Free AWS-CERTIFIED-DEVOPS-ENGINEER-PROFESSIONAL-DOP-C02 Amazon AWS-CERTIFIED-DEVOPS-ENGINEER-PROFESSIONAL-DOP-C02 Practice Test Question - Page 7

Question 19 (Topic 1)

A company has an AWS CodeDeploy application. The application has a deployment group that uses a single tag group to identify instances for the deployment of Application. The single tag group configuration identifies instances that have Environment=Production and Name=ApplicationA tags for the deployment of ApplicationA. The company launches an additional Amazon EC2 instance with Department=Marketing, Environment=Production, and Name=ApplicationB tags. On the next CodeDeploy deployment of Application, the additional instance has ApplicationA installed on it. A DevOps engineer needs to configure the existing deployment group to prevent ApplicationA from being installed on the additional instance. Which solution will meet these requirements?

Select an option, then click Submit answer.

○ Change the current single tag group to include only the Environment=Production tag. Add another single tag group that includes only the Name=ApplicationA tag.
○ Change the current single tag group to include the Department=Marketing, Environment=production, and Name=ApplicationA tags.
○ Add another single tag group that includes only the Department=Marketing tag. Keep the Environment=Production and Name=ApplicationA tags with the current single tag group.
○ Change the current single tag group to include only the Environment=Production tag. Add another single tag group that includes only the Department=Marketing tag.

Reference / correct answer:

Change the current single tag group to include only the Environment=Production tag. Add another single tag group that includes only the Name=ApplicationA tag.

Most accepted answer: A. Change the current single tag group to include only the Environment=Production tag. Add another single tag group that includes only the Name=ApplicationA tag.

Community votes: A=6, B=2

Selected Answer: A A is correct: All tags in one tag group are OR operator. Tags are in multiple tag groups are AND operator upvoted 9 times

Selected Answer: A I Found this question largely incomprehensible untill I understood the following concepts and mapped out everything - Single tag group: Any instance identified by at least one tag in the group is included in the deployment group. (OR Operator within individual tag groups) - Multiple tag groups: Instances that are identified by at least one tag in each of the tag groups are included. (AND Operator between multiple tag groups) https://docs.aws.amazon.com/codedeploy/latest/userguide/instances-tagging.html upvoted 6 times Gomer 2 years ago A:(YES) Block ApplicationA deployments on EC2B because it would now have to have both Production AND ApplicationA tags (AND Operator between tag groups) B: (NO) Allow ApplicationA deployments on EC2B because it has the Production tag (OR Operator within tag group) C: (NO) Allow ApplicationA deployments on EC2B because it has the Production and Marketing tags (OR Operator within tag group, AND Operator between tag groups) D: (NO) Allow ApplicationA deployments on EC2B because it has the Production and Marketing tags (OR Operator within tag group, AND Operator between tag groups) upvoted 2 times ...

A:(YES) Block ApplicationA deployments on EC2B because it would now have to have both Production AND ApplicationA tags (AND Operator between tag groups) B: (NO) Allow ApplicationA deployments on EC2B because it has the Production tag (OR Operator within tag group) C: (NO) Allow ApplicationA deployments on EC2B because it has the Production and Marketing tags (OR Operator within tag group, AND Operator between tag groups) D: (NO) Allow ApplicationA deployments on EC2B because it has the Production and Marketing tags (OR Operator within tag group, AND Operator between tag groups) upvoted 2 times

Selected Answer: A when you understand how multiple tag groups deploy, it makes it easier to map out. the golden rule is that an instance must match AT LEAST ONE of the tags in each of the tag groups. so when adding another single tag group with Name=ApplicationA tag, the new instance needs to have Environment=Production AND Name=ApplicationA tag to be included in the existing deployment group upvoted 1 times

Selected Answer: B Option B is the most effective solution, as it specifies that the deployment group should only target instances that have all three tags (Department=Marketing, Environment=Production, and Name=ApplicationA). This ensures that only instances specifically meant for ApplicationA are selected for the deployment, preventing unwanted instances (like those with Name=ApplicationB) from receiving the application. upvoted 1 times

Question 20 (Topic 1)

A company has an AWS CloudFormation stack that is deployed in a single AWS account. The company has configured the stack to send event notifications to an Amazon Simple Notification Service (Amazon SNS) topic. A DevOps engineer must implement an automated solution that applies a tag to the specific CloudFormation stack instance only after a successful stack update occurs. The DevOps engineer has created an AWS Lambda function that applies and updates this tag for the specific stack instance. Which solution will meet these requirements?

Select an option, then click Submit answer.

○ Run the AWS-UpdateCloudFormationStack AWS Systems ManagerAutomation runbook when Systems Manager detects an UPDATE_COMPLETE event for the instance status of the CloudFormation stack. Configure the runbook to invoke the Lambda function.
○ Create a custom AWS Config rule that produces a compliance change event if the CloudFormation stack has an UPDATE_COMPLETE instance status. Configure AWS Config to directly invoke the Lambda function to automatically remediate the change event.
○ Create an Amazon EventBridge rule that matches the UPDATE_COMPLETE event pattern for the instance status of the CloudFormation stack. Configure the rule to invoke the Lambda function.
○ Adjust the configuration of the CloudFormation stack to send notifications for only an UPDATE_COMPLETE instance status event to the SNS topic. Subscribe the Lambda function to the SNS topic.

Reference / correct answer:

Create an Amazon EventBridge rule that matches the UPDATE_COMPLETE event pattern for the instance status of the CloudFormation stack. Configure the rule to invoke the Lambda function.

Most accepted answer: C. Create an Amazon EventBridge rule that matches the UPDATE_COMPLETE event pattern for the instance status of the CloudFormation stack. Configure the rule to invoke the Lambda function.

Community votes: C=4

Selected Answer: C EventBridge is designed to detect specific events in AWS services, and it can be configured to match events such as UPDATE_COMPLETE from CloudFormation. This allows you to automate the process of tagging the CloudFormation stack instancess whenever the UPDATE_COMPLETE event occurs. The EventBridge rule will trigger the Lambda function, which will then apply the necessary tag to the stack. upvoted 3 times

Selected Answer: C options C and D are suitable for implementing the automated solution. However, using Option C with Amazon EventBridge is more direct and does not require additional SNS configuration upvoted 3 times

Selected Answer: C C, EventBridge + Lambda Function https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-run-lambda-schedule.html upvoted 3 times

Selected Answer: C Its C, 100% upvoted 3 times

Question 21 (Topic 1)

A cloud team uses AWS Organizations and AWS IAM Identity Center (AWS Single Sign-On) to manage a company's AWS accounts. The company recently established a research team. The research team requires the ability to fully manage the resources in its account. The research team must not be able to create IAM users. The cloud team creates a Research Administrator permission set in IAM Identity Center for the research team. The permission set has the AdministratorAccess AWS managed policy attached. The cloud team must ensure that no one on the research team can create IAM users. Which solution will meet these requirements?

Select an option, then click Submit answer.

○ Create an IAM policy that denies the iam:CreateUser action. Attach the IAM policy to the Research Administrator permission set.
○ Create an IAM policy that allows all actions except the iam:CreateUser action. Use the IAM policy to set the permissions boundary for the Research Administrator permission set.
○ Create an SCP that denies the iam:CreateUser action. Attach the SCP to the research team's AWS account.
○ Create an AWS Lambda function that deletes IAM users. Create an Amazon EventBridge rule that detects the IAM CreateUser event. Configure the rule to invoke the Lambda function.

Reference / correct answer:

Create an IAM policy that denies the iam:CreateUser action. Attach the IAM policy to the Research Administrator permission set.

Most accepted answer: A. Create an IAM policy that denies the iam:CreateUser action. Attach the IAM policy to the Research Administrator permission set.

Community votes: A=10, C=7

Selected Answer: C It's C for me, here is a link with a similar scenario: https://asecure.cloud/a/scp_deny_iam_user_creation_w_exception/ upvoted 8 times

Selected Answer: C While IAM policies can deny actions, they are typically attached to individual users or roles. In this scenario, you want to restrict user creation across the entire research team's account, making an SCP the more appropriate choice. upvoted 7 times

Selected Answer: A A just research team C all teams upvoted 1 times

Selected Answer: A A as the restriction just needs to be applied to the research team but not the whole account users upvoted 3 times

Selected Answer: A The wording is that only the research team should not be allowed to create users. This is A as the Permission Set will apply to just them. If you choose C it's an account wide deny so no other user or admins would be able to create a user which is outside the scope of the question. upvoted 4 times

Free AWS-CERTIFIED-DEVOPS-ENGINEER-PROFESSIONAL-DOP-C02 – Amazon AWS-CERTIFIED-DEVOPS-ENGINEER-PROFESSIONAL-DOP-C02 Practice Test Question