Free DOP-C02 Practice Test

https://aws.amazon.com/about-aws/whats-new/2020/02/aws-cloudformation-stacksets-introducesautomatic-deployments-across-accounts-and-regions-through-aws-organizations/

Stack Export and Import: Use the Export feature in CloudFormation to share outputs from one stack (e.g., database resources) and use them as inputs in another stack (e.g., web application resources). Steps to Create Stack Export: Define the resources in the database CloudFormation template and use the Outputs section to export necessary values. Outputs: DBInstanceEndpoint: Value: !GetAtt DBInstance.Endpoint.Address Export: Name: DBInstanceEndpoint Steps to Import into Web Application Stack: In the web application CloudFormation template, use the ImportValue function to import these exported values. Resources: MyResource: Type: "AWS::SomeResourceType" Properties: SomeProperty: !ImportValue DBInstanceEndpoint Resource-Level Change-Set Reviews: Both teams can continue using their respective review processes, as changes to each stack are managed independently. Use CloudFormation change sets to preview changes before deploying. By exporting resources from the database stack and importing them into the web application stack, both teams can maintain their separate review and lifecycle management processes while sharing necessary resources.
Reference: AWS CloudFormation Export AWS CloudFormation ImportValue

Comprehensive and Detailed Explanation From Exact Extract: Amazon Redshift supports audit logging which can be configured to log user activity, including queries and user changes. The logs can be delivered to an S3 bucket (Option B), which is the standard location for Redshift audit logs. While Redshift can send some logs to CloudWatch, the native audit logging is typically routed to S3. Creating a CloudWatch dashboard with a log widget (Option D) allows visualization of user activities from logs ingested into CloudWatch Logs or through custom processing.
Option A is invalid because CloudTrail does not capture Redshift query logs directly. Option C incorrectly assumes Redshift audit logs can be delivered directly to CloudWatch. Option E adds complexity by requiring Lambda and Athena unnecessarily when direct visualization in CloudWatch is simpler.
Reference: Amazon Redshift Audit Logging Visualizing Logs with Amazon CloudWatch Dashboards

The correct answer is B and E. Configuring a higher provisioned concurrency for the Lambda functions will ensure that the functions are ready to respond to the initial burst of requests without any cold start latency. Using Amazon RDS Proxy to create a proxy for the Aurora database will enable the Lambda functions to reuse existing database connections and reduce the overhead of establishing new ones. This will also improve the scalability and availability of the database by managing the connection pool size and handling failovers. Option A is incorrect because reserved concurrency only limits the number of concurrent executions for a function, not pre-warms them.
Option C is incorrect because converting the DB cluster to an Aurora global database will not address the issue of database connection latency, and may introduce additional costs and complexity. Option D is incorrect because moving the code blocks that initialize database connections into the function handlers will not improve the performance or scalability of the Lambda functions, and may actually worsen the cold start latency. Reference: AWS Lambda Provisioned Concurrency Using Amazon RDS Proxy with AWS Lambda Certified DevOps Engineer - Professional (DOP-C02) Study Guide (page 173)

Create an AWS Identity and Access Management Roles Anywhere trust anchor Create an IAM role that allows CodeArtifact actions and that has a trust relationship on the trust anchor. Update the on- premises CI/CD pipeline to assume the new IAM role and to publish the packages to CodeArtifact: Roles Anywhere allows on-premises servers to assume IAM roles, making it easier to integrate on- premises environments with AWS services. Steps: Create a trust anchor in IAM. Create an IAM role with permissions for CodeArtifact actions (e.g., publishing packages). Update the CI/CD pipeline to assume this role using the trust anchor. Create a new Amazon S3 bucket. Generate a presigned URL that allows the PutObject request. Update the on-premises CI/CD pipeline to use the presigned URL to publish the packages from the on-premises location to the S3 bucket. Create an AWS Lambda function that runs when packages are created in the bucket through a put command Configure the Lambda function to publish the packages to CodeArtifact: Using an S3 bucket as an intermediary, you can easily upload packages from on-premises systems. Steps: Create an S3 bucket. Generate presigned URLs to allow the CI/CD pipeline to upload packages. Configure an AWS Lambda function to trigger on S3 PUT events and publish the packages to CodeArtifact.
Reference: IAM Roles Anywhere Amazon S3 presigned URLs AWS Lambda function triggers

To prevent developers from unintentionally attaching an Elastic IP address to an Amazon EC2 instance in production, the best approach is to use IAM policies and AWS Config rules. By attaching an IAM policy that denies the associate-address permission to the developers’ IAM group, you ensure that developers cannot perform this action. Additionally, creating a custom AWS Config rule to check for Elastic IP addresses associated with instances tagged as production provides ongoing monitoring. If the rule detects an Elastic IP address, it can trigger an alert to notify the security team. This method is proactive and enforces the necessary permissions while also providing a mechanism for detection and notification. Reference: from Amazon DevOps sources

Turn off cross-zone load balancing on the ALB's target group: Cross-zone load balancing distributes traffic evenly across all registered targets in all enabled Availability Zones. Turning this off will ensure that each target group only handles requests from its respective Availability Zone. To disable cross-zone load balancing: Go to the Amazon EC2 console. Navigate to Load Balancers and select the ALB. Choose the Target Groups tab, select the target group, and then select the Group details tab. Click on Edit and turn off Cross-zone load balancing. Use Amazon Route 53 Application Recovery Controller to start a zonal shift away from the Availability Zone: Amazon Route 53 Application Recovery Controller provides the ability to control traffic flow to ensure high availability and disaster recovery. By using Route 53 Application Recovery Controller, you can perform a zonal shift to redirect traffic away from the unhealthy Availability Zone. To start a zonal shift: Configure Route 53 Application Recovery Controller by creating a cluster and control panel. Create routing controls to manage traffic shifts between Availability Zones. Use the routing control to shift traffic away from the affected Availability Zone.
Reference: Disabling cross-zone load balancing Route 53 Application Recovery Controller

To implement a control that requires the use of IMDSv2 on all EC2 instances in the account, the DevOps engineer can use a permissions boundary. A permissions boundary is a policy that defines the maximum permissions that an IAM entity can have. The DevOps engineer can create a permissions boundary that prevents the ec2:RunInstance action if the ec2:MetadataHttpTokens condition key is not set to a value of required. This condition key enforces the use of IMDSv2 on EC2 instances. The DevOps engineer can attach the permissions boundary to the IAM role that was used to launch the instance. This way, any attempt to launch an EC2 instance without using IMDSv2 will be denied by the permissions boundary.

To meet the new guideline for application deployment, the company can use a combination of AWS CodePipeline and AWS CloudTrail. A manual approval action in CodePipeline allows the security team to review and approve changes before they are deployed. This action can be configured to pause the pipeline until approval is granted, ensuring that no changes move to production without the necessary sign-off. Additionally, by creating an AWS CloudTrail trail, all actions taken within CodePipeline, including approvals, are recorded and delivered to an Amazon S3 bucket. This provides an audit trail that can be retained for compliance and review purposes.
Reference: AWS CodePipeline’s manual approval action provides a way to ensure that a member of the security team can review and approve changes before they are deployed1. AWS CloudTrail integration with CodePipeline allows for the recording and retention of all pipeline actions, including approvals, which can be stored in Amazon S3 for record-keeping2.