Question 1

A company's video streaming platform usage has increased from 10,000 users each day to 50,000 users each day in multiple countries. The company deploys the streaming platform on Amazon Elastic Kubernetes Service (Amazon EKS). The EKS workload scales up to thousands of nodes during peak viewing time.

The company's users report occurrences of unauthorized logins. Users also report sudden interruptions and logouts from the platform.

The company wants additional security measures for the entire platform. The company also needs a summarized view of the resource behaviors and interactions across the company's entire AWS environment. The summarized view must show login attempts, API calls, and network traffic. The solution must permit network traffic analysis while minimizing the overhead of managing logs. The solution must also quickly investigate any potential malicious behavior that is associated with the EKS workload.

Which solution will meet these requirements?

Options :

A : Enable Amazon GuardDuty for EKS Audit Log Monitoring. Enable AWS CloudTrail logs. Store the EKS audit logs and CloudTrail log files in an Amazon S3 bucket. Use Amazon Athena to create an external table. Use Amazon QuickSight to create a dashboard

B : Enable Amazon GuardDuty for EKS Audit Log Monitoring. Enable Amazon Detective in the company-s AWS account. Enable EKS audit logs from optional source packages in Detective.

C : Enable Amazon CloudWatch Container Insights. Enable AWS CloudTrail logs. Store the EKS audit logs and CloudTrail log files in an Amazon S3 bucket. Use Amazon Athena to create an external table. Use Amazon QuickSight to create a dashboard.

D : Enable Amazon GuardDuty for EKS Audit Log Monitoring. Enable Amazon CloudWatch Container Insights and VPC Flow Logs. Enable AWS CloudTrail logs.

Answer: D

Question 2

A company has a suite of applications that uses the MERN stack for the presentation tier and NGINX for the web tier. AWS CodeDeploy will be used to automate its application deployments. The DevOps team created a deployment group for their TEST environment and performed functional tests within the application. The team will set up additional deployment groups for STAGING and PROD environments later on. The current log level is configured within the NGINX settings, but the team wants to change this configuration dynamically when the deployment occurs. This will enable them to set different log level configurations depending on the deployment group without having a different application revision for each group.

Which among the options below provides the LEAST management overhead and does not require different script versions for each deployment group?

Options :

A : Set up a custom environment variable in CodeDeploy for each environment with a value of TEST, STAGING or PROD. Attach a shell script in the application revision that will read the custom variable and determine which deployment group the Amazon EC2 instance is associated with. In the appspec.yml config file, add a reference to this script as part of the ValidateService lifecycle hook. Configure the log level settings of the instance based on the result of the script.

B : Develop a custom shell script that uses the DEPLOYMENT_GROUP_ID environment variable in CodeDeploy to identify which deployment group the Amazon EC2 instance is associated with. In the appspec.yml config file, add a reference to this script as part of the ApplicationStart lifecycle hook. Configure the log level settings of the instance based on the result of the script.

C : Develop a custom shell script that uses the DEPLOYMENT_GROUP_NAME environment variable in CodeDeploy to identify which deployment group the Amazon EC2 instance is associated with. In the appspec.yml config file, add a reference to this script as part of the Beforelnstall lifecycle hook. Configure the log level settings of the instance based on the result of the script.

D : Use the AWS Resource Groups Tag Editor to add a tag on each EC2 instance based on its deployment group. Attach a shell script in the application revision that will fetch the instance tag using the aws ec2 describe-tags CLI command to determine which deployment group the Amazon EC2 instance is associated with. In the appspec.yml config file, add a reference to this script as part of the ValidateService lifecycle hook. Configure the log level settings of the instance based on the result of the script.

Answer: C

Question 3

A company requires an RPO of 2 hours and an RTO of 10 minutes for its data and application at all times. An application uses a MySQL database and Amazon EC2 web servers. The development team needs a strategy for failover and disaster recovery.

Which combination of deployment strategies will meet these requirements? (Choose two.)

Options :

A : Create an Amazon Aurora cluster in one Availability Zone across multiple Regions as the data store. Use Aurora’s automatic recovery capabilities in the event of a disaster.

B : Create an Amazon Aurora global database in two Regions as the data store. In the event of a failure, promote the secondary Region as the primary for the application.

C : Create an Amazon Aurora multi-master cluster across multiple Regions as the data store. Use a Network Load Balancer to balance the database traffic in different Regions.

D : Set up the application in two Regions and use Amazon Route 53 failover-based routing that points to the Application Load Balancers in both Regions. Use health checks to determine the availability in a given Region. Use Auto Scaling groups in each Region to adjust capacity based on demand.

E : Set up the application in two Regions and use a multi-Region Auto Scaling group behind Application Load Balancers to manage the capacity based on demand. In the event of a disaster, adjust the Auto Scaling group’s desired instance count to increase baseline capacity in the failover Region.

Answer: B,D

Question 4

A leading e-commerce company has a payment portal that handles the payment and refund transactions of its online platform. The portal is hosted in an Auto Scaling group of On-Demand EC2 instances across three multiple Availability Zones in the US West (N. California) region. There is a new requirement to improve the system monitoring of the application as well to track the number of payment and refund transactions being done every minute. The DevOps team should also be notified if this metric breached the specified threshold.

Which of the following options provides the MOST cost-effective and automated solution that will satisfy the above requirement?

Options :

A : Configure the instances to push the number of payments and refund transactions to CloudWatch as a custom metric. Set up a CloudWatch alarm to notify the DevOps team using SNS when the threshold is breached. View statistical graphs of your published metrics with the AWS Management Console.

B : Set up an ELK stack that is composed of Elasticsearch, Logstash, and Kibana for log processing. Store the payments and refund transactions in each instance and configure Logstash to send the logs to Amazon ES. Set up a Kibana dashboard to view the data and the metric graphs.

C : Configure the instances to push the entire log of each payments and refund transactions to CloudWatch Events as a custom metric. Set up a CloudWatch alarm to notify the DevOps team using SNS when the threshold is breached. View statistical graphs of your published metrics with the AWS Management Console.

D : Configure the instances to push the number of payments and refund transactions to Amazon CloudWatch Logs as a custom metric. Develop a custom monitoring application using a Python-based Flask web application to view the metrics and host it in an Amazon EC2 instance.

Answer: A

Question 5

A leading digital consultancy company has two teams in its IT department: the DevOps team and the Security team, that are working together on different components of its cloud architecture. AWS CloudFormation is used to manage its resources across all of its AWS accounts, including AWS Config for configuration management. The Security team applies the operating system-level updates and patches while the DevOps team manages application-level dependencies and updates. The DevOps team must use the latest AMI when launching new EC2 instances and deploying its flagship application.

Which of the following options is the MOST scalable method for integrating the two processes and teams?

Options :

A :

Instruct the Security team to maintain a nested stack in AWS CloudFormation that includes both the OS and the templates from the DevOps team. Order the Security team to use the stack update action to deploy updates to the application stack whenever the DevOps team changes the application code.

B : Instruct the Security team to set up an AWS CloudFormation stack that creates an AWS CodePipeline pipeline that builds new Amazon Machine Images. Then, store the AMI ARNs as parameters in AWS Systems Manager Parameter Store as part of the pipeline output. Order the DevOps team to use the AWS::SSM::Parameter section in their CloudFormation stack to obtain the most recent AMI ARN from the Parameter Store.

C : Instruct the Security team to use a CloudFormation stack that launches an AWS CodePipeline pipeline that builds new AMIs then store the latest AMI ARNs in an encrypted S3 object as part of the pipeline output. Order the DevOps team to use a cross-stack reference within their own CloudFormation template to get that S3 object location and obtain the most recent AMI ARNs to use when deploying their application.

D : Instruct the Security team to set up an AWS CloudFormation template that creates new versions of their AMIs and lists the Amazon Resource names (ARNs) of the AMIs in an encrypted S3 object as part of the stack output section. Direct the DevOps team to use the cross-stack reference to load the encrypted S3 object and obtain the most recent AMI ARNs.

Answer: B

Smartly Prepare Exam with Free Online DOP-C02 Practice Test

Buying Options: