AWS Certified CloudOps Engineer - Associate

• #41

  A company runs a single-page web application on AWS. The application uses Amazon CloudFront to deliver static content from an Amazon S3 bucket origin. The application also uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to serve API calls. Users sometimes report that the website is not operational, even when monitoring shows that the index page is reachable and that the EKS cluster is healthy. A CloudOps Engineer must implement additional monitoring that can detect when the website is not operational before users report the problem. Which solution will meet these requirements?

  • ACreate an Amazon CloudWatch Synthetics heartbeat monitor canary that points to the fully qualified domain name (FQDN) of the website.
  • BCreate an Amazon CloudWatch Synthetics API canary that monitors the availability of API endpoints from the EKS cluster.
  • CCreate an Amazon CloudWatch RUM app monitor that points to the fully qualified domain name (FQDN) of the website. Configure the app monitor to collect performance telemetry and JavaScript errors.
  • DCreate an Amazon CloudWatch RUM app monitor that uses the API endpoints from the EKS cluster.
  解答を表示
• #42

  A company has a web application that is experiencing performance problems many times each night. A root cause analysis reveals spikes in CPU utilization that last 5 minutes on an Amazon EC2 Linux instance. A CloudOps Engineer is tasked with finding the process ID (PID) of the service or process that is consuming more CPU. How can the Engineer accomplish this with the LEAST amount of effort?

  • AConfigure an AWS Lambda function in Python 3.7 to run every minute to capture the PID and send a notification.
  • BConfigure the procstat plugin to collect and send CPU metrics for the running processes.
  • CLog in to the EC2 Linux instance using a .pem key each night and then run the top command.
  • DUse the default Amazon CloudWatch CPU utilization metric to capture the PID in the CloudWatch dashboard.
  解答を表示
• #43

  A CloudOps Engineer is managing a web application that runs on Amazon EC2 instances behind an ELB Application Load Balancer (ALB). The instances run in an EC2 Auto Scaling group. The Engineer wants to set an alarm for when all target instances associated with the ALB are unhealthy. Which condition should be used with the alarm?

  • AAWS/ApplicationELB HealthyHostCount <= 0.
  • BAWS/ApplicationELB UnhealthyHostCount >= 1.
  • CAWS/EC2 StatusCheckFailed <= 0.
  • DAWS/EC2 StatusCheckFailed >= 1.
  解答を表示
• #442 つ選択

  A CloudOps Engineer needs to configure the Amazon Route 53 hosted zone for example.com and www.example.com to point to an Application Load Balancer (ALB). Which combination of actions should the CloudOps Engineer take to meet these requirements? (Choose two.)

  • AConfigure an A record for example.com to point to the IP address of the ALB.
  • BConfigure an A record for www.example.com to point to the IP address of the ALB.
  • CConfigure an alias record for example.com to point to the CNAME of the ALB.
  • DConfigure an alias record for www.example.com to point to the Route 53 example.com record.
  • EConfigure a CNAME record for example.com to point to the CNAME of the ALB.
  解答を表示
• #45

  A company has a cluster of Linux Amazon EC2 Spot Instances that read many files from and write many files to attached Amazon Elastic Block Store (Amazon EBS) volumes. The EC2 instances are frequently started and stopped. As part of the process when an EC2 instance starts, an EBS volume is restored from a snapshot. EBS volumes that are restored from snapshots are experiencing initial performance that is lower than expected. The company's workload needs almost all the provisioned IOPS on the attached EBS volumes. The EC2 instances are unable to support the workload when the performance of the EBS volumes is too low. A CloudOps Engineer must implement a solution to ensure that the EBS volumes provide the expected performance when they are restored from snapshots. Which solution will meet these requirements?

  • AConfigure fast snapshot restore (FSR) on the snapshots that are used.
  • BRestore each snapshot onto an unencrypted EBS volume. Encrypt the EBS volume when the performance stabilizes.
  • CFormat the EBS volumes as XFS file systems before restoring the snapshots.
  • DIncrease the Linux read-ahead buffer to 1 MiB.
  解答を表示
• #46

  A company's application currently uses an IAM role that allows all access to all AWS services. A CloudOps Engineer must ensure that the company's IAM policies allow only the permissions that the application requires. How can the CloudOps Engineer create a policy to meet this requirement?

  • ATurn on AWS CloudTrail. Generate a policy by using AWS Security Hub.
  • BTurn on Amazon EventBridge (Amazon CloudWatch Events). Generate a policy by using AWS Identity and Access Management Access Analyzer.
  • CUse the AWS CLI to run the get-generated-policy command in AWS Identity and Access Management Access Analyzer.
  • DTurn on AWS CloudTrail. Generate a policy by using AWS Identity and Access Management Access Analyzer.
  解答を表示
• #47

  A CloudOps Engineer must devise a strategy for enforcing tagging of all EC2 instances and Amazon Elastic Block Store (Amazon EBS) volumes. What action can the Engineer take to implement this for real-time enforcement?

  • AUse the AWS Tag Editor to manually search for untagged resources and then tag them properly in the editor.
  • BSet up AWS Service Catalog with the TagOptions Library rule that enforces a tagging taxonomy proactively when instances and volumes are launched.
  • CIn a PowerShell or shell script, check for untagged items by using the resource tagging GetResources API action, and then manually tag the reported items.
  • DLaunch items by using the AWS API. Use the TagResources API action to apply the required tags when the instances and volumes are launched.
  解答を表示
• #48

  A CloudOps Engineer must create a solution that automatically shuts down any Amazon EC2 instances that have less than 10% average CPU utilization for 60 minutes or more. Which solution will meet this requirement In the MOST operationally efficient manner?

  • AImplement a cron job on each EC2 instance to run once every 60 minutes and calculate the current CPU utilization. Initiate an instance shutdown If CPU utilization is less than 10%.
  • BImplement an Amazon CloudWatch alarm for each EC2 instance to monitor average CPU utilization. Set the period at 1 hour, and set the threshold at 10%. Configure an EC2 action on the alarm to stop the instance.
  • CInstall the unified Amazon CloudWatch agent on each EC2 instance, and enable the Basic level predefined metric set. Log CPU utilization every 60 minutes, and initiate an instance shutdown if CPU utilization is less than 10%.
  • DUse AWS Systems Manager Run Command to get CPU utilization from each EC2 instance every 60 minutes. Initiate an instance shutdown if CPU utilization is less than 10%.
  解答を表示
• #49

  A new website will run on Amazon EC2 instances behind an Application Load Balancer. Amazon Route 53 will be used to manage DNS records. What type of record should be set in Route 53 to point the website's apex domain name (for example, company.com) to the Application Load Balancer?

  • ACNAME.
  • BSOA.
  • CTXT.
  • DALIAS.
  解答を表示
• #50

  CloudOps Engineer needs to create alerts that are based on the read and write metrics of Amazon Elastic Block Store (Amazon EBS) volumes that are attached to an Amazon EC2 instance. The CloudOps Engineer creates and enables Amazon CloudWatch alarms for the DiskReadBytes metric and the DiskWriteBytes metric. A custom monitoring tool that is installed on the EC2 instance with the same alarm configuration indicates that the volume metrics have exceeded the threshold. However, the CloudWatch alarms were not in ALARM state. Which action will ensure that the CloudWatch alarms function correctly?

  • AInstall and configure the CloudWatch agent on the EC2 instance to capture the desired metrics.
  • BInstall and configure AWS Systems Manager Agent on the EC2 instance to capture the desired metrics.
  • CReconfigure the CloudWatch alarms to use the VolumeReadBytes metric and the VolumeWriteBytes metric for the EBS volumes.
  • DReconfigure the CloudWatch alarms to use the VolumeReadBytes metric and the VolumeWriteBytes metric for the EC2 instance.
  解答を表示
• #51

  A company is preparing for a marketing campaign that will increase traffic to a new web application. The application uses Amazon API Gateway and AWS Lambda for the application logic. The application stores relevant user data in an Amazon Aurora MySQL DB cluster that has one Aurora Replica. Database queries for the application are 5% write and 95% read. What should a CloudOps Engineer do to scale the database when traffic increases?

  • AConfigure Aurora Auto Scaling to add or remove Aurora Replicas in the cluster based on the average CPU utilization of the Aurora Replicas.
  • BConfigure Aurora Auto Scaling to increase or decrease the size of the Aurora Replicas based on the average CPU utilization of the Aurora Replicas.
  • CConfigure AWS Auto Scaling to monitor the Aurora cluster. Configure AWS Auto Scaling to add or remove Aurora Replicas in the cluster based on the average CPU utilization of the primary instance.
  • DConfigure AWS Auto Scaling to monitor the Aurora cluster. Configure AWS Auto Scaling to add or remove Aurora Replicas in the cluster based on the average CPU utilization of the existing Aurora Replica.
  解答を表示
• #52

  An Amazon EC2 instance is running an application that uses Amazon Simple Queue Service (Amazon SQS) queues. A CloudOps Engineer must ensure that the application can read, write, and delete messages from the SQS queues. Which solution will meet these requirements in the MOST secure manner?

  • ACreate an IAM user with an IAM policy that allows the sqs:SendMessage permission, the sqs:ReceiveMessage permission, and the sqs:DeleteMessage permission to the appropriate queues Embed the IAM user's credentials in the application's configuration.
  • BCreate an IAM user with an IAM policy that allows the sqs:SendMessage permission, the sqs:ReceiveMessage permission, and the sqs:DeleteMessage permission to the appropriate queues Export the IAM user's access key and secret access key as environment variables on the EC2 instance.
  • CCreate and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM policy to the role that allows sqs: permissions to the appropriate queues.
  • DCreate and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM policy to the role that allows the sqs:SendMessage permission, the sqs:ReceiveMessage permission, and the sqs:DeleteMessage permission to the appropriate queues.
  解答を表示
• #53

  A company's CloudOps Engineer has created an Amazon EC2 instance with custom software that will be used as a template for all new EC2 instances across multiple AWS accounts. The Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the EC2 instance are encrypted with AWS managed keys. The CloudOps Engineer creates an Amazon Machine Image (AMI) of the custom EC2 instance and plans to share the AMI with the company's other AWS accounts. The company requires that all AMIs are encrypted with AWS Key Management Service (AWS KMS) keys and that only authorized AWS accounts can access the shared AMIs. Which solution will securely share the AMI with the other AWS accounts?

  • AIn the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.
  • BIn the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the KMS key. Modify the permissions on the copied AMI to specify the AWS account numbers that the AMI will be shared with.
  • CIn the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the KMS key. Modify the permissions on the copied AMI to make it public.
  • DIn the account where the AMI was created, modify the key policy of the AWS managed key to provide kms:DescribeKey, kms:ReEncrypt, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Modify the AMI permissions to specify the AWS account numbers that the AMI will be shared with.
  解答を表示
• #54

  A CloudOps Engineer is writing an AWS Lambda function in AWS Account A to put objects in an Amazon S3 bucket in AWS Account B. The Lambda function is able to successfully write new objects to the S3 bucket, but IAM users in Account B are unable to delete objects written to the bucket by Account A. Which step will fix this issue?

  • AAdd s3:DeleteObject permission to the IAM execution role of the AWS Lambda function in Account A.
  • BChange the bucket policy of the S3 bucket in Account B to allow s3:DeleteObject permission for Account A.
  • CDisable server-side encryption for objects written to the S3 bucket by the Lambda function.
  • DModify the Lambda function to call the s3:PutObjectAcl API operation to specify bucket owner, full control.
  解答を表示
• #55

  A user has created a VPC with public and private subnets using the VPC Wizard. The VPC has CIDR 20.0.0.0/16. The private subnet uses CIDR 20.0.0.0/24. Which of the below mentioned entries are required in the main route table to allow the instances in VPC to communicate with each other?

  • ADestination: 20.0.0.0/24 and Target: VPC.
  • BDestination: 20.0.0.0/16 and Target: Local.
  • CDestination: 20.0.0.0/0 and Target: ALL.
  • DDestination: 20.0.0.0/24 and Target: Local.
  解答を表示
• #56

  A company runs a worker process on three Amazon EC2 instances. The instances are in an Auto Scaling group that is configured to use a simple scaling policy. The instances process messages from an Amazon Simple Queue Service (Amazon SQS) queue. Random periods of increased messages are causing a decrease in the performance of the worker process. A CloudOps Engineer must scale the instances to accommodate the increased number of messages. Which solution will meet these requirements?

  • AUse CloudWatch to create a metric math expression to calculate the approximate age of the oldest message in the SQS queue. Create a target tracking scaling policy for the metric math expression to modify the Auto Scaling group.
  • BUse CloudWatch to create a metric math expression to calculate the approximate number of messages visible in the SQS queue for each instance. Create a target tracking scaling policy for the metric math expression to modify the Auto Scaling group.
  • CCreate an Application Load Balancer (ALB). Attach the ALB to the Auto Scaling group. Create a target tracking scaling policy for the ALB's RequestCountPerTarget metric to modify the Auto Scaling group.
  • DCreate an Application Load Balancer (ALB). Attach the ALB to the Auto Scaling group. Create a scheduled scaling policy for the Auto Scaling group.
  解答を表示
• #57

  A CloudOps Engineer needs to configure a solution that will deliver digital content to a set of authorized users through Amazon CloudFront. Unauthorized users must be restricted from access. Which solution will meet these requirements?

  • AStore the digital content in an Amazon S3 bucket that does not have public access blocked. Use signed URLs to access the S3 bucket through CloudFront.
  • BStore the digital content in an Amazon S3 bucket that has public access blocked. Use an Origin Access Identity (OAI) to deliver the content through CloudFront. Restrict S3 bucket access with signed URLs in CloudFront.
  • CStore the digital content in an Amazon S3 bucket that has public access blocked. Use an Origin Access Identity (OAI) to deliver the content through CloudFront. Enable field-level encryption.
  • DStore the digital content in an Amazon S3 bucket that does not have public access blocked. Use signed cookies for restricted delivery of the content through CloudFront.
  解答を表示
• #58

  A company uses an Amazon Elastic File System (Amazon EFS) file system to share files across many Linux Amazon EC2 instances. A CloudOps Engineer notices that the file system's PercentIOLimit metric is consistently at 100% for 15 minutes or longer. The CloudOps Engineer also notices that the application that reads and writes to that file system is performing poorly. They application requires high throughput and IOPS while accessing the file system. What should the CloudOps Engineer do to remediate the consistently high PercentIOLimit metric?

  • ACreate a new EFS file system that uses Max I/O performance mode. Use AWS DataSync to migrate data to the new EFS file system.
  • BCreate an EFS lifecycle policy to transition future files to the Infrequent Access (IA) storage class to improve performance. Use AWS DataSync to migrate existing data to IA storage.
  • CModify the existing EFS file system and activate Max I/O performance mode.
  • DModify the existing EFS file system and activate Provisioned Throughput mode.
  解答を表示
• #59

  A company is testing Amazon Elasticsearch Service (Amazon ES) as a solution for analyzing system logs from a fleet of Amazon EC2 instances. During the test phase, the domain operates on a single-node cluster. A CloudOps Engineer needs to transition the test domain into a highly available production-grade deployment. Which Amazon ES configuration should the CloudOps Engineer use to meet this requirement?

  • AUse a cluster of four data nodes across two AWS Regions. Deploy four dedicated master nodes in each Region.
  • BUse a cluster of six data nodes across three Availability Zones. Use three dedicated master nodes.
  • CUse a cluster of six data nodes across three Availability Zones. Use six dedicated master nodes.
  • DUse a cluster of eight data nodes across two Availability Zones. Deploy four master nodes in a failover AWS Region.
  解答を表示
• #602 つ選択

  A company must ensure that any objects uploaded to a S3 bucket are encrypted. Which of the following actions will meet this requirement? (Choose two.)

  • AImplement AWS Shield to protect against unencrypted objects stored in S3 buckets.
  • BImplement Object Access Control List (ACL) to deny unencrypted objects from being uploaded to the S3 bucket.
  • CImplement Amazon S3 default encryption to make sure that any object being uploaded is encrypted before it is stored.
  • DImplement Amazon Inspector to inspect objects uploaded to the S3 bucket to make sure that they are encrypted.
  • EImplement S3 bucket policies to deny unencrypted objects from being uploaded to the buckets.
  解答を表示

スコアの記録、時間制限付き模擬試験、AI解説をご利用になりますか？ 無料アカウントを作成