AWS Certified CloudOps Engineer - Associate

• #3012 つ選択

  A CloudOps Engineer is maintaining a web application using an Amazon CloudFront web distribution, an Application Load Balancer (ALB), Amazon RDS, and Amazon EC2 in a VPC. All services have logging enabled. The Engineer needs to investigate HTTP Layer 7 status codes from the web application. Which log sources contain the status codes? (Choose two.)

  • AVPC Flow Logs.
  • BAWS CloudTrail logs.
  • CALB access logs.
  • DCloudFront access logs.
  • ERDS logs.
  解答を表示
• #302

  A root account owner has given full access of his S3 bucket to one of the IAM users using the bucket ACL. When the IAM user logs in to the S3 console, which actions can he perform?

  • AHe can just view the content of the bucket.
  • BHe can do all the operations on the bucket.
  • CIt is not possible to give access to an IAM user using ACL.
  • DThe IAM user can perform all operations on the bucket using only API/SDK.
  解答を表示
• #303

  An Amazon EC2 instance in a private subnet needs to copy data to an Amazon S3 bucket. For security reasons, the connection from the EC2 instance to Amazon S3 must not traverse across the Internet. What action should the CloudOps Engineer take to accomplish this?

  • ACreate a NAT instance and route traffic destined to Amazon S3 through it.
  • BCreate a VPN connection between the EC2 instance and Amazon S3.
  • CCreate an S3 VPC endpoint in the VPC where the EC2 instance resides.
  • DUse AWS Direct Connect to maximize throughput and keep the traffic private.
  解答を表示
• #304

  A CloudOps Engineer is troubleshooting an AWS CloudFormation template whereby multiple Amazon EC2 instances are being created. The template is working In us-east-1, but it is failing. In us-west-2 with the error code: AMI [ami-12345678] does not exist. How should the Engineer ensure that the AWS CloudFormation template is working in every region?

  • ACopy the source region's Amazon Machine Image (AMI) to the destination region and assign it the same ID.
  • BEdit the AWS CloudFormatton template to specify the region code as part of the fully qualified AMI ID.
  • CEdit the AWS CloudFormatton template to offer a drop-down list of all AMIs to the user by using the AWS::EC2::AMI::ImageID control.
  • DModify the AWS CloudFormation template by including the AMI IDs in the Mappings section. Refer to the proper mapping within the template for the proper AMI ID.
  解答を表示
• #305

  With the threat of ransomware viruses encrypting and holding company data hostage, which action should be taken to protect an Amazon S3 bucket?

  • ADeny Post, Put, and Delete on the bucket.
  • BEnable server-side encryption on the bucket.
  • CEnable Amazon S3 versioning on the bucket.
  • DEnable snapshots on the bucket.
  解答を表示
• #306

  A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group across multiple Availability Zones. A CloudOps Engineer notices that some of these EC2 instances show up as healthy in the Auto Scaling group but show up as unhealthy in the ALB target group. What is a possible reason for this issue?

  • ASecurity groups are not allowing traffic between the ALB and the failing EC2 instances.
  • BThe Auto Scaling group health check is configured for EC2 status checks.
  • CThe EC2 instances are failing to launch and failing EC2 status checks.
  • DThe target group health check is configured with an incorrect port or path.
  解答を表示
• #307

  A CloudOps Engineer is creating resources from an AWS CloudFormation template that defines an Auto Scaling group of Amazon EC2 instances. The Auto Scaling group launch template provisions each EC2 instance by using a user data script. The creation of the Auto Scaling group resource is failing because of an error. The wait condition is not receiving the required number of signals. How should the CloudOps Engineer resolve this error?

  • ARun cfn-signal at the completion of the user data script.
  • BModify the EC2 instances' security group to allow outgoing traffic on port 443.
  • CReduce the Auto Scaling group's DesiredCapacity value in the CloudFormation template.
  • DSet the AssociatePublicIpAddress property to True in the Auto Scaling group launch template.
  解答を表示
• #308

  A company manages its multi-account environment by using AWS Organizations. The company needs to automate the creation of daily incremental backups of any Amazon Elastic Block Store (Amazon EBS) volume that is marked with a Lifecycle: Production tag in one of its primary AWS accounts. The company wants to prevent users from using Amazon EC2 permissions to delete any of these production snapshots. What should a CloudOps Engineer do to meet these requirements?

  • ACreate a daily snapshot of all EBS volumes by using Amazon Data Lifecycle Manager. Specify Lifecycle as the tag key. Specify Production as the tag value.
  • BAssociate a Service Control Policy (SCP) with the account to deny users the ability to delete EBS snapshots. Create an Amazon EventBridge rule with a 24-hour cron schedule. Configure EBS Create Snapshot as the target. Target all EBS volumes with the specified tags.
  • CCreate a daily snapshot of all EBS volumes by using AWS Backup. Specify Lifecycle as the tag key. Specify Production as the tag value.
  • DCreate a daily Amazon Machine Image (AMI) of every production EC2 instance within the AWS account by using Amazon Data Lifecycle Manager.
  解答を表示
• #309

  A CloudOps Engineer launches an Amazon EC2 Linux instance in a public subnet. When the instance is running, the CloudOps Engineer obtains the public IP address and attempts to remotely connect to the instance multiple times. However, the CloudOps Engineer always receives a timeout error. Which action will allow the CloudOps Engineer to remotely connect to the instance?

  • AAdd a route table entry in the public subnet for the CloudOps Engineer's IP address.
  • BAdd an outbound network ACL rule to allow TCP port 22 for the CloudOps Engineer's IP address.
  • CModify the instance security group to allow inbound SSH traffic from the CloudOps Engineer's IP address.
  • DModify the instance security group to allow outbound SSH traffic to the CloudOps Engineer's IP address.
  解答を表示
• #310

  An application is running on an Amazon EC2 instance in a VPC with the default DHCP option set. The application connects to an on-premises Microsoft SQL. Server database with the DNS name mssql.example.com. The application is unable to resolve the database DNS name. Which solution will fix this problem?

  • ACreate an Amazon Route 53 Resolver inbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.
  • BCreate an Amazon Route 53 Resolver inbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.
  • CCreate an Amazon Route 53 Resolver outbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.
  • DCreate an Amazon Route 53 Resolver outbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.
  解答を表示
• #311

  A company runs hundreds of Amazon EC2 instances in a single AWS Region. Each EC2 instance has two attached 1 GiB General Purpose SSD (gp2) Amazon Elastic Block Store (Amazon EBS) volumes. A critical workload is using all the available IOPS capacity on the EBS volumes. According to company policy, the company cannot change instance types or EBS volume types without completing lengthy acceptance tests to validate that the company's applications will function properly. A CloudOps Engineer needs to increase the I/O performance of the EBS volumes as quickly as possible. Which action should the CloudOps Engineer take to meet these requirements?

  • AIncrease the size of the 1 GiB EBS volumes.
  • BAdd two additional elastic network interfaces on each EC2 instance.
  • CTurn on Transfer Acceleration on the EBS volumes in the Region.
  • DAdd all the EC2 instances to a cluster placement group.
  解答を表示
• #312

  A company updates its security policy to prohibit the public exposure of any data in Amazon S3 buckets in the company's account. What should a CloudOps Engineer do to meet this requirement?

  • ATurn on S3 Block Public Access from the account level.
  • BCreate an Amazon Event Bridge (Amazon CloudWatch Events) rule to enforce that all S3 objects are private.
  • CUse Amazon Inspector to search for S3 buckets and to automatically reset S3 ACLs if any public S3 buckets are found.
  • DUse S3 Object Lambda to examine S3 ACLs and to change any public S3 ACLs to private.
  解答を表示
• #313

  A company has several member accounts that are in an organization in AWS Organizations. The company recently discovered that administrators have been using account root user credentials. The company must prevent the Engineers from using root user credentials to perform any actions on Amazon EC2 instances. What should a CloudOps Engineer do to meet this requirement?

  • ACreate an identity-based IAM policy in each member account to deny actions on EC2 instances by the root user.
  • BIn the organization's management account, create a Service Control Policy (SCP) to deny actions on EC2 instances by the root user in all member accounts.
  • CUse AWS Config to prevent any actions on EC2 instances by the root user.
  • DUse Amazon Inspector in each member account to scan for root user logins and to prevent any actions on EC2 instances by the root user
  解答を表示
• #3142 つ選択

  A financial service company is running distributed computing software to manage a fleet of 20 servers for their calculations. There are 2 control nodes and 18 worker nodes to run the calculations. Worker nodes can be automatically started by the control nodes when required. Currently, all nodes are running on demand, and the worker nodes are used for approximately 4 hours each day. Which combination of actions will be MOST cost-effective? (Choose two.)

  • AUse Dedicated Hosts for the control nodes.
  • BUse Reserved Instances for the control nodes.
  • CUse Reserved Instances for the worker nodes.
  • DUse Spot Instances for the control nodes and On-Demand Instances if there is no Spot availability.
  • EUse Spot Instances for the worker nodes and On-Demand Instances if there is no Spot availability.
  解答を表示
• #315

  A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet (port 80) and a DB server in the private subnet (port 3306). The user is configuring a security group for the public subnet (WebSecGrp) and the private subnet (DBSecGrp). Which of the below mentioned entries is required in the web server security group (WebSecGrp)?

  • AConfigure Destination as DB Security group ID (DbSecGrp) for port 3306 outbound.
  • B80 for Destination 0.0.0.0/0 outbound.
  • CConfigure port 3306 for source 20.0.0.0/24 inbound.
  • DConfigure port 80 inbound for source 20.0.0.0/16.
  解答を表示
• #3162 つ選択

  A company runs a retail website on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The company must secure traffic to the website over an HTTPS connection. Which combination of actions should a CloudOps Engineer take to meet these requirements? (Choose two.)

  • AAttach the certificate to each EC2 instance.
  • BAttach the certificate to the ALB.
  • CCreate a private certificate in AWS Certificate Manager (ACM).
  • DCreate a public certificate in AWS Certificate Manager (ACM).
  • EExport the certificate, and attach it to the website.
  解答を表示
• #3172 つ選択

  A CloudOps Engineer found that a newly-deployed Amazon EC2 application server is unable to connect to an existing Amazon RDS database. After enabling VPC Flow Logs and confirming that the flow log is active on the console, the log group cannot be located in Amazon CloudWatch. What are the MOST likely reasons for this situation? (Choose two.)

  • AThe Engineer must configure the VPC Flow Logs to have them sent to AWS CloudTrail.
  • BThe Engineer has waited less than ten minutes for the log group to be created in CloudWatch.
  • CThe account VPC Flow Logs have been disabled by using a Service Control Policy.
  • DNo relevant traffic has been sent since the VPC Flow Logs were created.
  • EThe account has Amazon GuardDuty enabled.
  解答を表示
• #318

  A CloudOps Engineer maintains several Amazon EC2 instances that do not have access to the public internet. To patch operating systems, the instances require outbound internet connectivity. For security reasons, the instances should not be reachable from the public Internet. The Engineer deploys a NAT instance, updates the security groups, and configures the appropriate routes within the route table. However, the instances are still unable to reach the Internet. What should be done to resolve the issue?

  • AAssign Elastic IP addresses to the instances and create a route from the private subnets to the internet gateway.
  • BDelete the NAT instance and replace it with AWS WAF.
  • CDisable source/destination checks on the NAT instance.
  • DStart/stop the NAT instance so it is launched on a different host.
  解答を表示
• #319

  A company hosts a static website on Amazon S3. The website is served by an Amazon CloudFront distribution with a default TTL of 86,400 seconds. The company recently uploaded an updated version of the website to Amazon S3. However, users still see the old content when they refresh the site. A CloudOps Engineer must make the new version of the website visible to users as soon as possible. Which solution meets these requirements?

  • AAdjust the TTL value for the DNS CNAME record that is pointing to the CloudFront distribution.
  • BCreate an invalidation on the CloudFront distribution for the old S3 objects.
  • CCreate a new CloudFront distribution. Update the DNS records to point to the new CloudFront distribution.
  • DUpdate the DNS record for the website to point to the S3 bucket.
  解答を表示
• #320

  A CloudOps Engineer is required to monitor free space on Amazon EBS volumes attached to Microsoft Windows-based Amazon EC2 instances within a company's account. The Engineer must be alerted to potential issues. What should the Engineer do to receive email alerts before low storage space affects EC2 instance performance?

  • AUse built-in Amazon CloudWatch metrics, and configure CloudWatch alarms and an Amazon SNS topic for email notifications.
  • BUse AWS CloudTrail logs and configure the trail to send notifications to an Amazon SNS topic.
  • CUse the Amazon CloudWatch agent to send disk space metrics, then set up CloudWatch alarms using an Amazon SNS topic.
  • DUse AWS Trusted Advisor and enable email notification alerts for EC2 disk space.
  解答を表示

スコアの記録、時間制限付き模擬試験、AI解説をご利用になりますか？ 無料アカウントを作成