AWS Certified CloudOps Engineer - Associate

• #241

  After a network change, application servers cannot connect to the corresponding Amazon RDS MySQL database. What should the CloudOps Engineer analyze?

  • AVPC Flow Logs.
  • BElastic Load Balancing logs.
  • CAmazon CloudFront logs.
  • DAmazon RDS MySQL error logs.
  Tampilkan jawaban
• #242

  A company has an application that is deployed to two AWS Regions in an active-passive configuration. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in each Region. The instances are in an Amazon EC2 Auto Scaling group in each Region. The application uses an Amazon Route 53 hosted zone for DNS. A CloudOps Engineer needs to configure automatic failover to the secondary Region. What should the CloudOps Engineer do to meet these requirements?

  • AConfigure Route 53 alias records that point to each ALB. Choose a failover routing policy. Set Evaluate Target Health to Yes.
  • BConfigure CNAME records that point to each ALChoose a failover routing policy. Set Evaluate Target Health to Yes.
  • CConfigure Elastic Load Balancing (ELB) health checks for the Auto Scaling group. Add a target group to the ALB in the primary Region. Include the EC2 instances in the secondary Region as targets.
  • DConfigure EC2 health checks for the Auto Scaling group. Add a target group to the ALB in the primary Region. Include the EC2 instances in the secondary Region as targets.
  Tampilkan jawaban
• #243

  A company needs to deploy a web application on two Amazon EC2 instances behind an Application Load Balancer (ALB). Two EC2 instances will also be deployed to host the database. The infrastructure needs to be designed across Availability Zones for high availability and must limit public access to the instances as much as possible. How should this be achieved within a VPC?

  • ACreate one public subnet for the Application Load Balancer, one public subnet for the web servers, and one private subnet for the database servers.
  • BCreate one public subnet for the Application Load Balancer, two public subnets for the web servers, and two private subnets for the database servers.
  • CCreate two public subnets for the Application Load Balancer, two private subnets for the web servers, and two private subnets for the database servers.
  • DCreate two public subnets for the Application Load Balancer, two public subnets for the web servers, and two public subnets for the database servers.
  Tampilkan jawaban
• #244

  A company's CloudOps Engineer deploys four new Amazon EC2 instances by using the standard Amazon Linux 2 Amazon Machine Image (AMI). The company needs to be able to use AWS Systems Manager to manage the instances The CloudOps Engineer notices that the instances do not appear in the Systems Manager console. What must the CloudOps Engineer do to resolve this issue?

  • AConnect to each instance by using SSH. Install Systems Manager Agent on each instance. Configure Systems Manager Agent to start automatically when the instances start up.
  • BUse AWS Certificate Manager (ACM) to create a TLS certificate. Import the certificate into each instance. Configure Systems Manager Agent to use the TLS certificate for secure communications.
  • CConnect to each instance by using SSH. Create an ssm-user account. Add the ssm-user account to the /etcsudoers directory.
  • DAttach an IAM instance profile to the instances. Ensure that the instance profile contains the AmazonSSMManagedinstanceCore policy.
  Tampilkan jawaban
• #245

  A manufacturing company uses an Amazon RDS DB instance to store inventory of all stock items. The company maintains several AWS Lambda functions that interact with the database to add, update, and delete items. The Lambda functions use hardcoded credentials to connect to the database. A CloudOps Engineer must ensure that the database credentials are never stored in plaintext and that the password is rotated every 30 days. Which solution will meet these requirements in the MOST operationally efficient manner?

  • AStore the database password as an environment variable for each Lambda function. Create a new Lambda function that is named PasswordRotate. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the PasswordRotate function every 30 days to change the database password and update the environment variable for each Lambda function.
  • BUse AWS Key Management Service (AWS KMS) to encrypt the database password and to store the encrypted password as an environment variable for each Lambda function. Grant each Lambda function access to the KMS key so that the database password can be decrypted when required. Create a new Lambda function that is named PasswordRotate to change the password every 30 days.
  • CUse AWS Secrets Manager to store credentials for the database. Create a Secrets Manager secret, and select the database so that Secrets Manager will use a Lambda function to update the database password automatically. Specify an automatic rotation schedule of 30 days. Update each Lambda function to access the database password from Secrets Manager.
  • DUse AWS Systems Manager Parameter Store to create a secure string to store credentials for the database. Create a new Lambda function called PasswordRotate. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the PasswordRotate function every 30 days to change the database password and to update the secret within Parameter Store. Update each Lambda function to access the database password from Parameter Store.
  Tampilkan jawaban
• #246

  An application team uses an Amazon Aurora MySQL DB cluster with one Aurora Replica. The application team notices that the application read performance degrades when user connections exceed 200. The number of user connections is typically consistent around 180. with occasional sudden increases above 200 connections. The application team wants the application to automatically scale as user demand increases or decreases. Which solution will meet these requirements?

  • AMigrate to a new Aurora multi-master DB cluster. Modify the application database connection string.
  • BModify the DB cluster by changing to serverless mode whenever user connections exceed 200.
  • CCreate an auto scaling policy with a target metric of 195 DatabaseConnections.
  • DModify the DB cluster by increasing the Aurora Replica instance size.
  Tampilkan jawaban
• #247

  A company's application is hosted by an internet provider at app.example.com. The company wants to access the application by using www.company.com, which the company owns and manages with Amazon Route 53. Which Route 53 record should be created to address this?

  • AA record.
  • BAlias record.
  • CCNAME record.
  • DPointer (PTR) record.
  Tampilkan jawaban
• #248

  A company has launched a social media website that gives users the ability to upload images directly to a centralized Amazon S3 bucket. The website is popular in areas that are geographically distant from the AWS Region where the S3 bucket is located. Users are reporting that uploads are slow. A CloudOps Engineer must improve the upload speed. What should the CloudOps Engineer do to meet these requirements?

  • ACreate S3 access points in Regions that are closer to the users.
  • BCreate an accelerator in AWS Global Accelerator for the S3 bucket.
  • CEnable S3 Transfer Acceleration on the S3 bucket.
  • DEnable cross-origin resource sharing (CORS) on the S3 bucket.
  Tampilkan jawaban
• #249

  A company is running a serverless application on AWS Lambda. The application stores data in an Amazon RDS for MySQL DB instance. Usage has steadily increased, and recently there have been numerous too many connections errors when the Lambda function attempts to connect to the database. The company already has configured the database to use the maximum max_connections value that is possible. What should a CloudOps Engineer do to resolve these errors?

  • ACreate a read replica of the database. Use Amazon Route 53 to create a weighted DNS record that contains both databases.
  • BUse Amazon RDS Proxy to create a proxy. Update the connection string in the Lambda function.
  • CIncrease the value in the max_connect_errors parameter in the parameter group that the database uses.
  • DUpdate the Lambda function's reserved concurrency to a higher value.
  Tampilkan jawaban
• #250

  A company runs a multi-tier web application with two Amazon EC2 instances in one Availability Zone in the us-east-1 Region. A CloudOps Engineer must migrate one of the EC2 instances to a new Availability Zone. Which solution will accomplish this?

  • ACopy the EC2 instance to a different Availability Zone. Terminate the original instance.
  • BCreate an Amazon Machine Image (AMI) from the EC2 instance and launch it in a different Availability Zone. Terminate the original instance.
  • CMove the EC2 instance to a different Availability Zone using the AWS CLI.
  • DStop the EC2 instance, modify the Availability Zone, and start the instance.
  Tampilkan jawaban
• #251

  Development teams are maintaining several workloads on AWS. Company management is concerned about rising costs and wants the CloudOps Engineer to configure alerts so teams are notified when spending approaches preset limits. Which AWS service will satisfy these requirements?

  • AAWS Budgets.
  • BAWS Cost Explorer.
  • CAWS Trusted Advisor.
  • DAWS Cost and Usage report.
  Tampilkan jawaban
• #252

  A company wants to create an automated solution for all accounts managed by AWS Organizations to detect any security groups that use 0.0.0.0/0 as the source address for inbound traffic. The company also wants to automatically remediate any noncompliant security groups by restricting access to a specific CIDR block that corresponds with the company's intranet. Which set of actions should the CloudOps Engineer take to create a solution?

  • ACreate an AWS Config rule to detect noncompliant security groups. Set up automatic remediation to change the 0.0.0.0/0 source address to the approved CIDR block.
  • BCreate an IAM policy to deny the creation of security groups that have 0.0.0.0/0 as the source address. Attach this IAM policy to every user in the company.
  • CCreate an AWS Lambda function to inspect new and existing security groups. Check for a noncompliant 0.0.0.0/0 source address and change the source address to the approved CIDR block.
  • DCreate a Service Control Policy (SCP) for the organizational unit (OU) to deny the creation of security groups that have the 0.0.0.0/0 source address. Set up automatic remediation to change the 0.0.0.0/0 source address to the approved CIDR block.
  Tampilkan jawaban
• #253

  A CloudOps Engineer is managing an application that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The application stores data in an Amazon RDS MySQL DB instance. The Engineer must ensure that application stays available if the database becomes unresponsive. How can these requirements be met?

  • ACreate read replicas for the RDS database and use them in case of a database failure.
  • BCreate a new RDS instance from the snapshot of the original RDS instance if a failure occurs.
  • CKeep a separate RDS database running and switch the endpoint in the web application if a failure occurs.
  • DModify the RDS instance to be a Multi-AZ deployment.
  Tampilkan jawaban
• #254

  A company hosts an online shopping portal in the AWS Cloud. The portal provides HTTPS security by using a TLS certificate on an Elastic Load Balancer (ELB). Recently, the portal suffered an outage because the TLS certificate expired. A CloudOps Engineer must create a solution to automatically renew certificates to avoid this issue in the future. What is the MOST operationally efficient solution that meets these requirements?

  • ARequest a public certificate by using AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. Write a scheduled AWS Lambda function to renew the certificate every 18 months.
  • BRequest a public certificate by using AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. ACM will automatically manage the renewal of the certificate.
  • CRegister a certificate with a third-party certificate authority (CA). Import this certificate into AWS Certificate Manager (ACM). Associate the certificate from ACM with the ELB. ACM will automatically manage the renewal of the certificate.
  • DRegister a certificate with a third-party certificate authority (CA). Configure the ELB to import the certificate directly from the CA. Set the certificate refresh cycle on the ELB to refresh when the certificate is within 3 months of the expiration date.
  Tampilkan jawaban
• #255

  A company has a memory-intensive application that runs on a fleet of Amazon EC2 instances behind an Elastic Load Balancer (ELB). The instances run in an Auto Scaling group. A CloudOps Engineer must ensure that the application can scale based on the number of users that connect to the application. Which solution will meet these requirements?

  • ACreate a scaling policy that will scale the application based on the ActiveConnectionCount Amazon CloudWatch metric that is generated from the ELB.
  • BCreate a scaling policy that will scale the application based on the mem_used Amazon CloudWatch metric that is generated from the ELB.
  • CCreate a scheduled scaling policy to increase the number of EC2 instances in the Auto Scaling group to support additional connections.
  • DCreate and deploy a script on the ELB to expose the number of connected users as a custom Amazon CloudWatch metric. Create a scaling policy that uses the metric.
  Tampilkan jawaban
• #256

  A company is planning to expand into an additional AWS Region for disaster recovery purposes. The company uses AWS CloudFormation, and its infrastructure is well-defined as code. The company would like to reuse as much of its existing code as possible when deploying resources to additional Regions. A CloudOps Engineer is reviewing how Amazon Machine Images (AMIs) are selected in AWS CloudFormation, but is having trouble making the same stack work in the new Region. Which action would make it easier to manage multiple Regions?

  • AName each AMI in the new Region exactly the same as the equivalent AMI in the first Region.
  • BDuplicate the stack so unique AMI names can be coded into the appropriate stack.
  • CCreate an alias for each AMI so that an AMI can be referenced by a common name across Regions.
  • DCreate a Mappings section in the stack, and define the Region to AMI associations.
  Tampilkan jawaban
• #257

  A CloudOps Engineer is tasked with deploying a company's infrastructure as code. The CloudOps Engineer want to write a single template that can be reused for multiple environments. How should the CloudOps Engineer use AWS CloudFormation to create a solution?

  • AUse Amazon EC2 user data in a CloudFormation template.
  • BUse nested stacks to provision resources.
  • CUse parameters in a CloudFormation template.
  • DUse stack policies to provision resources.
  Tampilkan jawaban
• #258

  A company stores critical data in Amazon S3 buckets. A CloudOps Engineer must build a solution to record all S3 API activity. Which action will meet this requirement?

  • AConfigure S3 bucket metrics to record object access logs.
  • BCreate an AWS CloudTrail trail to log data events for all S3 objects.
  • CEnable S3 server access logging for each S3 bucket.
  • DUse AWS IAM Access Analyzer for Amazon S3 to store object access logs.
  Tampilkan jawaban
• #259

  A CloudOps Engineer configured AWS Backup to capture snapshots from a single Amazon EC2 instance that has one Amazon Elastic Block Store (Amazon EBS) volume attached. On the first snapshot, the EBS volume has 10 GiB of data. On the second snapshot, the EBS volume still contains 10 GiB of data, but 4. GiB have changed. On the third snapshot, 2 GiB of data have been added to the volume, for a total of 12 GiB. How much total storage is required to store these snapshots?

  • A12 GiB.
  • B16 GiB.
  • C26 GiB.
  • D32 GiB.
  Tampilkan jawaban
• #260

  A company has mandated the use of multi-factor authentication (MFA) for all IAM users, and requires users to make all API-calls using the CLI. However, users are not prompted to enter MFA tokens, and are able to run CLI commands without MFA. In an attempt to enforce MFA, the company attached an IAM policy to all users that denies API calls that have not been authenticated with MFA. What additional step must be taken to ensure that API calls are authenticated using MFA?

  • AEnable MFA on IAM roles, and require IAM users to use role credentials to sign API calls.
  • BAsk the IAM users to log into the AWS Management Console with MFA before making API calls using the CLI.
  • CRestrict the IAM users to use of the console, as MFA is not supported for CLI use.
  • DRequire users to use temporary credentials from the get-session token command to sign API calls.
  Tampilkan jawaban

Ingin melacak skor, mengikuti ujian simulasi berwaktu, dan mendapat penjelasan AI? Buat akun gratis