AWS Certified CloudOps Engineer - Associate

• #321

  A company's public website is hosted in an Amazon S3 bucket in the us-east-1 Region behind an Amazon CloudFront distribution. The company wants to ensure that the website is protected from DDoS attacks. A CloudOps Engineer needs to deploy a solution that gives the company the ability to maintain control over the rate limit at which DDoS protections are applied. Which solution will meet these requirements?

  • ADeploy a global-scoped AWS WAF web ACL with an allow default action. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the CloudFront distribution.
  • BDeploy an AWS WAF web ACL with an allow default action in us-east-1. Configure an AWS WAF rate-based rule to block matching traffic. Associate the web ACL with the S3 bucket.
  • CDeploy a global-scoped AWS WAF web ACL with a block default action. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the CloudFront distribution.
  • DDeploy an AWS WAF web ACL with a block default action in us-east-1. Configure an AWS WAF rate-based rule to allow matching traffic. Associate the web ACL with the S3 bucket.
  उत्तर दिखाएँ
• #322

  A company wants to track its AWS costs in all member accounts that are part of an organization in AWS Organizations. Managers of the member accounts want to receive a notification when the estimated costs exceed a predetermined amount each month. The managers are unable to configure a billing alarm. The IAM permissions for all users are correct. What could be the cause of this issue?

  • AThe management/payer account does not have billing alerts turned on.
  • BThe company has not configured AWS Resource Access Manager (AWS RAM) to share billing information between the member accounts and the management/payer account.
  • CAmazon GuardDuty is turned on for all the accounts.
  • DThe company has not configured an AWS Config rule to monitor billing.
  उत्तर दिखाएँ
• #323

  A CloudOps Engineer is creating a simple, public-facing website running on Amazon EC2. The CloudOps Engineer created the EC2 instance in an existing public subnet and assigned an Elastic IP address to the instance. Next, the CloudOps Engineer created and applied a new security group to the instance to allow incoming HTTP traffic from 0.0.0.0/0. Finally, the CloudOps Engineer created a new network ACL and applied it to the subnet to allow incoming HTTP traffic from 0.0.0.0/0. However, the website cannot be reached from the internet. What is the cause of this issue?

  • AThe CloudOps Engineer did not create an outbound rule that allows ephemeral port return traffic in the new network ACL.
  • BThe CloudOps Engineer did not create an outbound rule in the security group that allows HTTP traffic from port 80.
  • CThe Elastic IP address assigned to the EC2 instance has changed.
  • DThere is an additional network ACL associated with the subnet that includes a rule that denies inbound HTTP traffic from port 80.
  उत्तर दिखाएँ
• #324

  A company's CloudOps Engineer manages a fleet of hundreds of Amazon EC2 instances that run Windows-based workloads and Linux-based workloads. Each EC2 instance has a tag that identifies its operating system. All the EC2 instances run AWS Systems Manager Session Manager. A zero-day vulnerability is reported, and no patches are available. The company's security team provides code for all the relevant operating systems to reduce the risk of the vulnerability. The CloudOps Engineer needs to implement the code on the EC2 instances and must provide a report that shows that the code has successfully run on all the instances. What should the CloudOps Engineer do to meet these requirements as quickly as possible?

  • AUse Systems Manager Run Command. Choose either the AWS-RunShellScript document or the AWS-RunPowerShellScript document. Configure Run Command with the code from the security team. Specify the operating system tag in the Targets parameter. Run the command. Provide the command history's evidence to the security team.
  • BCreate an AWS Lambda function that connects to the EC2 instances through Session Manager. Configure the Lambda function to identify the operating system, run the code from the security team, and return the results to an Amazon RDS DB instance. Query the DB instance for the results. Provide the results as evidence to the security team.
  • CLog on to each EC2 instance. Run the code from the security team on each EC2 instance. Copy and paste the results of each run into a single spreadsheet. Provide the spreadsheet as evidence to the security team.
  • DUpdate the launch templates of the EC2 instances to include the code from the security team in the user data. Relaunch the EC2 instances by using the updated launch templates. Retrieve the EC2 instance logs of each instance. Provide the EC2 instance logs as evidence to the security team.
  उत्तर दिखाएँ
• #325

  A company's security policy states that connecting to Amazon EC2 instances is not permitted through SSH and RDP. If access is required, authorized staff can connect to instances by using AWS Systems Manager Session Manager. Users report that they are unable to connect to one specific Amazon EC2 instance that is running Ubuntu and has AWS Systems Manager Agent (SSM Agent) pre-installed. These users are able to use Session Manager to connect to other instances in the same subnet, and they are in an IAM group that has Session Manager permission for all instances. What should a CloudOps Engineer do to resolve this issue?

  • AAdd an inbound rule for port 22 in the security group associated with the Ubuntu instance.
  • BAssign the AmazonSSMManagedInstanceCore managed policy to the EC2 instance profile for the Ubuntu instance.
  • CConfigure the SSM Agent to log in with a user name of ubuntu.
  • DGenerate a new key pair, configure Session Manager to use this new key pair, and provide the private key to the users.
  उत्तर दिखाएँ
• #326

  A company has two AWS accounts: development and production. All applications send logs to a specific Amazon S3 bucket for each account, and the Developers are requesting access to the production account S3 buckets to view the logs. Which is the MOST efficient way to provide the Developers with access?

  • ACreate an AWS Lambda function with an IAM role attached to it that has access to both accounts' S3 buckets. Pull the logs from the production S3 bucket to the development S3 bucket.
  • BCreate IAM users for each Developer on the production account, and add the Developers to an IAM group that provides read-only access to the S3 log bucket.
  • CCreate an Amazon EC2 bastion host with an IAM role attached to it that has access to the production S3 log bucket, and then provision access for the Developers on the host.
  • DCreate a resource-based policy for the S3 bucket on the production account that grants access to the development account, and then delegate access in the development account.
  उत्तर दिखाएँ
• #327

  A company hosts its website on Amazon EC2 instances in the us-east-1 Region. The company is preparing to extend its website into the eu-central-1 Region, but the database must remain only in us-east-1. After deployment, the EC2 instances in eu-central-1 are unable to connect to the database in us-east-1. What is the MOST operationally efficient solution that will resolve this connectivity issue?

  • ACreate a VPC peering connection between the two Regions. Add the private IP address range of the instances to the inbound rule of the database security group.
  • BCreate a VPC peering connection between the two Regions. Add the security group of the instances in eu-central-1 to the outbound rule of the database security group.
  • CCreate a VPN connection between the two Regions. Add the private IP address range of the instances to the outbound rule of the database security group.
  • DCreate a VPN connection between the two Regions. Add the security group of the instances in eu-central-1 to the inbound rule of the database security group.
  उत्तर दिखाएँ
• #328

  A company is running a website on Amazon EC2 instances that are in an Auto Scaling group. When the website traffic increases, additional instances take several minutes to become available because of a long-running user data script that installs software. A CloudOps Engineer must decrease the time that is required for new instances to become available. Which action should the CloudOps Engineer take to meet this requirement?

  • AReduce the scaling thresholds so that instances are added before traffic increases.
  • BPurchase Reserved Instances to cover 100%of the maximum capacity of the Auto Scaling group.
  • CUpdate the Auto Scaling group to launch instances that have a storage optimized instance type.
  • DUse EC2 Image Builder to prepare an Amazon Machine Image (AMI) that has pre-installed software.
  उत्तर दिखाएँ
• #329

  A company is managing multiple AWS accounts in AWS Organizations. The company is reviewing internal security of its AWS environment. The company's security engineer has their own AWS account and wants to review the VPC configuration of developer AWS accounts. Which solution will meet these requirements in the MOST secure manner?

  • ACreate an IAM policy in each developer account that has read-only access related to VPC resources Assign the policy to an IAM user. Share the user credentials with the security engineer.
  • BCreate an IAM policy in each developer account that has administrator access to all Amazon EC2 actions, including VPC actions. Assign the policy to an IAM user. Share the user credentials with the security engineer.
  • CCreate an IAM policy in each developer account that has administrator access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security engineer to assume the role from their account.
  • DCreate an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security engineer to assume the role from their account.
  उत्तर दिखाएँ
• #330

  A company's CloudOps Engineer is troubleshooting communication between the components of an application. The company configured VPC flow logs to be published to Amazon CloudWatch Logs. However, there are no logs in CloudWatch Logs. What could be blocking the VPC flow logs from being published to CloudWatch Logs?

  • AThe IAM policy that is attached to the IAM role for the flow log is missing the logs CreateLogGroup permission.
  • BThe IAM policy that is attached to the IAM role for the flow log is missing the logs CreateExportTask permission.
  • CThe VPC is configured for IPv6 addresses.
  • DThe VPC is peered with another VPC in the AWS account.
  उत्तर दिखाएँ
• #331

  A company has scientists who upload large data objects to an Amazon S3 bucket. The scientists upload the objects as multipart uploads. The multipart uploads often fail because of poor end-client connectivity. The company wants to optimize storage costs that are associated with the data. A CloudOps Engineer must implement a solution that presents metrics for incomplete uploads. The solution also must automatically delete any incomplete uploads after 7 days. Which solution will meet these requirements?

  • AReview the Incomplete Multipart Upload Bytes metric in the S3 Storage Lens dashboard. Create a S3 Lifecycle policy to automatically delete any incomplete multipart uploads after 7 days.
  • BImplement S3 Intelligent-Tiering to move data into lower-cost storage classes after 7 days. Create a S3 Storage Lens policy to automatically delete any incomplete multipart uploads after 7 days.
  • CAccess the S3 console. Review the Metrics tab to check the storage that incomplete multipart uploads are consuming. Create an AWS Lambda function to delete any incomplete multipart uploads after 7 days.
  • DUse the S3 analytics storage class analysis tool to identify and measure incomplete multipart uploads. Configure a S3 bucket policy to enforce restrictions on multipart uploads to delete incomplete multipart uploads after 7 days.
  उत्तर दिखाएँ
• #332

  A company is storing media content in an Amazon S3 bucket and uses Amazon CloudFront to distribute the content to its users. Due to licensing terms, the company is not authorized to distribute the content in some countries. A CloudOps Engineer must restrict access to certain countries. What is the MOST operationally efficient solution that meets these requirements?

  • AConfigure the S3 bucket policy to deny the GetObject operation based on the s3:LocationConstraint condition.
  • BCreate a secondary Origin Access Identity (OAI). Configure the S3 bucket policy to prevent access from unauthorized countries.
  • CEnable the geo restriction feature in the CloudFront distribution to prevent access from unauthorized countries.
  • DUpdate the application to generate signed CloudFront URLs only for IP addresses in authorized counties.
  उत्तर दिखाएँ
• #333

  A company stores sensitive data in an Amazon S3 bucket. The company must log all access attempts to the S3 bucket. The company's risk team must receive immediate notification about any delete events. Which solution will meet these requirements?

  • AEnable S3 server access logging for audit logs. Set up an Amazon Simple Notification Service (Amazon SNS) notification for the S3 bucket. Select DeleteObject for the event type for the alert system.
  • BEnable S3 server access logging for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance to download the access logs each day and to scan for a DeleteObject event.
  • CUse Amazon CloudWatch Logs for audit logs. Use Amazon CloudWatch alarms with an Amazon Simple Notification Service (Amazon SNS) notification for the alert system.
  • DUse Amazon CloudWatch Logs for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance each day to compare the list of the items with the list from the previous day. Configure the cron job to send a notification if an item is missing.
  उत्तर दिखाएँ
• #334

  A company is using Amazon Elastic File System (Amazon EFS) to share a file system among several Amazon EC2 instances. As usage increases, users report that file retrieval from the EFS file system is slower than normal. Which action should a CloudOps Engineer take to improve the performance of the file system?

  • AConfigure the file system for Provisioned Throughput.
  • BEnable encryption in transit on the file system.
  • CIdentify any unused files in the file system, and remove the unused files.
  • DResize the Amazon Elastic Block Store (Amazon EBS) volume of each of the EC2 instances.
  उत्तर दिखाएँ
• #335

  A company needs to upload gigabytes of files every day. The company need to achieve higher throughput and upload speeds to Amazon S3. Which action should a CloudOps Engineer take to meet this requirement?

  • ACreate an Amazon CloudFront distribution with the GET HTTP method allowed and the S3 bucket as an origin.
  • BCreate an Amazon ElastiCache cluster and enable caching for the S3 bucket.
  • CSet up AWS Global Accelerator and configure it with the S3 bucket.
  • DEnable S3 Transfer Acceleration and use the acceleration endpoint when uploading files.
  उत्तर दिखाएँ
• #336

  A company hosts an application on Amazon EC2 instances. The instances are in an Amazon EC2 Auto Scaling group that uses a launch template. The amount of application traffic changes throughout the day. Scaling events happen frequently. A CloudOps Engineer needs to help developers troubleshoot the application. When a scaling event removes an instance, EC2 Auto Scaling terminates the instance before the developers can log in to the instance to diagnose issues. Which solution will prevent termination of the instance so that the developers can log in to the instance?

  • AEnsure that the Delete on termination setting is turned off in the UserData section of the launch template.
  • BUpdate the Auto Scaling group by enabling instance scale-in protection for newly launched instances.
  • CUse Amazon Inspector to configure a rules package to protect the instances from termination.
  • DUse Amazon GuardDuty to configure rules to protect the instances from termination.
  उत्तर दिखाएँ
• #337

  A company has an AWS Site-to-Site VPN connection between on-premises resources and resources that are hosted in a VPC. A CloudOps Engineer launches an Amazon EC2 instance that has only a private IP address into a private subnet in the VPC. The EC2 instance runs Microsoft Windows Server. A security group for the EC2 instance has rules that allow inbound traffic from the on-premises network over the VPN connection. The on-premises environment contains a third-party network firewall. Rules in the third-party network firewall allow Remote Desktop Protocol (RDP) traffic to flow between the on-premises users over the VPN connection. The on-premises users are unable to connect to the EC2 instance and receive a timeout error. What should the CloudOps Engineer do to troubleshoot this issue?

  • ACreate Amazon CloudWatch logs for the EC2 instance to check for blocked traffic.
  • BCreate Amazon CloudWatch logs for the Site-to-Site VPN connection to check for blocked traffic.
  • CCreate VPC flow logs for the EC2 instance's elastic network interface to check for rejected traffic.
  • DInstruct users to use EC2 Instance Connect as a connection method.
  उत्तर दिखाएँ
• #338

  A user has created a VPC with CIDR 20.0.0.0/16 using the wizard. The user has created public and VPN only subnets along with hardware VPN access to connect to the user's data center. The user has not yet launched any instance as well as modified or deleted any setup. He wants to delete this VPC from the console. Will the console allow the user to delete the VPC?

  • AYes, the console will delete all the setups and also delete the virtual private gateway.
  • BNo, the console will ask the user to manually detach the virtual private gateway first and then allow deleting the VPC.
  • CYes, the console will delete all the setups and detach the virtual private gateway.
  • DNo, since the NAT instance is running.
  उत्तर दिखाएँ
• #339

  An application running on Amazon EC2 allows users to launch batch jobs for data analysis. The jobs are run asynchronously, and the user is notified when they are complete. While multiple jobs can run concurrently, a user's request need not be fulfilled for up to 24 hours. To run a job, the application launches an additional EC2 instance that performs all the analytics calculations. A job takes between 75 and 110 minutes to complete and cannot be interrupted. What is the MOST cost-effective way to run this workload?

  • ARun the application on On-Demand EC2 instances. Run the jobs on Spot Instances with a specified duration.
  • BRun the application on Reserved Instance EC2 instances. Run the jobs on AWS Lambda.
  • CRun the application on On-Demand EC2 instances. Run the jobs on On-Demand EC2 instances.
  • DRun the application on Reserved Instance EC2 instances. Run the jobs on Spot Instances with a specified duration.
  उत्तर दिखाएँ
• #340

  A company stores its internal data within an Amazon S3 bucket. All existing data within the S3 bucket is protected by using server-side encryption with Amazon S3 managed encryption keys (SSE-S3). S3 Versioning is enabled. A CloudOps Engineer must replicate the internal data to another S3 bucket in a different AWS account for disaster recovery. All the existing data is copied from the source S3 bucket to the destination S3 bucket. Which replication solution is MOST operationally efficient?

  • AAdd a replication rule to the source bucket and specify the destination bucket. Create a bucket policy for the destination bucket to allow the owner of the source bucket to replicate objects.
  • BSchedule an AWS Batch job with Amazon EventBridge to copy new objects from the source bucket to the destination bucket. Create a Batch Operations IAM role in the destination account.
  • CConfigure an Amazon S3 event notification for the source bucket to invoke an AWS Lambda function to copy new objects to the destination bucket. Ensure that the Lambda function has cross-account access permissions.
  • DRun a scheduled script on an Amazon EC2 instance to copy new objects from the source bucket to the destination bucket. Assign cross-account access permissions to the EC2 instance's role.
  उत्तर दिखाएँ

अपना स्कोर ट्रैक करना, समयबद्ध मॉक परीक्षा देना और AI व्याख्या पाना चाहते हैं? निःशुल्क खाता बनाएँ