Question 1 of 5
0% complete
Review your answers
0 of 5 correct
-
Question 1
Correct IncorrectWhat should a DevOps engineer do to meet these requirements?
Configure the pipeline to periodically check the repository’s main branch for changes. Start the pipeline when changes are detected. Correct answer Your answerConfigure an Amazon EventBridge (Amazon CloudWatch Events) rule to detect changes to the repository’s main branch. Configure the pipeline to start in response to the changes. Correct answer Your answerConfigure the repository to periodically run an AWS Lambda function. Configure the function to check the repository’s main branch and to start the pipeline when the function detects changes. Correct answer Your answerConfigure the repository to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic when changes occur to the repository’s main branch. Subscribe the pipeline to the SNS topic. Correct answer Your answerExplanation
Option B is the recommended solution and is the most responsive of the given options. The change will directly produce the event, and the event will directly start the pipeline. The periodic checks in option A will work, but they will not launch the pipeline until the next periodic check occurs. Option C is not a feature that AWS CodeCommit supports. Option D is not a valid method to start the pipeline.
-
Question 2
Correct IncorrectWhich combination of steps should the team take to meet these requirements in the MOST operationally efficient way? (Select THREE.)
Use AWS CloudFormation StackSets to create a new S3 bucket that has versioning enabled in each required Region. Copy the assets from the existing S3 bucket to the new S3 buckets. Create an AWS Lambda function to copy files that are added to the new S3 bucket in the primary Region to the additional Regions. Correct answer Your answerUse AWS CloudFormation StackSets to create a new S3 bucket that has versioning enabled in each required Region. Create multiple S3 replication rules on the new S3 bucket in the primary Region to replicate all its contents to the additional Regions. Copy the assets from the existing S3 bucket to the new S3 bucket in the primary Region. Correct answer Your answerCreate an Amazon CloudFront distribution. Configure new origins for each S3 bucket. Create an origin group that contains all the newly created origins. Update the default behavior of the distribution to use the new origin group. Correct answer Your answerCreate an Amazon CloudFront distribution. Configure new origins for each S3 bucket. Create a Lambda@Edge function to validate the availability of the origin and to route the viewer request to an available nearby origin. Correct answer Your answerCreate an Amazon Route 53 alias record. Configure a failover routing policy that uses the newly created S3 buckets as a target. Correct answer Your answerCreate an Amazon Route 53 alias record. Configure a simple routing policy that uses the Amazon CloudFront distribution as a target. Correct answer Your answerExplanation
There are three parts to this question. Part 1 is how to deploy the workload to multiple AWS Regions. Part 2 is how to provide access from a single endpoint for multiple deployments. Part 3 is how to handle failover events by using DNS. Part 1: For option B, AWS CloudFormation StackSets provides an operationally efficient multi-Region deployment strategy for the Region-specific Amazon S3 buckets. S3 replication copies new and existing objects in the primary Region to multiple deployment Regions. Option A is incorrect because it is less operationally efficient. The AWS Lambda function is unnecessary because S3 replication can provide the appropriate functionality without custom code. Part 2: For option C, you can use an Amazon CloudFront distribution to make a single endpoint available to resolve to multiple origins. You can configure CloudFront custom origins to create high availability origin failover that requires a shorter connection timeout, fewer connection attempts, or both. Option D is feasible but is less operationally efficient because it involves custom code within the Lambda@Edge function. The custom code is unnecessary because of native handling within the origin configurations. Part 3: For option F, because the CloudFront origin configurations are handling the failover, Route 53 is providing a simple routing policy user-friendly domain name to the CloudFront distribution. Option E is incorrect because there are not multiple records to benefit from failover routing.
-
Question 3
Correct IncorrectWhich solution will meet these requirements?
Add a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket. Set a bucket policy that prevents upload to the bucket unless the request includes the x-amz-server-side-encryption header. Add a Deny statement for all actions with a NotPrincipal element that references the operations IAM group. Correct answer Your answerAdd a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket. Configure an S3 event notification to invoke an AWS Lambda function to get the object, encrypt the object, and put the object back into the S3 bucket with a tag key of Encrypted and a tag value of True. Set a bucket policy with a Deny statement for all actions with a NotPrincipal element that references the operations IAM group. Include in the policy a Condition element that references the Encrypted tag. Correct answer Your answerAdd a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket that has S3 default encryption enabled. Set a bucket policy that contains a Deny statement for all actions with a NotPrincipal element that references the operations IAM role. Correct answer Your answerAdd a post-build command to the CodeBuild build specification to call the AWS Key Management Service (AWS KMS) Encrypt API operation and pass the artifact to AWS KMS for encryption with a specified KMS key. Push the encrypted artifact to an Amazon S3 bucket. Set up the operations IAM group as the only user for the specified KMS key. Correct answer Your answerExplanation
Amazon S3 default encryption ensures that the artifacts are encrypted at rest. The Deny statement with the NotPrincipal element set to the operations IAM role will deny access to the S3 bucket except for requests that use the role. The scenario implies that the operations role has a permissions policy that allows access to the bucket. Options A and B are incorrect because the bucket policy is referencing the IAM group and not the role. Option A is also incorrect because AWS recommends the use of default encryption over a bucket policy to enforce encryption. Option B also allows artifacts to be stored at rest briefly without encryption. Option D is incorrect because AWS Key Management Service (AWS KMS) Encrypt API operations would be useful for encryption of plaintext values such as a password, but not for encryption of a build artifact file, archive, or object.
-
Question 4
Correct IncorrectWhich combination of steps should the DevOps engineer take to meet these requirements? (Select THREE.)
Create a second Auto Scaling group behind the same ALB. Correct answer Your answerCreate a second Auto Scaling group behind a second ALB. Correct answer Your answerIn Route 53, create a second alias record that points to the new environment. Use a failover routing policy to choose between the two records. Correct answer Your answerIn Route 53, create a second alias record that points to the new environment. Use a weighted routing policy to choose between the two records. Correct answer Your answerConfigure the new EC2 instances to use the primary RDS DB instance. Correct answer Your answerConfigure the new EC2 instances to use the standby RDS DB instance. Correct answer Your answerExplanation
A blue/green deployment consists of two separate environments. The blue environment contains Amazon EC2 instances in an Auto Scaling group that run the current production version of the application. The green environment contains EC2 instances in another Auto Scaling group that run the new version of the application. Each Auto Scaling group is behind its own Application Load Balancer (ALB), so you can configure two alias records as endpoints in Amazon Route 53 and use a weighted routing policy to gradually shift traffic from the ALB for the blue environment to the ALB for the green environment. Unless schema changes are necessary for the new release, it is best to point both environments to the same database so that the data remains consistent during the cutover. Option A is incorrect because you need two ALBs as endpoints so that you can use Route 53 to gradually shift the traffic. Option C is incorrect because a failover routing policy sends all traffic to a single endpoint unless a health check detects a failure. Therefore, this option cannot gradually shift the traffic. Option F is incorrect because the standby instance in an Amazon RDS Multi-AZ DB instance is a hot standby and is not available for reads or writes.
-
Question 5
Correct IncorrectHow should a DevOps engineer configure the table to meet these requirements with the LEAST operational overhead?
Create a DynamoDB table in each of the three Regions. Give each table the same name. Correct answer Your answerConfigure three DynamoDB tables in each of the three Regions. Use the AWS SDK for DynamoDB to synchronize data changes among the tables. Correct answer Your answerConfigure a multi-Region, multi-active DynamoDB global table that includes the three Regions. Correct answer Your answerUse DynamoDB global tables to configure a primary table in one Region and a read replica in each of the other Regions. Correct answer Your answerExplanation
Amazon DynamoDB global tables start as single-Region tables that you can make available for multi-Region and multi-active workloads. Global tables provide Region-specific workloads with low-latency data access without requiring you to configure or manage a replication solution. Option A is incorrect because the use of a separate table in each Region would require an additional replication solution. Option B is incorrect because the development and management of a synchronization process across the tables would be unnecessary operational overhead. Option D is incorrect because global tables are multi-Region, multi-active tables that do not have read replicas.