Question 1

Your current log analysis application takes more than four hours to generate a report of the top 10 users of your web application. You have been asked to implement a system that can report this information in real time, ensure that the report is always up to date, and handle increases in the number of requests to your web application. Choose the option that is cost-effective and can fulfill the requirements.

Accepted Answer

A)  Publish your data to CloudWatch Logs, and configure your application to autoscale to handle the load on demand. 
B)  Publish your log data to an Amazon S3 bucket. Use AWS CloudFormation to create an Auto Scaling group to scale your post-processing application which is configured to pull down your log files stored an Amazon S3. 
C)  Post your log data to an Amazon Kinesis data stream, and subscribe your log-processing application so that is configured to process your logging data. 
D)  Configure an Auto Scaling group to increase the size of your Amazon EMR duster. 
E)  Create a multi-AZ Amazon RDS MySQL cluster, post the logging data to MySQL, and run a map reduce job to retrieve the required information on user counts.

Question 2

A DevOps engineer is deploying a new version of a company's application in an AWS CodeDeploy deployment group associated with its Amazon EC2 instances. After some time, the deployment fails. The engineer realizes that all the events associated with the specific deployment ID are in a Skipped status, and code was not deployed in the instances associated with the deployment group. What are valid reasons for this failure? (Choose two.)

Accepted Answer

A)  The networking configuration does not allow the EC2 instances to reach the internet via a NAT gateway or internet gateway, and the CodeDeploy endpoint cannot be reached. 
B)  The IAM user who triggered the application deployment does not have permission to interact with the CodeDeploy endpoint. 
C)  The target EC2 instances were not properly registered with the CodeDeploy endpoint. 
D)  An instance profile with proper permissions was not attached to the target EC2 instances. 
E)  The appspec.yml file was not included in the application revision.

Question 3

A company develops and maintains a web application using Amazon EC2 instances and an Amazon RDS for SQL Server DB instance in a single Availability Zone. The resources need to run only when new deployments are being tested using AWS CodePipeline. Testing occurs one or more times a week and each test takes 2-3 hours to run. A DevOps engineer wants a solution that does not change the architecture components. Which solution will meet these requirements in the MOST cost-effective manner?

Accepted Answer

A)  Convert the RDS database to an Amazon Aurora Serverless database. Use an AWS Lambda function to start and stop the EC2 instances before and after tests. 
B)  Put the EC2 instances into an Auto Scaling group. Schedule scaling to run at the start of the deployment tests. 
C)  Replace the EC2 instances with EC2 Spot Instances and the RDS database with an RDS Reserved Instance. 
D)  Subscribe Amazon Cloud Watch Events to CodePipeline to trigger AWS Systems Manager Automation documents that start and stop all EC2 and RDS instances before and after deployment tests.

Question 4

A DevOps engineer has been tasked with ensuring that all Amazon S3 buckets, except for those with the word "public" in the name, allow access only to authorized users utilizing S3 bucket policies. The security team wants to be notified when a bucket is created without the proper policy and for the policy to be automatically updated. Which solutions will meet these requirements?

Accepted Answer

A)  Create a custom AWS Config rule that will trigger an AWS Lambda function when an S3 bucket is created or updated. Use the Lambda function to look for S3 buckets that should be private, but that do not have a bucket policy that enforces privacy. When such a bucket is found, invoke a remediation action and use Amazon SNS to notify the security team. 
B)  Create an Amazon EventBridge (Amazon CloudWatch Events) rule that triggers when an S3 bucket is created. Use an AWS Lambda function to determine whether the bucket should be private. If the bucket should be private, update the PublicAccessBlock configuration. Configure a second EventBridge (CloudWatch Events) rule to notify the security team using Amazon SNS when PutBucketPolicy is called. 
C)  Create an Amazon S3 event notification that triggers when an S3 bucket is created that does not have the word "public" in the name. Define an AWS Lambda function as a target for this notification and use the function to apply a new default policy to the S3 bucket. Create an additional notification with the same filter and use Amazon SNS to send an email to the security team. 
D)  Create an Amazon EventBridge (Amazon CloudWatch Events) rule that triggers when a new object is created in a bucket that does not have the word "public" in the name. Target and use an AWS Lambda function to update the PublicAccessBlock configuration. Create an additional notification with the same filter and use Amazon SNS to send an email to the security team.

Question 5

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it. They also need an efficient, automated way to store metadata from the .csv file. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

Accepted Answer

A)  Filter the data through AWS X-Ray to visualize the data. 
B)  Filter the data through Amazon QuickSight to visualize the data. 
C)  Query the data with Amazon Athena. 
D)  Query the data with Amazon Redshift. 
E)  Use AWS Glue as the persistent metadata store.
F) Use Amazon S3 as the persistent metadata store.

Question 6

A company runs a database on a single Amazon EC2 instance in a development environment. The data is stored on separate Amazon EBS volumes that are attached to the EC2 instance. An Amazon Route 53 A record has been created and configured to point to the EC2 instance. The company would like to automate the recovery of the database instance when an instance or Availability Zone (AZ) fails. The company also wants to keep its costs low. The RTO is 4 hours and the RPO is 12 hours. Which solution should a DevOps Engineer implement to meet these requirements?

Accepted Answer

A)  Run the database in an Auto Scaling group with a minimum and maximum instance count of 1 in multiple AZs. Add a lifecycle hook to the Auto Scaling group and define an Amazon CloudWatch Events rule that is triggered when a lifecycle event occurs. Have the CloudWatch Events rule invoke an AWS Lambda function to detach or attach the Amazon EBS data volumes from the EC2 instance based on the event. Configure the EC2 instance UserData to mount the data volumes (retry on failure with a short delay), then start the database and update the Route 53 record. 
B)  Run the database on two separate EC2 instances in different AZs with one active and the other as a standby. Attach the data volumes to the active instance. Configure an Amazon CloudWatch Events rule to invoke an AWS Lambda function on EC2 instance termination. The Lambda function launches a replacement EC2 instance. If the terminated instance was the active node, then the function attaches the data volumes to the standby node. Start the database and update the Route 53 record. 
C)  Run the database in an Auto Scaling group with a minimum and maximum instance count of 1 in multiple AZs. Create an AWS Lambda function that is triggered by a scheduled Amazon CloudWatch Events rule every 4 hours to take a snapshot of the data volume and apply a tag. Have the instance UserData get the latest snapshot, create a new volume from it, and attach and mount the volume. Then start the database and update the Route 53 record. 
D)  Run the database on two separate EC2 instances in different AZs. Configure one of the instances as a master and the other as a standby. Set up replication between the master and standby instances. Point the Route 53 record to the master. Configure an Amazon CloudWatch Events rule to invoke an AWS Lambda function upon the EC2 instance termination. The Lambda function launches a replacement EC2 instance. If the terminated instance was the active node, the function promotes the standby to master and points the Route 53 record to it.

Question 7

A company runs a three-tier web application in its production environment, which is built on a single AWS CloudFormation template made up of Amazon EC2 instances behind an ELB Application Load Balancer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones. Data is stored in an Amazon RDS Multi-AZ DB instance with read replicas. Amazon Route 53 manages the application's public DNS record. A DevOps Engineer must create a workflow to mitigate a failed software deployment by rolling back changes in the production environment when a software cutover occurs for new application software. What steps should the Engineer perform to meet these requirements with the LEAST amount of downtime?

Accepted Answer

A)  Use CloudFormation to deploy an additional staging environment and configure the Route 53 DNS with weighted records. During cutover, change the Route 53 A record weights to achieve an even traffic distribution between the two environments. Validate the traffic in the new environment and immediately terminate the old environment if tests are successful. 
B)  Use a single AWS Elastic Beanstalk environment to deploy the staging and production environments. Update the environment by uploading the ZIP file with the new application code. Swap the Elastic Beanstalk environment CNAME. Validate the traffic in the new environment and immediately terminate the old environment if tests are successful. 
C)  Use a single AWS Elastic Beanstalk environment and an AWS OpsWorks environment to deploy the staging and production environments. Update the environment by uploading the ZIP file with the new application code into the Elastic Beanstalk environment deployed with the OpsWorks stack. Validate the traffic in the new environment and immediately terminate the old environment if tests are successful. 
D)  Use AWS CloudFormation to deploy an additional staging environment, and configure the Route 53 DNS with weighted records. During cutover, increase the weight distribution to have more traffic directed to the new staging environment as workloads are successfully validated. Keep the old production environment in place until the new staging environment handles all traffic.

Question 8

An Amazon EC2 instance with no internet access is running in a Virtual Private Cloud (VPC) and needs to download an object from a restricted Amazon S3 bucket. When the DevOps Engineer tries to gain access to the object, an AccessDenied error is received. What are the possible causes for this error? (Choose three.)

Accepted Answer

A)  The S3 bucket default encryption is enabled. 
B)  There is an error in the S3 bucket policy. 
C)  There is an error in the VPC endpoint policy. 
D)  The object has been moved to Amazon Glacier. 
E)  There is an error in the IAM role configuration.
F) S3 versioning is enabled.

Question 9

A company uses federated access for its AWS environment. The company creates and manages IAM roles by using AWS CloudFormation from a CI/CD pipeline. All changes should be made to the IAM roles through the pipeline. The company's security team discovers that out-of-band changes are being made to the IAM roles. The security team needs a way to detect when these out-of-band changes occur. What should a DevOps engineer do to meet this requirement?

Accepted Answer

A)  Use Amazon Inspector rules to detect and notify when an AWS CloudFormation stack has a configuration change. 
B)  Use AWS Trusted Advisor to detect and notify when an AWS CloudFormation stack has a configuration change. 
C)  Use AWS CloudTrail to detect and notify when an AWS CloudFormation stack detects a configuration change. 
D)  Use an AWS Config rule to detect and notify when AWS CloudFormation drift detection identifies a configuration change.

Question 10

A company has an application deployed using Amazon ECS with data stored in an Amazon DynamoDB table. The company wants the application to fail over to another Region in a disaster recovery scenario. The application must also efficiently recover from any accidental data loss events. The RPO for the application is 1 hour and the RTO is 2 hours. Which highly available solution should a DevOps engineer recommend?

Accepted Answer

A)  Change the configuration of the existing DynamoDB table. Enable this as a global table and specify the second Region that will be used. Enable DynamoDB point-in-time recovery. 
B)  Enable DynamoDB Streams for the table and create an AWS Lambda function to write the stream data to an S3 bucket in the second Region. Schedule a job for every 2 hours to use AWS Data Pipeline to restore the database to the failover Region. 
C)  Export the DynamoDB table every 2 hours using AWS Data Pipeline to an Amazon S3 bucket in the second Region. Use Data Pipeline in the second Region to restore the export from S3 into the second DynamoDB table. 
D)  Use AWS DMS to replicate the data every hour. Set the original DynamoDB table as the source and the new DynamoDB table as the target.

Question 11

Your mobile application includes a photo-sharing service that is expecting tens of thousands of users at launch. You will leverage Amazon Simple Storage Service (S3) for storage of the user Images, and you must decide how to authenticate and authorize your users for access to these images. You also need to manage the storage of these images. Which two of the following approaches should you use? (Choose two.)

Accepted Answer

A)  Create an Amazon S3 bucket per user, and use your application to generate the S3 URI for the appropriate content. 
B)  Use AWS Identity and Access Management (IAM) user accounts as your application-level user database, and offload the burden of authentication from your application code. 
C)  Authenticate your users at the application level, and use AWS Security Token Service (STS) to grant token-based authorization to S3 objects. 
D)  Authenticate your users at the application level, and send an SMS token message to the user. Create an Amazon S3 bucket with the same name as the SMS message token, and move the user's objects to that bucket. 
E)  Use a key-based naming scheme comprised from the user IDs for all user objects in a single Amazon S3 bucket.

Question 12

If Erin has three clusters of server types that are all managed by Ansible and she needs to provision each cluster so that they are configured with their appropriate NTP server addresses. What is the best method Erin should use in Ansible for managing this?

Accepted Answer

A)  Write a task that scans the network in the target hosts' region for the NTP server, register the resulting address so that the next task can write the NTP configuration. 
B)  Break down the hosts by region in the Ansible inventory file and assign an inventory group variable the NTP address value for the respective region. The playbook can contain just the single play referencing the NTP variable from the inventory. 
C)  Create a playbook for each different region and store the NTP address in a variable in the play in the event the NTP server changes. 
D)  Create three plays, each one has the hosts for their respective regions and set the NTP server address in each task.

Question 13

You are running a Docker daemon on a Linux host and it becomes unresponsive. Which signal, when sent to a Docker process with the kill command, forces the full stack trace to be logged for debugging purposes?

Accepted Answer

A)  -TRACE 
B)  -IOTRACE 
C)  -SIGUSER1 
D)  -KILLTRACE

Question 14

A company has a website in an AWS Elastic Beanstalk load balancing and automatic scaling environment. This environment has an Amazon RDS MySQL instance configured as its database resource. After a sudden increase in traffic, the website started dropping traffic. An administrator discovered that the application on some instances is not responding as the result of out-of-memory errors. Classic Load Balancer marked those instances as out of service, and the health status of Elastic Beanstalk enhanced health reporting is degraded. However, Elastic Beanstalk did not replace those instances. Because of the diminished capacity behind the Classic Load Balancer, the application response times are slower for the customers. Which action will permanently fix this issue?

Accepted Answer

A)  Clone the Elastic Beanstalk environment. When the new environment is up, swap CNAME and terminate the earlier environment. 
B)  Temporarily change the maximum number of instances in the Auto Scaling group to allow the group to support more traffic. 
C)  Change the setting for the Auto Scaling group health check from Amazon EC2 to Elastic Load Balancing, and increase the capacity of the group. 
D)  Write a cron script for restarting the web server process when memory is full, and deploy it with AWS Systems Manager.

Question 15

Which of these configuration or deployment practices is a security risk for RDS?

Accepted Answer

A)  Storing SQL function code in plaintext 
B)  Non-Multi-AZ RDS instance 
C)  Having RDS and EC2 instances exist in the same subnet 
D)  RDS in a public subnet

Question 16

You use Amazon CloudWatch as your primary monitoring system for your web application. After a recent software deployment, your users are getting Intermittent 500 Internal Server Errors when using the web application. You want to create a CloudWatch alarm, and notify an on-call engineer when these occur. How can you accomplish this using AWS services? (Choose three.)

Accepted Answer

A)  Deploy your web application as an AWS Elastic Beanstalk application. Use the default Elastic Beanstalk Cloudwatch metrics to capture 500 Internal Server Errors. Set a CloudWatch alarm on that metric. 
B)  Install a CloudWatch Logs Agent on your servers to stream web application logs to CloudWatch. 
C)  Use Amazon Simple Email Service to notify an on-call engineer when a CloudWatch alarm is triggered. 
D)  Create a CloudWatch Logs group and define metric filters that capture 500 Internal Server Errors. Set a CloudWatch alarm on that metric. 
E)  Use Amazon Simple Notification Service to notify an on-call engineer when a CloudWatch alarm is triggered.
F) Use AWS Data Pipeline to stream web application logs from your servers to CloudWatch.

Question 17

A Security team is concerned that a Developer can unintentionally attach an Elastic IP address to an Amazon EC2 instance in production. No Developer should be allowed to attach an Elastic IP address to an instance. The Security team must be notified if any production server has an Elastic IP address at any time. How can this task be automated?

Accepted Answer

A)  Use Amazon Athena to query AWS CloudTrail logs to check for any associate-address attempts. Create an AWS Lambda function to disassociate the Elastic IP address from the instance, and alert the Security team. 
B)  Attach an IAM policy to the Developers' IAM group to deny associate-address permissions. Create a custom AWS Config rule to check whether an Elastic IP address is associated with any instance tagged as production, and alert the Security team. 
C)  Ensure that all IAM groups are associated with Developers do not have associate-address permissions. Create a scheduled AWS Lambda function to check whether an Elastic IP address is associated with any instance tagged as production, and alert the Security team if an instance has an Elastic IP address associated with it. 
D)  Create an AWS Config rule to check that all production instances have EC2 IAM roles that include deny associate-address permissions. Verify whether there is an Elastic IP address associated with any instance, and alert the Security team if an instance has an Elastic IP address associated with it.

Question 18

A software company wants to automate the build process for a project where the code is stored in GitHub. When the repository is updated, source code should be compiled, tested, and pushed to Amazon S3. Which combination of steps would address these requirements? (Choose three.)

Accepted Answer

A)  Add a buildspec.yml file to the source code with build instructions. 
B)  Configure a GitHub webhook to trigger a build every time a code change is pushed to the repository. 
C)  Create an AWS CodeBuild project with GitHub as the source repository. 
D)  Create an AWS CodeDeploy application with the Amazon EC2/On-Premises compute platform. 
E)  Create an AWS OpsWorks deployment with the install dependencies command.
F) Provision an Amazon EC2 instance to perform the build.

Question 19

You are creating an application which stores extremely sensitive financial information. All information in the system must be encrypted at rest and in transit. Which of these is a violation of this policy?

Accepted Answer

A)  ELB SSL termination. 
B)  ELB Using Proxy Protocol v1. 
C)  CloudFront Viewer Protocol Policy set to HTTPS redirection. 
D)  Telling S3 to use AES256 on the server-side.

Question 20

What flag would you use to limit a Docker container's memory usage to 128 megabytes?

Accepted Answer

A)  -memory 128m 
B)  -m 128m 
C)  --memory-reservation 128m 
D)  -m 128MB

Exam 12: AWS DevOps Engineer - Professional (DOP-C01)