AWS Certified CloudOps Engineer - Associate

• #2812 つ選択

  A company is running distributed computing software to manage a fleet of 20 Amazon EC2 instances for calculations. The fleet includes 2 control nodes and 18 task nodes to run the calculations. Control nodes can automatically start the task nodes. Currently, all the nodes run on demand. The control nodes must be available 24 hours a day, 7 days a week. The task nodes run for 4 hours each day. A CloudOps Engineer needs to optimize the cost of this solution. Which combination of actions will meet these requirements? (Choose two.)

  • APurchase EC2 Instance Savings Plans for the control nodes.
  • BUse Dedicated Hosts for the control nodes.
  • CUse Reserved Instances for the task nodes.
  • DUse Spot Instances for the control nodes. Use On-Demand Instances if there is no Spot availability.
  • EUse Spot Instances for the task nodes. Use On-Demand Instances if there is no Spot availability.
  解答を表示
• #2823 つ選択

  A CloudOps Engineer has set up a new Amazon EC2 instance as a web server in a public subnet. The instance uses HTTP port 80 and HTTPS port 443. The CloudOps Engineer has confirmed internet connectivity by downloading operating system updates and software from public repositories. However, the CloudOps Engineer cannot access the instance from a web browser on the internet. Which combination of steps should the CloudOps Engineer take to troubleshoot this issue? (Choose three.)

  • AEnsure that the inbound rules of the instance's security group allow traffic on ports 80 and 443.
  • BEnsure that the outbound rules of the instance's security group allow traffic on ports 80 and 443.
  • CEnsure that ephemeral ports 1024-65535 are allowed in the inbound rules of the network ACL that is associated with the instance's subnet.
  • DEnsure that ephemeral ports 1024-65535 are allowed in the outbound rules of the network ACL that is associated with the instance's subnet.
  • EEnsure that the filtering rules for any firewalls that are running on the instance allow inbound traffic on ports 80 and 443.
  • FEnsure that AWS WAF is turned on for the instance and is blocking web traffic.
  解答を表示
• #283

  A company uses an AWS CloudFormation template to provision an Amazon EC2 instance and an Amazon RDS DB instance. A CloudOps Engineer must update the template to ensure that the DB instance is created before the EC2 instance is launched. What should the CloudOps Engineer do to meet this requirement?

  • AAdd a wait condition to the template. Update the EC2 instance user data script to send a signal after the EC2 instance is started.
  • BAdd the DependsOn attribute to the EC2 instance resource, and provide the logical name of the RDS resource.
  • CChange the order of the resources in the template so that the RDS resource is listed before the EC2 instance resource.
  • DCreate multiple templates. Use AWS CloudFormation StackSets to wait for one stack to complete before the second stack is created.
  解答を表示
• #284

  An errant process is known to use an entire processor and run at 100%. A CloudOps Engineer wants to automate restarting an Amazon EC2 instance when the problem occurs for more than 2 minutes. How can this be accomplished?

  • ACreate an Amazon CloudWatch alarm for the EC2 instance with basic monitoring. Add an action to restart the instance.
  • BCreate an Amazon CloudWatch alarm for the EC2 instance with detailed monitoring. Add an action to restart the instance.
  • CCreate an AWS Lambda function to restart the EC2 instance, invoked on a scheduled basis every 2 minutes.
  • DCreate an AWS Lambda function to restart the EC2 instance, invoked by EC2 health checks.
  解答を表示
• #285

  A company has a policy that requires all Amazon EC2 instances to have a specific set of tags. If an EC2 instance does not have the required tags, the noncompliant instance should be terminated. What is the MOST operationally efficient solution that meets these requirements?

  • ACreate an Amazon EventBridge (Amazon CloudWatch Events) rule to send all EC2 instance state changes to an AWS Lambda function to determine if each instance is compliant. Terminate any noncompliant instances.
  • BCreate an IAM policy that enforces all EC2 instance tag requirements. If the required tags are not in place for an instance, the policy will terminate noncompliant instance.
  • CCreate an AWS Lambda function to determine if each EC2 instance is compliant and terminate an instance if it is noncompliant. Schedule the Lambda function to invoke every 5 minutes.
  • DCreate an AWS Config rule to check if the required tags are present. If an EC2 instance is noncompliant, invoke an AWS Systems Manager Automation document to terminate the instance.
  解答を表示
• #286

  A user has created a VPC with CIDR 20.0.0.0/16 using the wizard. The user has created a public subnet CIDR 20.0.0.0/24 and VPN only subnets CIDR 20.0.1.0/24 along with the VPN gateway vgw-12345 to connect to the user's data center. The user's data center has CIDR 172.28.0.0/12. The user has also setup a NAT instance i-123456 to allow traffic to the internet from the VPN subnet. Which of the below mentioned options is not a valid entry for the main route table in this scenario?

  • ADestination: 20.0.1.0/24 and Target: i-12345.
  • BDestination: 0.0.0.0/0 and Target: i-12345.
  • CDestination: 172.28.0.0/12 and Target: vgw-12345.
  • DDestination: 20.0.0.0/16 and Target: local.
  解答を表示
• #287

  A company has an application that collects notifications from thousands of alarm systems. The notifications include alarm notifications and information notifications. The information notifications include the system arming processes, disarming processes, and sensor status. All notifications are kept as messages in an Amazon Simple Queue Service (Amazon SQS) queue. Amazon EC2 instances that are in an Auto Scaling group process the messages. A CloudOps Engineer needs to implement a solution that prioritizes alarm notifications over information notifications. Which solution will meet these requirements?

  • AAdjust the Auto Scaling group to scale faster when a high number of messages is in the queue.
  • BUse the Amazon Simple Notification Service (Amazon SNS) fanout feature with Amazon SQS to send the notifications in parallel to all the C2 instances.
  • CAdd an Amazon DynamoDB stream to accelerate the message processing.
  • DCreate a queue for alarm notifications and a queue for information notifications. Update the application to collect messages from the alarm notifications queue first.
  解答を表示
• #288

  When the AWS Cloud infrastructure experiences an event that may impact an organization, which AWS service can be used to see which of the organization's resources are affected?

  • AAWS Service Health Dashboard.
  • BAWS Trusted Advisor.
  • CAWS Personal Health Dashboard.
  • DAWS Systems Manager.
  解答を表示
• #2892 つ選択

  An application is running on multiple EC2 instances. As part of an initiative to improve overall infrastructure security, the EC2 instances were moved to a private subnet. However, since moving, the EC2 instances have not been able to automatically update, and a CloudOps Engineer has not been able to SSH into them remotely. Which two actions could the Engineer take to securely resolve these issues? (Choose two.)

  • ASet up a bastion host in a public subnet, and configure security groups and route tables accordingly.
  • BSet up a bastion host in the private subnet, and configure security groups accordingly.
  • CConfigure a load balancer in a public subnet, and configure the route tables accordingly.
  • DSet up a NAT gateway in a public subnet, and change the private subnet route tables accordingly.
  • ESet up a NAT gateway in a private subnet, and ensure that the route tables are configured accordingly.
  解答を表示
• #290

  A user has created a VPC with CIDR 20.0.0.0/16 using the wizard. The user has created a public subnet CIDR 20.0.0.0/24 and VPN only subnets CIDR 20.0.1.0/24 along with the VPN gateway vgw-12345 to connect to the user's data center. Which of the below mentioned options is a valid entry for the main route table in this scenario?

  • ADestination: 20.0.0.0/24 and Target: vgw-12345.
  • BDestination: 20.0.0.0/16 and Target: ALL.
  • CDestination: 20.0.1.0/16 and Target: vgw-12345.
  • DDestination: 0.0.0.0/0 and Target: vgw-12345.
  解答を表示
• #291

  A company uses an Amazon S3 bucket to store data files. The S3 bucket contains hundreds of objects. The company needs to replace a tag on all the objects in the S3 bucket with another tag. What is the MOST operationally efficient way to meet this requirement?

  • AUse S3 Batch Operations. Specify the operation to replace all object tags.
  • BUse the AWS CLI to get the tags for each object. Save the tags in a list. Use S3 Batch Operations. Specify the operation to delete all object tags. Use the AWS CLI and the list to retag the objects.
  • CUse the AWS CLI to get the tags for each object. Save the tags in a list. Use the AWS CLI and the list to remove the object tags. Use the AWS CLI and the list to retag the objects.
  • DUse the AWS CLI to copy the objects to another S3 bucket. Add the new tag to the copied objects. Delete the original objects.
  解答を表示
• #292

  A CloudOps Engineer maintains the security and compliance of a company's AWS account. To ensure the company's Amazon EC2 instances are following company policy, a CloudOps Engineer wants to terminate any EC2 instance that do not contain a department tag. Noncompliant resources must be terminated in near-real time. Which solution will meet these requirements?

  • ACreate an AWS Config rule with the required-tags managed rule to identify noncompliant resources. Configure automatic remediation to run the AWS TerminateEC2Instance automation document to terminate noncompliant resources.
  • BCreate a new Amazon EventBridge (Amazon CloudWatch Events) rule to monitor when new EC2 instances are created. Send the event to a Simple Notification Service (Amazon SNS) topic for automatic remediation.
  • CEnsure all users who can create EC2 instances also have the permissions to use the ec2:CreateTags and ec2:DescribeTags actions. Change the instance's shutdown behavior to terminate.
  • DEnsure AWS Systems Manager Compliance is configured to manage the EC2 instances. Call the AWS-StopEC2Instances automation document to stop noncompliant resources.
  解答を表示
• #293

  A user has created a VPC with public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The private subnet uses CIDR 20.0.0.0/24. The NAT instance ID is i-a12345. Which of the below mentioned entries are required in the main route table attached with the private subnet to allow instances to connect with the internet?

  • ADestination: 0.0.0.0/0 and Target: i-a12345.
  • BDestination: 20.0.0.0/0 and Target: 80.
  • CDestination: 20.0.0.0/0 and Target: i-a12345.
  • DDestination: 20.0.0.0/24 and Target: i-a12345.
  解答を表示
• #294

  A CloudOps Engineer creates an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that uses AWS Fargate. The cluster is deployed successfully. The CloudOps Engineer needs to manage the cluster by using the kubectl command line tool. Which of the following must be configured on the CloudOps Engineer's machine so that kubectl can communicate with the cluster API server?

  • AThe kubeconfig file.
  • BThe kube-proxy Amazon EKS add-on.
  • CThe Fargate profile.
  • DThe eks-connector.yaml file.
  解答を表示
• #295

  An Amazon S3 bucket in a CloudOps Engineer's account can be accesses by users in other AWS accounts. How can the Engineer ensure that the bucket is only accessible to members of the Engineer's AWS account?

  • AMove the S3 bucket from a public subnet to a private subnet in the Amazon VPC.
  • BChange the bucket Access Control List (ACL) to restrict access to the bucket owner.
  • CEnable server-side encryption for all objects in the bucket.
  • DUse only Amazon S3 presigned URLs for accessing objects in the bucket.
  解答を表示
• #296

  A company uses an Amazon Simple Queue Service (Amazon SQS) standard queue with its application. The application sends messages to the queue with unique message bodies. The company decides to switch to an SQS FIFO queue. What must the company do to migrate to an SQS FIFO queue?

  • ACreate a new SQS FIFO gueue. Turn on content based deduplication on the new FIFO queue. Update the application to include a message group ID in the messages.
  • BCreate a new SQS FIFO queue. Update the application to include the DelaySeconds parameter in the messages.
  • CModify the queue type from SQS standard to SQS FIFO. Turn off content-based deduplication on the queue. Update the application to include a message group ID in the messages.
  • DModify the queue type from SQS standard to SQS FIFO. Update the application to send messages with identical message bodies and to include the DelaySeconds parameter in the messages.
  解答を表示
• #297

  A CloudOps Engineer has created an AWS Service Catalog portfolio and has shared the portfolio with a second AWS account in the company. The second account is controlled by a different engineer. Which action will the Engineer of the second account be able to perform?

  • AAdd a product from the imported portfolio to a local portfolio.
  • BAdd new products to the imported portfolio.
  • CChange the launch role for the products contained in the imported portfolio.
  • DCustomize the products in the imported portfolio.
  解答を表示
• #298

  A company runs a web application that users access using the domain name www.example.com. The company manages the domain name using Amazon Route 53. The company created an Amazon CloudFront distribution in front of the application and would like www.example.com to access the application through CloudFront. What is the MOST cost-effective way to achieve this?

  • ACreate a CNAME record in Amazon Route 53 that points to the CloudFront distribution URL.
  • BCreate an ALIAS record in Amazon Route 53 that points to the CloudFront distribution URL.
  • CCreate an A record in Amazon Route 53 that points to the public IP address of the web application.
  • DCreate a PTR record in Amazon Route 53 that points to the public IP address of the web application.
  解答を表示
• #299

  A company uses AWS Organizations to manage its AWS accounts. A CloudOps Engineer must create a backup strategy for all Amazon EC2 instances across all the company's AWS accounts. Which solution will meet these requirements in the MOST operationally efficient way?

  • ADeploy an AWS Lambda function to each account to run EC2 instance snapshots on a scheduled basis.
  • BCreate an AWS CloudFormation stack set in the management account to add an AutoBackup=True tag to every EC2 instance.
  • CUse AWS Backup in the management account to deploy policies for all accounts and resources.
  • DUse a Service Control Policy (SCP) to run EC2 instance snapshots on a scheduled basis in each account.
  解答を表示
• #3002 つ選択

  A company has an application that uses an Amazon S3 bucket for object storage. A developer needs to configure in-transit encryption for the S3 bucket. All the S3 objects containing personal data needs to be encrypted at rest with AWS Key Management Service (AWS KMS) keys, which can be rotated on demand. Which combination of steps will meet these requirements? (Choose two.)

  • AWrite a S3 bucket policy to allow only encrypted connections over HTTPS by using permissions boundary.
  • BConfigure a S3 bucket policy to enable client-side encryption for the objects containing personal data by using an AWS KMS customer managed key.
  • CConfigure the application to encrypt the objects by using an AWS KMS customer managed key before uploading the objects containing personal data to Amazon S3.
  • DWrite a S3 bucket policy to allow only encrypted connections over HTTPS by using the aws:SecureTransport condition.
  • EConfigure S3 Block Public Access settings for the S3 bucket to allow only encrypted connections over HTTPS.
  解答を表示

スコアの記録、時間制限付き模擬試験、AI解説をご利用になりますか？ 無料アカウントを作成