DOP-C02 Exam - Question 4

Question

A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, dally, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes.

A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified.

Which solution will meet these requirements?

Examice · Accepted Answer

To ensure that all EBS volumes always have the Backup_Frequency tag, the best solution is to use AWS CloudTrail in combination with Amazon EventBridge to react to specific EBS volume events. The solution should be able to handle both the creation and modification of EBS volumes to apply the Backup_Frequency tag correctly. This can be achieved by creating an EventBridge rule that reacts to EBS CreateVolume events or EBS ModifyVolume events. Then, a custom AWS Systems Manager Automation runbook can be configured to apply the Backup_Frequency tag with a value of weekly and specified as the target of the rule. This approach ensures that the tag is applied immediately upon the creation or modification of any EBS volume, meeting the requirement for continuous tagging compliance.

thanhnv142 · Answer

B is correct: We should use AWS config for this task 
C and D: cloud trail is for auditing account activities, which is irrelevant
A: <returns a compliance failure for all Amazon EC2 resources> : we need to remediate EC2 volumes only, not all EC2 resources

SanChan · Answer

B is the most straightforward and efficient solution to ensure that all EBS volumes always have the Backup_Frequency tag applied with the least amount of effort.

A This approach requires more effort than using a managed rule provided by AWS.

bhond · Answer

i got this question in the exam

zijo · Answer

B is the best choice. If you look at Config Managed Rules you can find - ebs-in-backup-plan - Check if Amazon Elastic Block Store (Amazon EBS) volumes are added in backup plans of AWS Backup. The rule is NON_COMPLIANT if Amazon EBS volumes are not included in backup plans.

Dimidrol · Answer

B for me. https://aws.amazon.com/ru/blogs/mt/build-an-aws-config-custom-rule-to-optimize-amazon-ebs-volume-types/

lunt · Answer

Only takes few minutes to login > Config > Managed rulename = BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK
A = tags everything in EC2, thats EC2::* which includes ELB/EIP/etc. Nope.
Option B you can specify the tags to match & expected values = answer.

ele · Answer

Answer B: Config has a managed rule for type AWS EC2 Volume for tag compliance check.

alce2020 · Answer

B. Set up AWS Config in the account. Use a managed rule that returns a compliance failure for EC2::Volume resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.

vherman · Answer

B makes sense

madperro · Answer

B makes sense, you can use managed rule "required-tags" to identify non-compliant volumes and custom SSM document to fix it.

Sisanda_giiven · Answer

A is the correct answer "The AWS-managed AWS Systems Manager automation document AWS-SetRequiredTags does not work as a remediation with this rule. You will need to create your own custom Systems Manager automation documentation for remediation." from this link : https://docs.aws.amazon.com/config/latest/developerguide/required-tags.html

Diego1414 · Answer

Answer is A.
Checks if your resources have the tags that you specify. For example, you can check whether your Amazon EC2 instances have the CostCenter tag, while also checking if all your RDS instance have one set of Keys tag. Separate multiple values with commas. You can check up to 6 tags at a time.

The AWS-managed AWS Systems Manager automation document AWS-SetRequiredTags does not work as a remediation with this rule. You will need to create your own custom Systems Manager automation documentation for remediation

https://docs.aws.amazon.com/config/latest/developerguide/required-tags.html

c3518fc · Answer

By leveraging the AWS Config managed rule and automated remediation action, the DevOps engineer can ensure that all EBS volumes in the account always have the required Backup_Frequency tag, enabling the company to perform backups at least weekly unless a different value is explicitly specified. This solution provides continuous monitoring and automated remediation, reducing the risk of human error and ensuring compliance with the company's backup policy.

ajeeshb · Answer

Option B --> AWS config managed rule on EC2::Volume resource + custom SSM automation document
Not Option A --> because it says custom config rule on all EC2::Instance + Managed SSM automation document
Not options C & D --> As it says cloudtrail which is for logging API actions

DOP-C02 Exam - Question 4

Discussion