AWS-Certified-DevOps-Engineer-Professional Free Practice Test

A DevOps engineer needs to apply a core set of security controls to an existing set of AWS accounts. The accounts are in an organization in AWS Organizations. Individual teams will administer individual accounts by using the AdministratorAccess AWS managed policy. For all accounts. AWS CloudTrail and AWS Config must be turned on in all available AWS Regions. Individual account administrators must not be able to edit or delete any of the baseline resources. However, individual account administrators must be able to edit or delete their own CloudTrail trails and AWS Config rules.
Which solution will meet these requirements in the MOST operationally efficient way?

1. A. Create an AWS CloudFormation template that defines the standard account resource
2. B. Deploy the template to all accounts from the organization's management account by using CloudFormation StackSet
3. C. Set the stack policy to deny Update:Delete actions.
4. D. Enable AWS Control Towe
5. E. Enroll the existing accounts in AWS Control Towe
6. F. Grant the individual account administrators access to CloudTrail and AWS Config.
7. G. Designate an AWS Config management accoun
8. H. Create AWS Config recorders in all accounts by using AWS CloudFormation StackSet
9. I. Deploy AWS Config rules to the organization by using the AWS Config management accoun
10. J. Create a CloudTrail organization trail in the organization’s management accoun
11. K. Deny modification or deletion of the AWS Config recorders by using an SCP.
12. L. Create an AWS CloudFormation template that defines the standard account resource
13. M. Deploy the template to all accounts from the organization's management account by using Cloud Formation StackSets Create an SCP that prevents updates or deletions to CloudTrail resources or AWS Config resources unless the principal is an administrator of the organization's management account.

Correct Answer: D

A company updated the AWS Cloud Formation template for a critical business application. The stack update process failed due to an error in the updated template and AWS CloudFormation automatically began the stack rollback process Later a DevOps engineer discovered that the application was still unavailable and that the stack was in the UPDATE_ROLLBACK_FAILED state.
Which combination of actions should the DevOps engineer perform so that the stack rollback can complete successfully? (Select TWO.)

1. A. Attach the AWSC loud Formation FullAccess IAM policy to the AWS CtoudFormation role.
2. B. Automatically recover the stack resources by using AWS CloudFormation drift detection.
3. C. Issue a ContinueUpdateRollback command from the AWS CloudFormation console or the AWS CLI.
4. D. Manually adjust the resources to match the expectations of the stack.
5. E. Update the existing AWS CloudFormation stack by using the original template.

Correct Answer: CD
https://docs.aws.amazon.com/cli/latest/reference/cloudformation/continue- update-rollback.html For a specified stack that is in the UPDATE_ROLLBACK_FAILED state, continues rolling it back to the UPDATE_ROLLBACK_COMPLETE state. Depending on the cause of the failure, you can manually fix the error and continue the rollback. By continuing the rollback, you can return your stack to a working state (the UPDATE_ROLLBACK_COMPLETE state), and then try to update the stack again.

A DevOps engineer is working on a data archival project that requires the migration of on- premises data to an Amazon S3 bucket. The DevOps engineer develops a script that incrementally archives on-premises data that is older than 1 month to Amazon S3. Data that is transferred to Amazon S3 is deleted from the on-premises location The script uses the S3 PutObject operation.
During a code review the DevOps engineer notices that the script does not verity whether the data was successfully copied to Amazon S3. The DevOps engineer must update the script to ensure that data is not corrupted during transmission. The script must use MD5 checksums to verify data integrity before the on-premises data is deleted.
Which solutions for the script will meet these requirements'? (Select TWO.)

1. A. Check the returned response for the Versioned Compare the returned Versioned against the MD5 checksum.
2. B. Include the MD5 checksum within the Content-MD5 paramete
3. C. Check the operationcall's return status to find out if an error was returned.
4. D. Include the checksum digest within the tagging parameter as a URL query parameter.
5. E. Check the returned response for the ETa
6. F. Compare the returned ETag against the MD5 checksum.
7. G. Include the checksum digest within the Metadata parameter as a name-value pair After upload use the S3 HeadObject operation to retrieve metadata from the object.

Correct Answer: BD
https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object- integrity.html

A company deploys its corporate infrastructure on AWS across multiple AWS Regions and Availability Zones. The infrastructure is deployed on Amazon EC2 instances and connects with AWS loT Greengrass devices. The company deploys additional resources on on- premises servers that are located in the corporate headquarters.
The company wants to reduce the overhead involved in maintaining and updating its resources. The company's DevOps team plans to use AWS Systems Manager to implement automated management and application of patches. The DevOps team confirms that Systems Manager is available in the Regions that the resources are deployed m Systems Manager also is available in a Region near the corporate headquarters.
Which combination of steps must the DevOps team take to implement automated patch and configuration management across the company's EC2 instances loT devices and on- premises infrastructure? (Select THREE.)

1. A. Apply tags lo all the EC2 instance
2. B. AWS loT Greengrass devices, and on-premises server
3. C. Use Systems Manager Session Manager to push patches to all the tagged devices.
4. D. Use Systems Manager Run Command to schedule patching for the EC2 instances AWS loT Greengrass devices and on-premises servers.
5. E. Use Systems Manager Patch Manager to schedule patching loT the EC2 instances AWS loT Greengrass devices and on-premises servers as a Systems Manager maintenance window task.
6. F. Configure Amazon EventBridge to monitor Systems Manager Patch Manager for updates to patch baseline
7. G. Associate Systems Manager Run Command with the event lo initiate a patch action for all EC2 instances AWS loT Greengrass devices and on-premises servers.
8. H. Create an IAM instance profile for Systems Manager Attach the instance profile to all the EC2 instances in the AWS accoun
9. I. For the AWS loT Greengrass devices and on-premises servers create an IAM service role for Systems Manager.
10. J. Generate a managed-instance activation Use the Activation Code and Activation ID to install Systems Manager Agent (SSM Agent) on each server in the on-premises environment Update the AWS loT Greengrass IAM token exchange role Use the role to deploy SSM Agent on all the loT devices.

Correct Answer: CEF
https://aws.amazon.com/blogs/mt/how-to-centrally-manage-aws-iot-greengrass-devices-using-aws-systems-manager/?force_isolation=true

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.
On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.
How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

1. A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content.
2. B. Update the weighted DNS record entry that points to the S3 bucke
3. C. Apply a weight of 0. Specify the domain reset option to propagate changes immediately.
4. D. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB.
5. E. Remove the weighted DNS record entry that points to the S3 bucket from the example.com hosted zon
6. F. Wait for DNS propagation to become complete.

Correct Answer: D