Free AWS-CERTIFIED-DEVOPS-ENGINEER-PROFESSIONAL-DOP-C02 – Amazon AWS-CERTIFIED-DEVOPS-ENGINEER-PROFESSIONAL-DOP-C02 Practice Test Question

Loading demo links...

Showing 37–39 of 43 questions

Question 37 (Topic 1)

A company has multiple AWS accounts in an organization in AWS Organizations that has all features enabled. The company’s DevOps administrator needs to improve security across all the company's AWS accounts. The administrator needs to identify the top users and roles in use across all accounts. Which solution will meet these requirements with the MOST operational efficiency?

Select an option, then click Submit answer.

○ Create a new organization trail in AWS CloudTrail. Configure the trail to send log events to Amazon CloudWatch Logs. Create a CloudWatch Contributor Insights rule for the userIdentity.arn log field. View the results in CloudWatch Contributor Insights.
○ Create an unused access analysis for the organization by using AWS Identity and Access Management Access Analyzer. Review the analyzer results and determine if each finding has the intended level of permissions required for the workload.
○ Create a new organization trail in AWS CloudTrail. Create a table in Amazon Athena that uses partition projection. Load the Athena table with CloudTrail data. Query the Athena table to find the top users and roles.
○ Generate a Service access report for each account by using Organizations. From the results, pull the last accessed date and last accessed by account fields to find the top users and roles.

Reference / correct answer:

Create a new organization trail in AWS CloudTrail. Configure the trail to send log events to Amazon CloudWatch Logs. Create a CloudWatch Contributor Insights rule for the userIdentity.arn log field. View the results in CloudWatch Contributor Insights.

Most accepted answer: A. Create a new organization trail in AWS CloudTrail. Configure the trail to send log events to Amazon CloudWatch Logs. Create a CloudWatch Contributor Insights rule for the userIdentity.arn log field. View the results in CloudWatch Contributor Insights.

Community votes: A=5, C=4

Selected Answer: C You can use partition projection in Athena to optimize your queries by specifying how the logs are structured in S3. This makes the process of querying CloudTrail logs across multiple AWS accounts much more efficient. upvoted 6 times

Selected Answer: A Option A provides a solution that is operationally efficient, scalable, and directly addresses the requirement to identify the top users and roles in use across all AWS accounts. By leveraging AWS services like CloudTrail and CloudWatch Contributor Insights, the DevOps administrator can gain real-time insights with minimal setup and maintenance effort. upvoted 5 times

Selected Answer: A C (Athena) = technically works but heavy operational burden A (Contributor Insights) = real-time, zero-query, zero-maintenance dashboards Therefore A is the MOST operationally efficient solution. upvoted 2 times

Selected Answer: A Which solution will meet these requirements with the MOST operational efficiency? Answer is A upvoted 4 times

Selected Answer: A What do you think "partition projection" has to do with the required scenario guys? upvoted 2 times

Question 38 (Topic 1)

A company is using AWS Organizations and wants to implement a governance strategy with the following requirements: • AWS resource access is restricted to the same two Regions for all accounts. • AWS services are limited to a specific group of authorized services for all accounts. • Authentication is provided by Active Directory. • Access permissions are organized by job function and are identical in each account. Which solution will meet these requirements?

Select an option, then click Submit answer.

○ Establish an organizational unit (OU) with group policies in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.
○ Establish a permission boundary in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.
○ Establish a service control policy in the management account to restrict Regions and authorized services. Use AWS Resource Access Manager (AWS RAM) to share management account roles with permissions for each job function, including AWS IAM Identity Center for authentication in each account.
○ Establish a service control policy in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.

Reference / correct answer:

Establish a service control policy in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.

Most accepted answer: D. Establish a service control policy in the management account to restrict Regions and authorized services. Use AWS CloudFormation StackSets to provision roles with permissions for each job function, including an IAM trust policy for IAM identity provider authentication in each account.

Community votes: D=2

Selected Answer: D Service Control Policies (SCPs): SCPs are used in AWS Organizations to apply restrictions at the organization level to control which AWS Regions and services can be used. SCPs will enforce the policy across all accounts in the organization, ensuring that resource access is restricted to only the allowed Regions and services. CloudFormation StackSets: AWS CloudFormation StackSets are used to automatically create and maintain roles and permissions across all accounts. This allows for standardized job-function-based roles to be created consistently in each account, with the exact same structure, regardless of account. IAM Trust Policy with Active Directory: The solution includes an IAM trust policy that allows Active Directory to authenticate users. This ensures that access is controlled by user identity and role, according to the organizational job functions. upvoted 2 times

Selected Answer: D should be D upvoted 4 times

Question 39 (Topic 1)

A company runs several applications in the same AWS account. The applications send logs to Amazon CloudWatch. A data analytics team needs to collect performance metrics and custom metrics from the applications. The analytics team needs to transform the metrics data before storing the data in an Amazon S3 bucket. The analytics team must automatically collect any new metrics that are added to the CloudWatch namespace. Which solution will meet these requirements with the LEAST operational overhead?

Select an option, then click Submit answer.

○ Configure a CloudWatch metric stream to include metrics from the application and the CloudWatch namespace. Configure the metric stream to deliver the metrics to an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.
○ Configure a CloudWatch metrics stream to include all the metrics and to deliver the metrics to an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.
○ Configure metric filters for the CloudWatch logs to create custom metrics. Configure a CloudWatch metric stream to deliver the application metrics to the S3 bucket.
○ Configure subscription filters on the application log groups to target an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.

Reference / correct answer:

Configure a CloudWatch metrics stream to include all the metrics and to deliver the metrics to an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.

Most accepted answer: B. Configure a CloudWatch metrics stream to include all the metrics and to deliver the metrics to an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket.

Community votes: A=2, B=4

Selected Answer: A Explanation: The requirements are: 1. Collect performance metrics and custom metrics from CloudWatch. 2. Automatically include new metrics added to the namespace. 3. Transform the metrics data. 4. Store the transformed data in an S3 bucket. 5. Minimize operational overhead. Option A: Configure a CloudWatch metric stream to include metrics from the application and the CloudWatch namespace. Configure the metric stream to deliver the metrics to an Amazon Data Firehose delivery stream. Configure the Firehose delivery stream to invoke an AWS Lambda function to transform the data. Configure the delivery stream to send the transformed data to the S3 bucket. upvoted 7 times

Selected Answer: B Why not option B? Just collect all the metrics in the namespace, if new ones are added later, it will also be collected upvoted 7 times GripZA 1 year, 3 months ago I think his Selected Answer supposed to be A. upvoted 2 times ...

I think his Selected Answer supposed to be A. upvoted 2 times

Selected Answer: B B is the correct answer. Imagine have an application that currently publishes these metrics: app/metrics (RequestCount, ErrorCount). You configure a CloudWatch metric stream (Option A) with a filter: Include only metrics from namespace App/Metrics Day 1: Metrics RequestCount and ErrorCount are captured in the metric stream. ... Day 7: Your development team deploys a new feature that emits metrics in a new namespace: Namespace: App/Cache (CacheHitRate, CacheMissRate) Because your metric stream was explicitly configured to include only App/Metrics, the new App/Cache namespace is not included. With Option B (all metrics): On Day 7, the new App/Cache metrics automatically appear in S3 without you touching anything. ✅ upvoted 2 times

Selected Answer: B CloudWatch metric streams are designed specifically to stream metric data in near real-time to destinations like Firehose. Selecting "all metrics" ensures that any new metrics added in the future are automatically included, satisfying the requirement to "automatically collect any new metrics." Amazon Kinesis Data Firehose supports Lambda transforms, so the analytics team can modify data before it's delivered. Output to S3 is natively supported by Firehose, which satisfies the storage requirement. upvoted 3 times 4eaa7a4 8 months, 2 weeks ago It does say collect any new metrics from the Cloudwatch namespace that is already added (as a whole) in answer A upvoted 1 times ...

← Prev 6 7 8 9 10 11 12 13 14 15 Next →

Page 13 of 15

Sale Ends In

2h 0m 0s