DOP-C02 Practice Questions

https://aws.amazon.com/about-aws/whats-new/2020/02/aws-cloudformation-stacksets-introducesautomatic-deployments-across-accounts-and-regions-through-aws-organizations/

Stack Export and Import:

Use the Export feature in CloudFormation to share outputs from one stack (e.g., database resources)

and use them as inputs in another stack (e.g., web application resources).

Steps to Create Stack Export:

Define the resources in the database CloudFormation template and use the Outputs section to

export necessary values.

Outputs:

DBInstanceEndpoint:

Value: !GetAtt DBInstance.Endpoint.Address

Export:

Name: DBInstanceEndpoint

Steps to Import into Web Application Stack:

In the web application CloudFormation template, use the ImportValue function to import these

exported values.

Resources:

MyResource:

Type: "AWS::SomeResourceType"

Properties:

SomeProperty: !ImportValue DBInstanceEndpoint

Resource-Level Change-Set Reviews:

Both teams can continue using their respective review processes, as changes to each stack are

managed independently.

Use CloudFormation change sets to preview changes before deploying.

By exporting resources from the database stack and importing them into the web application stack,

both teams can maintain their separate review and lifecycle management processes while sharing

necessary resources.

Reference:

AWS CloudFormation Export

AWS CloudFormation ImportValue

Comprehensive and Detailed Explanation From Exact Extract:

Amazon Redshift supports audit logging which can be configured to log user activity, including

queries and user changes. The logs can be delivered to an S3 bucket (Option B), which is the standard

location for Redshift audit logs.

While Redshift can send some logs to CloudWatch, the native audit logging is typically routed to S3.

Creating a CloudWatch dashboard with a log widget (Option D) allows visualization of user activities

from logs ingested into CloudWatch Logs or through custom processing.

Option A is invalid because CloudTrail does not capture Redshift query logs directly. Option C

incorrectly assumes Redshift audit logs can be delivered directly to CloudWatch. Option E adds

complexity by requiring Lambda and Athena unnecessarily when direct visualization in CloudWatch is

simpler.

Reference:

Amazon Redshift Audit Logging

Visualizing Logs with Amazon CloudWatch Dashboards

The correct answer is B and E. Configuring a higher provisioned concurrency for the Lambda

functions will ensure that the functions are ready to respond to the initial burst of requests without

any cold start latency. Using Amazon RDS Proxy to create a proxy for the Aurora database will enable

the Lambda functions to reuse existing database connections and reduce the overhead of

establishing new ones. This will also improve the scalability and availability of the database by

managing the connection pool size and handling failovers. Option A is incorrect because reserved

concurrency only limits the number of concurrent executions for a function, not pre-warms them.

Option C is incorrect because converting the DB cluster to an Aurora global database will not address

the issue of database connection latency, and may introduce additional costs and complexity. Option

D is incorrect because moving the code blocks that initialize database connections into the function

handlers will not improve the performance or scalability of the Lambda functions, and may actually

worsen the cold start latency. Reference:

AWS Lambda Provisioned Concurrency

Using Amazon RDS Proxy with AWS Lambda

Certified DevOps Engineer - Professional (DOP-C02) Study Guide (page 173)

Create an AWS Identity and Access Management Roles Anywhere trust anchor Create an IAM role

that allows CodeArtifact actions and that has a trust relationship on the trust anchor. Update the on-

premises CI/CD pipeline to assume the new IAM role and to publish the packages to CodeArtifact:

Roles Anywhere allows on-premises servers to assume IAM roles, making it easier to integrate on-

premises environments with AWS services.

Steps:

Create a trust anchor in IAM.

Create an IAM role with permissions for CodeArtifact actions (e.g., publishing packages).

Update the CI/CD pipeline to assume this role using the trust anchor.

Create a new Amazon S3 bucket. Generate a presigned URL that allows the PutObject request.

Update the on-premises CI/CD pipeline to use the presigned URL to publish the packages from the

on-premises location to the S3 bucket. Create an AWS Lambda function that runs when packages are

created in the bucket through a put command Configure the Lambda function to publish the

packages to CodeArtifact:

Using an S3 bucket as an intermediary, you can easily upload packages from on-premises systems.

Steps:

Create an S3 bucket.

Generate presigned URLs to allow the CI/CD pipeline to upload packages.

Configure an AWS Lambda function to trigger on S3 PUT events and publish the packages to

CodeArtifact.

Reference:

IAM Roles Anywhere

Amazon S3 presigned URLs

AWS Lambda function triggers

To prevent developers from unintentionally attaching an Elastic IP address to an Amazon EC2

instance in production, the best approach is to use IAM policies and AWS Config rules. By attaching

an IAM policy that denies the associate-address permission to the developers’ IAM group, you

ensure that developers cannot perform this action. Additionally, creating a custom AWS Config rule

to check for Elastic IP addresses associated with instances tagged as production provides ongoing

monitoring. If the rule detects an Elastic IP address, it can trigger an alert to notify the security

team. This method is proactive and enforces the necessary permissions while also providing a

mechanism for detection and notification. Reference: from Amazon DevOps sources

Turn off cross-zone load balancing on the ALB's target group:

Cross-zone load balancing distributes traffic evenly across all registered targets in all enabled

Availability Zones. Turning this off will ensure that each target group only handles requests from its

respective Availability Zone.

To disable cross-zone load balancing:

Go to the Amazon EC2 console.

Navigate to Load Balancers and select the ALB.

Choose the Target Groups tab, select the target group, and then select the Group details tab.

Click on Edit and turn off Cross-zone load balancing.

Use Amazon Route 53 Application Recovery Controller to start a zonal shift away from the

Availability Zone:

Amazon Route 53 Application Recovery Controller provides the ability to control traffic flow to

ensure high availability and disaster recovery.

By using Route 53 Application Recovery Controller, you can perform a zonal shift to redirect traffic

away from the unhealthy Availability Zone.

To start a zonal shift:

Configure Route 53 Application Recovery Controller by creating a cluster and control panel.

Create routing controls to manage traffic shifts between Availability Zones.

Use the routing control to shift traffic away from the affected Availability Zone.

Reference:

Disabling cross-zone load balancing

Route 53 Application Recovery Controller

To implement a control that requires the use of IMDSv2 on all EC2 instances in the account, the

DevOps engineer can use a permissions boundary. A permissions boundary is a policy that defines

the maximum permissions that an IAM entity can have. The DevOps engineer can create a

permissions boundary that prevents the ec2:RunInstance action if the ec2:MetadataHttpTokens

condition key is not set to a value of required. This condition key enforces the use of IMDSv2 on EC2

instances. The DevOps engineer can attach the permissions boundary to the IAM role that was used

to launch the instance. This way, any attempt to launch an EC2 instance without using IMDSv2 will be

denied by the permissions boundary.

To meet the new guideline for application deployment, the company can use a combination of AWS

CodePipeline and AWS CloudTrail. A manual approval action in CodePipeline allows the security

team to review and approve changes before they are deployed. This action can be configured to

pause the pipeline until approval is granted, ensuring that no changes move to production without

the necessary sign-off. Additionally, by creating an AWS CloudTrail trail, all actions taken within

CodePipeline, including approvals, are recorded and delivered to an Amazon S3 bucket. This provides

an audit trail that can be retained for compliance and review purposes.

Reference:

AWS CodePipeline’s manual approval action provides a way to ensure that a member of the security

team can review and approve changes before they are deployed1.

AWS CloudTrail integration with CodePipeline allows for the recording and retention of all pipeline

actions, including approvals, which can be stored in Amazon S3 for record-keeping2.