[Amazon] DOP-C02 - DevOps Engineer Professional Exam Dumps & Study Guide

Free [Amazon] DOP-C02 - DevOps Engineer Professional Practice Questions Preview

• Question 1

  A company has a mobile application that makes HTTP API calls to an Application Load Balancer (ALB). The ALB routes requests to an AWS Lambda function. Many different versions of the application are in use at any given time, including versions that are in testing by a subset of users. The version of the application is defined in the user-agent header that is sent with all requests to the API.
  After a series of recent changes to the API, the company has observed issues with the application. The company needs to gather a metric for each API operation by response code for each version of the application that is in use. A DevOps engineer has modified the Lambda function to extract the API operation name, version information from the user-agent header and response code.
  Which additional set of actions should the DevOps engineer take to gather the required metrics?

  • A. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group. Configure a CloudWatch Logs metric filter that increments a metric for each API operation name. Specify response code and application version as dimensions for the metric.
  • B. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group. Configure a CloudWatch Logs Insights query to populate CloudWatch metrics from the log lines. Specify response code and application version as dimensions for the metric.
  • C. Configure the ALB access logs to write to an Amazon CloudWatch Logs log group. Modify the Lambda function to respond to the ALB with the API operation name, response code, and version number as response metadata. Configure a CloudWatch Logs metric filter that increments a metric for each API operation name. Specify response code and application version as dimensions for the metric.
  • D. Configure AWS X-Ray integration on the Lambda function. Modify the Lambda function to create an X-Ray subsegment with the API operation name, response code, and version number. Configure X-Ray insights to extract an aggregated metric for each API operation name and to publish the metric to Amazon CloudWatch. Specify response code and application version as dimensions for the metric.

  Correct Answer: A

  Explanation:

  The best approach to gather the required metrics is to use CloudWatch Logs metric filters. Here's a breakdown of why option A is the most suitable and why the others are less ideal:
  
  Suggested Answer: A
  
  Reasoning for choosing A:

  • Efficiency and Cost-Effectiveness: CloudWatch Logs metric filters are designed for extracting metrics from log data. This method avoids the overhead and complexity of other solutions.
  • Simplicity: It involves a straightforward configuration of CloudWatch Logs and metric filters, which are relatively easy to implement.
  • Scalability: This solution scales well with the application, as CloudWatch Logs can handle large volumes of log data.
  • Direct Metric Extraction: Metric filters allow direct extraction of the required information (API operation name, response code, and version number) and creation of metrics with specified dimensions.

  
  Reasons for not choosing the other answers:

  • B (CloudWatch Logs Insights): While CloudWatch Logs Insights can query log data, it's primarily designed for ad-hoc analysis and troubleshooting, not for continuous metric collection. It is more resource-intensive and costly for ongoing metric gathering compared to metric filters.
  • C (ALB Access Logs and Response Metadata): This option is less efficient because:
    • It requires modifying the Lambda function to include metric data in the response metadata, which is not a standard practice.
    • ALB access logs might not directly capture the specific API operation name, requiring additional parsing complexity.
  • D (AWS X-Ray Integration): While X-Ray can provide insights into application performance, it's more focused on tracing requests and identifying bottlenecks than on aggregating custom metrics. Using X-Ray for this purpose would add unnecessary overhead and complexity. The primary goal of X-Ray is not to create aggregated metrics based on log data or specific response codes; it is more suited to tracing requests.

  
  Therefore, option A is the most efficient and suitable solution for gathering the required metrics in this scenario.

  • CloudWatch Logs Metric Filters, https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CountingLogEventsWithFilters.html

• Question 2

  A company provides an application to customers. The application has an Amazon API Gateway REST API that invokes an AWS Lambda function. On initialization, the Lambda function loads a large amount of data from an Amazon DynamoDB table. The data load process results in long cold-start times of 8-10 seconds. The DynamoDB table has DynamoDB Accelerator (DAX) configured.
  Customers report that the application intermittently takes a long time to respond to requests. The application receives thousands of requests throughout the day. In the middle of the day, the application experiences 10 times more requests than at any other time of the day. Near the end of the day, the application's request volume decreases to 10% of its normal total.
  A DevOps engineer needs to reduce the latency of the Lambda function at all times of the day.
  Which solution will meet these requirements?

  • A. Configure provisioned concurrency on the Lambda function with a concurrency value of 1. Delete the DAX cluster for the DynamoDB table.
  • B. Configure reserved concurrency on the Lambda function with a concurrency value of 0.
  • C. Configure provisioned concurrency on the Lambda function. Configure AWS Application Auto Scaling on the Lambda function with provisioned concurrency values set to a minimum of 1 and a maximum of 100.
  • D. Configure reserved concurrency on the Lambda function. Configure AWS Application Auto Scaling on the API Gateway API with a reserved concurrency maximum value of 100.

  Correct Answer: C

  Explanation:

  The best solution is C. Configure provisioned concurrency on the Lambda function. Configure AWS Application Auto Scaling on the Lambda function with provisioned concurrency values set to a minimum of 1 and a maximum of 100.
  
  Reasoning:
  This option effectively addresses the problem of Lambda cold starts and varying request volumes throughout the day. Provisioned concurrency ensures that a specified number of Lambda function instances are initialized and ready to respond immediately, significantly reducing latency caused by cold starts. AWS Application Auto Scaling dynamically adjusts the provisioned concurrency based on the application's demand, ensuring that sufficient capacity is available during peak hours and minimizing costs during off-peak hours. The minimum of 1 ensures there is always a warm instance available.
  
  Why other options are not optimal:

  • A: Configure provisioned concurrency on the Lambda function with a concurrency value of 1. Delete the DAX cluster for the DynamoDB table. Provisioned concurrency of 1 is insufficient to handle the 10x increase in requests during peak hours. Deleting DAX will likely increase DynamoDB latency.
  • B: Configure reserved concurrency on the Lambda function with a concurrency value of 0. Reserved concurrency set to 0 effectively disables the Lambda function, preventing it from executing. This would lead to application failure.
  • D: Configure reserved concurrency on the Lambda function. Configure AWS Application Auto Scaling on the API Gateway API with a reserved concurrency maximum value of 100. Reserved concurrency limits the maximum concurrent executions for a Lambda function. While Application Auto Scaling on API Gateway can manage the number of API Gateway instances, it does not directly address the cold start issue of the Lambda function.

  • Title: AWS Lambda Provisioned Concurrency, https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html
  • Title: AWS Application Auto Scaling, https://aws.amazon.com/autoscaling/application-autoscaling/

• Question 3

  A company is adopting AWS CodeDeploy to automate its application deployments for a Java-Apache Tomcat application with an Apache Webserver. The development team started with a proof of concept, created a deployment group for a developer environment, and performed functional tests within the application. After completion, the team will create additional deployment groups for staging and production.
  The current log level is configured within the Apache settings, but the team wants to change this configuration dynamically when the deployment occurs, so that they can set different log level configurations depending on the deployment group without having a different application revision for each group.
  How can these requirements be met with the LEAST management overhead and without requiring different script versions for each deployment group?

  • A. Tag the Amazon EC2 instances depending on the deployment group. Then place a script into the application revision that calls the metadata service and the EC2 API to identify which deployment group the instance is part of. Use this information to configure the log level settings. Reference the script as part of the AfterInstall lifecycle hook in the appspec.yml file.
  • B. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ NAME to identify which deployment group the instance is part of. Use this information to configure the log level settings. Reference this script as part of the BeforeInstall lifecycle hook in the appspec.yml file.
  • C. Create a CodeDeploy custom environment variable for each environment. Then place a script into the application revision that checks this environment variable to identify which deployment group the instance is part of. Use this information to configure the log level settings. Reference this script as part of the ValidateService lifecycle hook in the appspec.yml file.
  • D. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ID to identify which deployment group the instance is part of to configure the log level settings. Reference this script as part of the Install lifecycle hook in the appspec.yml file.

  Correct Answer: B

  Explanation:

  The best approach to meet the requirements with the least management overhead is to use the CodeDeploy environment variable `DEPLOYMENT_GROUP_NAME`. Therefore, the recommended answer is:
  
  B. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_NAME to identify which deployment group the instance is part of. Use this information to configure the log level settings. Reference this script as part of the BeforeInstall lifecycle hook in the appspec.yml file.
  
  Reasoning:

  • Efficiency: CodeDeploy provides built-in environment variables, and using `DEPLOYMENT_GROUP_NAME` is the most direct and efficient way to identify the deployment group.
  • Least Overhead: This method avoids the need to query external services like the EC2 metadata service or the EC2 API, reducing complexity and potential points of failure.
  • No Script Duplication: Using the environment variable ensures that the same script can be used across all deployment groups without modification.
  • Lifecycle Hook Appropriateness: The `BeforeInstall` lifecycle hook is the ideal place to configure the log level. This allows the log level to be set before the application is installed and started.

  
  Reasons for not choosing other options:

  • A: Tagging and EC2 API Calls: This option is more complex and involves unnecessary overhead. Tagging instances and then querying the EC2 API or metadata service adds extra steps and dependencies. It is more management overhead than using the built-in environment variable.
  • C: Custom Environment Variables: While custom environment variables can work, they add unnecessary complexity to the CodeDeploy configuration. CodeDeploy already provides the necessary information via built-in variables. `ValidateService` lifecycle event is run after the service has been installed and started and would be too late to set log levels at installation.
  • D: DEPLOYMENT_GROUP_ID and Install Hook: Although using `DEPLOYMENT_GROUP_ID` could work, `DEPLOYMENT_GROUP_NAME` is more human-readable and easier to manage. There isn't anything inherently wrong with this, but `BeforeInstall` is better for configuring the environment before the installation happens and `DEPLOYMENT_GROUP_NAME` is easier to read.

  • AWS CodeDeploy Environment Variables, https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-environment-variables.html
  • AWS CodeDeploy AppSpec File, https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file.html

• Question 4

  A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, dally, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes.
  A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified.
  Which solution will meet these requirements?

  • A. Set up AWS Config in the account. Create a custom rule that returns a compliance failure for all Amazon EC2 resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
  • B. Set up AWS Config in the account. Use a managed rule that returns a compliance failure for EC2::Volume resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
  • C. Turn on AWS CloudTrail in the account. Create an Amazon EventBridge rule that reacts to EBS CreateVolume events. Configure a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly. Specify the runbook as the target of the rule.
  • D. Turn on AWS CloudTrail in the account. Create an Amazon EventBridge rule that reacts to EBS CreateVolume events or EBS ModifyVolume events. Configure a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly. Specify the runbook as the target of the rule.

  Correct Answer: B

  Explanation:

  The best solution is B. Set up AWS Config in the account. Use a managed rule that returns a compliance failure for EC2::Volume resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
  
  Reasoning:
  AWS Config allows you to assess, audit, and evaluate the configurations of your AWS resources. Using a managed rule specifically for EC2::Volume resources that checks for the existence of the 'Backup_Frequency' tag is the most efficient and targeted approach. When non-compliant resources are identified, a remediation action using a Systems Manager Automation runbook can automatically apply the 'Backup_Frequency' tag with a default value of 'weekly', ensuring all EBS volumes are tagged as required. This approach ensures continuous compliance and reduces the operational burden on developers.
  
  Why other options are not correct:

  • A. Set up AWS Config in the account. Create a custom rule that returns a compliance failure for all Amazon EC2 resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
    This option is less specific. Applying a rule to *all* EC2 resources is overly broad and inefficient as it would include EC2 instances themselves rather than focusing on the EBS volumes, this may create additional overhead, and it can result in inconsistent tagging. The managed rule of option B will be more focused and efficient.
  • C. Turn on AWS CloudTrail in the account. Create an Amazon EventBridge rule that reacts to EBS CreateVolume events. Configure a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly. Specify the runbook as the target of the rule.
    CloudTrail is primarily an auditing service and not designed for continuous compliance enforcement. This solution only addresses new EBS volumes being created, and will not remediate existing volumes without the tag. EventBridge reacting to CreateVolume events will only apply the tag at creation time, missing existing volumes or volumes that might have the tag removed later.
  • D. Turn on AWS CloudTrail in the account. Create an Amazon EventBridge rule that reacts to EBS CreateVolume events or EBS ModifyVolume events. Configure a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly. Specify the runbook as the target of the rule.
    While this option attempts to address tag modifications through the EBS ModifyVolume event, it still relies on CloudTrail and EventBridge, which are not as suitable for continuous compliance as AWS Config. Also, like option C, it doesn't inherently address existing volumes without the tag. The latency associated with CloudTrail events could also delay the application of the tag.

  • AWS Config, https://aws.amazon.com/config/
  • AWS Systems Manager Automation, https://aws.amazon.com/systems-manager/automation/

• Question 5

  A company is using an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured with a single DB instance. The application performs read and write operations on the database by using the cluster's instance endpoint.
  The company has scheduled an update to be applied to the cluster during an upcoming maintenance window. The cluster must remain available with the least possible interruption during the maintenance window.
  What should a DevOps engineer do to meet these requirements?

  • A. Add a reader instance to the Aurora cluster. Update the application to use the Aurora cluster endpoint for write operations. Update the Aurora cluster's reader endpoint for reads.
  • B. Add a reader instance to the Aurora cluster. Create a custom ANY endpoint for the cluster. Update the application to use the Aurora cluster's custom ANY endpoint for read and write operations.
  • C. Turn on the Multi-AZ option on the Aurora cluster. Update the application to use the Aurora cluster endpoint for write operations. Update the Aurora cluster’s reader endpoint for reads.
  • D. Turn on the Multi-AZ option on the Aurora cluster. Create a custom ANY endpoint for the cluster. Update the application to use the Aurora cluster's custom ANY endpoint for read and write operations

  Correct Answer: A

  Explanation:

  The best approach to meet the requirements of minimal interruption during an Aurora cluster update is to leverage read replicas and the cluster endpoint. Here's a breakdown of the recommended answer and why other options are less suitable:
  
  The suggested answer is A: Add a reader instance to the Aurora cluster. Update the application to use the Aurora cluster endpoint for write operations. Update the Aurora cluster's reader endpoint for reads.
  
  Reasoning for choosing A:
  

  • Adding a reader instance allows read operations to be offloaded to the reader during the maintenance window, minimizing the impact on the application.
  • Using the cluster endpoint for writes ensures that write operations are directed to the primary instance, even during the update process (with appropriate failover if necessary).
  • Directing reads to the reader endpoint isolates read traffic from the primary instance, further reducing interruption.

  
  Reasons for not choosing the other answers:
  

  • B: Creating a custom ANY endpoint is not a standard feature of Aurora and not necessary for this scenario. The cluster endpoint already provides failover capabilities.
  • C: While Multi-AZ provides high availability, it primarily addresses failure scenarios rather than planned maintenance. Additionally, Multi-AZ cannot be enabled after cluster creation, as pointed out in the discussion. The question specifies "during an upcoming maintenance window," suggesting planned maintenance, not a failure event.
  • D: Combines the drawbacks of both B and C. Multi-AZ is less relevant for planned maintenance and cannot be enabled afterward, and custom ANY endpoints are not a standard Aurora feature.

  • Title: AWS Aurora Endpoints, https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Overview.html
  • Title: High Availability (HA) for Amazon Aurora, https://aws.amazon.com/rds/aurora/features/

• Question 6

  A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account.
  The company has created an AWS Key Management Service (AWS KMS) key in the source account.
  Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)

  • A. In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action.
  • B. In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the default Amazon Elastic Block Store (Amazon EBS) encryption key in the copy action.
  • C. In the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account.
  • D. In the source account, modify the key policy to give the target account permissions to create a grant. In the target account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role.
  • E. In the source account, share the unencrypted AMI with the target account.
  • F. In the source account, share the encrypted AMI with the target account.

  Correct Answer: ADF

  Explanation:

  The correct answer is ADF.
  Here's a breakdown of why and the necessary steps to achieve the desired outcome:
  A: In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action.
  Reason: This is a crucial first step. The original AMI is unencrypted, and the requirement is to share encrypted AMIs. Copying the AMI and specifying the KMS key during the copy process ensures that the new AMI is encrypted using the company's designated key.
  D: In the source account, modify the key policy to give the target account permissions to create a grant. In the target account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role.
  Reason: To allow the target account to use the encrypted AMI, the KMS key policy in the source account must be updated to grant the target account permission to create grants. After this, the target account then creates a KMS grant to allow its Auto Scaling group service-linked role to use the KMS key to decrypt the AMI. This is necessary for the EC2 instances launched by the Auto Scaling group to access the encrypted AMI.
  F: In the source account, share the encrypted AMI with the target account.
  Reason: Once the AMI is encrypted and the necessary KMS permissions are in place, the AMI needs to be explicitly shared with the target account. This makes the encrypted AMI visible and usable within the target account.
  Reasons for excluding other options:

  • B: In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the default Amazon Elastic Block Store (Amazon EBS) encryption key in the copy action.
    Reason: The question specifies using the company's KMS key, not the default EBS encryption key.
  • C: In the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account.
    Reason: You cannot create a KMS grant in the source account that directly delegates permissions to a role in the target account. The target account needs to create the grant itself after being given permission to do so by the key policy.
  • E: In the source account, share the unencrypted AMI with the target account.
    Reason: The question states that all AMIs shared across accounts must be encrypted. Sharing the unencrypted AMI violates this requirement.

  • AWS Documentation on Sharing Encrypted AMIs: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-encrypt.html
  • AWS KMS documentation: https://docs.aws.amazon.com/kms/latest/developerguide/

• Question 7

  A company uses AWS CodePipeline pipelines to automate releases of its application A typical pipeline consists of three stages build, test, and deployment. The company has been using a separate AWS CodeBuild project to run scripts for each stage. However, the company now wants to use AWS CodeDeploy to handle the deployment stage of the pipelines.
  The company has packaged the application as an RPM package and must deploy the application to a fleet of Amazon EC2 instances. The EC2 instances are in an EC2 Auto Scaling group and are launched from a common AMI.
  Which combination of steps should a DevOps engineer perform to meet these requirements? (Choose two.)

  • A. Create a new version of the common AMI with the CodeDeploy agent installed. Update the IAM role of the EC2 instances to allow access to CodeDeploy.
  • B. Create a new version of the common AMI with the CodeDeploy agent installed. Create an AppSpec file that contains application deployment scripts and grants access to CodeDeploy.
  • C. Create an application in CodeDeploy. Configure an in-place deployment type. Specify the Auto Scaling group as the deployment target. Add a step to the CodePipeline pipeline to use EC2 Image Builder to create a new AMI. Configure CodeDeploy to deploy the newly created AMI.
  • D. Create an application in CodeDeploy. Configure an in-place deployment type. Specify the Auto Scaling group as the deployment target. Update the CodePipeline pipeline to use the CodeDeploy action to deploy the application.
  • E. Create an application in CodeDeploy. Configure an in-place deployment type. Specify the EC2 instances that are launched from the common AMI as the deployment target. Update the CodePipeline pipeline to use the CodeDeploy action to deploy the application.

  Correct Answer: AD

  Explanation:

  The correct combination of steps to meet the requirements are A and D.
  
  Reasoning:
  * **Option A:** Installing the CodeDeploy agent on the base AMI ensures that all EC2 instances launched from the Auto Scaling group have the agent ready to receive deployments. Updating the IAM role of the EC2 instances to allow access to CodeDeploy is crucial for CodeDeploy to interact with and deploy applications to the instances. This is necessary for CodeDeploy to manage deployments on the instances. * **Option D:** Creating an application in CodeDeploy and configuring an in-place deployment type is the correct way to set up the deployment process. Specifying the Auto Scaling group as the deployment target ensures that deployments are automatically applied to all instances within the group, including new instances launched during scaling events. Updating the CodePipeline pipeline to use the CodeDeploy action connects the pipeline to CodeDeploy, automating the deployment process. This aligns with best practices for managing deployments to EC2 Auto Scaling groups.
  Reasons for not choosing the other options:
  * **Option B:** While creating a new AMI with the CodeDeploy agent is necessary, the AppSpec file itself does not grant access to CodeDeploy. IAM roles are used to grant permissions. * **Option C:** Using EC2 Image Builder in the pipeline to create a new AMI for each deployment is inefficient and unnecessary. In-place deployments with CodeDeploy are designed to update the application on existing instances. This approach also complicates the deployment process. * **Option E:** Specifying individual EC2 instances as the deployment target, rather than the Auto Scaling group, is not scalable or maintainable. It would require updating the CodeDeploy configuration every time instances are added or removed from the Auto Scaling group. Deploying to the ASG ensures new instances are automatically updated.

  • AWS CodeDeploy, https://aws.amazon.com/codedeploy/
  • AWS CodePipeline, https://aws.amazon.com/codepipeline/
  • AWS Auto Scaling group, https://aws.amazon.com/autoscaling/

• Question 8

  A company’s security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are included in a single organization in AWS Organizations. The company has configured AWS Config for the organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS WAF web ACLs.
  Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)

  • A. Delegate AWS Firewall Manager to a security account.
  • B. Delegate Amazon GuardDuty to a security account.
  • C. Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
  • D. Create an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
  • E. Configure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.

  Correct Answer: AC

  Explanation:

  The correct answer is A and C.
  
  Reasoning for choosing A: AWS Firewall Manager is designed to centrally manage and configure firewall rules across multiple AWS accounts and applications. By delegating AWS Firewall Manager to a security account, the company can centrally manage AWS WAF rules for all accounts within the AWS Organization. This ensures consistent application of security policies.
  
  Reasoning for choosing C: Creating an AWS Firewall Manager policy to attach AWS WAF web ACLs to newly created ALBs and API Gateway APIs will automatically enforce the security team's requirement. This automated enforcement helps prevent future violations by ensuring that all new external ALBs and APIs are automatically protected by AWS WAF. This is exactly what Firewall Manager is designed to do.
  
  Reasoning for not choosing B: Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior. It does not manage or configure firewalls or WAF rules. Therefore, delegating GuardDuty to a security account would not prevent violations related to missing WAF web ACLs.
  
  Reasoning for not choosing D: Similar to option B, Amazon GuardDuty does not have the capability to attach AWS WAF web ACLs. GuardDuty is focused on threat detection, not prevention or configuration of security rules.
  
  Reasoning for not choosing E: While AWS Config can be used to detect resources that are non-compliant (i.e., ALBs without WAF), it is not the primary tool for automatically attaching AWS WAF web ACLs to new resources across an entire AWS Organization. AWS Config could trigger remediation through other services like Lambda, but Firewall Manager is more directly suited for this purpose. Furthermore, AWS Config focuses more on auditing and less on automated policy enforcement compared to AWS Firewall Manager.

  • AWS Firewall Manager, https://aws.amazon.com/firewall-manager/
  • AWS WAF, https://aws.amazon.com/waf/

• Question 9

  A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet regulatory compliance requirements. The security team wants to be notified when any keys have not been rotated after 90 days.
  Which solution will accomplish this?

  • A. Configure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
  • B. Configure an Amazon EventBridge event to launch an AWS Lambda function to call the AWS Trusted Advisor API and publish to an Amazon Simple Notification Service (Amazon SNS) topic.
  • C. Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
  • D. Configure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.

  Correct Answer: C

  Explanation:

  The best solution is C. Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
  
  Reasoning:
  AWS Config is designed to monitor the configuration of AWS resources and can evaluate whether these configurations comply with desired rules. Creating a custom rule within AWS Config allows for the specific monitoring of KMS key age. When a key exceeds the 90-day threshold, the rule can trigger a notification via Amazon SNS, fulfilling the requirement to notify the security team.
  
  Why other options are not suitable:

  • A is incorrect because AWS KMS itself does not have the built-in capability to directly publish to Amazon SNS based on key age. KMS manages keys, but it doesn't provide native alerting on key rotation status.
  • B is incorrect because while EventBridge and Lambda could be used to check key ages, using Trusted Advisor API in this way is not the most efficient or appropriate method. AWS Config is better suited for continuous monitoring of resource configurations. Additionally, Trusted Advisor is more focused on cost optimization, performance, and security best practices at a high level rather than detailed configuration monitoring.
  • D is incorrect because AWS Security Hub aggregates security findings from various AWS services but does not inherently monitor KMS key age or provide notifications based on custom age thresholds. While Security Hub can ingest findings related to KMS, it's not the primary tool for configuring a rule around key rotation age.

  • AWS Config, https://aws.amazon.com/config/
  • AWS Key Management Service (AWS KMS), https://aws.amazon.com/kms/

• Question 10

  A security review has identified that an AWS CodeBuild project is downloading a database population script from an Amazon S3 bucket using an unauthenticated request. The security team does not allow unauthenticated requests to S3 buckets for this project.
  How can this issue be corrected in the MOST secure manner?

  • A. Add the bucket name to the AllowedBuckets section of the CodeBuild project settings. Update the build spec to use the AWS CLI to download the database population script.
  • B. Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token. Update the build spec to use cURL to pass the token and download the database population script.
  • C. Remove unauthenticated access from the S3 bucket with a bucket policy. Modify the service role for the CodeBuild project to include Amazon S3 access. Use the AWS CLI to download the database population script.
  • D. Remove unauthenticated access from the S3 bucket with a bucket policy. Use the AWS CLI to download the database population script using an IAM access key and a secret access key.

  Correct Answer: C

  Explanation:

  The best way to correct the issue of unauthenticated access to the S3 bucket in the most secure manner is to implement the following steps:
  1. Remove unauthenticated access from the S3 bucket using a bucket policy.
  2. Modify the service role for the CodeBuild project to include Amazon S3 access.
  3. Use the AWS CLI to download the database population script.

  Therefore, the suggested answer is C.

  Reasoning:
  The most secure approach is to leverage IAM roles for authentication, as it avoids hardcoding credentials or relying on less secure methods. By associating an IAM role with the CodeBuild project, the AWS CLI can automatically assume the role and access the S3 bucket.

  • Removing unauthenticated access from the S3 bucket with a bucket policy ensures that only authenticated requests are allowed, enhancing security.
  • Modifying the service role for the CodeBuild project to include Amazon S3 access grants the necessary permissions for the CodeBuild project to access the S3 bucket.
  • Using the AWS CLI to download the database population script leverages the IAM role for authentication, eliminating the need for unauthenticated requests.

  Reasons for not choosing the other answers:

  • A is incorrect because adding the bucket name to the AllowedBuckets section of the CodeBuild project settings does not address the underlying issue of unauthenticated access. It also doesn't specify how the download happens which is important.
  • B is incorrect because modifying the S3 bucket settings to enable HTTPS basic authentication and specifying a token is not a secure practice. Tokens can be exposed and basic authentication is generally discouraged.
  • D is incorrect because using an IAM access key and a secret access key is a less secure approach than using IAM roles, as it involves storing and managing long-term credentials. If these keys are compromised, it could lead to unauthorized access. IAM roles are temporary and automatically managed by AWS.

  The principle of least privilege should be followed, granting only the necessary permissions to the CodeBuild project. Using IAM roles and bucket policies is the recommended approach for managing access to S3 buckets in a secure and scalable manner.

  • Title: AWS CodeBuild, https://aws.amazon.com/codebuild/
  • Title: AWS S3 bucket policies, https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html
  • Title: AWS IAM roles, https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html