DevOps Engineer Professional (Page 27)

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate.The instances are created and maintained with AWS CloudFormation.A DevOps engineer wants the instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated.Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?Read More →

A company deploys its corporate infrastructure on AWS across multiple AWS Regions and Availability Zones.The infrastructure is deployed on Amazon EC2 instances and connects with AWS IoT Greengrass devices.The company deploys additional resources on on-premises servers that are located in the corporate headquarters.The company wants to reduce the overhead involved in maintaining and updating its resources.The company’s DevOps team plans to use AWS Systems Manager to implement automated management and application of patches.The DevOps team confirms that Systems Manager is available in the Regions that the resources are deployed in.Systems Manager also is available in a Region near the corporate headquarters.Which combination of steps must the DevOps team take to implement automated patch and configuration management across the company’s EC2 instances, IoT devices, and on-premises infrastructure? (Choose three.)Read More →

A company has deployed an application in a production VPC in a single AWS account.The application is popular and is experiencing heavy usage.The company’s security team wants to add additional security, such as AWS WAF, to the application deployment.However, the application’s product manager is concerned about cost and does not want to approve the change unless the security team can prove that additional security is necessary.The security team believes that some of the application’s demand might come from users that have IP addresses that are on a deny list.The security team provides the deny list to a DevOps engineer.If any of the IP addresses on the deny list access the application, the security team wants to receive automated notification in near real time so that the security team can document that the application needs additional security.The DevOps engineer creates a VPC flow log for the production VPC.Which set of additional steps should the DevOps engineer take to meet these requirements MOST cost-effectively?Read More →

A DevOps engineer needs to configure a blue/green deployment for an existing three-tier application.The application runs on Amazon EC2 instances and uses an Amazon RDS database.The EC2 instances run behind an Application Load Balancer (ALB) and are in an Auto Scaling group.The DevOps engineer has created a launch template and an Auto Scaling group for the blue environment.The DevOps engineer also has created a launch template and an Auto Scaling group for the green environment.Each Auto Scaling group deploys to a matching blue or green target group.The target group also specifies which software, blue or green, gets loaded on the EC2 instances.The ALB can be configured to send traffic to the blue environment’s target group or the green environment’s target group.An Amazon Route 53 record for www.example.com points to the ALB.The deployment must move traffic all at once between the software on the blue environment’s EC2 instances to the newly deployed software on the green environment’s EC2 instances.What should the DevOps engineer do to meet these requirements?Read More →

A company uses AWS Storage Gateway in file gateway mode in front of an Amazon S3 bucket that is used by multiple resources.In the morning when business begins, users do not see the objects processed by a third party the previous evening.When a DevOps engineer looks directly at the S3 bucket, the data is there, but it is missing in Storage Gateway.Which solution ensures that all the updated third-party files are available in the morning?Read More →

A company is using an organization in AWS Organizations to manage multiple AWS accounts.The company’s development team wants to use AWS Lambda functions to meet resiliency requirements and is rewriting all applications to work with Lambda functions that are deployed in a VPC.The development team is using Amazon Elastic File System (Amazon EFS) as shared storage in Account A in the organization.The company wants to continue to use Amazon EFS with Lambda.Company policy requires all serverless projects to be deployed in Account B.A DevOps engineer needs to reconfigure an existing EFS file system to allow Lambda functions to access the data through an existing EFS access point.Which combination of steps should the DevOps engineer take to meet these requirements? (Choose three.)Read More →

A company that runs many workloads on AWS has an Amazon EBS spend that has increased over time.The DevOps team notices there are many unattachedEBS volumes.Although there are workloads where volumes are detached, volumes over 14 days old are stale and no longer needed.A DevOps engineer has been tasked with creating automation that deletes unattached EBS volumes that have been unattached for 14 days.Which solution will accomplish this?Read More →

A DevOps team is merging code revisions for an application that uses an Amazon RDS Multi-AZ DB cluster for its production database.The DevOps team uses continuous integration to periodically verify that the application works.The DevOps team needs to test the changes before the changes are deployed to the production database.Which solution will meet these requirements?Read More →

A company has a single AWS account that runs hundreds of Amazon EC2 instances in a single AWS Region.New EC2 instances are launched and terminated each hour in the account.The account also includes existing EC2 instances that have been running for longer than a week.The company’s security policy requires all running EC2 instances to use an EC2 instance profile.If an EC2 instance does not have an instance profile attached, the EC2 instance must use a default instance profile that has no IAM permissions assigned.A DevOps engineer reviews the account and discovers EC2 instances that are running without an instance profile.During the review, the DevOps engineer also observes that new EC2 instances are being launched without an instance profile.Which solution will ensure that an instance profile is attached to all existing and future EC2 instances in the Region?Read More →

A company manages a multi-tenant environment in its VPC and has configured Amazon GuardDuty for the corresponding AWS account.The company sends all GuardDuty findings to AWS Security Hub.Traffic from suspicious sources is generating a large number of findings.A DevOps engineer needs to implement a solution to automatically deny traffic across the entire VPC when GuardDuty discovers a new suspicious source.Which solution will meet these requirements?Read More →