DOP-C02 AWS Certified DevOps Engineer- Professional Free Demo Questions – Try Before You Buy

Question 1

A company has multiple accounts in an organization in AWS Organizations. The company's
SecOps team needs to receive an Amazon Simple Notification Service (Amazon SNS)
notification if any account in the organization turns off the Block Public Access feature on
an Amazon S3 bucket. A DevOps engineer must implement this change without affecting
the operation of any AWS accounts. The implementation must ensure that individual
member accounts in the organization cannot turn off the notification. Which solution will
meet these requirements?

A

Designate an account to be the delegated Amazon GuardDuty administrator account.
Turn on GuardDuty for all accounts across the organization. In the GuardDuty administrator
account, create an SNS topic. Subscribe the SecOps team's email address to the SNS topic. In the same
account, create an Amazon EventBridge rule that uses an event pattern for GuardDuty findings and a
target of the SNS topic.

B

Create an AWS CloudFormation template that creates an SNS topic and subscribes the

SecOps team’s email address to the SNS topic. In the template, include an Amazon EventBridge rule uses an event pattern of CloudTrail activity for s3: PutBucketPublicAccessBlock and a target of the SNS topic. Deploy the stack to every account in the organization by using CloudFormation StackSets.

C

Turn on AWS Config across the organization. In the delegated administrator account, create an SNS
topic. Subscribe the SecOps team's email address to the SNS topic. Deploy a conformance pack that
uses the s3-bucket-level-public-access-prohibited AWS Config managed rule in each account and
uses an AWS Systems Manager document to publish an event to the SNS topic to notify the SecOps
team.

D

Turn on Amazon Inspector across the organization. In the Amazon Inspector delegated
administrator account, create an SNS topic. Subscribe the SecOps team’s email address to the SNS
topic. In the same account, create an Amazon EventBridge rule that uses an event pattern for public
network exposure of the S3 bucket and publishes an event to the SNS topic to notify the SecOps
team

Correct Answer: C

Explanation:

Amazon GuardDuty is primarily on threat detection and response, not configuration monitoring A
conformance pack is a collection of AWS Config rules and remediation actions that can be easily
deployed as a single entity in an account and a Region or across an organization in AWS
Organizations.

Question 2

A company has an organization in AWS Organizations. The organization includes workload accounts
that contain enterprise applications. The company centrally manages users from an operations
account. No users can be created in the workload accounts. The company recently added an
operations team and must provide the operations team members with administrator access to each
workload account.
Which combination of actions will provide this access? (Choose three.)

A

Create a SysAdmin role in the operations account. Attach the AdministratorAccess policy to the
role. Modify the trust relationship to allow the sts:AssumeRole action from the workload accounts.

B

Create a SysAdmin role in each workload account. Attach the AdministratorAccess policy to the
role. Modify the trust relationship to allow the sts:AssumeRole action from the operations account.

C

Create an Amazon Cognito identity pool in the operations account. Attach the SysAdmin role as an
authenticated role.

D

In the operations account, create an IAM user for each operations team member.

E

In the operations account, create an IAM user group that is named SysAdmins. Add an IAM policy
that allows the sts:AssumeRole action for the SysAdmin role in each workload account. Add all
operations team members to the group.

F

Create an Amazon Cognito user pool in the operations account. Create an Amazon Cognito user for
each operations team member.

Correct Answer: B, D, E

Explanation:

Since the company manages users centrally in the operations account and does not allow users in workload accounts, the proper AWS cross-account access design is to create an IAM user for each operations team member in the operations account (D), create a SysAdmin role with the AdministratorAccess policy in each workload account and configure its trust policy to allow the operations account to assume it (B), and create a SysAdmins IAM group in the operations account with permissions to perform sts:AssumeRole on the SysAdmin roles in all workload accounts (E). This allows operations team members to authenticate once in the operations account and then assume administrator roles in the workload accounts without creating local users there, which follows AWS security best practices for centralized identity management.

Question 3

A developer is maintaining a fleet of 50 Amazon EC2 Linux servers. The servers are part of an Amazon
EC2 Auto Scaling group, and also use Elastic Load Balancing for load balancing.
aOccasionally, some application servers are being terminated after failing ELB HTTP health checks. The
developer would like to perform a root cause analysis on the issue, but before being able to access
application logs, the server is terminated.
How can log collection be automated?

A

Use Auto Scaling lifecycle hooks to put instances in a Pending:Wait state. Create an Amazon
CloudWatch alarm for EC2 Instance Terminate Successful and trigger an AWS Lambda function that
invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the
lifecycle action once logs are collected.

B

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an AWS Config
rule for EC2 Instance-terminate Lifecycle Action and trigger a step function that invokes a script to
collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.

C

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon
CloudWatch subscription filter for EC2 Instance Terminate Successful and trigger a CloudWatch agent
that invokes a script to collect logs, push them to Amazon S3, and complete the lifecycle action once
logs are collected.

D

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon
EventBridge rule for EC2 Instance-terminate Lifecycle Action and trigger an AWS Lambda function
that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the
lifecycle action once logs are collected.

Correct Answer: D

Explanation:

When an instance in an Auto Scaling group is about to be terminated, you can use an Auto Scaling lifecycle hook to place it in the Terminating:Wait state, which delays termination and provides time to perform custom actions. An Amazon EventBridge rule can capture the EC2 Instance-terminate Lifecycle Action event and trigger an AWS Lambda function. The Lambda function can then use AWS Systems Manager (SSM) Run Command to execute a script on the instance, collect the application logs, and upload them to Amazon S3. After the logs are safely stored, the Lambda function calls CompleteLifecycleAction to allow the instance termination to proceed. This is the recommended AWS-native solution for automatically preserving logs from instances that are being terminated, making D the correct answer.

Demo Amazon DOP-C02 Exam Questions

Create an AWS CloudFormation template that creates an SNS topic and subscribes the

SecOps team’s email address to the SNS topic. In the template, include an Amazon EventBridge rule uses an event pattern of CloudTrail activity for s3: PutBucketPublicAccessBlock and a target of the SNS topic. Deploy the stack to every account in the organization by using CloudFormation StackSets.

Correct Answer: C

Amazon GuardDuty is primarily on threat detection and response, not configuration monitoring A
conformance pack is a collection of AWS Config rules and remediation actions that can be easily
deployed as a single entity in an account and a Region or across an organization in AWS
Organizations.

Create a SysAdmin role in the operations account. Attach the AdministratorAccess policy to the
role. Modify the trust relationship to allow the sts:AssumeRole action from the workload accounts.

Create a SysAdmin role in each workload account. Attach the AdministratorAccess policy to the
role. Modify the trust relationship to allow the sts:AssumeRole action from the operations account.

Create an Amazon Cognito identity pool in the operations account. Attach the SysAdmin role as an
authenticated role.

In the operations account, create an IAM user for each operations team member.

In the operations account, create an IAM user group that is named SysAdmins. Add an IAM policy
that allows the sts:AssumeRole action for the SysAdmin role in each workload account. Add all
operations team members to the group.

Create an Amazon Cognito user pool in the operations account. Create an Amazon Cognito user for
each operations team member.

Correct Answer: B, D, E

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an AWS Config
rule for EC2 Instance-terminate Lifecycle Action and trigger a step function that invokes a script to
collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.

Correct Answer: D

Demo Practice Mode

Demo Amazon DOP-C02 Exam Questions

Create an AWS CloudFormation template that creates an SNS topic and subscribes the

SecOps team’s email address to the SNS topic. In the template, include an Amazon EventBridge rule uses an event pattern of CloudTrail activity for s3: PutBucketPublicAccessBlock and a target of the SNS topic. Deploy the stack to every account in the organization by using CloudFormation StackSets.

Correct Answer: C

Amazon GuardDuty is primarily on threat detection and response, not configuration monitoring Aconformance pack is a collection of AWS Config rules and remediation actions that can be easilydeployed as a single entity in an account and a Region or across an organization in AWSOrganizations.

Create a SysAdmin role in the operations account. Attach the AdministratorAccess policy to therole. Modify the trust relationship to allow the sts:AssumeRole action from the workload accounts.

Create a SysAdmin role in each workload account. Attach the AdministratorAccess policy to therole. Modify the trust relationship to allow the sts:AssumeRole action from the operations account.

Create an Amazon Cognito identity pool in the operations account. Attach the SysAdmin role as anauthenticated role.

In the operations account, create an IAM user for each operations team member.

In the operations account, create an IAM user group that is named SysAdmins. Add an IAM policythat allows the sts:AssumeRole action for the SysAdmin role in each workload account. Add alloperations team members to the group.

Create an Amazon Cognito user pool in the operations account. Create an Amazon Cognito user foreach operations team member.

Correct Answer: B, D, E

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an AWS Configrule for EC2 Instance-terminate Lifecycle Action and trigger a step function that invokes a script tocollect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.

Correct Answer: D

Demo Practice Mode

Amazon GuardDuty is primarily on threat detection and response, not configuration monitoring A
conformance pack is a collection of AWS Config rules and remediation actions that can be easily
deployed as a single entity in an account and a Region or across an organization in AWS
Organizations.

Create a SysAdmin role in the operations account. Attach the AdministratorAccess policy to the
role. Modify the trust relationship to allow the sts:AssumeRole action from the workload accounts.

Create a SysAdmin role in each workload account. Attach the AdministratorAccess policy to the
role. Modify the trust relationship to allow the sts:AssumeRole action from the operations account.

Create an Amazon Cognito identity pool in the operations account. Attach the SysAdmin role as an
authenticated role.

In the operations account, create an IAM user group that is named SysAdmins. Add an IAM policy
that allows the sts:AssumeRole action for the SysAdmin role in each workload account. Add all
operations team members to the group.

Create an Amazon Cognito user pool in the operations account. Create an Amazon Cognito user for
each operations team member.

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an AWS Config
rule for EC2 Instance-terminate Lifecycle Action and trigger a step function that invokes a script to
collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.