Question 1

You want to build a new search tool feature for your monitoring system that will allow your information security team to quickly audit all API calls in your AWS accounts. What combination of AWS services can you use to develop and automate the backend processes supporting this tool? (Choose three.)
A) Create an Amazon CloudSearch domain for API call logs. Configure the search domain so that it can be used to index API call logs for the search tool.
B) Use AWS CloudTrail to store API call logs in an Amazon S3 bucket. Configure an Amazon Simple Notification Service topic called "log-notification" that notifies subscribers when new logs are available. Subscribe an Amazon SQS queue to the topic.
C) Use Amazon Cloudwatch to ship AWS CloudTrail logs to your monitoring system.
D) Create an AWS Elastic Beanstalk application in worker role mode that uses an Amazon Simple Email Service (SES) domain to facilitate batch processing new API call log files retrieved from an Amazon S3 bucket into a search index.
E) Use AWS CloudTrail to store API call logs in an Amazon S3 bucket. Configure Amazon Simple Email Service (SES) to notify subscribers when new logs are available. Subscribe an Amazon SQS queue to the email domain.
F) Create Amazon Cloudwatch custom metrics for the API call logs. Configure a Cloudwatch search domain so that it can be used to index API call logs for the search tool.
G) Create an AWS Elastic Beanstalk application in worker role mode that uses an Amazon SQS queue to facilitate batch processing new API call log files retrieved from an Amazon S3 bucket into a search index.

Accepted Answer

The answer of You want to build a new search...

Question 2

Which of these is not a Pseudo Parameter in AWS CloudFormation?
A) AWS::StackName
B) AWS::AccountId
C) AWS::StackArn
D) AWS::NotificationARNs

Accepted Answer

AWS::StackArn is not a pseudo parameter in AWS CloudFormation. The pseudo parameters include AWS::StackName, AWS::AccountId, and AWS::NotificationARNs, but not AWS::StackArn.

Question 3

A user has attached an EBS volume to a running Linux instance as a "/dev/sdf" device. The user is unable to see the attached device when he runs the command "df -h". What is the possible reason for this?
A) The volume is not in the same AZ of the instance
B) The volume is not formatted
C) The volume is not attached as a root device
D) The volume is not mounted

Accepted Answer

The "df -h" command shows mounted filesystems. If the volume is not mounted, it won't appear in the output of this command.

Question 4

How long are the messages kept on an SQS queue by default?
A) If a message is not read, it is never deleted
B) 2 weeks
C) 1 day
D) 4 days

Accepted Answer

By default, messages in an Amazon SQS queue are retained for 4 days if they are not deleted after being read.

Question 5

When thinking of DynamoDB, what are true of Global Secondary Key properties?
A) The partition key and sort key can be different from the table.
B) Only the partition key can be different from the table.
C) Either the partition key or the sort key can be different from the table, but not both.
D) Only the sort key can be different from the table.

Accepted Answer

Global Secondary Indexes (GSI) in DynamoDB allow both the partition key and the sort key to be different from those of the base table.

Question 6

You need to grant a vendor access to your AWS account. They need to be able to read protected messages in a private S3 bucket at their leisure. They also use AWS. What is the best way to accomplish this?
A) Create an IAM User with API Access Keys. Grant the User permissions to access the bucket. Give the vendor the AWS Access Key ID and AWS Secret Access Key for the User.
B) Create an EC2 Instance Profile on your account. Grant the associated IAM role full access to the bucket. Start an EC2 instance with this Profile and give SSH access to the instance to the vendor.
C) Create a cross-account IAM Role with permission to access the bucket, and grant permission to use the Role to the vendor AWS account.
D) Generate a signed S3 PUT URL and a signed S3 PUT URL, both with wildcard values and 2 year durations. Pass the URLs to the vendor.

Accepted Answer

Creating a cross-account IAM Role with permission to access the bucket allows the vendor to assume the role from their AWS account, providing secure and controlled access to the S3 bucket.

Question 7

You are designing a system which needs, at minumum, 8 m4.large instances operating to service traffic. When designing a system for high availability in the us-east-1 region, which has 6 Availability Zones, you company needs to be able to handle death of a full availability zone. How should you distribute the servers, to save as much cost as possible, assuming all of the EC2 nodes are properly linked to an ELB? Your VPC account can utilize us-east-1's AZ's a through f, inclusive.
A) 3 servers in each of AZ's a through d, inclusive.
B) 8 servers in each of AZ's a and b.
C) 2 servers in each of AZ's a through e, inclusive.
D) 4 servers in each of AZ's a through c, inclusive.

Accepted Answer

Distributing 2 servers in each of AZ's a through e ensures that if one AZ fails, there are still 8 servers running across the remaining AZs, meeting the minimum requirement while minimizing costs.

Question 8

You are creating a new API for video game scores. Reads are 100 times more common than writes, and the top 1% of scores are read 100 times more frequently than the rest of the scores. What's the best design for this system, using DynamoDB?
A) DynamoDB table with 100x higher read than write throughput, with CloudFront caching.
B) DynamoDB table with roughly equal read and write throughput, with CloudFront caching.
C) DynamoDB table with 100x higher read than write throughput, with ElastiCache caching.
D) DynamoDB table with roughly equal read and write throughput, with ElastiCache caching.

Accepted Answer

The answer of You are creating a new API for...

Question 9

A user has created a new EBS volume from an existing snapshot. The user mounts the volume on the instance to which it is attached. Which of the below mentioned options is a required step before the user can mount the volume?
A) Run a cyclic check on the device for data consistency
B) Create the file system of the volume
C) Resize the volume as per the original snapshot size
D) No step is required. The user can directly mount the device

Accepted Answer

The answer of A user has created a new EBS...

Question 10

There are a number of ways to purchase compute capacity on AWS. Which orders the price per compute or memory unit from LOW to HIGH (cheapest to most expensive), on average?
A) On-Demand B Spot C Reserved
B) A, B, C
C) C, B, A
D) B, C, A
E) A, C, B

Accepted Answer

Reserved Instances are the cheapest option, followed by Spot Instances, and then On-Demand Instances.

Question 11

Your DevOps team is responsible for a multi-tier, Windows-based web application consisting of web servers, Amazon RDS database instances, and a load balancer behind Amazon Route53. You have been asked by your manager to build a cost-effective rolling deployment solution for this web application. What method should you use?
A) Re-deploy your application on an AWS OpsWorks stack. Use the AWS OpsWorks done stack feature to allow updates between duplicate stacks.
B) Re-deploy your application on Elastic Beanstalk and take advantage of Elastic BeanStalk rolling updates.
C) Re-deploy your application using an AWS CloudFormation template, launch a new AWS CloudFormation stack during each deployment, and then tear down the old stack.
D) Re-deploy your application using an AWS CloudFormation template. Use AWS CloudFormation rolling deployment policies, create a new policy for your AWS CloudFormation stack, and initiate an update stack operation to deploy new code.

Accepted Answer

AWS CloudFormation rolling deployment policies allow you to update your stack in a rolling manner, which means that you can update a portion of your stack at a time, while the rest of the stack remains operational. This is a cost-effective way to deploy updates to your web application, as it minimizes the amount of downtime that your application experiences.

Question 12

You have written a server-side Node.Js application and a web application with an HTML/JavaScript front end that uses the Angular.js framework. The server-side application connects to an Amazon Redshift cluster, issues queries, and then returns the results to the front end for display. Your user base is very large and distributed, but it is important to keep the cost of running this application low. Which deployment strategy is both technically valid and the most cost-effective?
A) Deploy an AWS Elastic Beanstalk application with two environments: one for the Node.js application and another for the web front end. Launch an Amazon Redshift cluster, and point your application to its Java Database Connectivity (JDBC) endpoint.
B) Deploy an AWS OpsWorks stack with three layers: a static web server layer for your front end, a Node.js app server layer for your server-side application, and a Redshift DB layer for your Amazon Redshift duster.
C) Upload the HTML, CSS, images, and JavaScript for the front end to an Amazon Simple Storage Service (S3) bucket. Create an Amazon CloudFront distribution with this bucket as its origin. Use AWS Elastic Beanstalk to deploy the Node.js application. Launch an Amazon Redshift cluster, and point your application to its JDBC endpoint.
D) Upload the HTML, CSS, images, and JavaScript for the front end, plus the Node.js code for the server-side application, to an Amazon S3 bucket. Create a CloudFront distribution with this bucket as its origin. Launch an Amazon Redshift cluster, and point your application to its JDBC endpoint.
E) Upload the HTML, CSS, images, and JavaScript for the front end to an Amazon S3 bucket. Use AWS Elastic Beanstalk to deploy the Node.js application. Launch an Amazon Redshift cluster, and point your application to its JDBC endpoint.

Accepted Answer

Using Amazon S3 and CloudFront for the static front end is cost-effective and scalable. AWS Elastic Beanstalk simplifies deployment and management of the Node.js application, and using Amazon Redshift for the database is appropriate for handling large datasets.

Question 13

You would like to run automated, continuous application level integration tests on all members of an Auto Scaling group. Which two options should you use? (Choose two.)
A) Use the AWS SDK to run the DescribeInstances API call on the Auto Scaling group, and then iterate over the members and remotely connect to each Amazon EC2 instance and run the integration tests.
B) Use the AWS SDK to run the DescribeAutoScalinglnstances API call on the Auto Scaling Group, iterate over the members using the Describe Instances API call, remotely connect to each Amazon EC2 instance, and then run the integration tests.
C) Set up a custom CloudWatch metric with the output of your integration tests that are run by a scheduled process on each instance, and then set up a CloudWatch alert for any failures.
D) Using an Auto Cycle Group lifecycle policy, define a scheduled task to run integration tests when a new Amazon EC2 instance enters the InService state.
E) Set up a custom CloudWatch metric that uses the output of the DescribeAutoScalingInstances API call to determine the HealthCheck status of the Amazon EC2 instances.
F) Using the Auto Cycle Group lifecycle policy, define a scheduled task to run integration tests on individual instances using the Amazon EC2 user data to export test data to CloudWatch Logs.

Accepted Answer

The answer of You would like to run automated, continuous...

Question 14

You currently run your infrastructure on Amazon EC2 instances behind an Auto Scaling group. All logs for you application are currently written to ephemeral storage. Recently your company experienced a major bug in code that made it through testing and was ultimately deployed to your fleet. This bug triggered your Auto Scaling group to scale up and back down before you could successfully retrieve the logs off your server to better assist you in troubleshooting the bug. Which technique should you use to make sure you are able to review your logs after your instances have shut down?
A) Configure the ephemeral policies on your Auto Scaling group to back up on terminate.
B) Configure your Auto Scaling policies to create a snapshot of all ephemeral storage on terminate.
C) Install the CloudWatch Logs Agent on your AMI, and configure CloudWatch Logs Agent to stream your logs.
D) Install the CloudWatch monitoring agent on your AMI, and set up new SNS alert for CloudWatch metrics that triggers the CloudWatch monitoring agent to backup all logs on the ephemeral drive.
E) Install the CloudWatch monitoring agent on your AMI, Update your Auto Scaling policy to enable automated CloudWatch Log copy.

Accepted Answer

Installing the CloudWatch Logs Agent and configuring it to stream logs to CloudWatch Logs ensures that logs are continuously sent to a persistent storage service, allowing you to access them even after instances are terminated.

Question 15

Your application Amazon Elastic Compute Cloud (EC2) instances bootstrap by using a master configuration file that is kept in a version-enabled Amazon Simple Storage Service (S3) bucket. Which one of the following methods should you use to securely install the current configuration version onto the instances in a cost-effective way?
A) Create an Amazon DynamoDB table to store the different versions of the configuration file. Associate AWS Identity and Access Management (IAM) EC2 roles to the Amazon EC2 instances, and reference the DynamoDB table to get the latest file from Amazon Simple Storage Service (S3).
B) Associate an IAM S3 role to the bucket, list the object versions using the Amazon S3 API, and then get the latest object.
C) Associate an IAM EC2 role to the instances, list the object versions using the Amazon S3 API, and then get the latest object.
D) Associate an IAM EC2 role to the instances, and then simply get the object from Amazon S3, because the default is the current version.
E) Store the IAM credentials in the Amazon EC2 user data for each instance, and then simply get the object from S3, because the default is the current version.

Accepted Answer

Associating an IAM EC2 role to the instances allows them to securely access the S3 bucket. By default, accessing an object in a version-enabled S3 bucket retrieves the current version, making it cost-effective and straightforward.

Question 16

Your application has an Auto Scaling group of m3.large instances running an application that receives messages born an Amazon SQS queue. After a while, the number of instances reaches the maximum set for the group and the number of messages on the queue continues to increase. You have discovered that a third- party library used by the application has a bug that causes a memory leak. What cost-effective steps can you take to continue message processing while the library developer fixes the bug?
A) Enable Elastic Load Balancing health checks for the Auto Scaling group. When Elastic Load Balancing has detected a failure, Auto Scaling will terminate the failing application's instance and launch a new one.
B) Use Amazon EC2 instance memory usage CloudWatch metrics to raise alerts when they reach a defined level and send a message to Auto Scaling to fail the instance health check.
C) Use application monitoring on the instance to restart the application when memory usage reaches a defined level.
D) Create a new Auto Scaling launch configuration to use the r3.large instance type. Update the Auto Scaling group with the new launch configuration.

Accepted Answer

The answer of Your application has an Auto Scaling group...

Question 17

You manage a web advertising platform on a single AWS account. This platform produces realtime ad-click data that you store as objects in an Amazon S3 bucket called "dick-data." Your advertising partners want to use Amazon Elastic MapReduce in their own AWS accounts to do analytics on the ad-click data. They have asked for immediate access to the ad-dick data so that they can run analytics. Which two choices are required to facilitate secure access to this data? (Choose two.)
A) Create a cross-account TAM role with a trust policy that contains partner AWS account IDs and a unique external ID.
B) Create a new IAM group for AWS Data Pipeline users with a trust policy that contains partner AWS account IDs.
C) Configure an Amazon S3 bucket policy for the "click-data" bucket that allows Read-Only access to the objects, and associate this policy with an IAM role.
D) Configure the Amazon S3 bucket access control list to allow access to the partners Amazon Elastic MapReduce cluster.
E) Configure AWS Data Pipeline in the partner AWS accounts to use the web Identity Federation API to access data in the "click-data" bucket.
F) Configure AWS Data Pipeline to transfer the data from the ''click-data" bucket to the partner's Amazon Elastic MapReduce cluster.

Accepted Answer

To securely allow access to the S3 bucket from another AWS account, you need to create a cross-account IAM role with a trust policy (A) and configure the S3 bucket policy to allow read-only access (C).

Question 18

You are responsible for a large-scale video transcoding system that operates with an Auto Scaling group of video transcoding workers. The Auto Scaling group is configured with a minimum of 750 Amazon EC2 instances and a maximum of 1000 Amazon EC2 instances. You are using Amazon SQS to pass a message containing the URI for a video stored in Amazon S3 to the transcoding workers. An Amazon CloudWatch alarm has notified you that the queue depth is becoming very large. How can you resolve the alarm without the risk of increasing the time to transcode videos? (Choose two.)
A) Create a second queue in Amazon SQS.
B) Adjust the Amazon CloudWatch alarms for a higher queue depth.
C) Create a new Auto Scaling group with a launch configuration that has a larger Amazon EC2 instance type.
D) Add an additional Availability Zone to the Auto Scaling group configuration.
E) Change the Amazon CloudWatch alarm so that it monitors the CPU utilization of the Amazon EC2 instances rather than the Amazon SQS queue depth.
F) Adjust the Auto Scaling group configuration to increase the maximum number of Amazon EC2 instances.

Accepted Answer

The answer of You are responsible for a large-scale video...

Question 19

You are responsible for a popular file sharing application that uses Elastic Load Balancing to distribute traffic to an Amazon EC2 application tier deployed in an Auto Scaling group that runs across multiple Availability Zones. You currently record the number of user file transfers to a log file on the application server, and then write data points from the logs to an Amazon RDS MySQL instance. You are not happy with how your application scales, and want to implement a new scaling policy based on the average number of user file transfers in a 10-minute period instead of average CPU utilization in the last five minutes. What steps should you take to ensure that your application tier scales based on this new policy? (Choose two.)
A) Create a new CloudWatch alarm based on the Elastic Load Balancing "RequestCount" metric that triggers an Auto Scaling action to scale the application tier.
B) Create a new CloudWatch alarm based on a custom metric streaming from the Amazon RDS MySQL instance that triggers an Auto Scaling action to scale the application tier.
C) Create a new CloudWatch alarm based on a custom metric published from file transfer logs streaming to CloudWatch that triggers an Auto Scaling action to scale the application tier.
D) Create a new Auto Scaling launch configuration that includes an Amazon EC2 user data script that installs a CloudWatch Logs Agent on newly launched instances in the application tier. The agent will be configured to stream the file transfers log tile to CloudWatch.
E) Create a new Auto Scaling launch configuration for the application tier that scales based on an Auto Scaling policy that reads the file transfer log data from the Amazon RIDS MySQL instance.
F) Create a new Auto Scaling launch configuration that includes an Amazon EC2 user data script that installs an Amazon RDS Logs Agent on newly launched instances in the application tier. The agent will be configured to stream the file transfer data points to the Auto Scaling group.

Accepted Answer

To scale based on the average number of user file transfers, you need to publish a custom metric to CloudWatch from the file transfer logs (C). Additionally, you need to ensure that the logs are streamed to CloudWatch by configuring a CloudWatch Logs Agent on the EC2 instances (D).

Question 20

You have been asked to de-risk deployments at your company. Specifically, the CEO is concerned about outages that occur because of accidental inconsistencies between Staging and Production, which sometimes cause unexpected behaviors in Production even when Staging tests pass. You already use Docker to get high consistency between Staging and Production for the application environment on your EC2 instances. How do you further de-risk the rest of the execution environment, since in AWS, there are many service components you may use beyond EC2 virtual machines?
A) Develop models of your entire cloud system in CloudFormation. Use this model in Staging and Production to achieve greater parity.
B) Use AWS Config to force the Staging and Production stacks to have configuration parity. Any differences will be detected for you so you are aware of risks.
C) Use AMIs to ensure the whole machine, including the kernel of the virual machines, is consistent, since Docker uses Linux Container (LXC) technology, and we need to make sure the container environment is consistent.
D) Use AWS ECS and Docker clustering. This will make sure that the AMIs and machine sizes are the same across both environments.

Accepted Answer

Using CloudFormation to model your entire cloud system ensures that both Staging and Production environments are created from the same infrastructure as code, reducing the risk of inconsistencies.

Exam 12: AWS DevOps Engineer - Professional (DOP-C01)

You want to build a new search tool feature for your monitoring system that will allow your information security team to quickly audit all API calls in your AWS accounts. What combination of AWS services can you use to develop and automate the backend processes supporting this tool? (Choose three.)

Which of these is not a Pseudo Parameter in AWS CloudFormation?

A user has attached an EBS volume to a running Linux instance as a "/dev/sdf" device. The user is unable to see the attached device when he runs the command "df -h". What is the possible reason for this?

How long are the messages kept on an SQS queue by default?

When thinking of DynamoDB, what are true of Global Secondary Key properties?

You need to grant a vendor access to your AWS account. They need to be able to read protected messages in a private S3 bucket at their leisure. They also use AWS. What is the best way to accomplish this?

You are creating a new API for video game scores. Reads are 100 times more common than writes, and the top 1% of scores are read 100 times more frequently than the rest of the scores. What's the best design for this system, using DynamoDB?

A user has created a new EBS volume from an existing snapshot. The user mounts the volume on the instance to which it is attached. Which of the below mentioned options is a required step before the user can mount the volume?

There are a number of ways to purchase compute capacity on AWS. Which orders the price per compute or memory unit from LOW to HIGH (cheapest to most expensive) , on average?

You would like to run automated, continuous application level integration tests on all members of an Auto Scaling group. Which two options should you use? (Choose two.)