DOP-C02 Question Bank · Latest 50 Questions Free Preview (Page 3/5)

Questions 21–30 of the latest 50 DOP-C02 questions (5 pages total), with answers and explanations, no login required. Practice all 951 questions online.

Question 21 · No. 922 · Single choice

A company is developing an ecommerce application that has a backend that runs on Amazon EC2 instances. The application has a static frontend website that is hosted in an Amazon S3 bucket. The company uses a GitHub repository for version control and must automate builds and deployments whenever code is pushed to the main branch. The company must deploy changes to the frontend and backend independently of each other. Which solution will meet these requirements?

A. Create a single AWS CodePipeline pipeline to use for the frontend and the backend. Specify the GitHub repository as the source. Configure two build stages that use AWS CodeBuild as the action provider to build the frontend components and backend components, respectively. Configure two deployment stages that use AWS CodeDeploy as the action provider to deploy the frontend and backend, respectively.
B. Create a single AWS CodePipeline pipeline to use for the frontend and the backend. Specify the GitHub repository as the source. Configure two build stages that use AWS CodeBuild as the action provider to build the frontend components and backend components, respectively. Configure two deployment stages. For the backend stage, use AWS CodeDeploy as the action provider to deploy the backend to the EC2 instances. For the frontend stage, use Amazon S3 as the action provider to deploy the frontend to the S3 bucket.
C. Create two AWS CodePipeline pipelines: one for the frontend and one for the backend. Specify the GitHub repository as the source. Configure a build stage that uses AWS CodeBuild as the action provider for each pipeline to build the frontend and the backend. Configure a deployment stage that uses AWS CodeDeploy as the action provider for each pipeline to deploy the frontend and the backend.
D. Create two AWS CodePipeline pipelines: one for the frontend and one for the backend. Specify the GitHub repository as the source. Configure a build stage that uses AWS CodeBuild as the action provider for each pipeline to build the frontend and the backend. For the backend pipeline, use AWS CodeDeploy as the action provider to deploy the backend to the EC2 instances. For the frontend pipeline, use Amazon S3 as the action provider to deploy the frontend to the S3 bucket.

Answer: D

Explanation: The key requirements are: (1) automate builds and deployments when code is pushed to the main branch, and (2) deploy the frontend and backend independently of each other. Option D uses two separate AWS CodePipeline pipelines—one for the frontend and one for the backend—which allows independent deployments. Additionally, it correctly uses Amazon S3 as the action provider for the frontend (since the frontend is hosted in S3) and AWS CodeDeploy for the backend (since the backend runs on EC2 instances). Options A and C fail because AWS CodeDeploy cannot deploy static frontend assets to an S3 bucket (S3 has its own native deployment integration). Option B fails because using a single pipeline means any change pushed to the main branch would trigger deployments for both frontend and backend together, violating the requirement to deploy them independently.

Question 22 · No. 923 · Single choice

A company has an RPO of 24 hours and an RTO of 10 minutes for a critical web application that runs on Amazon EC2 instances. The company uses AWS Organizations to manage its AWS account. The company wants to set up AWS Backup for its AWS environment. A DevOps engineer configures AWS Organizations for AWS Backup. The DevOps engineer creates a new centralized AWS account to store the backups. Each EC2 instance has four Amazon Elastic Block Store (Amazon EBS) volumes attached. Which solution will meet this requirement MOST securely?

A. Create encrypted backup vaults and customer managed AWS KMS keys in both accounts. Configure AWS Backup to create full EC2 backups as AMIs. Copy the backups to the centralized vault.
B. Create encrypted vaults in both accounts by using the source account's AWS KMS key. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.
C. Create backup vaults in both accounts. Use AWS managed keys for encryption. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.
D. Create encrypted vaults in both accounts. Use a customer managed KMS key in the source account. Use an AWS managed key in the centralized account. Configure AWS Backup to create EC2 AMIs. Copy the AMIs to the centralized vault.

Answer: A

Explanation: Option A is the most secure because it uses customer managed KMS keys in both the source and centralized accounts. This gives the company full control over encryption keys, including key rotation, access policies, and audit capabilities. Customer managed keys provide better security boundaries between accounts and ensure that the organization maintains control over its encryption infrastructure. Using customer managed keys in both accounts also allows for proper separation of duties and compliance with regulatory requirements that may mandate customer-controlled encryption keys.

Question 23 · No. 924 · Single choice

A company wants to proactively monitor and respond to AWS service issues that might affect an application. The company must correlate AWS Health events with application performance metrics and must set up automated alerts. The solution must give the company the ability to archive events, test the application's latency in different scenarios, and create custom metrics. Which solution will meet these requirements?

A. Use AWS CloudTrail to log all AWS Health events. Use Amazon Athena to query the logs and to correlate the logs with application metrics stored in Amazon Timestream for LiveAnalytics. Set up AWS Chatbot for real-time notifications.
B. Use Amazon EventBridge to route AWS Health events to Amazon CloudWatch Logs. Create a metric filter for AWS Health events. Create custom metrics in CloudWatch that are based on application performance data. Set up CloudWatch alarms that correlate AWS Health events with the custom metrics.
C. Configure the AWS Health Dashboard to send notifications to Amazon Simple Notification Service (Amazon SNS). Use AWS Lambda to correlate the notifications with metrics and to update custom metrics in Amazon CloudWatch. Set up CloudWatch alarms for the custom metrics. Use AWS Systems Manager for automated remediation.
D. Configure AWS X-Ray to trace AWS Health events and application performance. Use Amazon QuickSight to visualize the correlations between events and metrics. Use Amazon GuardDuty to detect anomalies in the application's behavior and to provide alerts.

Answer: B

Explanation: Option B is the best solution because it meets all the requirements: 1) Amazon EventBridge can natively capture and route AWS Health events; 2) CloudWatch Logs provides the ability to archive events; 3) Custom metrics can be created in CloudWatch based on application performance data; 4) CloudWatch alarms can correlate AWS Health events with the custom metrics to provide automated alerts; and 5) CloudWatch allows testing application latency in different scenarios (e.g., using CloudWatch Synthetics canaries). Option A is incorrect because AWS CloudTrail is for API auditing, not AWS Health events, and AWS Chatbot doesn't provide correlation capabilities. Option C is incorrect because the AWS Health Dashboard has limited automation capabilities and doesn't provide comprehensive event archiving. Option D is incorrect because X-Ray is for application tracing (not AWS Health events), GuardDuty is for security threat detection (not performance correlation), and QuickSight is for visualization (not automated correlation).

Question 24 · No. 925 · Multiple choice

A company uses a CI/CD pipeline to deploy its workload in the ap-southeast-2 Region. The company receives images through a Network Load Balancer (NLB) and processes the images in AWS Fargate tasks on an Amazon Elastic Container Service (Amazon ECS) cluster. An Amazon Elastic Container Registry (Amazon ECR) repository stores the images as Docker images. The company uses Amazon Route 53 to configure DNS. The company saves the images in an Amazon S3 bucket and saves the metadata from the images in an Amazon DynamoDB table. The company wants to expand the workload to a second Region. A DevOps engineer needs to build a highly available and resilient design to expand the workload to the eu-west-2 Region. Which combination of steps will meet these requirements with the FEWEST configuration changes? (Choose three.)

A. Configure ECR replication to eu-west-2 on the repository. Configure an NLB in eu-west-2 that resolves to Fargate tasks in an ECS cluster in eu-west-2. Configure a latency routing policy in Route 53 for the two workloads.
B. Configure the DynamoDB table as a global table with a replica in eu-west-2. Configure the Fargate tasks to interact with the DynamoDB table in ap-southeast-2.
C. Configure the DynamoDB table as a global table with a replica in eu-west-2. Configure the Fargate tasks to interact with the DynamoDB table in the same Region that the tasks run in.
D. Configure a new S3 bucket in eu-west-2. Configure data replication between the S3 bucket in ap-southeast-2 and the S3 bucket in eu-west-2. Configure the Fargate tasks to use the S3 bucket in the same Region that the tasks run in to perform S3 PUT operations and GET operations.
E. Configure an S3 Multi-Region Access Point for the S3 bucket in ap-southeast-2 and a new S3 bucket in eu-west-2. Configure two-way replication on the S3 buckets. Configure the workloads to use the Multi-Region Access Point for S3 PUT operations and GET operations.
F. Configure the CI/CD pipeline to deploy ECR images to both Regions. Configure an NLB in eu-west-2 that resolves to Fargate tasks in an ECS cluster in eu-west-2. Configure a failover routing policy in Route 53 for the two workloads.

Answer: A, C, E

Question 25 · No. 926 · Single choice

A company uses AWS Organizations, AWS Control Tower, AWS Config, and Terraform to manage its AWS accounts and resources. The company must ensure that users deploy only AWS Lambda functions that are connected to a VPC in member AWS accounts. Which solution will meet these requirements with the LEAST operational effort?

A. Configure AWS Control Tower to use proactive controls (guardrails). Enable the optional controls (guardrails) implemented with AWS CloudFormation hooks for Lambda on all OUs.
B. Create a new SCP. Include a conditional statement that uses a StringEquals condition operator to check the lambd:Vpclds condition key against a list of VPC IDs. Configure the SCP to allow the lambda CreateFunction action and the lambda UpdateFunctionConfiguration action if the value of the condition key matches one of the VPC IDs.
C. Create a custom rule in AWS Config to detect Lambda functions that are not connected to a VPC when any Lambda function is created or updated.
D. Create a new SCP. Include a conditional statement that uses a Null condition operator to determine whether the lambda Vpclds condition key is absent. Configure the SCP to deny the lambda CreateFunction action and the lambda UpdateFunctionConfiguration action if the condition key is absent.

Answer: D

Question 26 · No. 927 · Single choice

A DevOps engineer is planning to use the AWS Cloud Development Kit (AWS CDK) to manage infrastructure as code (IaC) for a microservices-based application. The DevOps engineer must create reusable components for common infrastructure patterns and must apply the same cost allocation tags across different microservices. Which solution will meet these requirements?

A. Create a custom CDK construct library that includes common infrastructure patterns. Create a CDK app. Use the TagManager class to add cost allocation tags to the whole app. Use the custom CDK construct library to write a higher-level construct that contains all the microservices. Deploy the microservices as a single CDK stack with environment-specific configurations
B. Create a custom CDK construct library that includes common infrastructure patterns. Create a CDK app. Use the Tags class to add cost allocation tags to the whole app. Use the custom CDK construct library to write higher-level constructs for each microservice. Deploy the microservices as separate CDK stacks with environment-specific configurations.
C. Create AWS Service Catalog products that contain common infrastructure components. Create a CDK app. Use the TagManager class to add cost allocation tags to the whole app. Use the Service Catalog products to write a higher-level construct that contains all the microservices. Deploy the microservices as a single CDK stack with environment-specific configurations.
D. Create AWS Service Catalog products that contain common infrastructure components. Create a CDK app. Use the Tags class to add cost allocation tags to the whole app. Use the Service Catalog products to write higher-level constructs for each microservice. Deploy the microservices as separate CDK stacks with environment-specific configurations.

Answer: B

Explanation: The correct solution is Option B for the following reasons: 1) A custom CDK construct library is the best approach for creating reusable components for common infrastructure patterns, as CDK constructs are designed specifically for this purpose and allow code reuse. 2) The Tags class (from aws-cdk-lib) is the proper public API for applying tags globally to all resources in a CDK app, ensuring the same cost allocation tags are consistently applied across different microservices. TagManager is a lower-level internal class, not typically used directly at the app level. 3) Deploying microservices as separate CDK stacks provides better isolation, independent deployment capabilities, and allows environment-specific configurations. 4) Using higher-level constructs for each microservice maintains reusability while providing the flexibility needed for independent microservice management.

Question 27 · No. 928 · Multiple choice

A company runs an application that uses an Amazon S3 bucket to store images. A DevOps engineer needs to implement a multi-Region disaster recover (DR) strategy for the S3 objects. The DevOps engineer enables two-way replication between the S3 buckets. The company must be able to fail over to a second S3 bucket that is in a second AWS Region. When an image is added to either S3 bucket, the image must be replicated to the other S3 bucket within 15 minutes. Which combination of steps will meet these requirements in the MOST operationally efficient way? (Choose three.)

A. Enable S3 Replication Time Control (S3 RTC) for each replication rule used in the configuration.
B. Create an S3 Multi-Region Access Point in an active-passive configuration.
C. Call the SubmitMultiRegionAccessPointRoutes operation in the Amazon S3 API when the company needs to fail over to the S3 bucket in the second Region.
D. Enable S3 Transfer Acceleration on both S3 buckets.
E. Configure a routing control in Amazon Route 53 Application Recovery Controller. Add both S3 buckets in an active-passive configuration.
F. Use an Amazon Route 53 Application Recovery Controller to shift traffic from the primary bucket to the failover bucket in the second Region.

Answer: A, B, C

Explanation: The correct answers are A, B, and C. A: Enable S3 Replication Time Control (S3 RTC) - This provides a 15-minute SLA for replication, which directly meets the requirement that images must be replicated within 15 minutes. B: Create an S3 Multi-Region Access Point in an active-passive configuration - This provides a unified access point for the S3 buckets across regions and allows for failover configuration with active-passive setup. C: Call the SubmitMultiRegionAccessPointRoutes operation in the Amazon S3 API when the company needs to fail over - This is the API used to shift traffic from the primary bucket to the failover bucket in a Multi-Region Access Point configuration. Option D is incorrect because Transfer Acceleration is for faster uploads from end users, not for cross-region replication or DR failover. Options E and F are incorrect because while Route 53 Application Recovery Controller can be used for orchestrated traffic shifting, for S3 buckets specifically, the Multi-Region Access Point with the SubmitMultiRegionAccessPointRoutes API is the more operationally efficient native solution that doesn't require additional DNS configuration.

Question 28 · No. 929 · Single choice

A company is developing a mobile app that requires extensive automated testing across multiple device types. The company is using AWS CodePipeline for its CI/CD pipeline. The company must implement a scalable testing solution that can handle increased test loads as the app grows. Which solution will meet these requirements with the LEAST management overhead?

A. Integrate AWS Device Farm with the pipeline to run the tests and scale as needed.
B. Deploy a fleet of Amazon EC2 instances with various mobile device emulators and auto scaling to run the tests. Create a custom AWS Lambda function to invoke EC2 test runs.
C. Implement a containerized testing solution that uses Amazon Elastic Container Service (Amazon ECS) with auto scaling. Configure the pipeline to invoke an AWS Lambda function to start the test runs on the ECS cluster.
D. Use AWS Lambda functions with custom runtime emulators to run the tests. Integrate the Lambda functions with the pipeline.

Answer: A

Explanation: AWS Device Farm is a fully managed service specifically designed for testing mobile applications across a wide range of real devices. It automatically scales to handle increased test loads without requiring the company to manage any infrastructure. Compared to the other options, it requires the least management overhead because: Option B requires provisioning and managing EC2 instances with emulators; Option C requires managing containers and ECS clusters; and Option D would require complex custom development for running mobile device emulators in Lambda. Device Farm integrates seamlessly with CodePipeline and handles the scaling automatically.

Question 29 · No. 930 · Single choice

A company has an application that streams logs to an Amazon CloudWatch Logs log group. The logs must be available for the team to search in CloudWatch for at least 30 days. Logs must be accessible with low latency for at least 90 days. After 180 days, log retrieval is rare and latency is not important. A DevOps engineer creates an Amazon S3 bucket to store the logs. Log availability metrics and data protection are important to the company. Which solution will meet these requirements in the MOST cost-effective way?

A. Configure the log group to have a retention period of 30 days and to use the infrequent access log class. Create a CloudWatch metric stream that uses Amazon Kinesis Data Streams to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon Glacier Flexible Retrieval after 180 days.
B. Configure the log group to have a retention period of 30 days and to use the infrequent access log class. Create a CloudWatch metric stream that uses Amazon Data Firehose to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) after 90 days and to Amazon S3 Glacier Flexible Retrieval after 180 days.
C. Configure the log groups to have a retention period of 30 days. Create a CloudWatch subscription filter that uses Amazon Kinesis Data Streams to send log events to the S3 bucket by writing files. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon S3 Glacier Instant Retrieval after 180 days.
D. Configure the log groups to have a retention period of 30 days. Create a CloudWatch subscription filter that uses Amazon Data Firehose to send log events to the S3 bucket. Create an S3 Lifecycle policy to move objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days and to Amazon S3 Glacier Deep Archive after 180 days.

Answer: D

Explanation: Option D is the most cost-effective solution that meets all requirements: (1) 30-day retention in CloudWatch (Standard log class) allows real-time searching during the first 30 days. (2) CloudWatch subscription filter with Amazon Data Firehose is more cost-effective than Kinesis Data Streams because Firehose is fully managed and serverless with automatic scaling. (3) S3 Standard-IA after 90 days provides low-latency access and multi-AZ data protection for the 30-180 day period. (4) S3 Glacier Deep Archive after 180 days is the cheapest storage tier for long-term archival where latency is not important. Options A and B are incorrect because they use the CloudWatch Logs Infrequent Access log class, which does not support real-time search/queries in CloudWatch Logs Insights. Option C uses Kinesis Data Streams (more expensive than Firehose) and Glacier Instant Retrieval (more expensive than Deep Archive for rare access). Option B uses S3 One Zone-IA, which only stores data in a single AZ, failing the data protection requirement.

Question 30 · No. 931 · Single choice

A company has an organization in AWS Organizations. The organization has all features enabled and has AWS CloudTrail trusted access configured for the management account. An Amazon Simple Notification Service (Amazon SNS) topic is configured for notifications. The company needs all AWS events in all AWS Regions in the organization to be recorded and retained in an audit account. The company needs near real-time notifications of any failed login attempts. A DevOps engineer has created an organization trail in the management account to log events for all Regions. Which solution will meet these requirements with the LEAST operational effort?

A. Configure the trail to publish logs to a new Amazon S3 bucket in the audit account. In the audit account, create an Amazon EventBridge rule that reacts to failed login events in CloudTrail. Configure the EventBridge rule to notify the SNS topic.
B. Configure the trail to publish logs to a new Amazon S3 bucket in the management account. Configure an Amazon Athena table to read from the new S3 bucket. Create an AWS Lambda function that queries the Athena table for failed login events and publishes the findings to the SNS topic. Create an Amazon EventBridge scheduled rule to invoke the Lambda function every 5 minutes.
C. Configure the trail to publish logs to a new Amazon S3 bucket in the audit account and a new Amazon CloudWatch log group in the management account. Create a CloudWatch Logs metric filter on the log group to create a custom metric for failed logins. Configure a CloudWatch alarm that uses the custom metric and notifies the SNS topic.
D. Configure the trail to publish logs to a new Amazon CloudWatch log group in the audit account. Create an Amazon Kinesis data stream in the audit account. Configure a subscription filter on the log group to send the logs to the data stream. Use Amazon Managed Service for Apache Flink to filter the data stream for failed logins. Publish the results to the SNS topic.

Answer: C

Prev 1 234 5 Next