AWS Certified CloudOps Engineer - Associate

• #261

  A CloudOps Engineer needs to provision a new fleet of Amazon EC2 Spot Instances in an Amazon EC2 Auto Scaling group. The Auto Scaling group will use a wide range of instance types. The configured fleet must come from pools that have the most availability for the number of instances that are launched. Which solution will meet these requirements?

  • ALaunch the Spot Instances up to the maximum capacity of the Auto Scaling group.
  • BLaunch the Spot Instances by using the diversified strategy.
  • CLaunch the Spot Instances by using the capacity optimized strategy.
  • DUse the Spot Instance advisor to help determine the best Spot allocation strategy.
  Tampilkan jawaban
• #262

  A CloudOps Engineer configures VPC flow logs to publish to Amazon CloudWatch Logs. The CloudOps Engineer reviews the logs in CloudWatch Logs and notices less traffic than expected. After the CloudOps Engineer compares the VPC flow logs to logs that were captured on premises, the CloudOps Engineer believes that the VPC flow logs are incomplete. Which of the following is a possible reason for the difference in traffic?

  • ACloudWatch Logs throttling has been applied.
  • BThe CloudWatch IAM role does not have a trust relationship with the VPC flow logs service.
  • CThe VPC flow log is still in the process of being created.
  • DVPC flow logs cannot capture traffic from on-premises servers to a VPC.
  Tampilkan jawaban
• #263

  CloudOps Engineer needs to secure the credentials for an Amazon RDS database that is created by an AWS CloudFormation template. The solution must encrypt the credentials and must support automatic rotation. Which solution will meet these requirements?

  • ACreate an AWS::SecretsManager::Secret resource in the CloudFormation template. Reference the credentials in the AWS::RDS::DBInstance resource by using the resolve:secretsmanager dynamic reference.
  • BCreate an AWS::SecretsManager::Secret resource in the CloudFormation template. Reference the credentials in the AWS::RDS::DBInstance resource by using the resolve:ssm-secure dynamic reference.
  • CCreate an AWS::SSM::Parameter resource in the CloudFormation template. Reference the credentials in the AWS::RDS::DBInstance resource by using the resolve:ssm dynamic reference.
  • DCreate parameters for the database credentials in the CloudFormation template. Use the Ref intrinsic function to provide the credentials to the AWS::RDS::DBInstance resource.
  Tampilkan jawaban
• #264

  A CloudOps Engineer developed a Python script that uses the AWS SDK to conduct several maintenance tasks. The script needs to run automatically every night. What is the MOST operationally efficient solution that meets this requirement?

  • AConvert the Python script to an AWS Lambda function. Use an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the function every night.
  • BConvert the Python script to an AWS Lambda function. Use AWS CloudTrail to invoke the function every night.
  • CDeploy the Python script to an Amazon EC2 Instance. Use Amazon EventBridge (Amazon CloudWatch Events) to schedule the instance to start and stop every night.
  • DDeploy the Python script to an Amazon EC2 instance. Use AWS Systems Manager to schedule the instance to start and stop every night.
  Tampilkan jawaban
• #265

  A company has an application that customers use to search for records on a website. The application's data is stored in an Amazon Aurora DB cluster. The application's usage varies by season and by day of the week. The website's popularity is increasing, and the website is experiencing slower performance because of increased load on the DB cluster during periods of peak activity. The application logs show that the performance issues occur when users are searching for information. The same search is rarely performed multiple times. A CloudOps Engineer must improve the performance of the platform by using a solution that maximizes resource efficiency. Which solution will meet these requirements?

  • ADeploy an Amazon ElastiCache for Redis cluster in front of the DB cluster. Modify the application to check the cache before the application issues new queries to the database. Add the results of any queries to the cache.
  • BDeploy an Aurora Replica for the DB cluster. Modify the application to use the reader endpoint for search operations. Use Aurora Auto Scaling to scale the number of replicas based on load.
  • CUse Provisioned IOPS on the storage volumes that support the DB cluster to improve performance sufficiently to support the peak load on the application.
  • DIncrease the instance size in the DB cluster to a size that is sufficient to support the peak load on the application. Use Aurora Auto Scaling to scale the instance size based on load.
  Tampilkan jawaban
• #266

  A CloudOps Engineer is managing a VPC network consisting of public and private subnets. Instances in the private subnets access the Internet through a NAT gateway. A recent AWS bill shows that the NAT gateway charges have doubled. The Engineer wants to identify which instances are creating the most network traffic. How should this be accomplished?

  • AEnable flow logs on the NAT gateway elastic network interface and use Amazon CloudWatch insights to filter data based on the source IP addresses.
  • BRun an AWS Cost and Usage report and group the findings by instance ID.
  • CUse the VPC traffic mirroring feature to send traffic to Amazon QuickSight.
  • DUse Amazon CloudWatch metrics generated by the NAT gateway for each individual instance.
  Tampilkan jawaban
• #267

  A company is using Amazon CloudFront to serve static content for its web application to its users. The CloudFront distribution uses an existing on-premises website as a custom origin. The company requires the use of TLS between CloudFront and the origin server. This configuration has worked as expected for several months. However, users are now experiencing HTTP 502 (Bad Gateway) errors when they view webpages that include content from the CloudFront distribution. What should a CloudOps Engineer do to resolve this problem?

  • AExamine the expiration date on the certificate on the origin site. Validate that the certificate has not expired. Replace the certificate if necessary.
  • BExamine the hostname on the certificate on the origin site. Validate that the hostname matches one of the hostnames on the CloudFront distribution. Replace the certificate if necessary.
  • CExamine the firewall rules that are associated with the origin server. Validate that port 443 is open for inbound traffic from the internet. Create an inbound rule if necessary.
  • DExamine the network ACL rules that are associated with the CloudFront distribution. Validate that port 443 is open for outbound traffic to the origin server. Create an outbound rule if necessary.
  Tampilkan jawaban
• #268

  A CloudOps Engineer has an Amazon S3 website and wants to restrict access to a single Amazon CloudFront distribution. Visitors to the website should not be able to circumvent CloudFront or view the S3 website directly from the bucket. Which AWS service or feature will meet these requirements?

  • AS3 bucket ACL.
  • BAWS Firewall Manager.
  • CAmazon Route 53 private hosted zone.
  • DOrigin Access Identity (OAI).
  Tampilkan jawaban
• #269

  An AWS Lambda function is intermittently failing several times a day. A CloudOps Engineer must find out how often this error has occurred in the last 7 days. Which action will meet this requirement in the MOST operationally efficient manner?

  • AUse Amazon Athena to query the Amazon CloudWatch logs that are associated with the Lambda function.
  • BUse Amazon Athena to query the AWS CloudTrail logs that are associated with the Lambda function.
  • CUse Amazon CloudWatch Logs Insights to query the associated Lambda function logs.
  • DUse Amazon Elasticsearch Service (Amazon ES) to stream the Amazon CloudWatch logs for the Lambda function.
  Tampilkan jawaban
• #270

  An organization with a large IT department has decided to migrate to AWS With different job functions in the IT department it is not desirable to give all users access to all AWS resources Currently the organization handles access via LDAP group membership. What is the BEST method to allow access using current LDAP credentials?

  • ACreate an AWS Directory Service Simple AD. Replicate the on-premises LDAP directory to Simple AD.
  • BCreate a Lambda function to read LDAP groups and automate the creation of IAM users.
  • CUse AWS CloudFormation to create IAM roles. Deploy Direct Connect to allow access to the on-premises LDAP server.
  • DFederate the LDAP directory with IAM using SAML. Create different IAM roles to correspond to different LDAP groups to limit permissions.
  Tampilkan jawaban
• #271

  A company expanded its web application to serve a worldwide audience. A CloudOps Engineer has implemented a multi-Region AWS deployment for all production infrastructure. The CloudOps Engineer must route traffic based on the location of resources. Which Amazon Route 53 routing policy should the CloudOps Engineer use to meet this requirement?

  • AGeolocation routing policy.
  • BGeoproximity routing policy.
  • CLatency-based routing policy.
  • DMultivalue answer routing policy.
  Tampilkan jawaban
• #272

  A CloudOps Engineer has configured a CloudWatch agent to send custom metrics to Amazon CloudWatch and is now assembling a CloudWatch dashboard to display these metrics. What steps should the Engineer take to complete this task?

  • ASelect the AWS Namespace, filter by metric name, then add to the dashboard.
  • BAdd a text widget, select the appropriate metric from the custom namespace, then add to the dashboard.
  • CSelect the appropriate widget and metrics from the custom namespace, then add to the dashboard.
  • DOpen the CloudWatch console, from the CloudWatch Events, add all custom metrics.
  Tampilkan jawaban
• #273

  A company is planning to host an application on a set of Amazon EC2 instances that are distributed across multiple Availability Zones. The application must be able to scale to millions of requests each second. A CloudOps Engineer must design a solution to distribute the traffic to the EC2 instances. The solution must be optimized to handle sudden and volatile traffic patterns while using a single static IP address for each Availability Zone. Which solution will meet these requirements?

  • AAmazon Simple Queue Service (Amazon SQS) queue.
  • BApplication Load Balancer.
  • CAWS Global Accelerator.
  • DNetwork Load Balancer.
  Tampilkan jawaban
• #274

  A CloudOps Engineer wants to protect objects in an Amazon S3 bucket from accidental overwrite and deletion. Noncurrent objects must be kept for 90 days and then must be permanently deleted. Objects must reside within the same AWS Region as the original S3 bucket. Which solution meets these requirements?

  • ACreate an Amazon Data Lifecycle Manager (Amazon DLM) lifecycle policy for the S3 bucket. Add a rule to the lifecycle policy to delete noncurrent objects after 90 days.
  • BCreate an AWS Backup policy for the S3 bucket. Create a backup rule that includes a lifecycle to expire noncurrent objects after 90 days.
  • CEnable S3 Cross-Region Replication on the S3 bucket. Create a S3 Lifecycle policy for the bucket to expire noncurrent objects after 90 days.
  • DEnable S3 Versioning on the S3 bucket. Create a S3 Lifecycle policy for the bucket to expire noncurrent objects after 90 days.
  Tampilkan jawaban
• #275Pilih 2

  A CloudOps Engineer wants to manage a web server application with AWS Elastic Beanstalk. The Elastic Beanstalk service must maintain full capacity for new deployments at all times. Which deployment policies satisfy this requirement? (Select TWO.)

  • AAll at once.
  • BImmutable.
  • CRebuild.
  • DRolling.
  • ERolling with additional batch.
  Tampilkan jawaban
• #276

  A user has created a VPC with public and private subnets using the VPC wizard. The user has not launched any instance manually and is trying to delete the VPC. What will happen in this scenario?

  • AIt will not allow to delete the VPC as it has subnets with route tables.
  • BIt will not allow to delete the VPC since it has a running route instance.
  • CIt will terminate the VPC along with all the instances launched by the wizard.
  • DIt will not allow to delete the VPC since it has a running NAT instance.
  Tampilkan jawaban
• #277

  A company has an application that uses a scheduled AWS Lambda function to retrieve datasets from external sources over the internet. The function is not associated with a VPC. The company is modifying the application to store the information that the Lambda function retrieves on an Amazon RDS DB instance in a private subnet. The VPC has two public subnets and two private subnets. A CloudOps Engineer must deploy a solution that allows the Lambda function to access the new database and continue to access the internet. Which solution meets these requirements?

  • ACreate a new Lambda function with VPC access and an Elastic IP address. Attach the function to public subnets in two Availability Zones. Associate a security group with the Elastic IP address. Configure the security group outbound rules to allow Lambda to access the required resources.
  • BCreate a new Lambda function with VPC access and two public IP addresses. Attach the function to public subnets in the same Availability Zones that the database uses. Associate a security group with the function. Configure the security group inbound rules to allow Lambda to access the required resources.
  • CReconfigure the Lambda function for VPC access. Add NAT gateways to the public subnets in the VPAdd route table entries in the private subnets to route through the NAT gateways to the internet. Attach the function to the private subnets that support the database. Associate a security group with the function. Configure the security group outbound rules to allow Lambda to access the internet.
  • DReconfigure the Lambda function for VPC access. Attach the function to the private subnets. Add route table entries in the private subnets to route through the internet gateway to the internet. Associate a security group with the subnets. Configure the security group inbound rules to allow Lambda to access the required resources through the internet gateway.
  Tampilkan jawaban
• #278Pilih 2

  A company's IT department noticed an increase in the spend of their developer AWS account. There are over 50 developers using the account, and the finance team wants to determine the service costs incurred by each developer. What should a CloudOps Engineer do to collect this information? (Select TWO.)

  • AActivate the createdBy tag in the account.
  • BAnalyze the usage with Amazon CloudWatch dashboards.
  • CAnalyze the usage with Cost Explorer.
  • DConfigure AWS Trusted Advisor to track resource usage.
  • ECreate a billing alarm in AWS Budgets.
  Tampilkan jawaban
• #279

  A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted. What is the SIMPLEST approach the CloudOps Engineer can take to ensure S3 buckets in those accounts can never be deleted?

  • ASet up MFA Delete on all the S3 buckets to prevent the buckets from being deleted.
  • BUse Service Control Policies to deny the s3:DeleteBucket action on all buckets in production accounts.
  • CCreate an IAM group that has an IAM policy to deny the s3:DeleteBucket action on all buckets in production accounts.
  • DUse AWS Shield to deny the s3:DeleteBucket action on the AWS account instead of all S3 buckets.
  Tampilkan jawaban
• #280

  A company uses AWS CloudFormation to deploy its infrastructure. The company recently retired an application. A cloud operations engineer initiates CloudFormation stack deletion, and the stack gets stuck in DELETE_FAILED status. A CloudOps Engineer discovers that the stack had deployed a security group. The security group is referenced by other security groups in the environment. The CloudOps Engineer needs to delete the stack without affecting other applications. Which solution will meet these requirements in the MOST operationally efficient manner?

  • ACreate a new security group that has a different name. Apply identical rules to the new security group. Replace all other security groups that reference the new security group. Delete the stack.
  • BCreate a CloudFormation change set to delete the security group. Deploy the change set.
  • CDelete the stack again. Specify that the security group be retained.
  • DPerform CloudFormation drift detection. Delete the stack.
  Tampilkan jawaban

Ingin melacak skor, mengikuti ujian simulasi berwaktu, dan mendapat penjelasan AI? Buat akun gratis