A. Failed deploy and build actions across all the pipelines

B. All rejected or failed approval actions across all the pipelines

C. All the events across all pipelines

D. Approval actions across all the pipelines

View answer

Correct Answer: B

Question #49

A company has a single AWS account that runs hundreds of Amazon EC2 instances in a single AWS Region. New EC2 instances are launched and terminated each hour in the account. The account also includes existing EC2 instances that have been running for longer than a week.The company's security policy requires all running EC2 instances to use an EC2 instance profile. If an EC2 instance does not have an instance profile attached, the EC2 instance must use a default instance profile that has no IAM permissions assigned.A DevOps engineer reviews the account and discovers EC2 instances that are running without an instance profile. During the review, the DevOps engineer also observes that new EC2 instances are being launched without an instance profile.Which solution will ensure that an instance profile is attached to all existing and future EC2 instances in the Region?

A. Configure an Amazon EventBridge rule that reacts to EC2 RunInstances API calls

B. Configure the ec2-instance-profile-attached AWS Config managed rule with a trigger type of configuration changes

C. Configure an Amazon EventBridge rule that reacts to EC2 StartInstances API calls

D. Configure the iam-role-managed-policy-check AWS Config managed rule with a trigger type of configuration changes

View answer

Correct Answer: B

Question #50

A company has an application that is using a MySQL-compatible Amazon Aurora Multi-AZ DB cluster as the database. A cross-Region read replica has been created for disaster recovery purposes. A DevOps engineer wants to automate the promotion of the replica so it becomes the primary database instance in the event of a failure.Which solution will accomplish this?

A. Configure a latency-based Amazon Route 53 CNAME with health checks so it points to both the primary and replica endpoints

B. Create an Aurora custom endpoint to point to the primary database instance

C. Create an AWS Lambda function to modify the application's AWS CloudFormation template to promote the replica, apply the template to update the stack, and point the application to the newly promoted instance

D. Store the Aurora endpoint in AWS Systems Manager Parameter Store

View answer

Correct Answer: D

Question #51

An ecommerce company has chosen AWS to host its new platform. The company's DevOps team has started building an AWS Control Tower landing zone. The DevOps team has set the identity store within AWS IAM Identity Center (AWS Single Sign-On) to external identity provider (IdP) and has configured SAML 2.0.The DevOps team wants a robust permission model that applies the principle of least privilege. The model must allow the team to build and manage only the team's own resources.Which combination of steps will meet these requirements? (Choose three.)

A. Create IAM policies that include the required permissions

B. Create permission sets

C. Create a group in the IdP

D. Create a group in the IdP

E. Enable attributes for access control in IAM Identity Center

F. Enable attributes for access control in IAM Identity Center

View answer

Correct Answer: BCF

Question #52

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #53

A company has developed an AWS Lambda function that handles orders received through an API. The company is using AWS CodeDeploy to deploy the Lambda function as the nal stage of a CI/CD pipeline.A DevOps Engineer has noticed there are intermittent failures of the ordering API for a few seconds after deployment. After some investigation, the DevOpsEngineer believes the failures are due to database changes not having fully propagated before the Lambda function begins executing.How should the DevOps Engineer overcome this?

A. Add a BeforeAllowTra c hook to the AppSpec le that tests and waits for any necessary database changes before tra c can ow to the new version of the Lambda function

B. Add an AfterAllowTra c hook to the AppSpec le that forces tra c to wait for any pending database changes before allowing the new version of the Lambda function to respond

C. Add a BeforeInstall hook to the AppSpec le that tests and waits for any necessary database changes before deploying the new version of the Lambda function

D. Add a ValidateService hook to the AppSpec le that inspects incoming tra c and rejects the payload if dependent services, such as the database, are not yet ready

View answer

Correct Answer: A

Question #54

A company is adopting AWS CodeDeploy to automate its application deployments for a Java-Apache Tomcat application with an Apache Webserver. The development team started with a proof of concept, created a deployment group for a developer environment, and performed functional tests within the application. After completion, the team will create additional deployment groups for staging and production.The current log level is configured within the Apache settings, but the team wants to change this configuration dynamically when the deployment occurs, so that they can set different log level configurations depending on the deployment group without having a different application revision for each group.How can these requirements be met with the LEAST management overhead and without requiring different script versions for each deployment group?

A. ag the Amazon EC2 instances depending on the deployment group

B. reate a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ NAME to identify which deployment group the instance is part of

C. reate a CodeDeploy custom environment variable for each environment

D. reate a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ID to identify which deployment group the instance is part of to configure the log level settings

View answer

Correct Answer: B

Question #55

A DevOps engineer is building a multistage pipeline with AWS CodePipeline to build, verify, stage, test, and deploy an application. A manual approval stage is required between the test stage and the deploy stage. The development team uses a custom chat tool with webhook support that requires near-real-time notifications.How should the DevOps engineer configure status updates for pipeline activity and approval requests to post to the chat tool?

A. Create an Amazon CloudWatch Logs subscription that filters on CodePipeline Pipeline Execution State Change

B. Create an AWS Lambda function that is invoked by AWS CloudTrail events

C. Create an Amazon EventBridge rule that filters on CodePipeline Pipeline Execution State Change

D. Modify the pipeline code to send the event details to the chat webhook URL at the end of each stage

View answer

Correct Answer: C

Question #56

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?

A. Failed deploy and build actions across all the pipelines

B. All rejected or failed approval actions across all the pipelines

C. All the events across all pipelines

D. Approval actions across all the pipelines

View answer

Correct Answer: B

Question #57

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #58

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #59

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #60

A DevOps engineer at a company is supporting an AWS environment in which all users use AWS IAM Identity Center (AWS Single Sign-On). The company wants to immediately disable credentials of any new IAM user and wants the security team to receive a notification.Which combination of steps should the DevOps engineer take to meet these requirements? (Choose three.)

A. Create an Amazon EventBridge rule that reacts to an IAM CreateUser API call in AWS CloudTrail

B. Create an Amazon EventBridge rule that reacts to an IAM GetLoginProfile API call in AWS CloudTrail

C. Create an AWS Lambda function that is a target of the EventBridge rule

D. Create an AWS Lambda function that is a target of the EventBridge rule

E. Create an Amazon Simple Notification Service (Amazon SNS) topic that is a target of the EventBridge rule

F. Create an Amazon Simple Queue Service (Amazon SQS) queue that is a target of the Lambda function

View answer

Correct Answer: ACE

Question #61

The Ansible Inventory system allows many attributes to be defined within it. Which item below is not one of these?

A. Group variables

B. Host groups

C. Include vars

D. Children groups

View answer

Correct Answer: C

Question #62

A company controls the source code for an application in AWS CodeCommit. The company is creating a CI/CD pipeline for the application by using AWS CodePipeline.The pipeline must start automatically when changes occur to the main branch of the CodeCommit repository. Changes occur frequently every day, so the pipeline must be as responsive as possible.What should a DevOps engineer do to meet these requirements?

A. Configure the pipeline to periodically check the repository’s main branch for changes

B. Configure an Amazon EventBridge (Amazon CloudWatch Events) rule to detect changes to the repository’s main branch

C. Configure the repository to periodically run an AWS Lambda function

D. Configure the repository to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic when changes occur to the repository’s main branch

View answer

Correct Answer: b

Question #63

A DevOps engineer is creating an AWS CloudFormation template to deploy a web service. The web service will run on Amazon EC2 instances in a private subnet behind an Application Load Balancer (ALB). The DevOps engineer must ensure that the service can accept requests from clients that have IPv6 addresses.What should the DevOps engineer do with the CloudFormation template so that IPv6 clients can access theweb service?

A. Add an IPv6 CIDR block to the VPC and the private subnet for the EC2 instances

B. Assign each EC2 instance an IPv6 Elastic IP address

C. Replace the ALB with a Network Load Balancer (NLB)

D. Add an IPv6 CIDR block to the VPC and subnets for the ALB

View answer

Correct Answer: D

Question #64

A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?

A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3

B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs

C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place

D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3

View answer

Correct Answer: D

Question #65

A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration

D. Use AWS Elastic Beanstalk with the con guration set to Immutable

View answer

Correct Answer: D

Question #66

A company wants to migrate its content sharing web application hosted on Amazon EC2 to a serverless architecture. The company currently deploys changes to its application by creating a new Auto Scaling group of EC2 instances and a new Elastic Load Balancer, and then shifting the traffic away using an Amazon Route 53 weighted routing policy.For its new serverless application, the company is planning to use Amazon API Gateway and AWS Lambda. The company will need to update its deployment processes to work with the new application. It will also need to retain the ability to test new features on a small number of users before rolling the features out to the entire user base.Which deployment strategy will meet these requirements?

A. Use AWS CDK to deploy API Gateway and Lambda functions

B. Use AWS CloudFormation to deploy API Gateway and Lambda functions using Lambda function versions

C. Use AWS Elastic Beanstalk to deploy API Gateway and Lambda functions

D. Use AWS OpsWorks to deploy API Gateway in the service layer and Lambda functions in a custom layer

View answer

Correct Answer: B

Question #67

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #68

An application has microservices spread across different AWS accounts and is integrated with an on-premises legacy system for some of its functionality.Because of the segmented architecture and missing logs, every time the application experiences issues, it is taking too long to gather the logs to identify the issues. A DevOps Engineer must x the log aggregation process and provide a way to centrally analyze the logs.Which is the MOST e cient and cost-effective solution?

A. Collect system logs and application logs by using the Amazon CloudWatch Logs agent

B. Collect system logs and application logs by using the Amazon CloudWatch Logs agent

C. Collect system logs and application logs using the Amazon CloudWatch Logs agent

D. Collect system logs and application logs by using the Amazon CloudWatch Logs agent

View answer

Correct Answer: D

Question #69

A company uses AWS CodePipeline pipelines to automate releases of its application A typical pipeline consists of three stages build, test, and deployment. The company has been using a separate AWS CodeBuild project to run scripts for each stage. However, the company now wants to use AWS CodeDeploy to handle the deployment stage of the pipelines.The company has packaged the application as an RPM package and must deploy the application to a fleet of Amazon EC2 instances. The EC2 instances are in an EC2 Auto Scaling group and are launched from a common AMI.Which combination of steps should a DevOps engineer perform to meet these requirements? (Choose two.)

A. Create a new version of the common AMI with the CodeDeploy agent installed

B. Create a new version of the common AMI with the CodeDeploy agent installed

C. Create an application in CodeDeploy

D. Create an application in CodeDeploy

E. Create an application in CodeDeploy

View answer

Correct Answer: AD

Question #70

A company is implementing AWS CodePipeline to automate its testing process. The company wants to be notified when the execution state fails and used the following custom event pattern in Amazon EventBridge:Which type of events will match this event pattern?

A. Failed deploy and build actions across all the pipelines

B. All rejected or failed approval actions across all the pipelines

C. All the events across all pipelines

D. Approval actions across all the pipelines

View answer

Correct Answer: B

Question #71

A DevOps engineer uses AWS CodeBuild to frequently produce software packages. The CodeBuild project builds large Docker images that the DevOps engineer can use across multiple builds. The DevOps engineer wants to improve build performance and minimize costs. Which solution will meet these requirements?

A. Store the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository

B. Cache the Docker images in an Amazon S3 bucket that is available across multiple build hosts

C. Store the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository

D. Create custom AMIs that contain the cached Docker images

View answer

Correct Answer: A

Question #72

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #73

A company is hosting a web application in an AWS Region. For disaster recovery purposes, a second region is being used as a standby. Disaster recovery requirements state that session data must be replicated between regions in near-real time and 1% of requests should route to the secondary region to continuously verify system functionality. Additionally, if there is a disruption in service in the main region, traffic should be automatically routed to the secondary region, and the secondary region must be able to scale up to handle all traffic.How should a DevOps engineer meet these requirements?

A. In both regions, deploy the application on AWS Elastic Beanstalk and use Amazon DynamoDB global tables for session data

B. In both regions, launch the application in Auto Scaling groups and use DynamoDB for session data

C. In both regions, deploy the application in AWS Lambda, exposed by Amazon API Gateway, and use Amazon RDS for PostgreSQL with cross-region replication for session data

D. In both regions, launch the application in Auto Scaling groups and use DynamoDB global tables for session data

View answer

Correct Answer: A

Question #74

A company's DevOps engineer uses AWS Systems Manager to perform maintenance tasks during maintenance windows. The company has a few Amazon EC2 instances that require a restart after notifications from AWS Health. The DevOps engineer needs to implement an automated solution to remediate these notifications. The DevOps engineer creates an Amazon EventBridge rule.How should the DevOps engineer configure the EventBridge rule to meet these requirements?

A. Configure an event source of AWS Health, a service of EC2, and an event type that indicates instance maintenance

B. Configure an event source of Systems Manager and an event type that indicates a maintenance window

C. Configure an event source of AWS Health, a service of EC2, and an event type that indicates instance maintenance

D. Configure an event source of EC2 and an event type that indicates instance maintenance

View answer

Correct Answer: A

Question #75

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #76

A development team is designing an application that has a large customer base spread across three AWS Regions. The application will use an Amazon DynamoDB table that must be available in all three Regions to deliver low-latency data access. When the table is updated in one Region, the changes must seamlessly propagate to the other Regions.How should a DevOps engineer configure the table to meet these requirements with the LEAST operational overhead?

A. Create a DynamoDB table in each of the three Regions

B. Configure three DynamoDB tables in each of the three Regions

C. Configure a multi-Region, multi-active DynamoDB global table that includes the three Regions

D. Use DynamoDB global tables to configure a primary table in one Region and a read replica in each of the other Regions

View answer

Correct Answer: d

Question #77

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

A. Filter the data through AWS X-Ray to visualize the data

B. Filter the data through Amazon QuickSight to visualize the data

C. Query the data with Amazon Athena

D. Query the data with Amazon Redshift

E. Use AWS Glue as the persistent metadata store

F. Use Amazon S3 as the persistent metadata store

View answer

Correct Answer: BCE

Question #78

A company uses AWS CloudTrail on all its AWS accounts and sends all trails to a centralized Amazon S3 bucket. The company sends specified events to a third-party logging tool by using S3 event notifications and an AWS Lambda function. The company has hired a security services provider to set up a security operations center.The security services provider wants to receive the CloudTrail logs through an Amazon Simple Queue Service (Amazon SQS) queue. The company must continue to use S3 event notifications and the Lambda function to send events to the third-party logging tool.What is the MOST operationally efficient way to meet these requirements?

A. Add an additional notification to the S3 bucket for all CreateObject events to send all objects to the SQS queue

B. Replace the existing S3 event notification destination with an Amazon Simple Notification Service (Amazon SNS) topic

C. Replace the existing S3 event notification destination with an Amazon Kinesis data stream

D. Configure the trail to send logs to Amazon CloudWatch Logs

View answer

Correct Answer: b

Question #79

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #80

A company is using an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured with a single DB instance. The application performs read and write operations on the database by using the cluster's instance endpoint.The company has scheduled an update to be applied to the cluster during an upcoming maintenance window. The cluster must remain available with the least possible interruption during the maintenance window.What should a DevOps engineer do to meet these requirements?

A. Add a reader instance to the Aurora cluster

B. Add a reader instance to the Aurora cluster

C. Turn on the Multi-AZ option on the Aurora cluster

D. Turn on the Multi-AZ option on the Aurora cluster

View answer

Correct Answer: A

Question #81

To run an application, a DevOps engineer launches an Amazon EC2 instance with public IP addresses in a public subnet. A user data script obtains the application artifacts and installs them on the instances upon launch. A change to the security classification of the application now requires the instances to run with no access to the internet. While the instances launch successfully and show as healthy, the application does not seem to be installed.Which of the following should successfully install the application while complying with the new rule?

A. Launch the instances in a public subnet with Elastic IP addresses attached

B. Set up a NAT gateway

C. Publish the application artifacts to an Amazon S3 bucket and create a VPC endpoint for S3

D. Create a security group for the application instances and allow only outbound traffic to the artifact repository

View answer

Correct Answer: C

Question #82

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #83

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #84

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #85

A company provides an application to customers. The application has an Amazon API Gateway REST API that invokes an AWS Lambda function. On initialization, the Lambda function loads a large amount of data from an Amazon DynamoDB table. The data load process results in long cold-start times of 8-10 seconds. The DynamoDB table has DynamoDB Accelerator (DAX) configured.Customers report that the application intermittently takes a long time to respond to requests. The application receives thousands of requests throughout the day. In the middle of the day, the application experiences 10 times more requests than at any other time of the day. Near the end of the day, the application's request volume decreases to 10% of its normal total.A DevOps engineer needs to reduce the latency of the Lambda function at all times of the day.Which solution will meet these requirements?

A. onfigure provisioned concurrency on the Lambda function with a concurrency value of 1

B. onfigure reserved concurrency on the Lambda function with a concurrency value of 0

C. onfigure provisioned concurrency on the Lambda function

D. onfigure reserved concurrency on the Lambda function

View answer

Correct Answer: C

Question #86

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #87

A company is implementing an Amazon Elastic Container Service (Amazon ECS) cluster to run its workload. The company architecture will run multiple ECS services on the cluster. The architecture includes an Application Load Balancer on the front end and uses multiple target groups to route traffic.A DevOps engineer must collect application and access logs. The DevOps engineer then needs to send the logs to an Amazon S3 bucket for near-real-time analysis.Which combination of steps must the DevOps engineer take to meet these requirements? (Choose three.)

A. Download the Amazon CloudWatch Logs container instance from AWS

B. Install the Amazon CloudWatch Logs agent on the ECS instances

C. Use Amazon EventBridge to schedule an AWS Lambda function that will run every 60 seconds and will run the Amazon CloudWatch Logs create-export-task command

D. Activate access logging on the ALB

E. Activate access logging on the target groups that the ECS services use

F. Create an Amazon Kinesis Data Firehose delivery stream that has a destination of the logging S3 bucket

View answer

Correct Answer: BDF

Question #88

A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account.The company has created an AWS Key Management Service (AWS KMS) key in the source account.Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)

A. In the source account, copy the unencrypted AMI to an encrypted AMI

B. In the source account, copy the unencrypted AMI to an encrypted AMI

C. In the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account

D. In the source account, modify the key policy to give the target account permissions to create a grant

E. In the source account, share the unencrypted AMI with the target account

F. In the source account, share the encrypted AMI with the target account

View answer

Correct Answer: ADF

Question #89

A space exploration company receives telemetry data from multiple satellites. Small packets of data are received through Amazon API Gateway and are placed directly into an Amazon Simple Queue Service (Amazon SQS) standard queue. A custom application is subscribed to the queue and transforms the data into a standard format.Because of inconsistencies in the data that the satellites produce, the application is occasionally unable to transform the data. In these cases, the messages remain in the SQS queue. A DevOps engineer must develop a solution that retains the failed messages and makes them available to scientists for review and future processing.Which solution will meet these requirements?

A. Configure AWS Lambda to poll the SQS queue and invoke a Lambda function to check whether the queue messages are valid

B. Convert the SQS standard queue to an SQS FIFO queue

C. Create an SQS dead-letter queue

D. Configure API Gateway to send messages to different SQS virtual queues that are named for each of the satellites

View answer

Correct Answer: C

Question #90

A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?

A. Auto Scaling groups can create new instances in a single AZ only

B. The EC2 instances have not been manually associated to the AL

C. The ALB should be replaced with a Network Load Balancer (NLB)

D. The new AZ has not been added to the ALB

View answer

Correct Answer: D

Question #91

A company runs an application on Amazon EC2 instances that use the latest version of the Amazon Linux 2 AMI. When server administrators apply new security patches, the server administrators manually remove affected instances from service, patch the instances, and place the instances back into service.A new security policy requires the company to apply security patches within 7 days after patches are released. The company’s security team must verify that all the EC2 instances are compliant with this policy. The patching must occur during a time that has the least impact on users.Which solution will automate compliance with these requirements?

A. Configure an AWS CodeBuild project to download and apply patches to all the instances over SSH

B. Use AWS Systems Manager Patch Manager to create a patch baseline

C. Create a script to apply any available security patches

D. Enlist all the EC2 instances in an AWS Systems Manager Patch Manager patch group

View answer

Correct Answer: d

Question #92

An ecommerce company has chosen AWS to host its new platform. The company's DevOps team has started building an AWS Control Tower landing zone. The DevOps team has set the identity store within AWS IAM Identity Center (AWS Single Sign-On) to external identity provider (IdP) and has configured SAML 2.0.The DevOps team wants a robust permission model that applies the principle of least privilege. The model must allow the team to build and manage only the team's own resources.Which combination of steps will meet these requirements? (Choose three.)

A. Create IAM policies that include the required permissions

B. Create permission sets

C. Create a group in the IdP

D. Create a group in the IdP

E. Enable attributes for access control in IAM Identity Center

F. Enable attributes for access control in IAM Identity Center

View answer

Correct Answer: BCF

Question #93

A development team uses AWS CodeCommit for version control for applications. The development team uses AWS CodePipeline, AWS CodeBuild. and AWS CodeDeploy for CI/CD infrastructure. In CodeCommit, the development team recently merged pull requests that did not pass long-running tests in the code base. The development team needed to perform rollbacks to branches in the codebase, resulting in lost time and wasted effort.A DevOps engineer must automate testing of pull requests in CodeCommit to ensure that reviewers more easily see the results of automated tests as part of the pull request review.What should the DevOps engineer do to meet this requirement?

A. Create an Amazon EventBridge rule that reacts to the pullRequestStatusChanged event

B. Create an Amazon EventBridge rule that reacts to the pullRequestCreated event

C. Create an Amazon EventBridge rule that reacts to pullRequestCreated and pullRequestSourceBranchUpdated events

D. Create an Amazon EventBridge rule that reacts to the pullRequestStatusChanged event

View answer

Correct Answer: C

Question #94

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #95

A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?

A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3

B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs

C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place

D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3

View answer

Correct Answer: D

Question #96

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #97

A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?

A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3

B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs

C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place

D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3

View answer

Correct Answer: D

Question #98

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

A. Filter the data through AWS X-Ray to visualize the data

B. Filter the data through Amazon QuickSight to visualize the data

C. Query the data with Amazon Athena

D. Query the data with Amazon Redshift

E. Use AWS Glue as the persistent metadata store

F. Use Amazon S3 as the persistent metadata store

View answer

Correct Answer: BCE

Question #99

A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, daily, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes.A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified.Which solution will meet these requirements?

A. Set up AWS Config in the account

B. Set up AWS Config in the account

C. Turn on AWS CloudTrail in the account

D. Turn on AWS CloudTrail in the account

View answer

Correct Answer: B

Question #100

An AWS CodePipeline pipeline has implemented a code release process. The pipeline is integrated with AWS CodeDeploy to deploy versions of an application to multiple Amazon EC2 instances for each CodePipeline stage.During a recent deployment, the pipeline failed due to a CodeDeploy issue. The DevOps team wants to improve monitoring and noti cations during deployment to decrease resolution times.What should the DevOps Engineer do to create noti cations when issues are discovered?

A. Implement AWS CloudWatch Logs for CodePipeline and CodeDeploy, create an AWS Con g rule to evaluate code deployment issues, and create an Amazon SNS topic to notify stakeholders of deployment issues

B. Implement AWS CloudWatch Events for CodePipeline and CodeDeploy, create an AWS Lambda function to evaluate code deployment issues, and create an Amazon SNS topic to notify stakeholders of deployment issues

C. Implement AWS CloudTrail to record CodePipeline and CodeDeploy API call information, create an AWS Lambda function to evaluate code deployment issues, and create an Amazon SNS topic to notify stakeholders of deployment issues

D. Implement AWS CloudWatch Events for CodePipeline and CodeDeploy, create an Amazon Inspector assessment target to evaluate code deployment issues, and create an Amazon SNS topic to notify stakeholders of deployment issues

View answer

Correct Answer: B

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free AWS DOP-C02 Practice Questions & Answers 2026 Part4

View The Updated DOP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free AWS DOP-C02 Practice Questions & Answers 2026 Part4

View The Updated DOP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now