AWS Certified CloudOps Engineer - Associate

• #1

  A company runs an application that uses a MySQL database on an Amazon EC2 instance. The EC2 instance has a General Purpose SSD Amazon Elastic Block Store (Amazon EBS) volume. The company made changes to the application code and now wants to perform load testing to evaluate the impact of the code changes. A CloudOps Engineer must create a new MySQL instance from a snapshot of the existing production instance. This new instance needs to perform as similarly as possible to the production instance. Which restore option meets these requirements?

  • AUse EBS fast snapshot restore to create a new General Purpose SSD EBS volume from the production snapshot.
  • BUse EBS fast snapshot restore to create a new Provisioned IOPS SSD EBS volume from the production snapshot.
  • CUse EBS snapshot restore to create a new General Purpose SSD EBS volume from the production snapshot.
  • DUse EBS snapshot restore to create a new Provisioned IOPS SSD EBS volume from the production snapshot.
  解答を表示
• #22 つ選択

  A company website contains a web tier and a database tier on AWS. The web tier consists of Amazon EC2 instances that run in an Auto Scaling group across two Availability Zones. The database tier runs on an Amazon RDS for MySQL Multi-AZ DB instance. The database subnet network ACLs are restricted to only the web subnets that need access to the database. The web subnets use the default network ACL with the default rules. The company's operations team has added a third subnet to the Auto Scaling group configuration. After an Auto Scaling event occurs, some users report that they intermittently receive an error message. The error message states that the server cannot connect to the database. The operations team has confirmed that the route tables are correct and that the required ports are open on all security groups. Which combination of actions should a CloudOps Engineer take so that the web servers can communicate with the DB instance? (Select TWO.)

  • AOn the default ACL. create inbound. Allow rules of type TCP with the ephemeral port range and the source as the database subnets.
  • BOn the default ACL, create outbound. Allow rules of type MySQL/Aurora (3306). Specify the destinations as the database subnets.
  • COn the network ACLs for the database subnets, create an inbound. Allow rule of type MySQL/Aurora (3306). Specify the source as the third web subnet.
  • DOn the network ACLs for the database subnets, create an outbound. Allow rule of type TCP with the ephemeral port range and the destination as the third web subnet.
  • EOn the network ACLs for the database subnets, create an outbound. Allow rule of type MySQL/Aurora (3306). Specify the destination as the third web subnet.
  解答を表示
• #3

  A company receives an alert from an Amazon CloudWatch alarm. The alarm indicates that a web application that is running on Amazon EC2 instances is not responding to requests. The EC2 instances have a Red Hat Enterprise Linux operating system and are in an Auto Scaling group. The Auto Scaling group has a minimum capacity of 2 and a maximum capacity of 5. An investigation reveals that the web application is experiencing out-of-memory errors. The company adds memory to the web application and wants to track operating system memory utilization. A CloudWatch memory metric does not currently exist for the EC2 instances in the Auto Scaling group. What should a CloudOps Engineer do to provide a CloudWatch memory metric for the EC2 instances?

  • AUse an Amazon Machine Image (AMI) that includes the CloudWatch agent.
  • BTurn on CloudWatch detailed monitoring.
  • CTurn on Instance Metadata Service Version 2 (IMDSv2).
  • DUse an Amazon Machine Image (AMI) that is based on Amazon Linux.
  解答を表示
• #4

  A CloudOps Engineer needs to create a replica of a company's existing AWS infrastructure in a new AWS account. Currently, an AWS Service Catalog portfolio is used to create and manage resources. What is the MOST efficient way to accomplish this?

  • ACreate an AWS CloudFormation template to use the AWS Service Catalog portfolio in the new AWS account.
  • BManually create an AWS Service Catalog portfolio in the new AWS account that duplicates the original portfolio.
  • CRun an AWS Lambda function to create a new AWS Service Catalog portfolio based on the output of the DescribePortfolio API operation.
  • DShare the AWS Service Catalog portfolio with the other AWS accounts and import the portfolio into the other AWS accounts.
  解答を表示
• #5

  A CloudOps Engineer is responsible for a large fleet of Amazon EC2 instances and must know whether any instances will be affected by upcoming hardware maintenance. Which option would provide this information with the LEAST administrative overhead?

  • ADeploy a third-party monitoring solution to provide real-time EC2 instance monitoring.
  • BList any instances with failed system status checks using the AWS Management Console.
  • CMonitor AWS CloudTrail for StopInstances API calls.
  • DReview the AWS Personal Health Dashboard.
  解答を表示
• #6

  A company migrated an I/O intensive application to an Amazon EC2 general purpose instance. The EC2 instance has a single General Purpose SSD Amazon Elastic Block Store (Amazon EBS) volume attached. Application users report that certain actions that require intensive reading and writing to the disk are taking much longer than normal or are failing completely. After reviewing the performance metrics of the EBS volume, a CloudOps Engineer notices that the VolumeQueueLength metric is consistently high during the same times in which the users are reporting issues. The CloudOps Engineer needs to resolve this problem to restore full performance to the application. Which action will meet these requirements?

  • AModify the instance type to be storage optimized.
  • BModify the volume properties by deselecting Auto-Enable Volume 10.
  • CModify the volume properties to increase the IOPS.
  • DModify the instance to enable enhanced networking.
  解答を表示
• #7

  A company's AWS account users are launching Amazon EC2 instances without required cost allocation tags. A CloudOps Engineer needs to prevent users within an organization in AWS Organizations from launching new EC2 instances that do not have the required tags. The solution must require the least possible operational overhead. Which solution meets these requirements?

  • ASet up an AWS Lambda function that will initiate a run instance event and check for the required tags. Configure the function to prevent the launch of EC2 instances if the tags are missing.
  • BSet up an AWS Config rule to monitor for EC2 instances that lack the required tags.
  • CSet up a Service Control Policy (SCP) that prevents the launch of EC2 instances that lack the required tags. Attach the SCP to the organization root.
  • DSet up an Amazon CloudWatch alarm to stop any EC2 instances that lack the required tags.
  解答を表示
• #8

  An application is running on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are configured in an Amazon EC2 Auto Scaling group. A CloudOps Engineer must configure the application to scale based on the number of incoming requests. Which solution accomplishes this with the LEAST amount of effort?

  • AUse a simple scaling policy based on a custom metric that measures the average active requests of all EC2 instances.
  • BUse a simple scaling policy based on the Auto Scaling group GroupDesiredCapacity metric.
  • CUse a target tracking scaling policy based on the ALB's ActiveConnectionCount metric.
  • DUse a target tracking scaling policy based on the ALB's RequestCountPerTarget metric.
  解答を表示
• #9

  A company has a stateless application that runs on four Amazon EC2 instances. The application requires tour instances at all times to support all traffic. A CloudOps Engineer must design a highly available, fault-tolerant architecture that continually supports all traffic if one Availability Zone becomes unavailable. Which configuration meets these requirements?

  • ADeploy two Auto Scaling groups in two Availability Zones with a minimum capacity of two instances in each group.
  • BDeploy an Auto Scaling group across two Availability Zones with a minimum capacity of four instances.
  • CDeploy an Auto Scaling group across three Availability Zones with a minimum capacity of four instances.
  • DDeploy an Auto Scaling group across three Availability Zones with a minimum capacity of six instances.
  解答を表示
• #10

  A company is storing monthly reports on Amazon S3. The company's security requirement states that traffic from the client VPC to Amazon S3 cannot traverse the internet. What should the CloudOps Engineer do to meet this requirement?

  • AUse AWS Direct Connect and a public virtual interface to connect to Amazon S3.
  • BUse a managed NAT gateway to connect to Amazon S3.
  • CDeploy a VPC endpoint to connect to Amazon S3.
  • DDeploy an internet gateway to connect to Amazon S3.
  解答を表示
• #11

  A company uses AWS Organizations to manage multiple AWS accounts. Corporate policy mandates that only specific AWS Regions can be used to store and process customer data. A CloudOps Engineer must prevent the provisioning of Amazon EC2 instances in unauthorized Regions by anyone in the company. What is the MOST operationally efficient solution that meets these requirements?

  • AConfigure AWS CloudTrail in all Regions to record all API activity. Create an Amazon EventBridge (Amazon CloudWatch Events) rule in all unauthorized Regions for ec2:RunInstances events. Use AWS Lambda to terminate the launched EC2 instances.
  • BIn each AWS account, create a managed IAM policy that uses a Region condition to deny the ec2:RunInstances action in all unauthorized Regions. Attach this policy to all IAM groups in each AWS account.
  • CIn each AWS account, create an IAM permissions boundary policy that uses a Region condition to deny the ec2:RunInstances action in all unauthorized Regions. Attach the permissions boundary policy to all IAM users in each AWS account.
  • DCreate a Service Control Policy (SCP) in AWS Organizations to deny the ec2:RunInstances action in all unauthorized Regions. Attach this policy to the root level of the organization.
  解答を表示
• #12

  A company recently migrated its application to a VPC on AWS. An AWS Site-to-Site VPN connection connects the company's on-premises network to the VPC. The application retrieves customer data from another system that resides on premises. The application uses an on-premises DNS server to resolve domain records. After the migration, the application is not able to connect to the customer data because of name resolution errors. Which solution will give the application the ability to resolve the internal domain names?

  • ALaunch EC2 instances in the VPC. On the EC2 instances, deploy a custom DNS forwarder that forwards all DNS requests to the on-premises DNS server. Create an Amazon Route 53 private hosted zone that uses the EC2 instances for name servers.
  • BCreate an Amazon Route 53 Resolver outbound endpoint. Configure the outbound endpoint to forward DNS queries against the on-premises domain to the on-premises DNS server.
  • CSet up two AWS Direct Connect connections between the AWS environment and the on-premises network. Set up a link aggregation group (LAG) that includes the two connections. Change the VPC resolver address to point to the on-premises DNS server.
  • DCreate an Amazon Route 53 public hosted zone for the on-premises domain. Configure the network ACLs to forward DNS requests against the on-premises domain to the Route 53 public hosted zone.
  解答を表示
• #13

  A user has created a VPC with CIDR 20.0.0.0/16 using VPC Wizard. The user has created a public CIDR 20.0.0.0/24 and a VPN only subnet CIDR 20.0.1.0/24 along with the hardware VPN access to connect to the user's data center. Which of the below mentioned components is not present when the VPC is setup with the wizard?

  • AMain route table attached with a VPN only subnet.
  • BA NAT instance configured to allow the VPN subnet instances to connect with the internet.
  • CCustom route table attached with a public subnet.
  • DAn internet gateway for a public subnet.
  解答を表示
• #14

  A company is using an AWS KMS Customer Master Key (CMK) with imported key material. The company references the CMK by its alias in the Java application to encrypt data. The CMK must be rotated every 6 months. What is the process to rotate the key?

  • AEnable automatic key rotation for the CMK, and specify a period of 6 months.
  • BCreate a new CMK with new imported material, and update the key alias to point to the new CMK.
  • CDelete the current key material, and import new material into the existing CMK.
  • DImport a copy of the existing key material into a new CMK as a backup, and set the rotation schedule for 6 months.
  解答を表示
• #15

  A web application runs on Amazon EC2 instances behind an Elastic Load Balancing Application Load Balancer (ALB). The instances run in an Auto Scaling group across multiple Availability Zones. A CloudOps Engineer has notice that some EC2 instances show up healthy in the Auto Scaling console but show up as unhealthy in the ALB target console. What could be the issue?

  • AThe health check grace period for the Auto Scaling group is set too low; increase it.
  • BThe target group health check is incorrectly configured and needs to be adjusted.
  • CThe user data or AMI used for the Auto Scaling group launch configuration is incorrect.
  • DThe Auto Scaling group health check type is based on EC2 instance health instead of Elastic Load Balancing health checks.
  解答を表示
• #16

  A VPC is connected to a company data center by a VPN. An Amazon EC2 instance with the IP address 172.31.16.139 is within a private subnet of the VPC. A CloudOps Engineer issued a ping command to the EC2 instance from an on-premises computer with the IP address 203.0.113.12 and did not receive an acknowledgment. VPC Flow Logs were enabled and showed the following. What action will resolve the issue?

  • AModify the EC2 security group rules to allow inbound traffic from the on-premises computer.
  • BModify the EC2 security group rules to allow outbound traffic to the on-premises computer.
  • CModify the VPC network ACL rules to allow inbound traffic from the on-premises computer.
  • DModify the VPC network ACL rules to allow outbound traffic to the on-premises computer.
  解答を表示
• #17

  A CloudOps Engineer is evaluating Amazon Route 53 DNS options to address concerns about high availability for an on-premises website. The website consists of two servers: a primary active server and a secondary passive server. Route 53 should route traffic to the primary server if the associated health check returns 2xx or 3xx HTTP codes. All other traffic should be directed to the secondary passive server. The failover record type, set ID, and routing policy have been set appropriately for both primary and secondary servers. Which next step should be taken to configure Route 53?

  • ACreate an A record for each server. Associate the records with the Route 53 HTTP health check.
  • BCreate an A record for each server. Associate the records with the Route 53 TCP health check.
  • CCreate an alias record for each server with Evaluate Target Health set to Yes. Associate the records with the Route 53 HTTP health check.
  • DCreate an alias record for each server with Evaluate Target Health set to Yes. Associate the records with the Route 53 TCP health check.
  解答を表示
• #18

  A CloudOps Engineer is responsible for a large fleet of EC2 instances and must know whether any instances will be affected by upcoming hardware maintenance. Which option would provide this information with the LEAST administrative overhead?

  • AMonitor AWS CloudTrail for StopInstances API calls related to upcoming maintenance.
  • BReview the Personal Health Dashboard for any scheduled maintenance.
  • CFrom the AWS Management Console, list any instances with failed system status checks.
  • DDeploy a third-party monitoring solution to provide real-time EC2 instance monitoring.
  解答を表示
• #19

  A company has deployed an application on Amazon EC2 instances in a single VPC. The company has placed the EC2 instances in a private subnet in the VPC. The EC2 instances need access to Amazon S3 buckets that are in the same AWS Region as the EC2 instances. A CloudOps Engineer must provide the EC2 instances with access to the S3 buckets without requiring any changes to the EC2 instances or the application. The EC2 instances must not have access to the internet. Which solution will meet these requirements?

  • ACreate a S3 gateway endpoint that uses the default gateway endpoint policy. Associate the private subnet with the gateway endpoint.
  • BCreate a S3 interface endpoint. Associate the EC2 instances with the interface endpoint.
  • CConfigure a NAT gateway. Associate the private subnet with the NAT gateway.
  • DConfigure a proxy EC2 instance. Update the private subnet route tables to route traffic through the proxy EC2 instance. Configure the proxy to route all S3 requests to the target S3 bucket.
  解答を表示
• #20

  A CloudOps Engineer must create a solution that immediately notifies software developers if an AWS Lambda function experiences an error. Which solution will meet this requirement?

  • ACreate an Amazon Simple Notification Service (Amazon SNS) topic with an email subscription for each developer. Create an Amazon CloudWatch alarm by using the Errors metric and the Lambda function name as a dimension. Configure the alarm to send a notification to the SNS topic when the alarm state reaches ALARM.
  • BCreate an Amazon Simple Notification Service (Amazon SNS) topic with a mobile subscription for each developer. Create an Amazon EventBridge (Amazon CloudWatch Events) alarm by using LambdaError as the event pattern and the SNS topic name as a resource. Configure the alarm to send a notification to the SNS topic when the alarm state reaches ALARM.
  • CVerify each developer email address in Amazon Simple Email Service (Amazon SES). Create an Amazon CloudWatch rule by using the LambdaError metric and developer email addresses as dimensions. Configure the rule to send an email through Amazon SES when the rule state reaches ALARM.
  • DVerify each developer mobile phone in Amazon Simple Email Service (Amazon SES). Create an Amazon EventBridge (Amazon CloudWatch Events) rule by using Errors as the event pattern and the Lambda function name as a resource. Configure the rule to send a push notification through Amazon SES when the rule state reaches ALARM.
  解答を表示

スコアの記録、時間制限付き模擬試験、AI解説をご利用になりますか？ 無料アカウントを作成