AWS Certified CloudOps Engineer - Associate

• #612 つ選択

  A company has an Auto Scaling group of Amazon EC2 instances that scale based on average CPU utilization. The Auto Scaling group events log indicates an InsufficientInstanceCapacity error. Which actions should a CloudOps Engineer take to remediate this issue? (Choose two.)

  • AChange the instance type that the company is using.
  • BConfigure the Auto Scaling group in different Availability Zones.
  • CConfigure the Auto Scaling group to use different Amazon Elastic Block Store (Amazon EBS) volume sizes.
  • DIncrease the maximum size of the Auto Scaling group.
  • ERequest an increase in the instance service quota.
  解答を表示
• #62

  A company runs an application that hosts critical data for several clients. The company uses AWS CloudTrail to track user activities on various AWS resources. To meet new security requirements, the company needs to protect the CloudTrail log files from being modified, deleted, or forged. Which solution will meet these requirement?

  • AEnable CloudTrail log file integrity validation.
  • BUse Amazon S3 MFA Delete on the S3 bucket where the CloudTrail log files are stored.
  • CUse Amazon S3 Versioning to keep all versions of the CloudTrail log files.
  • DUse AWS Key Management Service (AWS KMS) security keys to secure the CloudTrail log files.
  解答を表示
• #63

  A CloudOps Engineer is troubleshooting connection timeouts to an Amazon EC2 instance that has a public IP address. The instance has a private IP address of 172.31.16.139. When the CloudOps Engineer tries to ping the instance's public IP address from the remote IP address 203.0.113.12, the response is request timed out. The flow logs contain the following information: What is one cause of the problem?

  • AInbound security group deny rule.
  • BOutbound security group deny rule.
  • CNetwork ACL inbound rules.
  • DNetwork ACL outbound rules.
  解答を表示
• #64

  A CloudOps Engineer wants to upload a file that is 1 TB in size from on-premises to an Amazon S3 bucket using multipart uploads. What should the CloudOps Engineer do to meet this requirement?

  • AUpload the file using the S3 console.
  • BUse the s3api copy-object command.
  • CUse the s3api put-object command.
  • DUse the s3 cp command.
  解答を表示
• #65

  A company runs us Infrastructure on Amazon EC2 Instances that run In an Auto Scaling group. Recently, the company promoted faulty code to the entire EC2 fleet. This faulty code caused the Auto Scaling group to scale the instances before any of the application logs could be retrieved. What should a CloudOps Engineer do to retain the application logs after instances are terminated?

  • AConfigure an Auto Scaling lifecycle hook to create a snapshot of the ephemeral storage upon termination of the instances.
  • BCreate a new Amazon Machine Image (AMI) that has the Amazon CloudWatch agent installed and configured to send logs to Amazon CloudWatch Logs. Update the launch template to use the new AMI.
  • CCreate a new Amazon Machine Image (AMI) that has a custom script configured to send logs to AWS CloudTrail. Update the launch template to use the new AMI.
  • DInstall the Amazon CloudWatch agent on the Amazon Machine Image (AMI) that is defined in the launch template. Configure the CloudWatch agent to back up the logs to ephemeral storage.
  解答を表示
• #662 つ選択

  A CloudOps Engineer wants to provide access to AWS services by attaching an IAM policy to multiple IAM users. The CloudOps Engineer also wants to be able to change the policy and create new versions. Which combination of actions will meet these requirements? (Choose two.)

  • AAdd the users to an IAM service-linked role. Attach the policy to the role.
  • BAdd the users to an IAM user group. Attach the policy to the group.
  • CCreate an AWS managed policy.
  • DCreate a customer managed policy.
  • ECreate an inline policy.
  解答を表示
• #67

  A CloudOps Engineer working on an Amazon EC2 instance has misconfigured the clock by one hour. The EC2 instance is sending data to Amazon CloudWatch through the CloudWatch agent. The timestamps on the logs are 45 minutes in the future. What will be the result of this configuration?

  • AAmazon CloudWatch will not capture the data because it is in the future.
  • BAmazon CloudWatch will accept the custom metric data and record it.
  • CThe Amazon CloudWatch agent will check the Network Time Protocol (NTP) server before sending the data, and the agent will correct the time.
  • DThe Amazon CloudWatch agent will check the Network Time Protocol (NTP) server, and the agent will not send the data because it is more than 30 minutes in the future.
  解答を表示
• #68

  A CloudOps Engineer is managing an AWS account where Developers are authorized to launch Amazon EC2 instances to test new code. To limit costs, the Engineer must ensure that the EC2 instances in the account are terminated 24 hours after launch. How should the Engineer meet these requirements?

  • ACreate an Amazon CloudWatch alarm based on the CPUUtilization metric. When the metric is 0% for 24 hours, trigger an action to terminate the EC2 instance when the alarm is triggered.
  • BCreate an AWS Lambda function to check all EC2 instances and terminate instances running more than 24 hours. Trigger the function with an Amazon CloudWatch Events event every 15 minutes.
  • CAdd an action to AWS Trusted Advisor to turn off EC2 instances based on the Low Utilization Amazon EC2 Instances check, terminating instances identified by Trusted Advisor as running for more than 24 hours.
  • DInstall the unified Amazon CloudWatch agent on every EC2 instance. Configure the agent to terminate instances after they have been running for 24 hours.
  解答を表示
• #69

  A CloudOps Engineer is attempting to download patches from the internet into an instance in a private subnet. An internet gateway exists for the VPC, and a NAT gateway has been deployed on the public subnet; however, the instance has no internet connectivity. The resources deployed into the private subnet must be inaccessible directly from the public internet. What should be added to the private subnet's route table in order to address this issue, given the information provided?

  • A0.0.0.0/0 IGW.
  • B0.0.0.0/0 NAT.
  • C10.0.1.0/24 IGW.
  • D10.0.1.0/24 NAT.
  解答を表示
• #70

  A company has an application that is running on Amazon EC2 instances in a VPC. The application needs access to download software updates from the internet. The VPC has public subnets and private subnets. The company's security policy requires all EC2 instances to be deployed in private subnets. What should a CloudOps Engineer do to meet these requirements?

  • AAdd an internet gateway to the VPC. In the route table for the private subnets, add a route to the internet gateway.
  • BAdd a NAT gateway to a private subnet. In the route table for the private subnets, add a route to the NAT gateway.
  • CAdd a NAT gateway to public subnet. In the route table for the private subnets, add a route to the NAT gateway.
  • DAdd two internet gateways to the VPC. In the route tables for the private subnets and public subnets, add a route to each internet gateway.
  解答を表示
• #71

  A company has a high-performance Windows workload. The workload requires a storage volume that provides consistent performance of 10,000 IOPS. The company does not want to pay for additional unneeded capacity to achieve this performance. Which solution will meet these requirements with the LEAST cost?

  • AUse a Provisioned IOPS SSD (io1) Amazon Elastic Block Store (Amazon EBS) volume that is configured with 10,000 provisioned IOPS.
  • BUse a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume that is configured with 10,000 provisioned IOPS.
  • CUse an Amazon Elastic File System (Amazon EFS) file system in Max I/O mode.
  • DUse an Amazon FSx for Windows File Server file system that is configured with 10,000 IOPS.
  解答を表示
• #72

  A company has a policy that all Amazon EC2 instance logs must be published to Amazon CloudWatch Logs. A CloudOps Engineer is troubleshooting an EC2 instance that is running Amazon Linux 2. The EC2 instance is not publishing logs to CloudWatch Logs. The Amazon CloudWatch agent is running on the EC2 instance, and the agent configuration file is correct. What should the CloudOps Engineer do to resolve the issue?

  • AConfigure the AWS CLI on the EC2 instance. Create a cron job that calls the PutLogEvents API operation to push the log files to CloudWatch every 5 minutes.
  • BInspect the retention period of the CloudWatch Logs log group. Ensure that the retention period is set to a value that is greater than 1 day.
  • CSet up an Amazon Kinesis data stream that is running in the same AWS Region as the EC2 instance. Configure the CloudWatch agent on the EC2 instance to send CloudWatch events to the data stream.
  • DEnsure that the IAM role that is attached to the EC2 instance has permissions in CloudWatch Logs for the CreateLogGroup, CreateLogStream, PutLogEvents, and DescribeLogStreams actions.
  解答を表示
• #73

  A company has a web application with a database tier that consists of an Amazon EC2 instance that runs MySQL. A CloudOps Engineer needs to minimize potential data loss and the time that is required to recover in the event of a database failure. What is the MOST operationally efficient solution that meets these requirements?

  • ACreate an Amazon CloudWatch alarm for the StatusCheckFailed_System metric to invoke an AWS Lambda function that stops and starts the EC2 instance.
  • BCreate an Amazon RDS for MySQL Multi-AZ DB instance. Use a MySQL native backup that is stored in Amazon S3 to restore the data to the new database. Update the connection string in the web application.
  • CCreate an Amazon RDS for MySQL Single-AZ DB instance with a read replica. Use a MySQL native backup that is stored in Amazon S3 to restore the data to the new database. Update the connection string in the web application.
  • DUse Amazon Data Lifecycle Manager (Amazon DLM) to take a snapshot of the Amazon Elastic Block Store (Amazon EBS) volume every hour. In the event of an EC2 instance failure, restore the EBS volume from a snapshot.
  解答を表示
• #74

  A CloudOps Engineer is notified that an Amazon EC2 instance has stopped responding. The AWS Management Console indicates that the system checks are failing. What should the Engineer do first to resolve this issue?

  • AReboot the EC2 instance so it can be launched on a new host.
  • BStop and then start the EC2 instance so that it can be launched on a new host.
  • CTerminate the EC2 instance and relaunch it.
  • DView the AWS CloudTrail log to investigate what changed on the EC2 instance.
  解答を表示
• #75

  A CloudOps Engineer is troubleshooting a VPC with public and private subnets that leverage custom network ACLs. Instances in the private subnet are unable to access the internet. There is an internet gateway attached to the public subnet. The private subnet has a route to a NAT gateway that is also attached to the public subnet. The Amazon EC2 instances are associated with the default security group for the VPC. What is causing the issue in this scenario?

  • AThere is a network ACL on the private subnet set to deny all outbound traffic.
  • BThere is no NAT gateway deployed in the private subnet of the VPC.
  • CThe default security group for the VPC blocks all inbound traffic to the EC2 instances.
  • DThe default security group for the VPC blocks all outbound traffic from the EC2 instances.
  解答を表示
• #76

  A company uses AWS Organizations. A CloudOps Engineer wants to use AWS Compute Optimizer and AWS tag policies in the management account to govern all member accounts in the billing family. The CloudOps Engineer navigates to the AWS Organizations console but cannot activate tag policies through the management account. What could be the reason for this issue?

  • AAll features have not been enabled in the organization.
  • BConsolidated billing has not been enabled.
  • CThe member accounts do not have tags enabled for cost allocation.
  • DThe member accounts have not manually enabled trusted access for Compute Optimizer.
  解答を表示
• #77

  A company has users that deploy Amazon EC2 instances that have more disk performance capacity than is required. A CloudOps Engineer needs to review all Amazon Elastic Block Store (Amazon EBS) volumes that are associated with the instances and create cost optimization recommendations based on IOPS and throughput. What should the CloudOps Engineer do to meet these requirements in the MOST operationally efficient way?

  • AUse the monitoring graphs in the EC2 console to view metrics for EBS volumes. Review the consumed space against the provisioned space on each volume. Identify any volumes that have low utilization.
  • BStop the EC2 instances from the EC2 console. Change the EC2 instance type for Amazon EBS-optimized. Start the EC2 instances.
  • COpt in to AWS Compute Optimizer. Allow sufficient time for metrics to be gathered. Review the Compute Optimizer findings for EBS volumes.
  • DInstall the fio tool onto the EC2 instances and create a .cfg file to approximate the required workloads. Use the benchmark results to gauge whether the provisioned EBS volumes are of the most appropriate type.
  解答を表示
• #78

  A company uses Amazon Elasticsearch Service (Amazon ES) to analyze sales and customer usage data. Members of the company's geographically dispersed sales team are traveling. They need to log in to Kibana by using their existing corporate credentials that are stored in Active Directory. The company has deployed Active Directory Federation Services (AD FS) to enable authentication to cloud services. Which solution will meet these requirements?

  • AConfigure Active Directory as an authentication provider in Amazon ES. Add the Active Directory server's domain name to Amazon ES. Configure Kibana to use Amazon ES authentication.
  • BDeploy an Amazon Cognito user pool. Configure Active Directory as an external identity provider for the user pool. Enable Amazon Cognito authentication for Kibana on Amazon ES.
  • CEnable Active Directory user authentication in Kibana. Create an IP-based custom domain access policy in Amazon ES that includes the Active Directory server's IP address.
  • DEstablish a trust relationship with Kibana on the Active Directory server. Enable Active Directory user authentication in Kibana. Add the Active Directory server's IP address to Kibana.
  解答を表示
• #79

  A company has an AWS Lambda function in Account A. The Lambda function needs to read the objects in an Amazon S3 bucket in Account B. A CloudOps Engineer must create corresponding IAM roles in both accounts. Which solution will meet these requirements?

  • AIn Account A, create a Lambda execution role to assume the role in Account B. In Account B, create a role that the function can assume to gain access to the S3 bucket.
  • BIn Account A, create a Lambda execution role that provides access to the S3 bucket. In Account B, create a role that the function can assume.
  • CIn Account A, create a role that the function can assume. In Account B, create a Lambda execution role that provides access to the S3 bucket.
  • DIn Account A, create a role that the function can assume to gain access to the S3 bucket. In Account B, create a Lambda execution role to assume the role in Account A.
  解答を表示
• #80

  Users are periodically experiencing slow response times from a relational database. The database runs on a burstable Amazon EC2 instance with a 350 GB General Purpose SSD (gp2) Amazon Elastic Block Store (Amazon EBS) volume. A CloudOps Engineer monitors the EC2 instance in Amazon CloudWatch and observes that the VolumeReadOps metric drops to less than 10% of its peak value during the periods of slow response. What should the CloudOps Engineer do to ensure consistently high performance?

  • AConvert the gp2 volume to a General Purpose SSD (gp3) EBS volume.
  • BConvert the gp2 volume to a Cold HDD (sc1) EBS volume.
  • CConvert the EC2 instance to a memory optimized instance type.
  • DActivate unlimited mode on the EC2 instance.
  解答を表示

スコアの記録、時間制限付き模擬試験、AI解説をご利用になりますか？ 無料アカウントを作成