Amazon DOP-C01 Quiz 4 Topic 13 Questions 16-20

Question: 1

An application is running on Amazon EC2. It has an attached IAM role that is receiving an AccessDenied error while trying to access a SecureString parameter resource in the AWS Systems Manager Parameter Store. The SecureString parameter is encrypted with a customer-managed Customer Master Key (CMK),

What steps should the DevOps Engineer take to grant access to the role while granting least privilege? (Select three.)

ASet ssm:GetParamter for the parameter resource in the instance role's IAM policy.

BSet kms:Decrypt for the instance role in the customer-managed CMK policy.

CSet kms:Decrypt for the customer-managed CMK resource in the role's IAM policy.

DSet ssm:DecryptParameter for the parameter resource in the instance role IAM policy.

ESet kms:GenerateDataKey for the user on the AWS managed SSM KMS key.

FSet kms:Decrypt for the parameter resource in the customer-managed CMK policy.

Show Answer

Question: 2

An Application team is refactoring one of its internal tools to run in AWS instead of on-premises hardware. All of the code is currently written in Python and is standalone. There is also no external state store or relational database to be queried.

Which deployment pipeline incurs the LEAST amount of changes between development and production?

ADevelopers should use Docker for local development. When dependencies are changed and a new container is ready, use AWS CodePipeline and AWS CodeBuild to perform functional tests and then upload the new container to Amazon ECR. Use AWS CloudFormation with the custom container to deploy the new Amazon ECS.

BDevelopers should use Docker for local development. Use AWS SMS to import these containers as AMIs for Amazon EC2 whenever dependencies are updated. Use AWS CodePipeline to test new code changes against the Auto Scaling group.

CDevelopers should use their native Python environment. When Dependencies are changed and a new container is ready, use AWS CodePipeline and AWS CodeBuild to perform functional tests and then upload the new container to the Amazon ECR. Use AWS CloudFormation with the custom container to deploy the new Amazon ECS.

DDevelopers should use their native Python environment. When Dependencies are changed and a new code is ready, use AWS CodePipeline and AWS CodeBuild to perform functional tests and then upload the new container to the Amazon ECR. Use CodePipeline and CodeBuild with the custom container to test new code changes inside AWS Elastic Beanstalk

Show Answer

Question: 3

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.

The buildspec.yml file contains the following:

q3_DOP-C01

What steps should the DevOps Engineer take to stop this?

AModify the post_build to command to use ''-acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only.

BConfigure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access.

CCreate an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal '*'

DModify the post_build command to remove ''-acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only.

Show Answer

Question: 4

A DevOps Engineer is reviewing a system that uses Amazon EC2 instances in an Auto Scaling group. This system uses a configuration management tool that runs locally on each EC2 instance. Because of the volatility of the application load, new instances must be fully functional within 3 minutes of entering a running state. Current setup tasks include: Installing the configuration management agent -- 2 minutes Installing the application framework -- 15 minutes Copying configuration data from Amazon S3 -- 2 minutes Running the configuration management agent to configure instances -- 1 minute Deploying the application code from Amazon S3 -- 2 minutes How should the Engineer set up system so it meets the launch time requirement?

ATrigger an AWS Lambda function from an Amazon CloudWatch Events rule when a new EC2 instance launches. Have the function install the configuration management agent and the application framework, pull configuration data from Amazon S3, run the agent to configure the instance, and deploy the application from S3.

BWrite a bootstrap script to install the configuration management agent, install and the application framework, pull configuration data from Amazon S3, run the agent to configure the instance, and deploy the application from S3.

CBuild a custom AMI that includes the configuration management agent and application framework. Write a bootstrap script to pull configuration data from Amazon S3, run the agent to configure the instance, and deploy the application from S3.

DBuild a custom AMI that includes the configuration management agent, application framework, and configuration data. Write a bootstrap script to run the agent to configure the instance and deploy the application from Amazon S3.

Show Answer

Question: 5

An education company has a Docker-based application running on multiple Amazon EC2 instances in an Amazon ECS cluster. When deploying a new version of the application, the Developer, pushes a new image to a private Docker container registry, and then stops and starts all tasks to ensure that they all have the latest version of the application. The Developer discovers that the new tasks are occasionally running with an old image. How can this issue be prevented?

AAfter pushing the new image, restart ECS Agent, and then start the tasks.

BUse 'latest' for the Docker image tag in the task definition.

CUpdate the digest on the task definition when pushing the new image.

DUse Amazon ECR for a Docker container registry.

Show Answer

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.
The buildspec.yml file contains the following:
What steps should the DevOps Engineer take to stop this?

Amazon DOP-C01 Quiz:4 Topic:13 Questions:16-20

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:What steps should the DevOps Engineer take to stop this?

Amazon DOP-C01 Quiz:4 Topic:13 Questions:16-20

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.
The buildspec.yml file contains the following:
What steps should the DevOps Engineer take to stop this?