AWS Certified CloudOps Engineer - Associate

• #141

  A company is running a website on Amazon EC2 instances behind an Application Load Balancer (ALB). The company configured an Amazon CloudFront distribution and set the ALB as the origin. The company created an Amazon Route 53 CNAME record to send all traffic through the CloudFront distribution. As an unintended side effect, mobile users are now being served the desktop version of the website. Which action should a CloudOps Engineer take to resolve this issue?

  • AConfigure the CloudFront distribution behavior to forward the User-Agent header.
  • BConfigure the CloudFront distribution origin settings. Add a User-Agent header to the list of origin custom headers.
  • CEnable IPv6 on the ALB. Update the CloudFront distribution origin settings to use the dualstack endpoint.
  • DEnable IPv6 on the CloudFront distribution. Update the Route 53 record to use the dualstack endpoint.
  解答を表示
• #142

  An Amazon EBS volume attached to an EC2 instance was recently modified. Part of the modification included increasing the storage capacity. The CloudOps Engineer notices that the increased storage capacity is not reflected in the file system. Which step should the Engineer complete to use the increased storage capacity?

  • ARestart the EC2 instance.
  • BExtend the volume's file system.
  • CDetach the EBS volume, resize it, and attach it.
  • DTake an EBS snapshot and restore it to the bigger volume.
  解答を表示
• #143

  A company hosts an internal application on Amazon EC2 On-Demand Instances behind an Application Load Balancer (ALB). The instances are in an Amazon EC2 Auto Scaling group. Employees use the application to provide product prices to potential customers. The Auto Scaling group is configured with a dynamic scaling policy and tracks average CPU utilization of the instances. Employees have noticed that sometimes the application becomes slow or unresponsive. A CloudOps Engineer finds that some instances are experiencing a high CPU load. The Auto Scaling group cannot scale out because the company is reaching the EC2 instance service quota. The CloudOps Engineer needs to implement a solution that provides a notification when the company reaches 70% or more of the EC2 instance service quota. Which solution will meet these requirements in the MOST operationally efficient manner?

  • ACreate an AWS Lambda function that lists the EC2 instances, counts the EC2 instances, and compares the total number against the applied quota value by using the Service Quotas API. Configure the Lambda function to publish an Amazon Simple Notification Service (Amazon SNS) notification if the quota utilization is equal to or greater than 70%. Create an Amazon EventBridge rule to invoke the Lambda function.
  • BCreate an AWS Lambda function that lists the EC2 instances, counts the EC2 instances, and compares the total number against the applied quota value by using the Amazon CloudWatch Metrics API. Configure the Lambda function to publish an Amazon Simple Notification Service (Amazon SNS) notification if the quota utilization is equal to or greater than 70%. Create an Amazon EventBridge rule to invoke the Lambda function.
  • CUse the Service Quotas console to create an Amazon CloudWatch alarm for the EC2 instances. Configure the alarm with quota utilization equal to or greater than 70%. Configure the alarm to publish an Amazon Simple Notification Service (Amazon SNS) notification when the alarm enters ALARM state.
  • DCreate an Amazon CloudWatch alarm. Configure the alarm with a threshold of 70% for the CPUUtilization metric for the EC2 instances. Configure the alarm to publish an Amazon Simple Notification Service (Amazon SNS) notification when the alarm enters ALARM state.
  解答を表示
• #144

  A CloudOps Engineer launches an Amazon EC2 instance in a private subnet of a VPC. When the CloudOps Engineer attempts a curl command from the command line of the EC2 instance, the CloudOps Engineer cannot connect to https:www.example.com. What should the CloudOps Engineer do to resolve this issue?

  • AEnsure that there is an outbound security group for port 443 to 0.0.0.0/0.
  • BEnsure that there is an inbound security group for port 443 from 0.0.0.0/0.
  • CEnsure that there is an outbound network ACL for ephemeral ports 1024-66535 to 0.0.0.0/0.
  • DEnsure that there is an outbound network ACL for port 80 to 0.0.0.0/0.
  解答を表示
• #1452 つ選択

  A company wants to monitor the security groups of its Amazon EC2 instances to ensure that SSH is not open to the public. If the port is opened, the company needs to close the port as soon as possible. Which combination of actions should a CloudOps Engineer take to meet these requirements? (Choose two.)

  • AAdd an Amazon CloudWatch alarm to detect the security groups that allow SSH.
  • BAdd an AWS Config rule to detect the security groups that allow SSH.
  • CAdd an assessment template to Amazon Inspector to detect the security groups that allow SSH.
  • DCall an AWS Systems Manager Automation runbook to close the port.
  • ECall AWS Systems Manager Run Command to close the port.
  解答を表示
• #146

  A company uses AWS Organizations to manage multiple AWS accounts with consolidated billing enabled. Organization member account owners want the benefits of Reserved Instances (RIs) but do not want to share RIs with other accounts. Which solution will meet these requirements?

  • APurchase RIs in individual member accounts. Disable RI discount sharing in the management account.
  • BPurchase RIs in individual member accounts. Disable RI discount sharing in the member accounts.
  • CPurchase RIs in the management account. Disable RI discount sharing in the management account.
  • DPurchase RIs in the management account. Disable RI discount sharing in the member accounts.
  解答を表示
• #1472 つ選択

  A CloudOps Engineer is investigating why a user has been unable to use RDP to connect over the internet from their home computer to a bastion server running on an Amazon EC2 Windows instance. Which of the following are possible causes of this issue? (Choose two.)

  • AA network ACL associated with the bastion's subnet is blocking the network traffic.
  • BThe instance does not have a private IP address.
  • CThe route table associated with the bastion's subnet does not have a route to the internet gateway.
  • DThe security group for the instance does not have an inbound rule on port 22.
  • EThe security group for the instance does not have an outbound rule on port 3389.
  解答を表示
• #1482 つ選択

  A company's CloudOps Engineer manages a fleet of Windows Amazon EC2 instances that run in a single AWS account. The instances have a tag that includes a key of OS and a value of Windows. The company uses AWS Systems Manager to patch the instances. The company has installed the Amazon CloudWatch agent on the instances, but the configuration is inconsistent. The CloudOps Engineer needs to reconfigure every instance to use the same predefined CloudWatch configuration. Which combination of steps will meet these requirements? (Choose two.)

  • AStore the CloudWatch agent configuration file in an Amazon S3 bucket.
  • BStore the contents of the CloudWatch agent configuration file in Systems Manager OpsCenter.
  • CStore the contents of the CloudWatch agent configuration file in Systems Manager Parameter Store.
  • DCreate a Systems Manager State Manager association to run the AmazonCloudWatch-ManageAgent Systems Manager Run Command document. Select Systems Manager as an optional configuration source. Target the instances based on tag values.
  • ECreate a Systems Manager State Manager association to run the AmazonCloudWatch-ManageAgent Systems Manager Run Command document. Configure the document to use the S3 bucket location as the configuration source. Target the instances based on tag value.
  解答を表示
• #149

  A company has a new requirement stating that all resources In AWS must be tagged according to a set policy. Which AWS service should be used to enforce and continually Identify all resources that are not in compliance with the policy?

  • AAWS CloudTrail.
  • BAmazon Inspector.
  • CAWS Config.
  • DAWS Systems Manager.
  解答を表示
• #150

  An ecommerce company has built a web application that uses an Amazon Aurora DB cluster. The DB cluster includes memory optimized instance types with both a writer node and a reader node. Traffic volume changes throughout the day. During sudden traffic surges, Amazon CloudWatch metrics for the DB cluster indicate high RAM consumption and an increase in select latency. A CloudOps Engineer must implement a configuration change to improve the performance of the DB cluster. The change must minimize downtime and must not result in the loss of data. Which change will meet these requirements?

  • AAdd an Aurora Replica to the DB cluster.
  • BModify the DB cluster to convert the DB cluster into a multi-master DB cluster.
  • CTake a snapshot of the DB cluster. From that snapshot, create a new DB cluster that has larger memory optimized instances.
  • DIncrease the disk storage capacity of the DB cluster to double the existing disk capacity.
  解答を表示
• #151

  A CloudOps Engineer has many Windows Amazon EC2 instances that need to share a file system between nodes. The CloudOps Engineer creates an Amazon Elastic File System (Amazon EFS) file share. After creation of the file share, the CloudOps Engineer is having trouble mounting the file share to the EC2 instances. Which action should the CloudOps Engineer take so that the EC2 instances can share the files?

  • ADelete the EFS file share. Create an Amazon FSx for Windows File Server file share for the EC2 instances.
  • BUse the correct IAM credentials to mount the EFS file share.
  • CConfigure NFSv4 support on the Windows operating system that is running on the EC2 instances.
  • DAllow the correct port for NFS through the security group and network ACL.
  解答を表示
• #152

  A company is running Amazon EC2 On-Demand Instances in an Auto Scaling group. The instances process messages from an Amazon Simple Queue Service (Amazon SQS) queue. The Auto Scaling group is set to scale based on the number of messages in the queue. Messages can take up to 12 hours to process completely. A CloudOps Engineer must ensure that instances are not interrupted during message processing. What should the CloudOps Engineer do to meet these requirements?

  • AEnable instance scale-in protection for the specific instance in the Auto Scaling group at the start of message processing by calling the Amazon EC2 Auto Scaling API from the processing script. Disable instance scale-in protection after message processing is complete by calling the Amazon EC2 Auto Scaling API from the processing script.
  • BSet the Auto Scaling group's termination policy to OldestInstance.
  • CSet the Auto Scaling group's termination policy to OldestLaunchConfiguration.
  • DSuspend the Launch and Terminate scaling processes for the specific instance in the Auto Scaling group at the start of message processing by calling the Amazon EC2 Auto Scaling API from the processing script. Resume the scaling processes after message processing is complete by calling the Amazon EC2 Auto Scaling API from the processing script.
  解答を表示
• #153

  A company runs a stateless application that is hosted on an Amazon EC2 instance. Users are reporting performance issues. A CloudOps Engineer reviews the Amazon CloudWatch metrics for the application and notices that the instance's CPU utilization frequently reaches 90% during business hours. What is the MOST operationally efficient solution that will improve the application's responsiveness?

  • AConfigure CloudWatch logging on the EC2 instance. Configure a CloudWatch alarm for CPU utilization to alert the CloudOps Engineer when CPU utilization goes above 90%.
  • BConfigure an AWS Client VPN connection to allow the application users to connect directly to the EC2 instance private IP address to reduce latency.
  • CCreate an Auto Scaling group, and assign it to an Application Load Balancer. Configure a target tracking scaling policy that is based on the average CPU utilization of the Auto Scaling group.
  • DCreate a CloudWatch alarm that activates when the EC2 instance's CPU utilization goes above 80%. Configure the alarm to invoke an AWS Lambda function that vertically scales the instance.
  解答を表示
• #154

  A company has an Amazon CloudFront distribution that uses an Amazon S3 bucket as its origin. During a review of the access logs, the company determines that some requests are going directly to the S3 bucket by using the website hosting endpoint. A CloudOps Engineer must secure the S3 bucket to allow requests only from CloudFront. What should the CloudOps Engineer do to meet this requirement?

  • ACreate an Origin Access Identity (OAI) in CloudFront. Associate the OAI with the distribution. Remove access to and from other principals in the S3 bucket policy. Update the S3 bucket policy to allow access only from the OAI.
  • BCreate an Origin Access Identity (OAI) in CloudFront. Associate the OAI with the distribution. Update the S3 bucket policy to allow access only from the OAI. Create a new origin, and specify the S3 bucket as the new origin. Update the distribution behavior to use the new origin. Remove the existing origin.
  • CCreate an Origin Access Identity (OAI) in CloudFront. Associate the OAI with the distribution. Update the S3 bucket policy to allow access only from the OAI. Disable website hosting. Create a new origin, and specify the S3 bucket as the new origin. Update the distribution behavior to use the new origin. Remove the existing origin.
  • DUpdate the S3 bucket policy to allow access only from the CloudFront distribution. Remove access to and from other principals in the S3 bucket policy. Disable website hosting. Create a new origin, and specify the S3 bucket as the new origin. Update the distribution behavior to use the new origin. Remove the existing origin.
  解答を表示
• #155

  A large company is using AWS Organizations to manage its multi-account AWS environment. According to company policy, all users should have read-level access to a particular Amazon S3 bucket in a central account. The S3 bucket data should not be available outside the organization. A CloudOps Engineer must set up the permissions and add a bucket policy to the S3 bucket. Which parameters should be specified to accomplish this in the MOST efficient manner?

  • ASpecify "" as the principal and PrincipalOrgld as a condition.
  • BSpecify all account numbers as the principal.
  • CSpecify PrincipalOrgld as the principal.
  • DSpecify the organization's management account as the principal.
  解答を表示
• #156

  A company currently runs its infrastructure within a VPC in a single Availability Zone. The VPC is connected to the company's on-premises data center through an AWS Site-to-Site VPN connection attached to a virtual private gateway. The on-premises route tables route all VPC networks to the VPN connection. Communication between the two environments is working correctly. A CloudOps Engineer created new VPC subnets within a new Availability Zone, and deployed new resources within the subnets. However, communication cannot be established between the new resources and the on-premises environment. Which steps should the CloudOps Engineer take to resolve the issue?

  • AAdd a route to the route tables of the new subnets that send on-premises traffic to the virtual private gateway.
  • BCreate a ticket with AWS Support to request adding Availability Zones to the Site-to-Site VPN route configuration.
  • CEstablish a new Site-to-Site VPN connection between a virtual private gateway attached to the new Availability Zone and the on-premises data center.
  • DReplace the Site-to-Site VPN connection with an AWS Direct Connect connection.
  解答を表示
• #157

  A company is partnering with an external vendor to provide data processing services. For this integration, the vendor must host the company's data in an Amazon S3 bucket in the vendor's AWS account. The vendor is allowing the company to provide an AWS Key Management Service (AWS KMS) key to encrypt the company's data. The vendor has provided an IAM role Amazon Resources Name (ARN) to the company for this integration. What should a CloudOps Engineer do to configure this integration?

  • ACreate a new KMS key. Add the vendor's IAM role ARN to the KMS key policy. Provide the new KMS key ARN to the vendor.
  • BCreate a new KMS key. Create a new IAM user. Add the vendor's IAM role ARN to an inline policy that is attached to the IAM user. Provide the new IAM user ARN to the vendor.
  • CConfigure encryption using the KMS managed S3 key. Add the vendor's IAM role ARN to the KMS managed S3 key policy. Provide the KMS managed S3 key ARN to the vendor.
  • DConfigure encryption using the KMS managed S3 key. Create a S3 bucket. Add the vendor's IAM role ARN to the S3 bucket policy. Provide the S3 bucket ARN to the vendor.
  解答を表示
• #158

  A company is running a new promotion that will result in a massive spike in traffic for a single application. The CloudOps Engineer must prepare the application and ensure that the customers have a great experience. The application is heavy on memory and is running behind an AWS Application Load Balancer (ALB). The ALB has been pre-warmed, and the application is in an Auto Scaling group. What built-in metric should be used to control the Auto Scaling group's scaling policy?

  • ARejectedConnectionCount.
  • BRequestCountPerTarget.
  • CCPUUtilization.
  • DMemoryUtilization.
  解答を表示
• #159

  A company analyzes sales data for its customers. Customers upload files to one of the company's Amazon S3 buckets, and a message is posted to an Amazon Simple Queue Service (Amazon SQS) queue that contains the object Amazon Resource Name (ARN). An application that runs on an Amazon EC2 instance polls the queue and processes the messages. The processing time depends on the size of the file. Customers are reporting delays in the processing of their files. A CloudOps Engineer decides to configure Amazon EC2 Auto Scaling as the first step. The CloudOps Engineer creates an Amazon Machine Image (AMI) that is based on the existing EC2 instance. The CloudOps Engineer also creates a launch template that references the AMI. How should the CloudOps Engineer configure the Auto Scaling policy to improve the response time?

  • AAdd several different instance sizes in the launch template. Create an Auto Scaling policy based on the ApproximateNumberOfMessagesVisible metric to select the size of the instance based on the number of messages in the queue.
  • BCreate an Auto Scaling policy based on the ApproximateNumberOfMessagesDelayed metric to scale the number of instances based on the number of messages in the queue that have been delayed.
  • CCreate a custom metric based on the ASGAverageCPUUtilization metric and the GroupPendingInstances metric from the Auto Scaling group. Modify the application to calculate the metric and post the metric to Amazon CloudWatch once each minute. Create an Auto Scaling policy based on this metric to scale the number of instances.
  • DCreate a custom metric based on the ApproximateNumberOfMessagesVisible metric and the number of instances in the InService state in the Auto Scaling group. Modify the application to calculate the metric and post the metric to Amazon CloudWatch once each minute. Create an Auto Scaling policy based on this metric to scale the number of instances.
  解答を表示
• #160

  A global company handles a large amount of personally identifiable information (Pll) through an internal web portal. The company's application runs in a corporate data center that is connected to AWS through an AWS Direct Connect connection. The application stores the Pll in Amazon S3. According to a compliance requirement, traffic from the web portal to Amazon S3 must not travel across the internet. What should a CloudOps Engineer do to meet the compliance requirement?

  • AProvision an interface VPC endpoint for Amazon S3. Modify the application to use the interface endpoint.
  • BConfigure AWS Network Firewall to redirect traffic to the internal S3 address.
  • CModify the application to use the S3 path-style endpoint.
  • DSet up a range of VPC network ACLs to redirect traffic to the Internal S3 address.
  解答を表示

スコアの記録、時間制限付き模擬試験、AI解説をご利用になりますか？ 無料アカウントを作成