AWS Certified CloudOps Engineer - Associate

• #221

  A company has a private Amazon S3 bucket that contains sensitive information. A CloudOps Engineer needs to keep logs of the IP addresses from authentication failures that result from attempts to access objects in the bucket. The logs must be stored so that they cannot be overwritten or deleted for 90 days. Which solution will meet these requirements?

  • ACreate an AWS CloudTrail trail. Configure the log files to be saved to Amazon CloudWatch Logs. Configure the log group with a retention period of 90 days.
  • BCreate an AWS CloudTrail trail. Configure the log files to be saved to a different S3 bucket. Turn on CloudTrail log file integrity validation for 90 days.
  • CTurn on access logging for the S3 bucket. Configure the access logs to be saved to Amazon CloudWatch Logs. Configure the log group with a retention period of 90 days.
  • DTurn on access logging for the S3 bucket. Configure the access logs to be saved in a second S3 bucket. Turn on S3 Object Lock on the second S3 bucket, and configure a default retention period of 90 days.
  Tampilkan jawaban
• #222

  A company recently acquired another corporation and all of that corporation's AWS accounts. A financial analyst needs the cost data from these accounts. A CloudOps Engineer uses Cost Explorer to generate cost and usage reports. The CloudOps Engineer notices that No Tagkey represents 20% of the monthly cost. What should the CloudOps Engineer do to tag the No Tagkey resources?

  • AAdd the accounts to AWS Organizations. Use a Service Control Policy (SCP) to tag all the untagged resources.
  • BUse an AWS Config rule to find the untagged resources. Set the remediation action to terminate the resources.
  • CUse Cost Explorer to find and tag all the untagged resources.
  • DUse Tag Editor to find and tag all the untagged resources.
  Tampilkan jawaban
• #223

  A team of developers is using several Amazon S3 buckets as centralized repositories. Users across the world upload large sets of files to these repositories. The development team's applications later process these files. A CloudOps Engineer sets up a new S3 bucket, DOC-EXAMPLE-BUCKET, to support a new workload. The new S3 bucket also receives regular uploads of large sets of files from users worldwide. When the new S3 bucket is put into production, the upload performance from certain geographic areas is lower than the upload performance that the existing S3 buckets provide. What should the CloudOps Engineer do to remediate this issue?

  • AProvision an Amazon ElastiCache for Redis cluster for the new S3 bucket. Provide the developers with the configuration endpoint of the cluster for use in their API calls
  • BAdd the new S3 bucket to a new Amazon CloudFront distribution. Provide the developers with the domain name of the new distribution for use in their API calls.
  • CEnable S3 Transfer Acceleration for the new S3 bucket. Verify that the developers are using the DOC-EXAMPLE-BUCKET.s3-accelerate.amazonaws.com endpoint name in their API calls.
  • DUse S3 multipart upload for the new S3 bucket. Verify that the developers are using Region-specific S3 endpoint names such as DOC-EXAMPLE-BUCKETS3, [Region] amazonaws.com in their API calls.
  Tampilkan jawaban
• #224

  A recent organizational audit uncovered an existing Amazon RDS database that is not currently configured for high availability. Given the critical nature of this database, it must be configured for high availability as soon as possible. How can this requirement be met?

  • ASwitch to an active/passive database pair using the create-db-instance-read-replica with the –availability-zone flag.
  • BSpecify high availability when creating a new RDS instance, and live-migrate the data.
  • CModify the RDS instance using the console to include the Multi-AZ option.
  • DUse the modify-db-instance command with the –na flag.
  Tampilkan jawaban
• #225

  A company plans to run a public web application on Amazon EC2 instances behind an Elastic Load Balancer (ELB). The company's security team wants to protect the website by using AWS Certificate Manager (ACM) certificates. The ELB must automatically redirect any HTTP requests to HTTPS. Which solution will meet these requirements?

  • ACreate an Application Load Balancer that has one HTTPS listener on port 80. Attach an SSL/TLS certificate to listener port 80. Create a rule to redirect requests from HTTP to HTTPS.
  • BCreate an Application Load Balancer that has one HTTP listener on port 80 and one HTTPS protocol listener on port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
  • CCreate an Application Load Balancer that has two TCP listeners on port 80 and port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
  • DCreate a Network Load Balancer that has two TCP listeners on port 80 and port 443. Attach an SSL/TLS certificate to listener port 443. Create a rule to redirect requests from port 80 to port 443.
  Tampilkan jawaban
• #226

  A company wants to collect data from an application to use for analytics. For the first 90 days, the data will be infrequently accessed but must remain highly available. During this time, the company's analytics team requires access to the data in milliseconds. However, after 90 days, the company must retain the data for the long term at a lower cost. The retrieval time after 90 days must be less than 5 hours. Which solution will meet these requirements MOST cost-effectively?

  • AStore the data in S3 Standard-Infrequent Access (S3 Standard-IA) for the first 90 days. Set up a S3 Lifecycle rule to move the data to S3 Glacier Flexible Retrieval after 90 days.
  • BStore the data in S3 One Zone-Infrequent Access (S3 One Zone-IA) for the first 90 days. Set up a S3 Lifecycle rule to move the data to S3 Glacier Deep Archive after 90 days.
  • CStore the data in S3 Standard for the first 90 days. Set up a S3 Lifecycle rule to move the data to S3 Glacier Flexible Retrieval after 90 days.
  • DStore the data in S3 Standard for the first 90 days. Set up a S3 Lifecycle rule to move the data to S3 Glacier Deep Archive after 90 days.
  Tampilkan jawaban
• #227

  A compliance team requires all administrator passwords for Amazon RDS DB instances to be changed at least annually. Which solution meets this requirement in the MOST operationally efficient manner?

  • AStore the database credentials in AWS Secrets Manager. Configure automatic rotation for the secret every 365 days.
  • BStore the database credentials as a parameter in the RDS parameter group. Create a database trigger to rotate the password every 365 days.
  • CStore the database credentials in a private Amazon S3 bucket. Schedule an AWS Lambda function to generate a new set of credentials every 365 days.
  • DStore the database credentials in AWS Systems Manager Parameter Store as a secure string parameter. Configure automatic rotation for the parameter every 365 days.
  Tampilkan jawaban
• #228

  A company uses an AWS Service Catalog portfolio to create and manage resources. A CloudOps Engineer must create a replica of the company's existing AWS infrastructure in a new AWS account. What is the MOST operationally efficient way to meet this requirement?

  • ACreate an AWS CloudFormation template to use the AWS Service Catalog portfolio in the new AWS account.
  • BIn the new AWS account, manually create an AWS Service Catalog portfolio that duplicates the original portfolio.
  • CRun an AWS Lambda function to create a new AWS Service Catalog portfolio based on the output of the DescribePortfolio API operation.
  • DShare the AWS Service Catalog portfolio with the new AWS account. Import the portfolio into the new AWS account.
  Tampilkan jawaban
• #229Pilih 2

  A company creates a new member account by using AWS Organizations. A CloudOps Engineer needs to add AWS Business Support to the new account. Which combination of steps must the CloudOps Engineer take to meet this requirement? (Choose two.)

  • ASign in to the new account by using IAM credentials. Change the support plan.
  • BSign in to the new account by using root user credentials. Change the support plan.
  • CUse the AWS Support API to change the support plan.
  • DReset the password of the account root user.
  • ECreate an IAM user that has administrator privileges in the new account.
  Tampilkan jawaban
• #230

  A company hosts a static website on Amazon S3. An Amazon CloudFront distribution presents this site to global users. The company uses the Managed-CachingDisabled CloudFront cache policy. The company's developers confirm that they frequently update a file in Amazon S3 with new information. Users report that the website presents correct information when the website first loads the file. However, the users' browsers do not retrieve the updated file after a refresh. What should a CloudOps Engineer recommend to fix this issue?

  • AAdd a Cache-Control header field with max-age=0 to the S3 object.
  • BChange the CloudFront cache policy to Managed-CachingOptimized.
  • CDisable bucket versioning in the S3 bucket configuration.
  • DEnable content compression in the CloudFront configuration.
  Tampilkan jawaban
• #231

  A CloudOps Engineer has been tasked with deploying a company's infrastructure as code. The Engineer wants to write a single template that can be reused for multiple environments in a safe, repeatable manner. What is the recommended way to use AWS CloudFormation to meet this requirement?

  • AUse parameters to provision the resources.
  • BUse nested stacks to provision the resources.
  • CUse Amazon EC2 user data to provision the resources.
  • DUse stack policies to provision the resources.
  Tampilkan jawaban
• #232Pilih 2

  A company has two VPC networks named VPC A and VPC B. The VPC A CIDR block is 10.0.0.0/16 and the VPC B CIDR block is 172.31.0.0/16. The company wants to establish a VPC peering connection named pcx-12345 between both VPC's. Which rules should appear in the route table of VPC A after configuration? (Choose two.)

  • ADestination: 10.0.0.0/16, Target: Local.
  • BDestination: 172.31.0.0/16, Target: Local.
  • CDestination: 10.0.0.0/16, Target: pcx-12345.
  • DDestination: 172.31.0.0/16, Target: pcx-12345.
  • EDestination: 10.0.0.0/16, Target: 172.31.0.0/16.
  Tampilkan jawaban
• #233

  A CloudOps Engineer receives an alert from Amazon GuardDuty about suspicious network activity on an Amazon EC2 instance. The GuardDuty finding lists a new external IP address as a traffic destination. The CloudOps Engineer does not recognize the external IP address. The CloudOps Engineer must block traffic to the external IP address that GuardDuty identified Which solution will meet this requirement?

  • ACreate a new security group to block traffic to the external IP address. Assign the new security group to the EC2 instance.
  • BUse VPC flow logs with Amazon Athena to block traffic to the external IP address.
  • CCreate a network ACL. Add an outbound deny rule for traffic to the external IP address.
  • DCreate a new security group to block traffic to the external IP address. Assign the new security group to the entire VPC.
  Tampilkan jawaban
• #234

  A CloudOps Engineer is building a process for sharing Amazon RDS database snapshots between different accounts associated with different business units within the same company. All data must be encrypted at rest. How should the Engineer implement this process?

  • AWrite a script to download the encrypted snapshot, decrypt it using the AWS KMS encryption key used to encrypt the snapshot, then create a new volume in each account.
  • BUpdate the key policy to grant permission to the AWS KMS encryption key used to encrypt the snapshot with all relevant accounts, then share the snapshot with those accounts.
  • CCreate an Amazon EC2 instance based on the snapshot, then save the instance's Amazon EBS volume as a snapshot and share it with the other accounts. Require each account owner to create a new volume from that snapshot and encrypt it.
  • DCreate a new unencrypted RDS instance from the encrypted snapshot, connect to the instance using SSH/RDP. export the database contents into a file, then share this file with the other accounts.
  Tampilkan jawaban
• #235

  A global company operates out of five AWS Regions. A CloudOps Engineer wants to identify all the company's tagged and untagged Amazon EC2 instances. The company requires the output to display the instance ID and tags. What is the MOST operationally efficient way for the CloudOps Engineer to meet these requirements?

  • ACreate a tag-based resource group in AWS Resource Groups.
  • BUse AWS Trusted Advisor. Export the EC2 On-Demand Instances check results from Trusted Advisor.
  • CUse Cost Explorer. Choose a service type of EC2-Instances, and group by Resource.
  • DUse Tag Editor in AWS Resource Groups. Select all Regions, and choose a resource type of AWS::EC2::Instance.
  Tampilkan jawaban
• #236

  A company hosts its website on Amazon EC2 instances behind an Application Load Balancer. The company manages its DNS with Amazon Route 53, and wants to point its domain's zone apex to the website. Which type of record should be used to meet these requirements?

  • AAn AAAA record for the domain's zone apex.
  • BAn A record for the domain's zone apex.
  • CA CNAME record for the domain's zone apex.
  • DAn alias record for the domain's zone apex.
  Tampilkan jawaban
• #237

  A CloudOps Engineer receives notification that an application that is running on Amazon EC2 instances has failed to authenticate to an Amazon RDS database. To troubleshoot, the CloudOps Engineer needs to investigate AWS Secrets Manager password rotation. Which Amazon CloudWatch log will provide insight into the password rotation?

  • AAWS CloudTrail logs.
  • BEC2 instance application logs.
  • CAWS Lambda function logs.
  • DRDS database logs.
  Tampilkan jawaban
• #238

  A company is running a popular social media site on EC2 instances. The application stores data in an Amazon RDS for MySQL DB instance and has implemented read caching by using an ElastiCache for Redis (cluster mode enabled) cluster to improve read times. A social event is happening over the weekend, and the CloudOps Engineer expects website traffic to triple. What can a CloudOps Engineer do to ensure improved read times for users during the social event?

  • AUse Amazon RDS Multi-AZ.
  • BAdd shards to the existing Redis cluster.
  • COffload static data to Amazon S3.
  • DLaunch a second Multi-AZ Redis cluster.
  Tampilkan jawaban
• #239Pilih 2

  A CloudOps Engineer needs to delete an AWS CloudFormation stack that is no longer in use. The CloudFormation stack is in the DELETE_FAILED state. The CloudOps Engineer has validated the permissions that are required to delete the CloudFormation stack. Which of the following are possible causes of the DELETE_FAILED state? (Choose two.)

  • AThe configured timeout to delete the stack was too low for the delete operation to complete.
  • BThe stack contains nested stacks that must be manually deleted first.
  • CThe stack was deployed with the --disable-rollback option.
  • DThere are additional resources associated with a security group in the stack.
  • EThere are Amazon S3 buckets that still contain objects in the stack.
  Tampilkan jawaban
• #240

  A company wants to reduce costs on jobs that can be completed at any time. The jobs are currently run using multiple On-Demand Instances, and the jobs take just under 2 hours to complete. If a job fails for any reason, it can be restarted from the beginning. Which method is the MOST cost-effective based on these requirements?

  • APurchase Reserved Instances to be used for job execution.
  • BSubmit a request for a one-time Spot Instance for job execution.
  • CSubmit a request for a Spot block to be used for job execution.
  • DUse a mixture of On-Demand and Spot Instances for job execution.
  Tampilkan jawaban

Ingin melacak skor, mengikuti ujian simulasi berwaktu, dan mendapat penjelasan AI? Buat akun gratis