AWS Certified CloudOps Engineer - Associate

• #161

  A company hosts a web application on an Amazon EC2 instance in a production VPC. Client connections to the application are failing. A CloudOps Engineer inspects the VPC flow logs and finds the following entry. What is a possible cause of these failed connections?

  • AA security group deny rule is blocking traffic on port 443.
  • BThe EC2 instance is shut down.
  • CThe network ACL is blocking HTTPS traffic.
  • DThe VPC has no internet gateway attached.
  解答を表示
• #162

  A company runs an application on Amazon EC2 instances. The EC2 instances are in an Auto Scaling group and run behind an Application Load Balancer (ALB). The application experiences errors when total requests exceed 100 requests per second. A CloudOps Engineer must collect information about total requests for a 2-week period to determine when requests exceeded this threshold. What should the CloudOps Engineer do to collect this data?

  • AUse the ALB's RequestCount metric. Configure a time range of 2 weeks and a period of 1 minute. Examine the chart to determine peak traffic times and volumes.
  • BUse Amazon CloudWatch metric math to generate a sum of request counts for all the EC2 instances over a 2-week period. Sort by a 1-minute interval.
  • CCreate Amazon CloudWatch custom metrics on the EC2 launch configuration templates to create aggregated request metrics across all the EC2 instances.
  • DCreate an Amazon EventBridge (Amazon CloudWatch Events) rule. Configure an EC2 event matching pattern that creates a metric that is based on EC2 requests. Display the data in a graph.
  解答を表示
• #163

  A team of On-call engineers frequently needs to connect to Amazon EC2 Instances In a private subnet to troubleshoot and run commands. The Instances use either the latest AWS-provided Windows Amazon Machine Images (AMIs) or Amazon Linux AMIs. The team has an existing IAM role for authorization. A CloudOps Engineer must provide the team with access to the Instances by granting IAM permissions to this role. Which solution will meet this requirement?

  • AAdd a statement to the IAM role policy to allow the ssm:StartSession action on the instances. Instruct the team to use AWS Systems Manager Session Manager to connect to the Instances by using the assumed IAM role.
  • BAssociate an Elastic IP address and a security group with each instance. Add the engineers' IP addresses to the security group inbound rules. Add a statement to the IAM role policy to allow the ec2:AuthoflzeSecurityGroupIngress action so that the team can connect to the Instances.
  • CCreate a bastion host with an EC2 Instance, and associate the bastion host with the VPC. Add a statement to the IAM role policy to allow the ec2:CreateVpnConnection action on the bastion host. Instruct the team to use the bastion host endpoint to connect to the instances.
  • DCreate an internet-facing Network Load Balancer. Use two listeners. Forward port 22 to a target group of Linux instances. Forward port 3389 to a target group of Windows Instances. Add a statement to the IAM role policy to allow the ec2:CreateRoute action so that the team can connect to the Instances.
  解答を表示
• #1642 つ選択

  A company has Sales department and Marketing department. The company uses one AWS account. There is a need to determine what charges are incurred on the AWS platform by each department. There is also a need to receive notifications when a specified cost level is approached or exceeded. Which two actions must a CloudOps Engineer take to achieve both requirements with the LEAST amount of administrative overhead? (Choose two.)

  • AUse AWS Trusted Advisor to obtain a report containing the checked items in the Cost Optimization pillar.
  • BDownload the detailed billing report, upload it to a database, and match the line items with a list of known resources by department.
  • CCreate a script by using the AWS CLI to automatically apply tags to existing resources to each department. Schedule the script to run weekly.
  • DUse AWS Organizations to create a department Organizational Unit and allow only authorized personnel in each department to create resources.
  • ECreate a Budget from the Billing and Cost Management console. Specify the budget type a Cost, assign tags for each department, define notifications, and specify any other options as required.
  解答を表示
• #165

  A company is using Amazon CloudWatch alarms to monitor Amazon Elastic Kubernetes Service (Amazon EKS) workloads. The alarms are initiated through a threshold definition and are not helping the EKS cluster operate more efficiently. A CloudOps Engineer must implement a solution that identifies anomalies and generates recommendations for how to address the anomalies. Which solution will meet these requirements?

  • AUse CloudWatch anomaly detection to identify anomalies and provide recommendations.
  • BUse CloudWatch Container Insights with Amazon DevOps Guru to identify anomalies and provide recommendations.
  • CUse CloudWatch Container Insights to identify anomalies and provide recommendations.
  • DUse CloudWatch anomaly detection with CloudWatch Container Insights to identify anomalies and provide recommendations.
  解答を表示
• #1662 つ選択

  A company has an application that uses Amazon DynamoDB tables. The tables are spread across AWS accounts and AWS Regions. The company uses AWS CloudFormation to deploy AWS resources. A new team at the company is deleting unused AWS resources. The team accidentally deletes several production DynamoDB tables by running an AWS Lambda function that makes a DynamoDB DeleteTable API call. The table deletions cause an application outage. A CloudOps Engineer must implement a solution that minimizes the chance of accidental deletions of tables. The solution also must minimize data loss that results from accidental deletions. Which combination of steps will meet these requirements? (Choose two.)

  • AEnable termination protection for the CloudFormation stacks that deploy the DynamoDB tables.
  • BEnable deletion protection for the DynamoDB tables.
  • CEnable point-in-time recovery for the DynamoDB tables. Restore the tables if they are accidentally deleted.
  • DSchedule daily backups of the DynamoDB tables. Restore the tables if they are accidentally deleted.
  • EExport the DynamoDB tables to Amazon S3 every day. Use Import from Amazon S3 to restore data for tables that are accidentally deleted.
  解答を表示
• #167

  A company hosts its website in the us-east-1 Region. The company is preparing to deploy its website into the eu-central-1 Region. Website visitors who are located in Europe should access the website that is hosted in eu-central-1. All other visitors access the website that is hosted in us-east-1. The company uses Amazon Route 53 to manage the website's DNS records. Which routing policy should a CloudOps Engineer apply to the Route 53 record set to meet these requirements?

  • AGeolocation routing policy.
  • BGeoproximity routing policy.
  • CLatency routing policy.
  • DMultivalue answer routing policy.
  解答を表示
• #168

  A company uses AWS Organizations to host several applications across multiple AWS accounts. Several teams are responsible for building and maintaining the infrastructure of the applications across the AWS accounts. A CloudOps Engineer must implement a solution to ensure that user accounts and permissions are centrally managed. The solution must be integrated with the company's existing on-premises Active Directory environment. The CloudOps Engineer already has enabled AWS IAM Identity Center (AWS Single Sign-On) and has set up an AWS Direct Connect connection. What is the MOST operationally efficient solution that meets these requirements?

  • ACreate a Simple AD domain, and establish a forest trust relationship with the on-premises Active Directory domain. Set the Simple AD domain as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
  • BCreate an Active Directory domain controller on an Amazon EC2 instance that is joined to the on-premises Active Directory domain. Set the Active Directory domain controller as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
  • CCreate an AD Connector that is associated with the on-premises Active Directory domain. Set the AD Connector as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
  • DUse the built-in SSO directory as the identity source for IAM Identity Center. Copy the users and groups from the on-premises Active Directory domain. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
  解答を表示
• #169

  A company is managing many accounts by using a single organization in AWS Organizations. The organization has all features enabled. The company wants to turn on AWS Config in all the accounts of the organization and in all AWS Regions. What should a CloudOps Engineer do to meet these requirements in the MOST operationally efficient way?

  • AUse AWS CloudFormation StackSets to deploy stack instances that turn on AWS Config in all accounts and in all Regions.
  • BUse AWS CloudFormation StackSets to deploy stack policies that turn on AWS Config in all accounts and in all Regions.
  • CUse Service Control Policies (SCPs) to configure AWS Config in all accounts and in all Regions.
  • DCreate a script that uses the AWS CLI to turn on AWS Config in all accounts in the organization. Run the script from the organization's management account.
  解答を表示
• #170

  A CloudOps Engineer is investigating a company's web application for performance problems. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The application receives large traffic increases at random times throughout the day. During periods of rapid traffic increases, the Auto Scaling group is not adding capacity fast enough. As a result, users are experiencing poor performance. The company wants to minimize costs without adversely affecting the user experience when web traffic surges quickly. The company needs a solution that adds more capacity to the Auto Scaling group for larger traffic increases than for smaller traffic increases. How should the CloudOps Engineer configure the Auto Scaling group to meet these requirements?

  • ACreate a simple scaling policy with settings to make larger adjustments in capacity when the system is under heavy load.
  • BCreate a step scaling policy with settings to make larger adjustments in capacity when the system is under heavy load.
  • CCreate a target tracking scaling policy with settings to make larger adjustments in capacity when the system is under heavy load.
  • DUse Amazon EC2 Auto Scaling lifecycle hooks. Adjust the Auto Scaling group's maximum number of instances after every scaling event.
  解答を表示
• #1712 つ選択

  A CloudOps Engineer created an AWS Lambda function within a VPC with no access to the Internet. The Lambda function pulls messages from an Amazon SQS queue and stores them in an Amazon RDS instance in the same VPC. After executing the Lambda function, the data is not showing up on the RDS instance. Which of the following are possible causes for this? (Choose two.)

  • AA VPC endpoint has not been created for Amazon RDS.
  • BA VPC endpoint has not been created for Amazon SQS.
  • CThe RDS security group is not allowing connections from the Lambda function.
  • DThe subnet associated with the Lambda function does not have an internet gateway attached.
  • EThe subnet associated with the Lambda function has a NAT gateway.
  解答を表示
• #172

  An e-commerce company wants to lower costs on its nightly jobs that aggregate the current day's sales and store the results in Amazon S3. The jobs are currently run using multiple on-demand instances and the jobs take just under 2 hours to complete. If a job fails for any reason, it needs to be restarted from the beginning. What method is the MOST cost effective based on these requirements?

  • AUse a mixture of On-Demand and Spot Instances for job execution.
  • BSubmit a request for a Spot block to be used for job execution.
  • CPurchase Reserved Instances to be used for job execution.
  • DSubmit a request for a one-time Spot Instance for job execution.
  解答を表示
• #173

  The chief financial officer (CFO) of an organization has seen a spike in Amazon S3 storage costs over the last few months. A CloudOps Engineer suspects that these costs are related to storage for older versions of S3 objects from one of its S3 buckets. What can the Engineer do to confirm this suspicion?

  • AEnable Amazon S3 inventory and then query the inventory to identify the total storage of previous object versions.
  • BUse object-level cost allocation tags to identify the total storage of previous object versions.
  • CEnable the Amazon S3 analytics feature for the bucket to identify the total storage of previous object versions.
  • DUse Amazon CloudWatch storage metrics for the S3 bucket to identify the total storage of previous object versions.
  解答を表示
• #174

  A CloudOps Engineer creates a new VPC that includes a public subnet and a private subnet. The CloudOps Engineer successfully launches 11 Amazon EC2 instances in the private subnet. The CloudOps Engineer attempts to launch one more EC2 instance in the same subnet. However, the CloudOps Engineer receives an error message that states that not enough free IP addresses are available. What must the CloudOps Engineer do to deploy more EC2 instances?

  • AEdit the private subnet to change the CIDR block to /27.
  • BEdit the private subnet to extend across a second Availability Zone.
  • CAssign additional Elastic IP addresses to the private subnet.
  • DCreate a new private subnet to hold the required EC2 instances.
  解答を表示
• #175

  A company has a mobile app that uses Amazon S3 to store images The images are popular for a week, and then the number of access requests decreases over time The images must be highly available and must be immediately accessible upon request A CloudOps Engineer must reduce S3 storage costs for the company. Which solution will meet these requirements MOST cost-effectively?

  • ACreate a S3 Lifecycle policy to transition the images to S3 Glacier after 7 days.
  • BCreate a S3 Lifecycle policy to transition the images to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 7 days.
  • CCreate a S3 Lifecycle policy to transition the images to S3 Standard after 7 days.
  • DCreate a S3 Lifecycle policy to transition the images to S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days.
  解答を表示
• #176

  A company runs an application on an Amazon EC2 instance. A CloudOps Engineer creates an Auto Scaling group and an Application Load Balancer (ALB) to handle an increase in demand. However, the EC2 instances are failing the health check. What should the CloudOps Engineer do to troubleshoot this issue?

  • AVerify that the Auto Scaling group is configured to use all AWS Regions.
  • BVerify that the application is running on the protocol and the port that the listener is expecting.
  • CVerify the listener priority in the ALB. Change the priority if necessary.
  • DVerify the maximum number of instances in the Auto Scaling group. Change the number if necessary.
  解答を表示
• #177

  A company runs an application on hundreds of Amazon EC2 instances in three Availability Zones. The application calls a third-party API over the public internet. A CloudOps Engineer must provide the third party with a list of static IP addresses so that the third party can allow traffic from the application. Which solution will meet these requirements?

  • AAdd a NAT gateway in the public subnet of each Availability Zone. Make the NAT gateway the default route of all private subnets in those Availability Zones.
  • BAllocate one Elastic IP address in each Availability Zone. Associate the Elastic IP address with all the instances in the Availability Zone.
  • CPlace the instances behind a Network Load Balancer (NLB). Send the traffic to the internet through the private IP address of the NLB.
  • DUpdate the main route table to send the traffic to the internet through an Elastic IP address that is assigned to each instance.
  解答を表示
• #178

  A CloudOps Engineer configures an application to run on Amazon EC2 instances behind an Application Load Balancer (ALB) in a simple scaling Auto Scaling group with the default settings. The Auto Scaling group is configured to use the RequestCountPerTarget metric for scaling. The CloudOps Engineer notices that the RequestCountPerTarget metric exceeded the specified limit twice in 180 seconds. How will the number of EC2 instances in this Auto Scaling group be affected in this scenario?

  • AThe Auto Scaling group will launch an additional EC2 instance every time the RequestCountPerTarget metric exceeds the predefined limit.
  • BThe Auto Scaling group will launch one EC2 instance and will wait for the default cooldown period before launching another instance.
  • CThe Auto Scaling group will send an alert to the ALB to rebalance the traffic and not add new EC2 instances until the load is normalized.
  • DThe Auto Scaling group will try to distribute the traffic among all EC2 instances before launching another instance.
  解答を表示
• #179

  A company requires that all activity in its AWS account be logged using AWS CloudTrail. Additionally, a CloudOps Engineer must know when CloudTrail log files are modified or deleted. How should the CloudOps Engineer meet these requirements?

  • AEnable log file integrity validation. Use the AWS CLI to validate the log files.
  • BEnable log file integrity validation. Use the AWS CloudTrail Processing Library to validate the log files.
  • CUse CloudTrail Insights to monitor the log files for modifications.
  • DUse Amazon CloudWatch Logs to monitor the log files for modifications.
  解答を表示
• #180

  A CloudOps Engineer needs to configure an Amazon S3 bucket to host a web application. The CloudOps Engineer has created the S3 bucket and has copied the static files for the web application to the S3 bucket. The company has a policy that all S3 buckets must not be public. What should the CloudOps Engineer do to meet these requirements?

  • ACreate an Amazon CloudFront distribution. Configure the S3 bucket as an origin with an Origin Access Identity (OAI). Give the OAI the s3:GetObject permission in the S3 bucket policy.
  • BConfigure static website hosting in the S3 bucket. Use Amazon Route 53 to create a DNS CNAME to point to the S3 website endpoint.
  • CCreate an Application Load Balancer (ALB). Change the protocol to HTTPS in the ALB listener configuration. Forward the traffic to the S3 bucket.
  • DCreate an accelerator in AWS Global Accelerator. Set up a listener configuration for port 443. Set the endpoint type to forward the traffic to the S3 bucket.
  解答を表示

スコアの記録、時間制限付き模擬試験、AI解説をご利用になりますか？ 無料アカウントを作成