Free AWS-CERTIFIED-DEVOPS-ENGINEER-PROFESSIONAL-DOP-C02 – Amazon AWS-CERTIFIED-DEVOPS-ENGINEER-PROFESSIONAL-DOP-C02 Practice Test Question

Loading demo links...

Showing 25–27 of 43 questions

Question 25 (Topic 1)

A company has deployed a new platform that runs on Amazon Elastic Kubernetes Service (Amazon EKS). The new platform hosts web applications that users frequently update. The application developers build the Docker images for the applications and deploy the Docker images manually to the platform. The platform usage has increased to more than 500 users every day. Frequent updates, building the updated Docker images for the applications, and deploying the Docker images on the platform manually have all become difficult to manage. The company needs to receive an Amazon Simple Notification Service (Amazon SNS) notification if Docker image scanning returns any HIGH or CRITICAL findings for operating system or programming language package vulnerabilities. Which combination of steps will meet these requirements? (Choose two.)

Select an option, then click Submit answer.

○ Create an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon S3 event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project.
○ Create an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon EventBridge event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project.
○ Create an AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Turn on basic scanning for the ECR repository. Create an Amazon EventBridge rule that monitors Amazon GuardDuty events. Configure the EventBridge rule to send an event to an SNS topic when the finding-severity-counts parameter is more than 0 at a CRITICAL or HIGH level.
○ Create an AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. Turn on enhanced scanning for the ECR repository. Create an Amazon EventBridge rule that monitors ECR image scan events. Configure the EventBridge rule to send an event to an SNS topic when the finding-severity-counts parameter is more than 0 at a CRITICAL or HIGH level.
○ Create an AWS CodeBuild project that scans the Dockerfile. Configure the project to build the Docker images and store the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository if the scan is successful. Configure an SNS topic to provide notification if the scan returns any vulnerabilities.

Reference / correct answer:

Create an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon EventBridge event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project.

Most accepted answer: B. Create an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. Create a pipeline in AWS CodePipeline. Use an Amazon EventBridge event to invoke the pipeline when a newer version of the Dockerfile is committed. Add a step to the pipeline to initiate the AWS CodeBuild project.

Community votes: B=4, D=4

Selected Answer: BD B sets up a CI/CD pipeline with AWS CodePipeline triggered by changes in the AWS CodeCommit repository. Using Amazon EventBridge ensures that the pipeline is invoked whenever there is a new commit, automating the build and deployment process. D ensures that Docker images are built and pushed to ECR, where enhanced scanning is enabled. Enhanced scanning provides detailed vulnerability information. An EventBridge rule is configured to monitor scan events and trigger notifications via SNS when HIGH or CRITICAL vulnerabilities are found. upvoted 5 times

Selected Answer: BD The answer is BD upvoted 2 times

Selected Answer: BD Option B: - AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files. - Amazon EventBridge event to invoke the pipeline when a newer version of the Dockerfile is committed. Option D: - AWS CodeBuild project that builds the Docker images and stores the Docker images in an Amazon Elastic Container Registry (Amazon ECR) repository. - enhanced scanning for the ECR repository. upvoted 4 times

---> BD upvoted 2 times

Selected Answer: BD Agree with B,D upvoted 3 times

Question 26 (Topic 1)

A company has an organization in AWS Organizations for its multi-account environment. A DevOps engineer is developing an AWS CodeArtifact based strategy for application package management across the organization. Each application team at the company has its own account in the organization. Each application team also has limited access to a centralized shared services account. Each application team needs full access to download, publish, and grant access to its own packages. Some common library packages that the application teams use must also be shared with the entire organization. Which combination of steps will meet these requirements with the LEAST administrative overhead? (Choose three.)

Select an option, then click Submit answer.

○ Create a domain in each application team's account. Grant each application team's account full read access and write access to the application team's domain.
○ Create a domain in the shared services account. Grant the organization read access and CreateRepository access.
○ Create a repository in each application team’s account. Grant each application team’s account full read access and write access to its own repository.
○ Create a repository in the shared services account. Grant the organization read access to the repository in the shared services account Set the repository as the upstream repository in each application team's repository.
○ For teams that require shared packages, create resource-based policies that allow read access to the repository from other application teams' accounts.
○ Set the other application teams' repositories as upstream repositories.

Reference / correct answer:

Create a domain in the shared services account. Grant the organization read access and CreateRepository access.

Most accepted answer: B. Create a domain in the shared services account. Grant the organization read access and CreateRepository access.

Community votes: B=6, C=4, D=5, E=3

Selected Answer: BCD B: Establish a centralized domain in the shared services account and provide organizational access to common libraries. D: Create a repository for common libraries in the shared services account, allow organization-wide read access, and configure upstream repositories. C: Create individual repositories in each team’s account and grant full access to manage their own packages. upvoted 5 times jamesf 2 years ago Keywords: LEAST Administrative overhead Why not following options: A: (Optional) Creating a domain in each team’s account if they need isolated domains (generally, a centralized domain in the shared services account might be more efficient). E: (Optional) Configure resource-based policies for cross-account access if specific repositories need access by other teams' accounts beyond the shared services domain. F: (Optional) Set other repositories as upstream if required, though this may be redundant if the shared services account repository is already upstream. upvoted 1 times ...

Keywords: LEAST Administrative overhead Why not following options: A: (Optional) Creating a domain in each team’s account if they need isolated domains (generally, a centralized domain in the shared services account might be more efficient). E: (Optional) Configure resource-based policies for cross-account access if specific repositories need access by other teams' accounts beyond the shared services domain. F: (Optional) Set other repositories as upstream if required, though this may be redundant if the shared services account repository is already upstream. upvoted 1 times

Selected Answer: BDE The AWS standard answer for this is: B – Central domain with org-wide CreateRepository. D – Shared repo for common libraries (org read, upstream). E – Teams can set resource policies to share their repos with other teams (fulfills “grant access to its own packages”). Even though E adds some overhead, it’s the only option that allows teams to manage sharing of their own packages. upvoted 1 times

Selected Answer: BCE While Option D is a valid approach, it introduces additional complexity by requiring each application team to set up their repositories with the shared services account as an upstream repository. This can lead to more administrative overhead and potential misconfigurations. In contrast, Options B, C, and E provide a simpler and more direct way to achieve the desired outcome. By centralizing the domain in the shared services account, granting organization-wide access, and allowing resource-based policies for shared packages, you can efficiently manage package distribution without relying on individual repository configurations. upvoted 1 times CHRIS12722222 1 year, 7 months ago "Some common library packages that the application teams use must also be shared with the entire organization." looks like it is option D upvoted 1 times ...

"Some common library packages that the application teams use must also be shared with the entire organization." looks like it is option D upvoted 1 times

Question 27 (Topic 1)

A company uses AWS Organizations to manage its AWS accounts. The organization root has a child OU that is named Department. The Department OU has a child OU that is named Engineering. The default FullAWSAccess policy is attached to the root, the Department OU, and the Engineering OU. The company has many AWS accounts in the Engineering OU. Each account has an administrative IAM role with the AdministratorAccess IAM policy attached. The default FullAWSAccessPolicy is also attached to each account. A DevOps engineer plans to remove the FullAWSAccess policy from the Department OU. The DevOps engineer will replace the policy with a policy that contains an Allow statement for all Amazon EC2 API operations. What will happen to the permissions of the administrative 1AM roles as a result of this change?

Select an option, then click Submit answer.

○ All API actions on all resources will be allowed.
○ All API actions on EC2 resources will be allowed. All other API actions will be denied.
○ All API actions on all resources will be denied.
○ All API actions on EC2 resources will be denied. All other API actions will be allowed.

← Prev 4 5 6 7 8 9 10 11 12 13 Next →

Page 9 of 15

Sale Ends In

2h 0m 0s