Question 1

A company uses AWS CodeCommit for source code control. Developers apply their changes to various feature branches and create pull requests to move those changes to the main branch when the changes are ready for production.

The developers should not be able to push changes directly to the main branch. The company applied the AWSCodeCommitPowerUser managed policy to the developers’ IAM role, and now these developers can push changes to the main branch directly on every repository in the AWS account.

What should the company do to restrict the developers’ ability to push changes to the main branch directly?

Options :

A : Create an additional policy to include a Deny rule for the GitPush and PutFile actions. Include a restriction for the specific repositories in the policy statement with a condition that references the main branch.

B : Remove the IAM policy, and add an AWSCodeCommitReadOnly managed policy. Add an Allow rule for the GitPush and PutFile actions for the specific repositories in the policy statement with a condition that references the main branch.

C : Modify the IAM policy. Include a Deny rule for the GitPush and PutFile actions for the specific repositories in the policy statement with a condition that references the main branch.

D : Create an additional policy to include an Allow rule for the GitPush and PutFile actions. Include a restriction for the specific repositories in the policy statement with a condition that references the feature branches.

Answer: A

Question 2

A leading telecommunications company is using CloudFormation templates to deploy enterprise applications to their production, staging, and development environments in AWS. Their current process involves manual changes to their CloudFormation templates in order to specify the configuration variables and static attributes for each environment. The DevOps Engineer was tasked to set up automated deployments using AWS CodePipeline and ensure that the CloudFormation template is reusable across multiple pipelines.

How should the DevOps Engineer satisfy this requirement?

Options :

A : Set up a Lambda-backed custom resource in the CloudFormation templates. Configure the custom resource to monitor the status of the pipeline in AWS CodePipeline in order to detect which environment was launched. Use the cfn-init helper script to modify the launch configuration of each application stack based on its environment.

B : Launch a new pipeline using AWS CodePipeline that has multiple stages for each environment and configure it to use input parameters. Switch the associated UserData of the EC2 instances to match the environment where the application stack is being launched using CloudFormation mappings. Specify parameter overrides for AWS CloudFormation actions.

C : Manually configure the CloudFormation templates to use input parameters. Add a configuration that whenever the CloudFormation stack is updated, it will dynamically modify the LaunchConfiguration and UserData sections of the EC2 instances.

D : Launch a new pipeline using AWS CodePipeline for each environment with multiple stages for each application. Trigger the CloudFormation deployments using a Lambda function to dynamically modify the UserData of the EC2 instances that were launched in each environment.

Answer: B

Question 3

A popular e-commerce website which has customers across the globe is hosted in the us-east-1 AWS region with a backup site in the us-west-1 region. Due to an unexpected regional outage in the us-east-1 region, the company initiated their disaster recovery plan and turned on the backup site. However, they discovered that the actual failover still entails several hours of manual effort to prepare and switch over the database. They also noticed that the database is missing up to three hours of data transactions when the regional outage happened. Which of the following solutions should the DevOps engineer implement which will improve the RTO and RPO of the website for the cross-region failover?

Options :

A : Create a snapshot every hour using Amazon RDS scheduled instance lifecycle events which will also allow you to monitor specific RDS events. Perform a cross-region snapshot copy into the us-west-1 backup region once the SnapshotCreateComplete event occurred. Create an Amazon CloudWatch Alert which will trigger an action to restore the Amazon RDS database snapshot in the backup region when the CPU Utilization metric of the RDS instance in CloudWatch falls to 0% for more than 15 minutes.

B : Use Step Functions with 2 Lambda functions that call the RDS API to create a snapshot of the database, create a cross-region snapshot copy, and restore the database instance from a snapshot in the backup region. Use CloudWatch Events to trigger the function to take a database snapshot every hour. Set up an SNS topic that will receive published messages from AWS Health API, RDS availability and other events that will trigger the Lambda function to create a cross-region snapshot copy. During failover, Configure the Lambda function to restore the database from a snapshot in the backup region.

C :

Use an ECS cluster to host a custom python script that calls the RDS API to create a snapshot of the database, create a cross-region snapshot copy, and restore the database instance from a snapshot in the backup region. Create a scheduled job using CloudWatch Events that triggers the Lambda function to snapshot a database instance every hour. Set up an SNS topic that will receive published messages about AWS-initiated RDS events from Trusted Advisor that will trigger the function to create a cross-region snapshot copy. During failover, restore the database from a snapshot in the backup region.

D : Configure an Amazon RDS Multi-AZ Deployment configuration and place the standby instance in the us-west-1 region. Set up the RDS option group to enable multi-region availability for native automation of cross-region recovery as well as for continuous data replication. Set up a notification system using Amazon SNS which is integrated with AWS Health API to monitor RDS-related systems events and notify the Operations team. In the actual failover where the primary database instance is down, RDS will automatically make the standby instance in the backup region as the primary instance.

Answer: B

Question 4

An insurance firm is using CloudFormation for deploying their applications in AWS. They have a multi-tier web application which stores financial data in an Amazon RDS MySQL database in a Multi-AZ deployments configuration. They instructed their DevOps Engineer to upgrade the RDS instance to the latest major version of MySQL database. It is of utmost importance to ensure minimal downtime when doing the upgrade to avoid any business disruption.

Which of the following should the engineer implement to properly upgrade the database while minimizing downtime?

Options :

A : In the AWS::RDS::DBInstance resource type in the CloudFormation template, update the AutoMinorVersionUpgrade property to the latest MySQL database version. Launch a new RDS Read Replica with the same properties as the primary database instance that will be upgraded. Finally, trigger an Update Stack operation in CloudFormation.

B : In the AWS::RDS::DBInstance resource type in the CloudFormation template, update the AllowMajorVersionUpgrade property to the latest MySQL database version. Afterward, directly trigger an Update Stack operation in CloudFormation.

C : In the AWS::RDS::DBInstance resource type in the CloudFormation template, update the EngineVersion property to the latest MySQL database version. Create a second application stack and launch a new Read Replica with the same properties as the primary database instance that will be upgraded. Finally, perform an Update Stack operation in CloudFormation.

D : In the AWS::RDS::DBInstance resource type in the CloudFormation template, update the DBEngineVersion property to the latest MySQL database version. Trigger an Update Stack operation in CloudFormation. Launch a new RDS Read Replica with the same properties as the primary database instance that will be upgraded. Finally, perform a second Update Stack operation.

Answer: C

Question 5

A government-sponsored health service is running their web application containing information about the clinics, hospitals, medical specialists and other medical services in the country. They also have a set of public web services which enable third-party companies to search medical data for their respective applications and clients. Lambda functions are used for the public APIs. For its database-tier, an Amazon DynamoDB table stores all of the data with an Amazon ES domain which supports the search feature and stores the indexes. A DevOps engineer has been instructed to ensure that in the event of a failed deployment, there should be no downtime and a system should be in place to prevent subsequent deployments. The service must strictly maintain full capacity during API deployment without any reduced capacity to avoid degradation of service.

How can the engineer meet the above requirements in the MOST efficient way?

Options :

A : Deploy the DynamoDB tables, Lambda functions, and Amazon ES domain using AWS CloudFormation. Deploy changes with an AWS CodeDeploy blue/green deployment. Host the web application in AWS Elastic Beanstalk and set the deployment policy to All at Once.

B : Deploy the DynamoDB tables, Lambda functions, and Amazon ES domain using AWS CloudFormation. Deploy changes with an AWS CodeDeploy in-place deployment. Host the web application in AWS Elastic Beanstalk and set the deployment policy to Rolling.

C : Deploy the DynamoDB tables, Lambda functions, and Amazon ES domain using AWS CloudFormation. Deploy changes with an AWS CodeDeploy blue/green deployment. Host the web application in AWS Elastic Beanstalk and set the deployment policy to Immutable.

D : Deploy the DynamoDB tables, Lambda functions, and Amazon ES domain using AWS CloudFormation. Deploy changes with an AWS CodeDeploy blue/green deployment. Host the web application in Amazon S3 and enable cross-region replication.

Answer: C