AWS Certified CloudOps Engineer - Associate

• #101Choose 2

  Users are reporting consistent forced logouts from a stateful web application. The logouts occur before the expiration of a 15-minute application logout timer. The web application is hosted on Amazon EC2 instances that are in an Auto Scaling group. The instances run behind an Application Load Balancer (ALB) that has a single target group. The ALB is configured as the origin in an Amazon CloudFront distribution. Session affinity (sticky sessions) is already enabled on the ALB target group and uses duration-based cookies. The web application generates its own application cookie. Which combination of actions should a CloudOps Engineer take to resolve the logout problem? (Choose two.)

  • AChange to the least outstanding requests algorithm on the ALB target group.
  • BConfigure cookie forwarding in the CloudFront distribution's cache behavior settings.
  • CConfigure the duration-based cookie to be named AWSALB.
  • DConfigure the ALB to use the expiration cookie header.
  • EChange the ALB to use application-based cookies.
  Show answer
• #102

  A company is transitioning away from applications that are hosted on Amazon EC2 instances. The company wants to implement a serverless architecture that uses Amazon S3, Amazon API Gateway, AWS Lambda, and Amazon CloudFront. As part of this transition, the company has Elastic IP addresses that are unassociated with any EC2 instances after the EC2 instances are terminated. A CloudOps Engineer needs to automate the process of releasing all unassociated Elastic IP addresses that remain after the EC2 instances are terminated. Which solution will meet this requirement in the MOST operationally efficient way?

  • AActivate the eip-attached AWS Config managed rule to run automatically when resource changes occur in the AWS account. Configure automatic remediation for the rule. Specify the AWS-ReleaseElasticIP AWS Systems Manager Automation runbook for remediation. Specify an appropriate role that has permission for the remediation.
  • BCreate a custom Lambda function that calls the EC2 ReleaseAddress API operation and specifies the Elastic IP address AllocationId. Invoke the Lambda function by using an Amazon EventBridge rule. Specify AWS services as the event source, All Events as the event type, and AWS Trusted Advisor as the target.
  • CCreate an Amazon EventBridge rule. Specify AWS services as the event source, Instance State-change Notification as the event type, and Amazon EC2 as the service. Invoke a Lambda function that extracts the Elastic IP address from the notification. Use AWS CloudFormation to release the address by specifying the AllocationId as an input parameter.
  • DCreate a custom Lambda function that calls the EC2 ReleaseAddress API operation and specifies the Elastic IP address AllocationId. Invoke the Lambda function by using an Amazon EventBridge rule. Specify AWS services as the event source, Instance State-change Notification as the event type, and Amazon EC2 as the service.
  Show answer
• #103

  A company has multiple AWS Site-to-Site VPN connections between a VPC and its branch offices. The company manages an Amazon Elasticsearch Service (Amazon ES) domain that is configured with public access. The Amazon ES domain has an open domain access policy. A CloudOps Engineer needs to ensure that Amazon ES can be accessed only from the branch offices while preserving existing data. Which solution will meet these requirements?

  • AConfigure an identity-based access policy on Amazon ES. Add an allow statement to the policy that includes the Amazon Resource Name (ARN) for each branch office VPN connection.
  • BConfigure an IP-based domain access policy on Amazon ES. Add an allow statement to the policy that includes the private IP CIDR blocks from each branch office network.
  • CDeploy a new Amazon ES domain in private subnets in a VPC, and import a snapshot from the old domain. Create a security group that allows inbound traffic from the branch office CIDR blocks.
  • DReconfigure the Amazon ES domain in private subnets in a VPC. Create a security group that allows inbound traffic from the branch office CIDR blocks.
  Show answer
• #104Choose 2

  A company has an AWS CloudFormation template that creates an Amazon S3 bucket. A user authenticates to the corporate AWS account with their Active Directory credentials and attempts to deploy the CloudFormation template. However, the stack creation fails. Which factors could cause this failure? (Select TWO.)

  • AThe user's IAM policy does not allow the cloudformation:CreateStack action.
  • BThe user's IAM policy does not allow the cloudformation:CreateStackSet action.
  • CThe user's IAM policy does not allow the s3:CreateBucket action.
  • DThe user's IAM policy explicitly denies the s3:ListBucket action.
  • EThe user's IAM policy explicitly denies the s3:PutObject action.
  Show answer
• #105

  An application runs on Amazon EC2 instances in an Auto Scaling group. Following the deployment of a new feature on the EC2 instances, some instances were marked as unhealthy and then replaced by the Auto Scaling group. The EC2 instances terminated before a CloudOps Engineer could determine the cause of the health status changes. To troubleshoot this issue, the CloudOps Engineer wants to ensure that an AWS Lambda function is invoked in this situation. How should the CloudOps Engineer meet these requirements?

  • AActivate the instance scale-in protection setting for the Auto Scaling group. Invoke the Lambda function through Amazon EventBridge (Amazon CloudWatch Events).
  • BActivate the instance scale-in protection setting for the Auto Scaling group. Invoke the Lambda function through Amazon Route 53.
  • CAdd a lifecycle hook to the Auto Scaling group to invoke the Lambda function through Amazon EventBridge (Amazon CloudWatch Events).
  • DAdd a lifecycle hook to the Auto Scaling group to invoke the Lambda function through Amazon Route 53.
  Show answer
• #106

  While securing the connection between a company's VPC and its on-premises data center, a security engineer sent a ping command from an on-premises host (IP address 203.0.113.12) to an Amazon EC2 instance (IP address 172.31.16.139). The ping command did not return a response. The flow log in the VPC showed the following. What action should be performed to allow the ping to work?

  • AIn the security group of the EC2 instance, allow inbound ICMP traffic.
  • BIn the security group of the EC2 instance, allow outbound ICMP traffic.
  • CIn the VPC's NACL, allow inbound ICMP traffic.
  • DIn the VPC's NACL, allow outbound ICMP traffic.
  Show answer
• #107

  A CloudOps Engineer applies the following policy to an AWS CloudFormation stack. What is the result of this policy?

  • AUsers that assume an IAM role with a logical ID that begins with Production are prevented from running the update-stack command.
  • BUsers can update all resources in the stack except for resources that have a logical ID that begins with Production.
  • CUsers can update all resources in the stack except for resources that have an attribute that begins with Production.
  • DUsers in an IAM group with a logical ID that begins with Production are prevented from running the update-stack command.
  Show answer
• #108

  A CloudOps Engineer notices a scale-up event for an Amazon EC2 Auto Scaling group Amazon CloudWatch shows a spike in the RequestCount metric for the associated Application Load Balancer. The Engineer would like to know the IP addresses for the source of the requests. Where can the Engineer find this information?

  • AAuto Scaling logs.
  • BAWS CloudTrail logs.
  • CEC2 instance logs.
  • DElastic Load Balancer access logs.
  Show answer
• #109

  A company has a stateful, long-running workload on a single xlarge general purpose Amazon EC2 On-Demand Instance Metrics show that the service is always using 80% of its available memory and 40% of its available CPU. A CloudOps Engineer must reduce the cost of the service without negatively affecting performance. Which change in instance type will meet these requirements?

  • AChange to one large compute optimized On-Demand Instance.
  • BChange to one large memory optimized On-Demand Instance.
  • CChange to one xlarge general purpose Spot Instance.
  • DChange to two large general purpose On-Demand Instances.
  Show answer
• #110

  A company wants to prohibit its developers from using a particular family of Amazon EC2 instances. The company uses AWS Organizations and wants to apply the restriction across multiple accounts. What is the MOST operationally efficient way for the company to apply Service Control Policies (SCPs) to meet these requirements?

  • AAdd the accounts to an organizational unit (OU). Apply the SCPs to the OU.
  • BAdd the accounts to resource groups in AWS Resource Groups. Apply the SCPs to the resource groups.
  • CApply the SCPs to each developer account.
  • DEnroll the accounts with AWS Control Tower. Apply the SCPs to the AWS Control Tower management account.
  Show answer
• #111

  A CloudOps Engineer has used AWS CloudFormation to deploy a serverless application into a production VPC. The application consists of an AWS Lambda function, an Amazon DynamoDB table, and an Amazon API Gateway API. The CloudOps Engineer must delete the AWS CloudFormation stack without deleting the DynamoDB table. Which action should the CloudOps Engineer take before deleting the AWS CloudFormation stack?

  • AAdd a Retain deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
  • BAdd a Snapshot deletion policy to the DynamoDB resource in the AWS CloudFormation stack.
  • CEnable termination protection on the AWS CloudFormation stack.
  • DUpdate the application's IAM policy with a Deny statement for the dynamodb:DeleteTable action.
  Show answer
• #112

  A user has created a VPC with public and private subnets using the VPC wizard. Which of the below mentioned statements is not true in this scenario?

  • AThe VPC will create a routing instance and attach it with a public subnet.
  • BThe VPC will create two subnets.
  • CThe VPC will create one internet gateway and attach it to VPC.
  • DThe VPC will launch one NAT instance with an elastic IP.
  Show answer
• #113

  A company needs to ensure strict adherence to a budget for 25 applications deployed on AWS. Separate teams are responsible for storage, compute, and database costs. A CloudOps Engineer must implement an automated solution to alert each team when their projected spend will exceed a quarterly amount that has been set by the finance department. The solution cannot incur additional compute, storage, or database costs. Which solution will meet these requirements?

  • AConfigure AWS Cost and Usage Reports to send a daily report to an Amazon S3 bucket. Create an AWS Lambda function that will evaluate spend by service and notify each team by using Amazon Simple Notification Service (Amazon SNS) notifications. Invoke the Lambda function when a report is placed in the S3 bucket.
  • BConfigure AWS Cost and Usage Reports to send a daily report to an Amazon S3 bucket. Create a rule in Amazon EventBridge (Amazon CloudWatch Events) to evaluate the spend by service and notify each team by using Amazon Simple Queue Service (Amazon SQS) when the cost threshold is exceeded.
  • CUse AWS Budgets to create one cost budget and select each of the services in use. Specify the budget amount defined by the finance department along with the forecasted cost threshold. Enter the appropriate email recipients for the budget.
  • DUse AWS Budgets to create a cost budget for each team, filtering by the services they own. Specify the budget amount defined by the finance department along with a forecasted cost threshold. Enter the appropriate email recipients for each budget.
  Show answer
• #114

  A company is expanding its fleet of Amazon EC2 instances before an expected increase of traffic. When a CloudOps Engineer attempts to add more instances, an InstanceLimitExceeded error is returned. What should the CloudOps Engineer do to resolve this error?

  • AAdd an additional CIDR block to the VPC.
  • BLaunch the EC2 instances in a different Availability Zone.
  • CLaunch new EC2 instances in another VPC.
  • DUse Service Quotas to request an EC2 quota increase.
  Show answer
• #115

  A company runs thousands of Amazon EC2 instances that are based on the Amazon Linux 2 Amazon Machine Image (AMI). A CloudOps Engineer must implement a solution to record commands and output from any user that needs an interactive session on one of the EC2 instances. The solution must log the data to a durable storage location. The solution also must provide automated notifications and alarms that are based on the log data. Which solution will meet these requirements with the MOST operational efficiency?

  • AConfigure command session logging on each EC2 instance. Configure the unified Amazon CloudWatch agent to send session logs to Amazon CloudWatch Logs. Set up query filters and alerts by using Amazon Athena.
  • BRequire all users to use a central bastion host when they need command line access to an EC2 instance. Configure the unified Amazon CloudWatch agent on the bastion host to send session logs to Amazon CloudWatch Logs. Set up a metric filter and a metric alarm for relevant security findings in CloudWatch Logs.
  • CRequire all users to use AWS Systems Manager Session Manager when they need command line access to an EC2 instance. Configure Session Manager to stream session logs to Amazon CloudWatch Logs. Set up a metric filter and a metric alarm for relevant security findings in CloudWatch Logs.
  • DConfigure command session logging on each EC2 instance. Require all users to use AWS Systems Manager Run Command documents when they need command line access to an EC2 instance. Configure the unified Amazon CloudWatch agent to send session logs to Amazon CloudWatch Logs. Set up CloudWatch alarms that are based on Amazon Athena query results.
  Show answer
• #116

  A company has an application that runs behind an Application Load Balancer (ALB) in the us-west-2 Region. An Amazon Route 53 record set contains an alias record for app.anycompany.com that references the ALB in us-west-2 and uses a simple routing policy. The application is experiencing an increase in users from other locations in the world. These users are experiencing high latency. Most of the new users are close to the ap-southeast-2 Region. The company deploys a copy of the application to ap-southeast-2. A CloudOps Engineer must implement a solution that automatically routes requests to the lowest latency endpoint for users without changing the URL. Which solution will meet these requirements?

  • AAdd a new value to the existing alias record for app.anycompany.com with the DNS name of the new ALB in ap-southeast-2.
  • BChange the existing alias record to use a geolocation routing policy. Create two geolocation records, one record that references each ALSelect the location that is closest to each Region.
  • CChange the existing alias record to use a latency routing policy. Create two latency records, one record that references each ALB.
  • DChange the existing alias record to use a multivalue routing policy Add the DNS name of each ALB to the record.
  Show answer
• #117

  A CloudOps Engineer is deploying an application on 10 Amazon EC2 instances. The application must be highly available. The instances must be placed on distinct underlying hardware. What should the CloudOps Engineer do to meet these requirements?

  • ALaunch the instances into a cluster placement group in a single AWS Region.
  • BLaunch the instances into a partition placement group in multiple AWS Regions.
  • CLaunch the instances into a spread placement group in multiple AWS Regions.
  • DLaunch the instances into a spread placement group in single AWS Region.
  Show answer
• #118

  A gaming application is deployed on four Amazon EC2 instances in a default VPC. The CloudOps Engineer has noticed consistently high latency in responses as data is transferred among the four instances. There is no way for the Engineer to alter the application code. The MOST effective way to reduce latency is to relaunch the EC2 instances in:

  • ADedicated VPC.
  • BSingle subnet inside the VPC.
  • CPlacement group.
  • DSingle Availability Zone.
  Show answer
• #119

  A company's application infrastructure was deployed using AWS CloudFormation and is composed of Amazon EC2 instances behind an Application Load Balancer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones. When releasing a new version of the application, the update deployment must avoid DNS changes and allow rollback. Which solution should a CloudOps Engineer use to meet the deployment requirements for this new release?

  • AConfigure the Auto Scaling group to use lifecycle hooks. Deploy new instances with the new application version. Complete the lifecycle hook action once healthy.
  • BCreate a new Amazon Machine Image (AMI) containing the updated code. Create a launch configuration with the AMI. Update the Auto Scaling group to use the new launch configuration.
  • CDeploy a second CloudFormation stack. Wait for the application to be available. Cut over to the new Application Load Balancer.
  • DModify the CloudFormation template to use an AutoScalingReplacingUpdate policy. Update the stack. Perform a second update with the new release.
  Show answer
• #120

  A company has an application that uses an Amazon Elastic File System (Amazon EFS) file system. A recent incident that involved an application logic error corrupted several files. The company wants to improve its ability to back up and recover the EFS file system. The company must be able to recover individual files rapidly. Which solution meets these requirements MOST cost-effectively?

  • AConfigure Amazon Data Lifecycle Manager (Amazon DLM) to archive a copy of the data to an Amazon S3 Glacier vault. Use S3 Glacier retrieval requests to retrieve individual files.
  • BCreate a second EFS file system in another AWS Region. Configure AWS DataSync to copy the data to the backup file system. Recover files by copying them from the backup EFS file system.
  • CEnable AWS Backup in Amazon EFS to back up the file system to an Amazon S3 Glacier vault. Use S3 Glacier retrieval requests to retrieve individual files.
  • DEnable AWS Backup in Amazon EFS to back up the file system to a backup vault. Use a partial restore job to retrieve individual files.
  Show answer

Want to track your score, take timed mock exams and get AI explanations? Create a free account