Amazon Amazon Certifications DOP-C02 Questions & Answers

• Question 341:

  Within an IAM policy, can you add an IfExists condition at the end of a Null condition?

  A. Yes, you can add an IfExists condition at the end of a Null condition but not in all Regions.

  B. Yes, you can add an IfExists condition at the end of a Null condition depending on the condition.

  C. No, you cannot add an IfExists condition at the end of a Null condition.

  D. Yes, you can add an IfExists condition at the end of a Null condition.

  Correct Answer: C

  Within an IAM policy, IfExists can be added to the end of any condition operator except the Null condition. It can be used to indicate that conditional comparison needs to happen if the policy key is present in the context of a request; otherwise, it can be ignored.

  Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html

• Question 342:

  Consider the portion of a CloudTrail log file below. Which type of event is being captured?

  "eventTime":"2016-07-16T17:35:32Z",

  "eventSource":"signin.amazonaws.com",

  "eventName":"ConsoleLogin",

  "awsRegion":"us-west-1",

  "sourceIPAddress":"192.1.2.10",

  ...

  A. AWS console sign-in

  B. AWS log off

  C. AWS error

  D. AWS deployment

  Correct Answer: A

  CloudTrail records attempts to sign into the AWS Management Console, the AWS Discussion Forums and the AWS Support Center. Note, however, that CloudTrail does not record root sign-in failures.

  Reference: http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-awsconsole-sign-in-events.html

• Question 343:

  Using the AWS CLI, which command would you use to change the configuration settings for a CloudTrail trail?

  A. modify-trail

  B. change-trail

  C. update-trail

  D. set-trail

  Correct Answer: C

  The update-trail command is used to change the configuration settings for a trail. You can only run update-trail command from the region in which the trail was created.

  Reference: http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trailby-using-the-aws-cli.html

• Question 344:

  You want to build an application that coordinates work across distributed components, and you find Amazon Simple Workflow Service (Amazon SWF) does this easily. You have enabled logging in CloudTrail, but you are unsure about

  Amazon SWF actions supported.

  Which of the following actions is NOT supported?

  A. RegisterDomain

  B. RegisterWorkflowActivity

  C. RegisterActivityType

  D. RegisterWorkflowType

  Correct Answer: B

  Amazon SWF is integrated with AWS CloudTrail, a service that captures API calls made by or on behalf of Amazon SWF and delivers the log files to an Amazon S3 bucket that you specify. The API calls can be made indirectly by using the Amazon SWF console or directly by using the Amazon SWF API. When CloudTrail logging is enabled, calls made to Amazon SWF actions are tracked in log files. Amazon SWF records are written together with any other AWS service records in a log file. CloudTrail determines when to create and write to a new file based on a specified time period and file size. The following actions are supported: DeprecateActivityType DeprecateDomain DeprecateWorkflowType RegisterActivityType RegisterDomain RegisterWorkflowType

  Reference: http://docs.aws.amazon.com/amazonswf/latest/developerguide/ct-logging.html

• Question 345:

  You want to set up the CloudTrail Processing Library to log your bucket operations. Which command will build a .jar file from the CloudTrail Processing Library source code?

  A. mvn javac mvn -install processor

  B. jar install processor

  C. build jar -Dgpg.processor

  D. mvn clean install -Dgpg.skip=true

  Correct Answer: D

  The CloudTrail Processing Library is a Java library that provides an easy way to process AWS CloudTrail logs in a fault-tolerant, scalable and flexible way. To set up the CloudTrail Processing Library, you first need to download CloudTrail Processing Library source from GitHub. You can then create the .jar file using this command.

  Reference: http://docs.aws.amazon.com/awscloudtrail/latest/userguide/use-the-cloudtrail-processinglibrary.html

• Question 346:

  By default, Amazon CloudTrail logs ____ actions defined by the CloudTrail ____ APIs.

  A. bucket-level; RESTful

  B. object-level; RESTful

  C. object-level; SDK

  D. bucket-level; SDK

  Correct Answer: A

  By default, CloudTrail logs bucket-level actions. Amazon S3 records are written together with other AWS service records in a log file. Amazon S3 bucket-level actions supported for logging by CloudTrail are defined in its RESTful API.

  Reference: http://docs.aws.amazon.com/AmazonS3/latest/dev/cloudtrail-logging.html

• Question 347:

  What is the correct syntax for the AWS command to create a single region trail?

  A. aws create-trail --name trailname --s3-object objectname

  B. aws cloudtrail --s3-regionname IPaddress create-trail --name trailname

  C. aws cloudtrail create-trail --name trailname --s3-bucket-name bucketname

  D. aws cloudtrail create-trail --name trailname --s3-portnumber IPaddress

  Correct Answer: C

  The command aws cloudtrail create-trail --name trailname --s3-bucket-name bucketname will create a single region trail. You must create a S3 bucket before you execute the command, with proper CloudTrail permissions applied to it (and you must have the AWS command line tools (CLI) on your system).

  Reference: http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trailby-using-the-aws-cli.html

• Question 348:

  When logging with Amazon CloudTrail, API call information for services with single end points is ____.

  A. captured and processed in the same region as to which the API call is made and delivered to the region associated with your Amazon S3 bucket

  B. captured, processed, and delivered to the region associated with your Amazon S3 bucket

  C. captured in the same region as to which the API call is made and processed and delivered to the region associated with your Amazon S3 bucket

  D. captured in the region where the end point is located, processed in the region where the CloudTrail trail is configured, and delivered to the region associated with your Amazon S3 bucket

  Correct Answer: D

  When logging with Amazon CloudTrail, API call information for services with regional end points (EC2, RDS etc.) is captured and processed in the same region as to which the API call is made and delivered to the region associated with your Amazon S3 bucket. API call information for services with single end points (IAM, STS etc.) is captured in the region where the end point is located, processed in the region where the CloudTrail trail is configured, and delivered to the region associated with your Amazon S3 bucket.

  Reference: https://aws.amazon.com/cloudtrail/faqs/

• Question 349:

  You are running Amazon CloudTrail on an Amazon S3 bucket and look at your most recent log. You notice that the entries include the ListThings and CreateThings actions and wonder if your devices have been hacked. Based on these entries, what service would you be concerned may have been hacked?

  A. Amazon Inspector

  B. AWS IoT

  C. AWS CodePipeline

  D. Amazon Glacier

  Correct Answer: B

  AWS IoT (Internet of Things) is integrated with CloudTrail to capture API calls from the AWS IoT console or from your code to the AWS IoT APIs. AWS IoT provides secure, bi-directional communication between Internet-connected things (such as sensors, actuators, embedded devices, or smart appliances) and the AWS cloud. Using the information collected by CloudTrail, you can determine the request that was made to AWS IoT, the source IP address from which the request was made, who made the request, when it was made, and so on.

  Reference: http://docs.aws.amazon.com/iot/latest/developerguide/monitoring_overview.html#iot-usingcloudtrail

• Question 350:

  When logging with Amazon CloudTrail, API call information for services with regional end points is ____.

  A. captured and processed in the same region as to which the API call is made and delivered to the region associated with your Amazon S3 bucket

  B. captured, processed, and delivered to the region associated with your Amazon S3 bucket

  C. captured in the same region as to which the API call is made and processed and delivered to the region associated with your Amazon S3 bucket

  D. captured in the region where the end point is located, processed in the region where the CloudTrail trail is configured, and delivered to the region associated with your Amazon S3 bucket

  Correct Answer: A

  When logging with Amazon CloudTrail, API call information for services with regional end points (EC2, RDS etc.) is captured and processed in the same region as to which the API call is made and delivered to the region associated with your Amazon S3 bucket. API call information for services with single end points (IAM, STS etc.) is captured in the region where the end point is located, processed in the region where the CloudTrail trail is configured, and delivered to the region associated with your Amazon S3 bucket.

  Reference: https://aws.amazon.com/cloudtrail/faqs/