Latest Amazon DOP-C02 Dumps - AWSDumps

Question 1

A. Use Organizations to create OUs that have appropriate SCPs attached for each team.Place each team in the appropriate OUs to apply security controls. Create any new teamaccounts in the appropriate OUs
B. Create an AWS Control Tower landing zone. Configure OUs and appropriate controls inAWS Control Tower for the existing teams. Configure trusted access for AWS ControlTower. Enroll the existing accounts in the appropriate OUs that match the appropriatesecurity policies for each team. Use AWS Control Tower to provision any new accounts.
C. Create AWS CloudFormation stack sets in the organization's management account.Configure a stack set that deploys AWS Config with configuration rules and remediationactions for all controls to each account in the organization. Update the stack sets to deployto new accounts as the accounts are created. 
D. Configure AWS Config to manage the AWS Config rules across all AWS accounts in theorganization. Deploy conformance packs that provide AWS Config rules and remediationactions across the organization. 

Answer: B

Question 2

A. Use AWS Systems Manager to create a new custom patch baseline that includes thedefault operating system repository and the custom repository. Run the AWSRunPatchBaseline document by using the Run command to verify and install patches. Usethe BaselineOverride API to configure the new custom patch baseline
B. Use AWS Direct Connect to integrate the custom repository with the EC2 instances. UseAmazon EventBridge events to deploy the patches
C. Use the yum-config-manager command to add the custom repository to the/etc/yum.repos.d configuration. Run the yum-config-manager-enable command to activatethe new repository
D. Use AWS Systems Manager to create a patch baseline for the default operating systemrepository and a second patch baseline for the custom repository. Run the AWSRunPatchBaseline document by using the Run command to verify and install patches. Usethe BaselineOverride API to configure the default patch baseline and the custom patchbaseline. 

Answer: C

Question 3

A. Retrieve an access key from an AWS Systems Manager securestring parameter toaccess AWS services. Retrieve the database credentials from a Systems ManagerSecureString parameter
B. Launch the EC2 instances with an EC2 1AM role to access AWS services Retrieve thedatabase credentials from AWS Secrets Manager. 
C. Retrieve an access key from an AWS Systems Manager plaintext parameter to accessAWS services. Retrieve the database credentials from a Systems Manager SecureStringparameter. 
D. Launch the EC2 instances with an EC2 1AM role to access AWS services Store thedatabase passwords in an encrypted config file with the application artifacts. 

Answer: B

Question 4

A. Launch a replica environment of everything except Amazon RDS in a differentAvailability Zone Create an RDS read replica in the new Availability Zone: and configurethe new stack to point to the local RDS DB instance. Add the new stack to the Route 53record set by using a hearth check to configure a failover routing policy. 
B. Launch a replica environment of everything except Amazon RDS in a different AWS.Region Create an RDS read replica in the new Region and configure the new stack to pointto the local RDS DB instance. Add the new stack to the Route 53 record set by using ahealth check to configure a latency routing policy.
C. Launch a replica environment of everything except Amazon RDS ma different AWSRegion. In the event of an outage copy and restore the latest RDS snapshot from theprimary. Region to the DR Region Adjust the Route 53 record set to point to the ALB in theDR Region.
D. Launch a replica environment of everything except Amazon RDS in a different AWSRegion. Create an RDS read replica in the new Region and configure the new environmentto point to the local RDS DB instance. Add the new stack to the Route 53 record set byusing a health check to configure a failover routing policy. In the event of an outagepromote the read replica to primary.

Answer: D

Question 5

A. Use AWS Certificate Manager (ACM) to create a private certificate authority (CA).Provision a client certificate that is signed by the private CA.
B. Provision a client certificate that is signed by a public certificate authority (CA). Importthe certificate into AWS Certificate Manager (ACM).
C. Upload the provisioned client certificate to an Amazon S3 bucket. Configure the APIGateway mutual TLS to use the client certificate that is stored in the S3 bucket as the truststore.
D. Upload the provisioned client certificate private key to an Amazon S3 bucket. Configurethe API Gateway mutual TLS to use the private key that is stored in the S3 bucket as thetrust store.
E. Upload the root private certificate authority (CA) certificate to an Amazon S3 bucket.Configure the API Gateway mutual TLS to use the private CA certificate that is stored in theS3 bucket as the trust store.

Answer: A,E

Question 6

A. Configure AWS Lambda to poll the SQS queue and invoke a Lambda function to checkwhether the queue messages are valid. If validation fails, send a copy of the data that is notvalid to an Amazon S3 bucket so that the scientists can review and correct the data. Whenthe data is corrected, amend the message in the SQS queue by using a replay Lambdafunction with the corrected data.
B. Convert the SQS standard queue to an SQS FIFO queue. Configure AWS Lambda topoll the SQS queue every 10 minutes by using an Amazon EventBridge schedule. Invokethe Lambda function to identify any messages with a SentTimestamp value that is olderthan 5 minutes, push the data to the same location as the application's output location, andremove the messages from the queue.
C. Create an SQS dead-letter queue. Modify the existing queue by including a redrivepolicy that sets the Maximum Receives setting to 1 and sets the dead-letter queue ARN tothe ARN of the newly created queue. Instruct the scientists to use the dead-letter queue toreview the data that is not valid. Reprocess this data at a later time.
D. Configure API Gateway to send messages to different SQS virtual queues that arenamed for each of the satellites. Update the application to use a new virtual queue for anydata that it cannot transform, and send the message to the new virtual queue. Instruct thescientists to use the virtual queue to review the data that is not valid. Reprocess this data ata later time. 

Answer: C

Question 7

A. Allow users to deploy CloudFormation stacks using a CloudFormation service role only.Use CloudFormation drift detection to detect when resources have drifted from theirexpected state. 
B. Allow users to deploy CloudFormation stacks using a CloudFormation service role only.Use AWS Config rules to detect when resources have drifted from their expected state. 
C. Allow users to deploy CloudFormation stacks using AWS Service Catalog only. Enforcethe use of a launch constraint. Use AWS Config rules to detect when resources havedrifted from their expected state.
D. Allow users to deploy CloudFormation stacks using AWS Service Catalog only. Enforcethe use of a template constraint. Use Amazon EventBridge notifications to detect whenresources have drifted from their expected state. 

Answer: C

Question 8

A. In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMSkey in the copy action. 
B. In the source account, copy the unencrypted AMI to an encrypted AMI. Specify thedefault Amazon Elastic Block Store (Amazon EBS) encryption key in the copy action.
C. In the source account, create a KMS grant that delegates permissions to the AutoScaling group service-linked role in the target account.
D. In the source account, modify the key policy to give the target account permissions tocreate a grant. In the target account, create a KMS grant that delegates permissions to theAuto Scaling group service-linked role.
E. In the source account, share the unencrypted AMI with the target account. 
F. In the source account, share the encrypted AMI with the target account. 

Answer: A,D,F

Question 9

A. Use AWS CloudFormation StackSets to deploy an Amazon EventBridge rule to eachaccount. Configure the rule to react to AWS CloudTrail events for Amazon EC2 and tosend a notification to an Amazon Simple Notification Service (Amazon SNS) topic.Subscribe the DevOps team to the SNS topic 
B. Use AWS CloudFormation StackSets to deploy the approved-amis-by-id AWS Configmanaged rule to each account. Configure the rule with the list of approved AMIs. Configurethe rule to run the the AWS-StopEC2lnstance AWS Systems Manager Automation runbookfor the noncompliant EC2 instances.
C. Create an AWS Lambda function that processes AWS CloudTrail events for AmazonEC2 Configure the Lambda function to send a notification to an Amazon Simple NotificationService (Amazon SNS) topic. Subscribe the DevOps team to the SNS topic. Deploy theLambda function in each account in the organization Create an Amazon EventBridge rulein each account Configure the EventBridge rules to react to AWS CloudTrail events forAmazon EC2 and to invoke the Lambda function. 
D. Enable AWS Config across the organization Create a conformance pack that uses theapproved -amis-by-id AWS Config managed rule with the list of approved AMIs. Deploy theconformance pack across the organization. Configure the rule to run the AWSStopEC2lnstance AWS Systems Manager Automation runbook for the noncompliant EC2instances. 

Answer: D

Question 10

A. Use the CloudFormation detect root cause capability for the failed stack to analyze thefailure and return the event that is the most likely cause for the failure. 
B. Query failed stacks by specifying the root stack as the ParentId property. Examine theStackStatusReason property for all returned stacks to determine the reason the nestedstack failed to deploy.  
C. Activate AWS Systems Manager for the AWS account where the application runs. Usethe AWS Systems Manager Automation AWSSupport-TroubleshootCFNCustomResourcerunbook to determine the reason the nested stack failed to deploy.
D. Configure the CloudFormation template to publish logs to Amazon CloudWatch. Viewthe CloudFormation logs for the failed stack in the CloudWatch console to determine thereason the nested stack failed to deploy. 

Answer: B