DOP-C02 Free Practice Test

A development team wants to use AWS CloudFormation stacks to deploy an application. However, the developer IAM role does not have the required permissions to provision the resources that are specified in the AWS CloudFormation template. A DevOps engineer needs to implement a solution that allows the developers to deploy the stacks. The solution must follow the principle of least privilege.
Which solution will meet these requirements?

1. A. Create an IAM policy that allows the developers to provision the required resource
2. B. Attach the policy to the developer IAM role.
3. C. Create an IAM policy that allows full access to AWS CloudFormatio
4. D. Attach the policy to the developer IAM role.
5. E. Create an AWS CloudFormation service role that has the required permission
6. F. Grant the developer IAM role a cloudformation:* actio
7. G. Use the new service role during stack deployments.
8. H. Create an AWS CloudFormation service role that has the required permission
9. I. Grant the developer IAM role the iam:PassRole permissio
10. J. Use the new service role during stack deployments.

Correct Answer: D
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html

A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, dally, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes.
A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified.
Which solution will meet these requirements?

1. A. Set up AWS Config in the accoun
2. B. Create a custom rule that returns a compliance failure for all Amazon EC2 resources that do not have a Backup Frequency tag applie
3. C. Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
4. D. Set up AWS Config in the accoun
5. E. Use a managed rule that returns a compliance failure for EC2::Volume resources that do not have a Backup Frequency tag applie
6. F. Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
7. G. Turn on AWS CloudTrail in the accoun
8. H. Create an Amazon EventBridge rule that reacts to EBS CreateVolume event
9. I. Configure a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekl
10. J. Specify the runbook as the target of the rule.
11. K. Turn on AWS CloudTrail in the accoun
12. L. Create an Amazon EventBridge rule that reacts to EBS CreateVolume events or EBS ModifyVolume event
13. M. Configure a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekl
14. N. Specify the runbook as the target of the rule.

Correct Answer: B
The following are the steps that the DevOps engineer should take to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified:
Set up AWS Config in the account.
Use a managed rule that returns a compliance failure for EC2::Volume resources that do not have a Backup Frequency tag applied.
Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
The managed rule AWS::Config::EBSVolumesWithoutBackupTag will return a compliance failure for any EBS volume that does not have the Backup_Frequency tag applied. The remediation action will then use the Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly to the EBS volume.

A company manages an application that stores logs in Amazon CloudWatch Logs. The company wants to archive the logs to an Amazon S3 bucket Logs are rarely accessed after 90 days and must be retained tor 10 years.
Which combination of steps should a DevOps engineer take to meet these requirements? (Select TWO.)

1. A. Configure a CloudWatch Logs subscription filter to use AWS Glue to transfer all logs to an S3 bucket.
2. B. Configure a CloudWatch Logs subscription filter to use Amazon Kinesis Data Firehose to stream all logs to an S3 bucket.
3. C. Configure a CloudWatch Logs subscription fitter to stream all logs to an S3 bucket.
4. D. Configure the S3 bucket lifecycle policy to transition logs to S3 Glacier after 90 days and to expire logs after 3.650 days.
5. E. Configure the S3 bucket lifecycle policy to transition logs to Reduced Redundancy after 90 days and to expire logs after 3.650 days.

Correct Answer: BD
https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html