DOP-C02 Free Practice Test

A company has multiple member accounts that are part of an organization in AWS Organizations. The security team needs to review every Amazon EC2 security group and their inbound and outbound rules. The security team wants to programmatically retrieve this information from the member accounts using an AWS Lambda function in the management account of the organization.
Which combination of access changes will meet these requirements? (Choose three.)

1. A. Create a trust relationship that allows users in the member accounts to assume the management account IAM role.
2. B. Create a trust relationship that allows users in the management account to assume the IAM roles of the member accounts.
3. C. Create an IAM role in each member account that has access to the AmazonEC2ReadOnlyAccess managed policy.
4. D. Create an I AM role in each member account to allow the sts:AssumeRole action against the management account IAM role's ARN.
5. E. Create an I AM role in the management account that allows the sts:AssumeRole action against the member account IAM role's ARN.
6. F. Create an IAM role in the management account that has access to the AmazonEC2ReadOnlyAccess managed policy.

Correct Answer: BCE
https://aws.amazon.com/premiumsupport/knowledge-center/lambda-function-assume-iam-role/ https://kreuzwerker.de/post/aws-multi-account-setups-reloaded

A company is storing 100 GB of log data in csv format in an Amazon S3 bucket SQL developers want to query this data and generate graphs to visualize it. The SQL developers also need an efficient automated way to store metadata from the csv file.
Which combination of steps will meet these requirements with the LEAST amount of effort? (Select THREE.)

1. A. Fitter the data through AWS X-Ray to visualize the data.
2. B. Filter the data through Amazon QuickSight to visualize the data.
3. C. Query the data with Amazon Athena.
4. D. Query the data with Amazon Redshift.
5. E. Use the AWS Glue Data Catalog as the persistent metadata store.
6. F. Use Amazon DynamoDB as the persistent metadata store.

Correct Answer: BCE
https://docs.aws.amazon.com/glue/latest/dg/components-overview.html

A DevOps engineer is deploying a new version of a company's application in an AWS CodeDeploy deployment group associated with its Amazon EC2 instances. After some time, the deployment fails. The engineer realizes that all the events associated with the specific deployment ID are in a Skipped status and code was not deployed in the instances associated with the deployment group.
What are valid reasons for this failure? (Select TWO.).

1. A. The networking configuration does not allow the EC2 instances to reach the internet via a NAT gateway or internet gateway and the CodeDeploy endpoint cannot be reached.
2. B. The IAM user who triggered the application deployment does not have permission to interact with the CodeDeploy endpoint.
3. C. The target EC2 instances were not properly registered with the CodeDeploy endpoint.
4. D. An instance profile with proper permissions was not attached to the target EC2 instances.
5. E. The appspe
6. F. yml file was not included in the application revision.

Correct Answer: AD
https://docs.aws.amazon.com/codedeploy/latest/userguide/troubleshooting- deployments.html#troubleshooting-skipped-lifecycle-events

A company builds an application that uses an Application Load Balancer in front of Amazon EC2 instances that are in an Auto Scaling group. The application is stateless. The Auto Scaling group uses a custom AMI that is fully prebuilt. The EC2 instances do not have a custom bootstrapping process.
The AMI that the Auto Scaling group uses was recently deleted. The Auto Scaling group's scaling activities show failures because the AMI ID does not exist.
Which combination of steps should a DevOps engineer take to meet these requirements? (Select THREE.)

1. A. Create a new launch template that uses the new AMI.
2. B. Update the Auto Scaling group to use the new launch template.
3. C. Reduce the Auto Scaling group's desired capacity to O.
4. D. Increase the Auto Scaling group's desired capacity by I.
5. E. Create a new AMI from a running EC2 instance in the Auto Scaling group.
6. F. Create a new AMI by copying the most recent public AMI of the operating system that the EC2 instances use.

Correct Answer: ABF
To restore the functionality of the Auto Scaling group after the AMI was deleted, the DevOps engineer needs to create a new AMI and update the Auto Scaling group to use it. The DevOps engineer can create a new AMI by copying the most recent public AMI of the operating system that the EC2 instances use. This will ensure that the new AMI has the same operating system as the custom AMI that was deleted. The DevOps engineer can then create a new launch template that uses the new AMI and update the Auto Scaling group to use the new launch template. This will allow the Auto Scaling group to launch new instances with the new AMI.

AnyCompany is using AWS Organizations to create and manage multiple AWS accounts AnyCompany recently acquired a smaller company, Example Corp. During the acquisition process, Example Corp's single AWS account joined AnyCompany's management account through an Organizations invitation. AnyCompany moved the new member account under an OU that is dedicated to Example Corp.
AnyCompany's DevOps eng•neer has an IAM user that assumes a role that is named OrganizationAccountAccessRole to access member accounts. This role is configured with a full access policy When the DevOps engineer tries to use the AWS Management Console to assume the role in Example Corp's new member account, the DevOps engineer receives the following error message "Invalid information in one or more fields. Check your information or contact your administrator."
Which solution will give the DevOps engineer access to the new member account?

1. A. In the management account, grant the DevOps engineer's IAM user permission to assume the OrganzatlonAccountAccessR01e IAM role in the new member account.
2. B. In the management account, create a new SCR In the SCP, grant the DevOps engineer's IAM user full access to all resources in the new member accoun
3. C. Attach the SCP to the OU that contains the new member account,
4. D. In the new member account, create a new IAM role that is named OrganizationAccountAccessRol
5. E. Attach the AdmInistratorAccess AVVS managed policy to the rol
6. F. In the role's trust policy, grant the management account permission to assume the role.
7. G. In the new member account edit the trust policy for the Organ zationAccountAccessRole IAM rol
8. H. Grant the management account permission to assume the role.

Correct Answer: C
The problem is that the DevOps engineer cannot assume the OrganizationAccountAccessRole IAM role in the new member account that joined AnyCompany’s management account through an Organizations invitation. The solution is to create a new IAM role with the same name and trust policy in the new member account.
✑ Option A is incorrect, as it does not address the root cause of the error. The DevOps engineer’s IAM user already has permission to assume the OrganizationAccountAccessRole IAM role in any member account, as this is the default role name that AWS Organizations creates when a new account joins an organization. The error occurs because the new member account does not have this role, as it was not created by AWS Organizations.
✑ Option B is incorrect, as it does not address the root cause of the error. An SCP is a policy that defines the maximum permissions for account members of an organization or organizational unit (OU). An SCP does not grant permissions to IAM users or roles, but rather limits the permissions that identity-based policies or resource-based policies grant to them. An SCP also does not affect how IAM roles are assumed by other principals.
✑ Option C is correct, as it addresses the root cause of the error. By creating a new IAM role with the same name and trust policy as the OrganizationAccountAccessRole IAM role in the new member account, the DevOps engineer can assume this role and access the account. The new role should have the AdministratorAccess AWS managed policy attached, which grants full access to all AWS resources in the account. The trust policy should allow the management account to assume the role, which can be done by specifying the management account ID as a principal in the policy statement.
✑ Option D is incorrect, as it assumes that the new member account already has the OrganizationAccountAccessRole IAM role, which is not true. The new member account does not have this role, as it was not created by AWS Organizations. Editing the trust policy of a non-existent role will not solve the problem.