Exam AWS Certified DevOps Engineer - Professional DOP-C02 All Questions

View all questions & answers for the AWS Certified DevOps Engineer - Professional DOP-C02 exam

Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 188 discussion

Exam question from Amazon's AWS Certified DevOps Engineer - Professional DOP-C02

Question #: 188
Topic #: 1

[All AWS Certified DevOps Engineer - Professional DOP-C02 Questions]

A company runs an application for multiple environments in a single AWS account. An AWS CodePipeline pipeline uses a development Amazon Elastic Container Service (Amazon ECS) cluster to test an image for the application from an Amazon Elastic Container Registry (Amazon ECR) repository. The pipeline promotes the image to a production ECS cluster.

The company needs to move the production cluster into a separate AWS account in the same AWS Region. The production cluster must be able to download the images over a private connection.

Which solution will meet these requirements?

A. Use Amazon ECR VPC endpoints and an Amazon S3 gateway endpoint. In the separate AWS account, create an ECR repository. Set the repository policy to allow the production ECS tasks to pull images from the main AWS account. Configure the production ECS task execution role to have permission to download the image from the ECR repository.
B. Set a repository policy on the production ECR repository in the main AWS account. Configure the repository policy to allow the production ECS tasks in the separate AWS account to pull images from the main account. Configure the production ECS task execution role to have permission to download the image from the ECR repository.
C. Configure ECR private image replication in the main AWS account. Activate cross-account replication. Define the destination account ID of the separate AWS account.
D. Use Amazon ECR VPC endpoints and an Amazon S3 gateway endpoint. Set a repository policy on the production ECR repository in the main AWS account. Configure the repository policy to allow the production ECS tasks in the separate AWS account to pull images from the main account. Configure the production ECS task execution role to have permission to download the image from the ECR repository.

Show Suggested Answer

Suggested Answer: D 🗳️

by PrasannaBalaji at Dec. 29, 2023, 3:50 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Srikantha

3 months ago

Selected Answer: B

It allows the production ECS tasks in a different AWS account to pull images from the ECR repository in the main AWS account with the proper access control set via repository policies and ECS task execution role permissions

upvoted 1 times

...

GripZA

10 months, 2 weeks ago

Selected Answer: C

"You can configure your Amazon ECR private registry to support the replication of your repositories. Amazon ECR supports both cross-Region and cross-account replication" https://docs.aws.amazon.com/AmazonECR/latest/userguide/replication.html If cross-account replication is enabled, then for Cross-account replication, choose the cross-account replication setting for the registry. For Destination account, enter the account ID for the destination account and one or more Destination regions to replicate to. Choose Destination account + to configure additional accounts as replication destinations. https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry-settings-configure.html

upvoted 1 times

GripZA

2 months, 1 week ago

changing to D to meet private conn requirement

upvoted 1 times

...

hzaki

11 months, 1 week ago

The correct answer is A: The company needs to move the production cluster into a separate AWS account in the same AWS Region. The repository is in a separate account, and permissions are set there, giving better isolation between environments.

upvoted 1 times

hzaki

9 months, 4 weeks ago

I will go with option C because cross-account replication is straightforward and secure.

upvoted 1 times

...

Gomer

12 months ago

Selected Answer: D

Based the references provided, it would appear that both "C" and "D" could work to distribute an image, EXCEPT for the ""private connection" requirement. It's also seems like a cleaner solution to just rely on one ECR repository, rather than replicate repo's to other accounts in same region.

upvoted 1 times

...

c3518fc

1 year, 2 months ago

Selected Answer: D

https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

upvoted 2 times

...

dkp

1 year, 2 months ago

Selected Answer: D

Ans D: Amazon ECS tasks to pull private images from Amazon ECR, you must create a gateway endpoint for Amazon S3. The gateway endpoint is required because Amazon ECR uses Amazon S3 to store your image layers.

upvoted 2 times

...

DanShone

1 year, 3 months ago

Selected Answer: D

ECR VPC endpoints is needed to meet "download the images over a private connection."

upvoted 2 times

...

dzn

1 year, 3 months ago

Selected Answer: D

Use ECR VPC endpoints is necessary to meet the below requirements. `download the images over a private connection.`

upvoted 3 times

...

testhard

1 year, 4 months ago

Selected Answer: C

https://docs.aws.amazon.com/AmazonECR/latest/userguide/replication.html

upvoted 1 times

...

thanhnv142

1 year, 4 months ago

Selected Answer: C

C is correct: ECR private image replication can allow replicate image to the new account A and D: both mentions S3 gw, which is unnecessary B: no mention of how to replicate images cross account

upvoted 2 times

...

poctest

1 year, 5 months ago

Don't see the difference between A & D

upvoted 1 times

denccc

1 year, 5 months ago

It's D, no need to create a seperate ECR repo in the other account, just update the policy of the ECR repo in the main account to allow cross-account access.

upvoted 3 times

...

ozansenturk

1 year, 5 months ago

Selected Answer: D

https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

upvoted 2 times

...

kabary

1 year, 5 months ago

Selected Answer: D

Answer is D.

upvoted 2 times

...

csG13

1 year, 6 months ago

Selected Answer: D

It's D

upvoted 2 times

...

PrasannaBalaji

1 year, 6 months ago

Selected Answer: D

D - Using Amazon ECR VPC endpoints ensures that the ECS tasks in both the development and production clusters can pull Docker images securely over a private connection.

upvoted 2 times

...