AWS Certified CloudOps Engineer - Associate

• #381

  A company has a public web application that experiences rapid traffic increases after advertisements appear on local television. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The Auto Scaling group is not keeping up with the traffic surges after an advertisement runs. The company often needs to scale out to 100 EC2 instances during the traffic surges. The instance startup times are lengthy because of a boot process that creates machine-specific data caches that are unique to each instance. The exact timing of when the advertisements will appear on television is not known. A CloudOps Engineer must implement a solution so that the application can function properly during the traffic surges. Which solution will meet these requirements?

  • ACreate a warm pool. Keep enough instances in the Stopped state to meet the increased demand.
  • BStart 100 instances. Allow the boot process to finish running. Store this data on the instance store volume before stopping the instances.
  • CIncrease the value of the instance warmup time in the scaling policy
  • DUse predictive scaling for the Auto Scaling group.
  उत्तर दिखाएँ
  💬चर्चा
• #382

  A company has an Amazon S3 bucket that contains sensitive data. The data must be encrypted in transit and at rest. The company encrypts the data in the S3 bucket by using an AWS Key Management Service (AWS KMS) key. A developer needs to grant several other AWS accounts the permission to use the S3 GetObject operation to retrieve the data from the S3 bucket. How can the developer enforce that all requests to retrieve the data provide encryption in transit?

  • ADefine a resource-based policy on the S3 bucket to deny access when a request meets the condition aws:SecureTransport: false.
  • BDefine a resource-based policy on the S3 bucket to allow access when a request meets the condition aws:SecureTransport: false.
  • CDefine a role-based policy on the other accounts' roles to deny access when a request meets the condition of aws:SecureTransport: false.
  • DDefine a resource-based policy on the KMS key to deny access when a request meets the condition of aws:SecureTransport: false.
  उत्तर दिखाएँ
  💬चर्चा
• #383

  A company has an application that is running on an EC2 instance in one Availability Zone. A CloudOps Engineer has been tasked with making the application highly available. The Engineer created a launch configuration from the running EC2 instance. The Engineer also properly configured a load balancer. What step should the Engineer complete next to make the application highly available?

  • ACreate an Auto Scaling group by using the launch configuration across at least 2 Availability Zones with a minimum size of 1, desired capacity of 1, and a maximum size of 1.
  • BCreate an Auto Scaling group by using the launch configuration across at least 3 Availability Zones with a minimum size of 2, desired capacity of 2, and a maximum size of 2.
  • CCreate an Auto Scaling group by using the launch configuration across at least 2 regions with a minimum size of 1, desired capacity of 1, and a maximum size of 1.
  • DCreate an Auto Scaling group by using the launch configuration across at least 3 regions with a minimum size of 2, desired capacity of 2, and a maximum size of 2.
  उत्तर दिखाएँ
  💬चर्चा
• #3842 चुनें

  A new application runs on Amazon EC2 instances and accesses data in an Amazon RDS database instance. When fully deployed in production, the application fails. The database can be queried from a console on a bastion host. When looking at the web server logs, the following error is repeated multiple times: Error Establishing a Database Connection. Which of the following may be causes of the connectivity problems? (Choose two.)

  • AThe security group for the database does not have the appropriate egress rule from the database to the web server.
  • BThe certificate used by the web server is not trusted by the RDS instance.
  • CThe security group for the database does not have the appropriate ingress rule from the web server to the database.
  • DThe port used by the application developer does not match the port specified in the RDS configuration.
  • EThe database is still being created and is not available for connectivity.
  उत्तर दिखाएँ
  💬चर्चा
• #3853 चुनें

  A company needs to monitor the disk utilization of Amazon Elastic Block Store (Amazon EBS) volumes. The EBS volumes are attached to Amazon EC2 Linux instances. A CloudOps Engineer must set up an Amazon CloudWatch alarm that provides an alert when disk utilization increases to more than 80%. Which combination of steps must the CloudOps Engineer take to meet these requirements? (Choose three.)

  • ACreate an IAM role that includes the CloudWatchAgentServerPolicy AWS managed policy. Attach the role to the instances.
  • BCreate an IAM role that includes the CloudWatchApplicationInsightsReadOnlyAccess AWS managed policy. Attach the role to the instances.
  • CInstall and start the CloudWatch agent by using AWS Systems Manager or the command line.
  • DInstall and start the CloudWatch agent by using an IAM role. Attach the CloudWatchAgentServerPolicy AWS managed policy to the role.
  • EConfigure a CloudWatch alarm to enter ALARM state when the disk_used_percent CloudWatch metric is greater than 80%.
  • FConfigure a CloudWatch alarm to enter ALARM state when the disk_used CloudWatch metric is greater than 80% or when the disk_free CloudWatch metric is less than 20%.
  उत्तर दिखाएँ
  💬चर्चा
• #386

  A company has deployed AWS Security Hub and AWS Config in a newly implemented organization in AWS Organizations. A CloudOps Engineer must implement a solution to restrict all member accounts in the organization from deploying Amazon EC2 resources in the ap-southeast-2 Region. The solution must be implemented from a single point and must govern an current and future accounts. The use of root credentials also must be restricted in member accounts. Which AWS feature should the CloudOps Engineer use to meet these requirements?

  • AAWS Config aggregator.
  • BIAM user permissions boundaries.
  • CAWS Organizations Service Control Policies (SCPs).
  • DAWS Security Hub conformance packs.
  उत्तर दिखाएँ
  💬चर्चा
• #387

  A company wants to use only IPv6 for all its Amazon EC2 instances. The EC2 instances must not be accessible from the internet, but the EC2 instances must be able to access the internet. The company creates a dual-stack VPC and IPv6-only subnets. How should a CloudOps Engineer configure the VPC to meet these requirements?

  • ACreate and attach a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.
  • BCreate and attach an internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway. Attach the custom route table to the IPv6-only subnets.
  • CCreate and attach an egress-only internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the egress-only internet gateway. Attach the custom route table to the IPv6-only subnets.
  • DCreate and attach an internet gateway and a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway and all IPv4 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.
  उत्तर दिखाएँ
  💬चर्चा
• #3882 चुनें

  An Amazon S3 Inventory report reveals that more than 1 million objects in a S3 bucket are not encrypted These objects must be encrypted, and all future objects must be encrypted at the time they are written. Which combination of actions should a CloudOps Engineer take to meet these requirements? (Select TWO)

  • ACreate an AWS Config rule that runs evaluations against configuration changes to the S3 bucket. When an unencrypted object is found run an AWS Systems Manager Automation document to encrypt the object in place.
  • BEdit the properties of the S3 bucket to enable default server-side encryption.
  • CFilter the S3 Inventory report by using S3 Select to find all objects that are not encrypted. Create a S3 Batch Operations job to copy each object in place with en cryption enabled.
  • DFilter the S3 Inventory report by using S3 Select to find all objects that are not encrypted. Send each object name as a message to an Amazon Simple Queue Service (Amazon SQS) queue. Use the SQS queue to invoke an AWS Lambda function to tag each object with a key of Encryption and a value of SSE-KMS
  • EUse S3 Event Notifications to invoke an AWS Lambda function on all new object-created events for the S3 bucket. Configure the Lambda function to check whether the object is encrypted and to run an AWS Systems Manager Automation document to encrypt the object in place when an unencrypted object is found.
  उत्तर दिखाएँ
  💬चर्चा
• #389

  A company has a business application hosted on Amazon EC2 instances behind an Application Load Balancer. Amazon CloudWatch metrics show that the CPU utilization on the EC2 instances is very high. There are also reports from users that receive HTTP 503 and 504 errors when they try to connect to the application. Which action will resolve these issues?

  • APlace the EC2 instances into an AWS Auto Scaling group.
  • BConfigure the ALB's Target Group to use more frequent health checks.
  • CEnable sticky sessions on the Application Load Balancer.
  • DIncrease the idle timeout setting of the Application Load Balancer.
  उत्तर दिखाएँ
  💬चर्चा
• #390

  A company stores files on 50 Amazon S3 buckets in the same AWS Region The company wants to connect to the S3 buckets securely over a private connection from its Amazon EC2 instances. The company needs a solution that produces no additional cost. Which solution will meet these requirements?

  • ACreate a gateway VPC endpoint for each S3 bucket. Attach the gateway VPC endpoints to each subnet inside the VPC.
  • BCreate an interface VPC endpoint for each S3 bucket. Attach the interface VPC endpoints to each subnet inside the VPC.
  • CCreate one gateway VPC endpoint for all the S3 buckets. Add the gateway VPC endpoint to the VPC route table.
  • DCreate one interface VPC endpoint for all the S3 buckets. Add the interface VPC endpoint to the VPC route table.
  उत्तर दिखाएँ
  💬चर्चा
• #3912 चुनें

  A CloudOps Engineer must configure Amazon S3 to host a simple nonproduction webpage. The CloudOps Engineer has created an empty S3 bucket from the AWS Management Console. The S3 bucket has the default configuration in place. Which combination of actions should the CloudOps Engineer take to complete this process? (Choose two.)

  • AConfigure the S3 bucket by using the Redirect requests for an object functionality to point to the bucket root URL.
  • BTurn off the Block all public access setting. Allow public access by using a bucket ACL that contains WEBSITE.
  • CTurn off the Block all public access setting. Allow public access by using a bucket ACL that allows access to the AuthenticatedUsers grantee.
  • DTurn off the Block all public access setting. Set a bucket policy that allows Principal: the s3:GetObject action.
  • ECreate an index.html document. Configure static website hosting, and upload the index document to the S3 bucket.
  उत्तर दिखाएँ
  💬चर्चा
• #392

  A company needs to enforce tagging requirements for Amazon DynamoDB tables in its AWS accounts. A CloudOps Engineer must implement a solution to identify and remediate all DynamoDB tables that do not have the appropriate tags. Which solution will meet these requirements with the LEAST operational overhead?

  • ACreate a custom AWS Lambda function to evaluate and remediate all DynamoDB tables. Create an Amazon EventBridge scheduled rule to invoke the Lambda function.
  • BCreate a custom AWS Lambda function to evaluate and remediate ail DynamoDB tables. Create an AWS Config custom rule to invoke the Lambda function.
  • CUse the required-tags AWS Config managed rule to evaluate all DynamoDB tables for the appropriate tags. Configure an automatic remediation action that uses an AWS Systems Manager Automation custom runbook.
  • DCreate an Amazon EventBridge managed rule to evaluate all DynamoDB tables for the appropriate tags. Configure the EventBridge rule to run an AWS Systems Manager Automation custom runbook for remediation.
  उत्तर दिखाएँ
  💬चर्चा
• #3932 चुनें

  A company has developed a service that is deployed on a fleet of Linux-based Amazon EC2 instances that are in an Auto Scaling group. The service occasionally fails unexpectedly because of an error in the application code. The company's engineering team determines that resolving the underlying cause of the service failure could take several weeks. A CloudOps Engineer needs to create a solution to automate recovery if the service crashes on any of the EC2 instances. Which solutions will meet this requirement? (Choose two.)

  • AInstall the Amazon CloudWatch agent on the EC2 instances. Configure the CloudWatch agent to monitor the service. Set the CloudWatch action to restart if the service health check fails.
  • BTag the EC2 instances. Create an AWS Lambda function that uses AWS Systems Manager Session Manager to log in to the tagged EC2 instances and restart the service. Schedule the Lambda function to run every 5 minutes.
  • CTag the EC2 instances. Use AWS Systems Manager State Manager to create an association that uses the AWS-RunShellScript document. Configure the association command with a script that checks if the service is running and that starts the service if the service is not running. For targets, specify the EC2 instance tag. Schedule the association to run every 5 minutes.
  • DUpdate the EC2 user data that is specified in the Auto Scaling group's launch template to include a script that runs on a cron schedule every 5 minutes. Configure the script to check if the service is running and to start the service if the service is not running. Redeploy all the EC2 instances in the Auto Scaling group with the updated launch template.
  • EUpdate the EC2 user data that is specified in the Auto Scaling group's launch template to ensure that the service runs during startup. Redeploy all the EC2 instances in the Auto Scaling group with the updated launch template.
  उत्तर दिखाएँ
  💬चर्चा
• #3942 चुनें

  A company is using Amazon Elastic Container Service (Amazon ECS) to run a containerized application on Amazon EC2 instances. A CloudOps Engineer needs to monitor only traffic flows between the ECS tasks. Which combination of steps should the CloudOps Engineer take to meet this requirement? (Select TWO.)

  • AConfigure Amazon CloudWatch Logs on the elastic network interface of each task.
  • BConfigure VPC Flow Logs on the elastic network interface of each task.
  • CSpecify the awsvpc network mode in the task definition.
  • DSpecify the bridge network mode in the task definition.
  • ESpecify the host network mode in the task definition.
  उत्तर दिखाएँ
  💬चर्चा
• #395

  A CloudOps Engineer needs to collect the content of log files from a custom application that is deployed across hundreds of Amazon EC2 instances running Ubuntu. The log files need to be stored in Amazon CloudWatch Logs. How should the CloudOps Engineer collect the application log files with the LOWEST operational overhead?

  • AConfigure the syslogd service on each EC2 instance to collect and send the application log files to CloudWatch Logs.
  • BInstall the CloudWatch agent by using the Amazon Linux package manager on each EC2 instance. Configure each agent to collect the application log files.
  • CInstall the CloudWatch agent on each EC2 instance by using AWS Systems Manager. Create an agent configuration on each instance by using the CloudWatch configuration wizard. Configure each agent to collect the application log files.
  • DStore a CloudWatch agent configuration in the AWS Systems Manager Parameter Store. Install the CloudWatch agent on each EC2 instance by using Systems Manager. Configure each agent to collect the application log files.
  उत्तर दिखाएँ
  💬चर्चा

अपना स्कोर ट्रैक करना, समयबद्ध मॉक परीक्षा देना और AI व्याख्या पाना चाहते हैं? निःशुल्क खाता बनाएँ