ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified DevOps Engineer - Professional DOP-C02 All Questions

View all questions & answers for the AWS Certified DevOps Engineer - Professional DOP-C02 exam
Go to Exam

Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 13 discussion

Exam question from Amazon's AWS Certified DevOps Engineer - Professional DOP-C02
Question #: 13
Topic #: 1
[All AWS Certified DevOps Engineer - Professional DOP-C02 Questions]

A company has a single AWS account that runs hundreds of Amazon EC2 instances in a single AWS Region. New EC2 instances are launched and terminated each hour in the account. The account also includes existing EC2 instances that have been running for longer than a week.
The company's security policy requires all running EC2 instances to use an EC2 instance profile. If an EC2 instance does not have an instance profile attached, the EC2 instance must use a default instance profile that has no IAM permissions assigned.
A DevOps engineer reviews the account and discovers EC2 instances that are running without an instance profile. During the review, the DevOps engineer also observes that new EC2 instances are being launched without an instance profile.
Which solution will ensure that an instance profile is attached to all existing and future EC2 instances in the Region?

  • A. Configure an Amazon EventBridge rule that reacts to EC2 RunInstances API calls. Configure the rule to invoke an AWS Lambda function to attach the default instance profile to the EC2 instances.
  • B. Configure the ec2-instance-profile-attached AWS Config managed rule with a trigger type of configuration changes. Configure an automatic remediation action that invokes an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instances.
  • C. Configure an Amazon EventBridge rule that reacts to EC2 StartInstances API calls. Configure the rule to invoke an AWS Systems Manager Automation runbook to attach the default instance profile to the EC2 instances
  • D. Configure the iam-role-managed-policy-check AWS Config managed rule with a trigger type of configuration changes. Configure an automatic remediation action that invokes an AWS Lambda function to attach the default instance profile to the EC2 instances.
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by ele at April 7, 2023, 3:11 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
koenigParas2324
Highly Voted 8 months, 3 weeks ago
Selected Answer: B
WS Config, specifically utilizing the "ec2-instance-profile-attached" managed rule with the configuration change trigger type. This rule helps monitor the attachment of instance profiles to EC2 instances. An automatic remediation action can be configured within AWS Config to respond when instances are found without an instance profile attached. The remediation action would execute an AWS Systems Manager Automation runbook to attach the default instance profile to those instances.
upvoted 8 times
...
AWSPICHI
Most Recent 1 week, 4 days ago
Selected Answer: B
How is it possible to remember the list of all the config rules?
upvoted 1 times
...
Gomer
2 months, 1 week ago
Selected Answer: B
I concur the best answer seems to be "B". However, I have not been able to trigger exactly what kind of "configuration change" triggers the config rule (e.g. "starting" or "running" an instance isn't a configuration change, but a state change. The real world answer (IMHO) would be to just kick off the AWS Config rule manually or on a schedule. I'd also take steps to ensure that all EC2 launch templates specify an instance profile so I'm not running around trying to fix things that shouldn't have been left broken from the start.
upvoted 1 times
...
Gillar
3 months, 4 weeks ago
Selected Answer: B
The rules AWS Config
upvoted 1 times
...
thanhnv142
6 months, 1 week ago
B is correct: AWS config + runbook is the right way for remediation
upvoted 4 times
thanhnv142
6 months ago
B is correct: AWS Config run in combination with SSM Automation run book is the recommended way A: this option only remediate new instances C: this option only remedidate instances that have been stopped. D: automatic remediation action should invoke Automation run book, not lambda
upvoted 5 times
...
...
DucSiu
7 months, 3 weeks ago
B Config: ec2-instance-profile-attached SSM Automation: AttachedIAMtoinstances
upvoted 3 times
...
madperro
1 year, 1 month ago
Selected Answer: B
B is correct. https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-profile-attached.html
upvoted 2 times
...
ParagSanyashiv
1 year, 2 months ago
Selected Answer: B
B is correct
upvoted 1 times
...
alce2020
1 year, 3 months ago
correct answer is B
upvoted 1 times
...
ele
1 year, 4 months ago
Selected Answer: B
B , no brainer
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago