Free DevOps Engineering on AWS Certification Trivia Questions and Answers

Question 1

In AWS Code Commit, a corporation has control over the source code for an application. Using AWS CodePipeline, the firm is developing a CI/CD pipeline for the application. When modifications are made to the main branch of the CodeCommit repository, the pipeline must begin automatically. Because changes occur on a daily basis, the pipeline must be as responsive as feasible.
What should a DevOps engineer do to achieve these requirements?

Accepted Answer

Configure an Amazon EventBridge (Amazon CloudWatch Events) rule to detect changes to the repository's main branch. Configure the pipeline to start in response to the changes.

Answer

Configure the repository to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic when changes occur to the repository's main branch. Subscribe the pipeline to the SNS topic.

Answer

Configure the repository to periodically run an AWS Lambda function. Configure the function to check the repository's main branch and to start the pipeline when the function detects changes.

Answer

Configure the pipeline to periodically check the repository's main branch for changes. Start the pipeline when changes are detected.

Question 2

A business is building an application with AWS CodeBuild. All build artifacts must be encrypted at rest per company policy. Access to the artifacts must be limited to IAM users in an operations IAM group who have authority to take an operations IAM role.
Which solution fits these standards?

Accepted Answer

Add a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket that has S3 default encryption enabled. Set a bucket policy that contains a Deny statement for all actions with a NotPrincipal element that references the operations IAM role.

Answer

Add a post-build command to the CodeBuild build specification to call the AWS key Management Service (AWS KMS) Encrypt API operation and pass the artifact to AWS KMS for encryption with a specified KMS key. Push the encrypted artifact to an Amazon S3 bucket. Set up the operations IAM group as the only user for the specified KMS key.

Answer

Add a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket. Configure an S3 event notification to invoke an AWS Lambda function to get the object, encrypt the object, and put the object back into the S3 bucket with a tag key of Encrypted and a tag value of True. Set a bucket policy with a Deny statement for all actions with a NotPrincipal element that references the operations IAM group. Include in the policy a Condition element that references the encrypted tag.

Answer

Add a post-build command to the CodeBuild build specification to push build objects to an Amazon S3 bucket. Set a bucket policy that prevents upload to the bucket unless the request includes the x-amz-server-side-encryption header. Add a Deny statement for all actions with a NotPrincipal element that references the operations IAM group.

Question 3

On AWS, a DevOps engineer must create a blue/green deployment procedure for an application. The traffic between the environments must be gradually shifted by the DevOps engineer.
The application operates on Amazon EC2 instances and is managed by an Application Load Balancer (ALB). The instances are run as part of an Amazon EC2 Auto Scaling group. Data is stored on an Amazon RDS Multi-AZ DB instance. External DNS is provided by Amazon Route 53.
To achieve these criteria, which combination of steps should the DevOps engineer take?

Accepted Answer

All of the above

Answer

Configure the new EC2 instances to use the primary RDS DB instance.

Answer

Create a second Auto Scaling group behind a second ALB.

Answer

In Route 53, create a second alias record that points to the new environment. Use a weighted routing policy to choose between the two records.

Question 4

A business runs an application on Amazon EC2 instances using the most recent version of the Amazon Linux 2 AMI. When server administrators implement new security updates, they manually remove impacted instances from service, patch the instances, and reinstall the instances.
A new security policy mandates that the corporation implement security updates within 7 days of their release. The company's security staff must ensure that all EC2 instances follow this policy. The patching must take place at the least disruptive period for users.
Which solution will ensure that these needs are met automatically?

Accepted Answer

Enlist all the EC2 instances in an AWS Systems Manager Patch Manager patch group. Use patch Manager to create a patch baseline. Configure a maintenance window to apply the patch baseline.

Answer

Create a sript to apply any availabe security patches. Create a cron job to schedule the script to run during a maintenance window. Install the script and cron job on the application AMI. Redeploy the application.

Answer

Use AWS Systems Manager Patch Manager to create a patch baseline. Create a script on the EC2 instances to use the AWS CLI  to pull the latest patches from Patch Manager. Create a cron job to schedule the script to run during a maintenance window.

Answer

Configure an AWS CodeBuild project to download and apply patches to all the instances over SSH. Use an Amazon EventBridge (Amazon CloudWatch Events) scheduled rule to run the Codebuild project during a maintenance window.

Question 5

All of a company's AWS accounts utilize AWS CloudTrail, which delivers all trails to the same Amazon S3 bucket. The organization uses S3 event notifications and an AWS Lambda code to deliver defined events to a third-party logging solution.
A security services provider has been asked by the business to set up a security operations center. The security services provider would want to receive CloudTrail logs via an Amazon Simple Queue Service (Amazon SQS) queue.
To send events to the third-party logging solution, the business must continue to use S3 event notifications and the Lambda function. What is the MOST EFFECTIVE strategy to achieve these requirements?

Accepted Answer

Replace the existing S3 event notification destination with an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the Lambda function and the SQS queue to the topic.

Answer

Configure the trail to send logs to Amazon CloudWatch Logs. Subscribe the SQS queue to the CloudWatch Logs log group.

Answer

Replace the existing S3 event notification destination with an Amazon Kinesis data stream. Create consumers for the Lambda function and the SQS queue.

Answer

Add an additional notification to the S3 bucket for all CreateObject events to send all objects to the SQS queue.

Question 6

A development team is working on an application that will serve a huge number of customers across three AWS Regions. To provide low-latency data access, the application will use an Amazon DynamoDB database that must be accessible in all three Regions. When one Region updates the database, the changes must be smoothly propagated to the other Regions.
What is the LEAST operational overhead a DevOps engineer should do when configuring the table to match these requirements?

Accepted Answer

Configure a multi-Region,  multi-active DynamoDB global table that includes the three Regions.

Answer

Use DynamoDB global tables to configure a primary table in one Region and a read replica in each of the other Regions.

Answer

Configure three DynamoDB tables in each of the three regions. Use the AWS SDK for DynamoDB to synchronize data changes among the tables.

Answer

Create a DynamoDB table in each of the three Regions. Give each table the same name.

Question 7

A business has a legacy API that is served by a fleet of Amazon EC2 machines behind a public Application Load Balancer (ALB). The ALB supports access logging and saves the logs on Amazon S3. The API may be accessed using the hostname api.example.com. The firm manages the hostname via Amazon Route 53.
Developers rebuilt five API endpoints using a distinct AWS Lambda function for each endpoint. A DevOps engineer want to test the new Lambda functions with a small number of random consumers. To guarantee compatibility with an existing log processing service, the test must not change the ALB access logs.
To achieve these objectives, how should the DevOps engineer conduct the test?

Accepted Answer

Create a new target group for each Lambda function. On the ALB, create new listener rules that include a path condition that matches each of the different endpoints. Set the rules to be weighted between the Lambda function target group for that endpoint and the instance-based target group.

Answer

Create a new ALB and a new target group for each Lambda function. Create a new listener rule that includes a host header condition that matches each of the endpoints and forwards traffic to the traget groups. Create a new Route 53 alias record with a weight of 10. Update the existing Route 53 record for the api.example.com hostname with a weight of 90.

Answer

Create a single target group that includes all the Lambda functions as individual targets. On the ALB, create a new listener rule that includes a host header condition that matches the API endpoint's hostname. Add the target group to the listener rule. Specify a lower weight for the new target group than the weight of the default rule's target group.

Answer

Add the five Lambda functions as targets to the existing target group for the EC2 instances. Set the weight in the target group of each Lambda function target to be less than the EC2 instance targets. Amend the default rule on the ALB to enable target group-level stickiness.