Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 347 discussion

Exam question from Amazon's AWS Certified DevOps Engineer - Professional DOP-C02

Question #: 347
Topic #: 1

[All AWS Certified DevOps Engineer - Professional DOP-C02 Questions]

A company is using AWS CloudFormation to perform deployments of its application environment. A deployment failed during a recent update to the existing CloudFormation stack. A DevOps engineer discovered that some resources in the stack were manually modified.

The DevOps engineer needs a solution that detects manual modification of resources and sends an alert to the DevOps lead.

Which solution will meet these requirements with the LEAST operational effort?

A. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps lead to the topic by using an email address. Create an AWS Config managed rule that has the CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK identifier. Create an Amazon EventBridge rule that is invoked on the NON_COMPLIANT resources status. Set the SNS topic as the rule target.
B. Tag all CloudFormation resources with a specific tag. Create an AWS Config custom rule by using the AWS Config Rules Development Kit Library (RDKlib) that checks all resource changes that have the specific tag. Configure the custom rule to mark all the tagged resource changes as NON_COMPLIANT when the change is not performed by CloudFormation. Create an Amazon EventBridge rule that is invoked on the NON_COMPUANT resources status. Create an AWS Lambda function that sends an email message to the DevOps lead. Set the Lambda function as the rule target.
C. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps lead to the topic by using an email address. Create an AWS Config managed rule that has the CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK identifier. Create an Amazon EventBridge rule that is invoked on the COMPLIANT resources status. Set the SNS topic as the rule target.
D. Create an AWS Config managed rule that has the CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK identifier. Create an Amazon EventBridge rule that is invoked on the NON_COMPLIANT resources status. Create an AWS Lambda function that sends an email message to the DevOps lead. Set the Lambda function as the rule target.

Show Suggested Answer

Suggested Answer: A 🗳️

by uncledana at Nov. 19, 2024, 11:17 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Srikantha

2 months, 3 weeks ago

Selected Answer: A

AWS Config Managed Rule (CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK): The CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK is a built-in AWS Config rule that automatically detects drift on resources managed by CloudFormation. Drift refers to manual changes made to CloudFormation-managed resources, and this rule identifies such changes. EventBridge Rule: You can create an EventBridge rule that listens for NON_COMPLIANT events triggered by the AWS Config rule when drift is detected. This will ensure that whenever there are manual modifications on CloudFormation-managed resources, the event will be captured. SNS Notification: Using Amazon SNS, you can set up an email notification for the DevOps lead whenever the event is triggered. Subscribing the DevOps lead to the SNS topic ensures that they are immediately notified without requiring manual intervention.

upvoted 2 times

...

Ky_24

6 months, 1 week ago

Selected Answer: A

Key Requirements: 1. Detect manual modification of CloudFormation-managed resources. 2. Send an alert to the DevOps lead when such changes are detected. 3. Achieve this with minimal operational effort.

upvoted 4 times

...

luisfsm_111

6 months, 2 weeks ago

Selected Answer: A

Least operational overhead always will involve using AWS-Managed services instead of developing code, for example. So, A in my opinion.

upvoted 4 times

...

Impromptu

7 months ago

Selected Answer: A

A is less complex by just using SNS for notifying, instead of creating a lambda function just to do that.

upvoted 4 times

...

uncledana

7 months, 1 week ago

Selected Answer: D

Option D is the most efficient and least operationally complex solution because it uses AWS Config’s drift detection rule, integrates with EventBridge for event handling, and leverages a Lambda function to send notifications. This approach directly addresses the need to detect manual changes in CloudFormation-managed resources and alert the DevOps lead.

upvoted 1 times

...