DOP-C02 (Page 18)

AnyCompany is using AWS Organizations to create and manage multiple AWS accounts.AnyCompany recently acquired a smaller company, Example Corp.During the acquisition process, Example Corp’s single AWS account joined AnyCompany’s management account through an Organizations invitation.AnyCompany moved the new member account under an OU that is dedicated to Example Corp.AnyCompany’s DevOps engineer has an IAM user that assumes a role that is named OrganizationAccountAccessRole to access member accounts.This role is configured with a full access policy.When the DevOps engineer tries to use the AWS Management Console to assume the role in Example Corp’s new member account, the DevOps engineer receives the following error message: “Invalid information in one or more fields.Check your information or contact your administrator.”Which solution will give the DevOps engineer access to the new member account?Read More →

A company deploys an application on on-premises devices in the company’s on-premises data center.The company uses an AWS Direct Connect connection between the data center and the company’s AWS account.During initial setup of the on-premises devices and during application updates, the application needs to retrieve configuration files from an Amazon Elastic File System (Amazon EFS) file system.All traffic from the on-premises devices to Amazon EFS must remain private and encrypted.The on-premises devices must follow the principle of least privilege for AWS access.The company’s DevOps team needs the ability to revoke access from a single device without affecting the access of the other devices.Which combination of steps will meet these requirements? (Choose two.)Read More →

A company’s DevOps team manages a set of AWS accounts that are in an organization in AWS Organizations.The company needs a solution that ensures that all Amazon EC2 instances use approved AM Is that the DevOps team manages.The solution also must remediate the usage of AMIs that are not approved.The individual account administrators must not be able to remove the restriction to use approved AMIs.Which solution will meet these requirements?Read More →

A company recently created a new AWS Control Tower landing zone in a new organization in AWS Organizations.The landing zone must be able to demonstrate compliance with the Center for Internet Security (CIS) Benchmarks for AWS Foundations.The company’s security team wants to use AWS Security Hub to view compliance across all accounts.Only the security team can be allowed to view aggregated Security Hub findings.In addition, specific users must be able to view findings from their own accounts within the organization.All accounts must be enrolled in Security Hub after the accounts are created.Which combination of steps will meet these requirements in the MOST automated way? (Choose three.)Read More →

A DevOps engineer is building a continuous deployment pipeline for a serverless application that uses AWS Lambda functions.The company wants to reduce the customer impact of an unsuccessful deployment.The company also wants to monitor for issues.Which deploy stage configuration will meet these requirements?Read More →

A company has an organization in AWS Organizations.The organization includes workload accounts that contain enterprise applications.The company centrally manages users from an operations account.No users can be created in the workload accounts.The company recently added an operations team and must provide the operations team members with administrator access to each workload account.Which combination of actions will provide this access? (Choose three.)Read More →

A company hosts its staging website using an Amazon EC2 instance backed with Amazon EBS storage.The company wants to recover quickly with minimal data losses in the event of network connectivity issues or power failures on the EC2 instance.Which solution will meet these requirements?Read More →

A company runs an application with an Amazon EC2 and on-premises configuration.A DevOps engineer needs to standardize patching across both environments.Company policy dictates that patching only happens during non-business hours.Which combination of actions will meet these requirements? (Choose three.)Read More →

A company has chosen AWS to host a new application.The company needs to implement a multi-account strategy.A DevOps engineer creates a new AWS account and an organization in AWS Organizations.The DevOps engineer also creates the OU structure for the organization and sets up a landing zone by using AWS Control Tower.The DevOps engineer must implement a solution that automatically deploys resources for new accounts that users create through AWS Control Tower Account Factory.When a user creates a new account, the solution must apply AWS CloudFormation templates and SCPs that are customized for the OU or the account to automatically deploy all the resources that are attached to the account.All the OUs are enrolled in AWS Control Tower.Which solution will meet these requirements in the MOST automated way?Read More →

An online retail company based in the United States plans to expand its operations to Europe and Asia in the next six months.Its product currently runs on Amazon EC2 instances behind an Application Load Balancer.The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones.All data is stored in an Amazon Aurora database instance.When the product is deployed in multiple regions, the company wants a single product catalog across all regions, but for compliance purposes, its customer information and purchases must be kept in each region.How should the company meet these requirements with the LEAST amount of application changes?Read More →