support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Amazon
  4. AWS DevOps Engineer Professional

Free AWS DevOps Engineer Professional Exam Braindumps
AWS DevOps Engineer - Professional (DOP-C02) Questions 71–75 (page: 16)

Updated On: 10-Feb-2026
Page 16 of 43
PDF with 429 Questions

A development team is building an ecommerce application and is using Amazon Simple Noti cation Service (Amazon SNS) to send order messages to multiple endpoints. One of the endpoints is an external HTTP endpoint that is not always available. The development team needs to receive a noti cation if an order message is not delivered to the HTTP endpoint.
What should a DevOps engineer do to meet these requirements?

  1. Create an Amazon Simple Queue Service (Amazon SQS) queue. On the SNS topic, con gure a redrive policy that sends undelivered messages to the SQS queue. Create an Amazon CloudWatch alarm for the new SQS queue to notify the development team when messages are delivered to the queue.
  2. Create an Amazon Simple Queue Service (Amazon SQS) queue. On the HTTP endpoint subscription of the SNS topic, con gure a redrive policy that sends undelivered messages to the SQS queue. Create an Amazon CloudWatch alarm for the new SQS queue to notify the development team when messages are delivered to the queue.
  3. On the SNS topic, con gure an HTTPS delivery policy that will retry delivery until the order message is delivered successfully. Con gure the backoffFunction parameter in the policy to notify the development team when a message cannot be delivered within the set constraints.
  4. On the HTTP endpoint subscription of the SNS topic, con gure an HTTPS delivery policy that will retry delivery until the order message is delivered successfully. Con gure the backoffFunction parameter in the policy to notify the development team when a message cannot be delivered within the set constraints.

Answer(s): B

Explanation:


Reference:

https://docs.aws.amazon.com/sns/latest/dg/sns-message-delivery-retries.html



A company is deploying a container-based application using AWS CodeBuild. The Security team mandates that all containers are scanned for vulnerabilities prior to deployment using a password-protected endpoint. All sensitive information must be stored securely.
Which solution should be used to meet these requirements?

  1. Encrypt the password using AWS KMS. Store the encrypted password in the buildspec.yml le as an environment variable under the variables mapping. Reference the environment variable to initiate scanning.
  2. Import the password into an AWS CloudHSM key. Reference the CloudHSM key in the buildpec.yml le as an environment variable under the variables mapping. Reference the environment variable to initiate scanning.
  3. Store the password in the AWS Systems Manager Parameter Store as a secure string. Add the Parameter Store key to the buildspec.yml le as an environment variable under the parameter-store mapping. Reference the environment variable to initiate scanning.
  4. Use the AWS Encryption SDK to encrypt the password and embed in the buildspec.yml le as a variable under the secrets mapping. Attach a policy to CodeBuild to enable access to the required decryption key.

Answer(s): C



An Engineering team manages a Node.js e-commerce application. The current environment consists of the following components:
Amazon S3 buckets for storing content
Amazon EC2 for the front-end web servers
AWS Lambda for image processing
Amazon DynamoDB for storing session-related data
The team expects a signi cant increase in tra c to the site. The application should handle the additional load without interruption. The team ran initial tests by adding new servers to the EC2 front-end to handle the larger load, but the instances took up to 20 minutes to become fully con gured. The team wants to reduce this con guration time.
What changes will the Engineering team need to implement to make the solution the MOST resilient and highly available while meeting the expected increase in demand?

  1. Use AWS OpsWorks to automatically con gure each new EC2 instance as it is launched. Con gure the EC2 instances by using an Auto Scaling group behind an Application Load Balancer across multiple Availability Zones. Implement Amazon DynamoDB Auto Scaling. Use Amazon Route 53 to point the application DNS record to the Application Load Balancer.
  2. Deploy a eet of EC2 instances, doubling the current capacity, and place them behind an Application Load Balancer. Increase the Amazon DynamoDB read and write capacity units. Add an alias record that contains the Application Load Balancer endpoint to the existing Amazon Route 53 DNS record that points to the application.
  3. Con gure Amazon CloudFront and have its origin point to Amazon S3 to host the web application. Implement Amazon DynamoDB Auto Scaling. Use Amazon Route 53 to point the application DNS record to the CloudFront DNS name.
  4. Use AWS Elastic Beanstalk with a custom AMI including all web components. Deploy the platform by using an Auto Scaling group behind an Application Load Balancer across multiple Availability Zones. Implement Amazon DynamoDB Auto Scaling. Use Amazon Route 53 to point the application DNS record to the Elastic Beanstalk load balancer.

Answer(s): D



A company's application development team uses Linux-based Amazon EC2 instances as bastion hosts. Inbound SSH access to the bastion hosts is restricted to speci c IP addresses, as de ned in the associated security groups. The company's security team wants to receive a noti cation if the security group rules are modi ed to allow SSH access from any IP address.
What should a DevOps engineer do to meet this requirement?

  1. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with a source of aws.cloudtrail and the event name AuthorizeSecurityGroupIngress. De ne an Amazon Simple Noti cation Service (Amazon SNS) topic as the target.
  2. Enable Amazon GuardDuty and check the ndings for security group in AWS Security Hub. Con gure an Amazon EventBridge (Amazon CloudWatch Events) rule with a custom pattern that matches GuardDuty events with an output of NON_COMPLIANT. De ne an Amazon Simple Noti cation Service (Amazon SNS) topic as the target.
  3. Create an AWS Con g rule by using the restricted-ssh managed rule to check whether security groups disallow unrestricted incoming SSH tra c. Con gure automatic remediation to publish a message to an Amazon Simple Noti cation Service (Amazon SNS) topic.
  4. Enable Amazon Inspector. Include the Common Vulnerabilities and Exposures-1.1 rules package to check the security groups that are associated with the bastion hosts. Con gure Amazon Inspector to publish a message to an Amazon Simple Noti cation Service (Amazon SNS) topic.

Answer(s): C


Reference:

https://docs.aws.amazon.com/con g/latest/developerguide/restricted-ssh.html



A company is using AWS Organizations to create separate AWS accounts for each of its departments. The company needs to automate the following tasks:
Update the Linux AMIs with new patches periodically and generate a golden image Install a new version of Chef agents in the golden image, if available
Provide the newly generated AMIs to the department's accounts
Which solution meets these requirements with the LEAST management overhead?

  1. Write a script to launch an Amazon EC2 instance from the previous golden image. Apply the patch updates. Install the new version of the Chef agent, generate a new golden image, and then modify the AMI permissions to share only the new image with the department's accounts.
  2. Use Amazon EC2 Image Builder to create an image pipeline that consists of the base Linux AMI and components to install the Chef agent.
    Use AWS Resource Access Manager to share EC2 Image Builder images with the department's accounts.
  3. Use an AWS Systems Manager Automation runbook to update the Linux AMI by using the previous image. Provide the URL for the script that will update the Chef agent. Use AWS Organizations to replace the previous golden image in the department's accounts.
  4. Use Amazon EC2 Image Builder to create an image pipeline that consists of the base Linux AMI and components to install the Chef agent.
    Create a parameter in AWS Systems Manager Parameter Store to store the new AMI ID that can be referenced by the department's accounts.

Answer(s): B

Explanation:


Reference:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html



  PDF
Viewing page 16 of 43
Viewing questions 76 - 80 out of 429 questions


Post your Comments and Discuss Amazon AWS DevOps Engineer Professional exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!