AWS Certified CloudOps Engineer - Associate

• #361

  A company is running a flash sale on its website. The website is hosted on burstable performance Amazon EC2 instances in an Auto Scaling group. The Auto Scaling group is configured to launch instances when the CPU utilization is above 70%. A couple of hours into the sale, users report slow load times and error messages for refused connections. A CloudOps Engineer reviews Amazon CloudWatch metrics and notices that the CPU utilization is at 20% across the entire fleet of instances. The CloudOps Engineer must restore the website's functionality without making changes to the network infrastructure. Which solution will meet these requirements?

  • AActivate unlimited mode for the instances in the Auto Scaling group.
  • BImplement an Amazon CloudFront distribution to offload the traffic from the Auto Scaling group.
  • CMove the website to a different AWS Region that is closer to the users.
  • DReduce the desired size of the Auto Scaling group to artificially increase CPU average utilization.
  解答を表示
  💬ディスカッション
• #362

  A CloudOps Engineer is responsible for managing a company's cloud infrastructure with AWS CloudFormation. The CloudOps Engineer needs to create a single resource that consists of multiple AWS services. The resource must support creation and deletion through the CloudFormation console. Which CloudFormation resource type should the CloudOps Engineer create to meet these requirements?

  • AAWS::EC2::Instance with a cfn-init helper script.
  • BAWS::OpsWorks::Instance.
  • CAWS::SSM::Document.
  • DCustom::MyCustomType.
  解答を表示
  💬ディスカッション
• #363

  An Application team has asked a CloudOps Engineer to provision an additional environment for an application in four additional regions. The application is running on more than 100 instances in us-east-1, using fully baked AMIs. An AWS CloudFormation template has been created to deploy resources in us-east-1. What must the CloudOps Engineer do to provision the application quickly?

  • ACopy the AMI to each region using aws ec2 copy-image. Update the CloudFormation mapping to include mappings for the copied AMIs.
  • BCreate a snapshot of the running instance and copy the snapshot to the other regions. Create an AMI from the snapshots. Update the CloudFormation template for each region to use the new AMI.
  • CRun the existing CloudFormation template in each additional region based on the success of the template used currently in us-east-1.
  • DUpdate the CloudFormation template to include the additional regions in the Auto Scaling group. Update the existing stack in us-east-1.
  解答を表示
  💬ディスカッション
• #3642 つ選択

  An organization stores sensitive customer in S3 buckets protected by bucket policies. Recently, there have been reports that unauthorized entities within the company have been trying to access the data on those S3 buckets. The Chief Information Security Officer (CISO) would like to know which buckets are being targeted and determine who is responsible for trying to access that information. Which steps should a CloudOps Engineer take to meet the CISO's requirement? (Choose two.)

  • AEnable Amazon S3 Analytics on all affected S3 buckets to obtain a report of which buckets are being accessed without authorization.
  • BEnable Amazon S3 Server Access Logging on all affected S3 buckets and have the logs stored in a bucket dedicated for logs.
  • CUse Amazon Athena to query S3 Analytics report for HTTP 403 errors, and determine the IAM user or role making the requests.
  • DUse Amazon Athena to query the S3 Server Access Logs for HTTP 403 errors, and determine the IAM user or role making the requests.
  • EUse Amazon Athena to query the S3 Server Access Logs for HTTP 503 errors, and determine the IAM user or role making the requests.
  解答を表示
  💬ディスカッション
• #365

  A company needs to view a list of security groups that are open to the internet on port 3389. What should a CloudOps Engineer do to meet this requirement?

  • AConfigure Amazon GuardDuty to scan security groups and report unrestricted access on port 3389.
  • BConfigure a Service Control Policy (SCP) to identify security groups that allow unrestricted access on port 3389.
  • CUse AWS Identity and Access Management Access Analyzer to find any instances that have unrestricted access on port 3389.
  • DUse AWS Trusted Advisor to find security groups that allow unrestricted access on port 3389.
  解答を表示
  💬ディスカッション
• #366

  A company monitors its account activity using AWS CloudTrail, and is concerned that some log files are being tampered with after the logs have been delivered to the account's Amazon S3 bucket. Moving forward, how can the CloudOps Engineer confirm that the log files have not been modified after being delivered to the S3 bucket?

  • AStream the CloudTrail logs to Amazon CloudWatch Logs to store logs at a secondary location.
  • BEnable log file integrity validation and use digest files to verify the hash value of the log file.
  • CReplicate the S3 log bucket across regions, and encrypt log files with S3 managed keys.
  • DEnable S3 server access logging to track requests made to the log bucket for security audits.
  解答を表示
  💬ディスカッション
• #367

  The security team is concerned because the number of AWS Identity and Access Management (IAM) policies being used in the environment is increasing. The team tasked a CloudOps Engineer to report on the current number of IAM policies in use and the total available IAM policies. Which AWS service should the Engineer use to check how current IAM policy usage compares to current service limits?

  • AAWS Trusted Advisor.
  • BAmazon Inspector.
  • CAWS Config.
  • DAWS Organizations.
  解答を表示
  💬ディスカッション
• #368

  A company recently deployed MySQL on an Amazon EC2 instance with a default boot volume. The company intends to restore a 1.75 TB database. A CloudOps Engineer needs to provision the correct Amazon Elastic Block Store (Amazon EBS) volume. The database will require read performance of up to 10,000 IOPS and is not expected to grow in size. Which solution will provide the required performance at the LOWEST cost?

  • ADeploy a 2 TB Cold HDD (sc1) volume.
  • BDeploy a 2 TB Throughput Optimized HDD (st1) volume.
  • CDeploy a 2 TB General Purpose SSD (gp3) volume. Set the IOPS to 10,000.
  • DDeploy a 2 TB Provisioned IOPS SSD (io2) volume. Set the IOPS to 10,000.
  解答を表示
  💬ディスカッション
• #369

  A company recently deployed an application in production. The production environment currently runs on a single Amazon EC2 instance that hosts the application's web application and a MariaDB database. Company policy states that all IT production environments must be highly available. What should a CloudOps Engineer do to meet this requirement?

  • AMigrate the database from the EC2 instance to an Amazon RDS for MariaDB Multi-AZ DB instance. Run the application on EC2 instances that are in an Auto Scaling group that extends across multiple Availability Zones. Place the EC2 instances behind a load balancer.
  • BMigrate the database from the EC2 instance to an Amazon RDS for MariaDB Multi-AZ DB instance. Use AWS Application Migration Service to convert the application into an AWS Lambda function. Specify the Multi-AZ option for the Lambda function.
  • CCopy the database to a different EC2 instance in a different Availability Zone. Use AWS Backup to create Amazon Machine Images (AMIs) of the application EC2 instance and the database EC2 instance. Create an AWS Lambda function that performs health checks every minute. In case of failure, configure the Lambda function to launch a new EC2 instance from the AMIs that AWS Backup created.
  • DMigrate the database to a different EC2 instance. Place the application EC2 instance in an Auto Scaling group that extends across multiple Availability Zones. Create an Amazon Machine Image (AMI) from the database EC2 instance. Use the AMI to launch a second database EC2 instance in a different Availability Zone. Put the second database EC2 instance in the stopped state. Use the second database EC2 instance as a standby.
  解答を表示
  💬ディスカッション
• #370

  A CloudOps Engineer manages a company's Amazon S3 buckets. The CloudOps Engineer has identified 5 GB of incomplete multipart uploads in a S3 bucket in the company's AWS account. The CloudOps Engineer needs to reduce the number of incomplete multipart upload objects in the S3 bucket. Which solution will meet this requirement?

  • ACreate a S3 Lifecycle rule on the S3 bucket to delete expired markers or incomplete multipart uploads.
  • BRequire users that perform uploads of files into Amazon S3 to use the S3 TransferUtility.
  • CEnable S3 Versioning on the S3 bucket that contains the incomplete multipart uploads.
  • DCreate a S3 Object Lambda Access Point to delete incomplete multipart uploads.
  解答を表示
  💬ディスカッション
• #371

  AnyCompany has acquired Example Corp and is attempting to consolidate the business systems of both companies. AnyCompany's IT department needs to integrate with Example Corp's IT ticketing system. A CloudOps Engineer must implement a solution that uses Amazon CloudWatch alarms for Amazon EC2 instances in AnyCompany's account to create new tickets in Example Corp's ticketing system. The ticketing system provides an HTTPS endpoint for the creation of new tickets. The ticketing system accepts messages in the following JSON format. Which approach to creating tickets from the CloudWatch alarms will meet these requirements with the LEAST development time?

  • ACreate an Amazon EventBridge rule that filters appropriate events and specifies EventBridge API destinations as a target. Configure EventBridge API destinations to send events to the HTTPS endpoint. In the EventBridge rule, create an input transformer to convert the source to a compatible output for the ticketing system.
  • BCreate an Amazon EventBridge rule that filters appropriate events and specifies an Amazon Kinesis data stream as the target. Create an AWS Lambda function to receive events from the Kinesis data stream. Configure the Lambda function to start an AWS Glue job to transform the data and forward the output to the HTTPS endpoint.
  • CCreate an Amazon EventBridge rule that filters appropriate events and specifies Amazon Simple Notification Service (Amazon SNS) as a target. Configure Amazon SNS to transform the events and send the events to the HTTPS endpoint.
  • DCreate an Amazon EventBridge rule that filters appropriate events and specifies an AWS Step Functions state machine as a target. Create an AWS Lambda function and an AWS Glue job in Step Functions to transform the events and send the events to the HTTPS endpoint.
  解答を表示
  💬ディスカッション
• #372

  A company is expanding its use of AWS services across its portfolios. The company wants to provision AWS accounts for each team to ensure a separation of business processes for security compliance and billing. Account creation and bootstrapping should be completed in a scalable and efficient way so new accounts are created with a defined baseline and governance guardrails in place. A CloudOps Engineer needs to design a provisioning process that saves time and resources. Which action should be taken to meet these requirements?

  • AAutomate using AWS Elastic Beanstalk to provision the AWS accounts set up infrastructure and integrate with AWS Organizations.
  • BCreate bootstrapping scripts in AWS OpsWorks and combine them with AWS CloudFormation templates to provision accounts and infrastructure.
  • CUse AWS Config to provision accounts and deploy instances using AWS Service Catalog.
  • DUse AWS Control Tower to create a template in Account Factory and use the template to provision new accounts.
  解答を表示
  💬ディスカッション
• #373

  A CloudOps Engineer needs to give users the ability to upload objects to an Amazon S3 bucket. The CloudOps Engineer creates a presigned URL and provides the URL to a user, but the user cannot upload an object to the S3 bucket. The presigned URL has not expired, and no bucket policy is applied to the S3 bucket. Which of the following could be the cause of this problem?

  • AThe user has not properly configured the AWS CLI with their access key and secret access key.
  • BThe CloudOps Engineer does not have the necessary permissions to upload the object to the S3 bucket.
  • CThe CloudOps Engineer must apply a bucket policy to the S3 bucket to allow the user to upload the object.
  • DThe object already has been uploaded through the use of the presigned URL, so the presigned URL is no longer valid.
  解答を表示
  💬ディスカッション
• #374

  A company uploaded its website files to an Amazon S3 bucket that has S3 Versioning enabled. The company uses an Amazon CloudFront distribution with the S3 bucket as the origin. The company recently modified the files, but the object names remained the same. Users report that old content is still appearing on the website. How should a CloudOps Engineer remediate this issue?

  • ACreate a CloudFront invalidation, and add the path of the updated files.
  • BCreate a CloudFront signed URL to update each object immediately.
  • CConfigure a S3 Origin Access Identity (OAI) to display only the updated files to users.
  • DDisable S3 Versioning on the S3 bucket so that the updated files can replace the old files.
  解答を表示
  💬ディスカッション
• #375

  An errant process is known to use an entire processor and run at 100%. A CloudOps Engineer wants to automate restarting the instance once the problem occurs for more than 2 minutes. How can this be accomplished?

  • ACreate an Amazon CloudWatch alarm for the Amazon EC2 instance with basic monitoring. Enable an action to restart the instance.
  • BCreate a CloudWatch alarm for the EC2 instance with detailed monitoring. Enable an action to restart the instance.
  • CCreate an AWS Lambda function to restart the EC2 instance triggered on a scheduled basis every 2 minutes.
  • DCreate a Lambda function to restart the EC2 instance, triggered by EC2 health checks.
  解答を表示
  💬ディスカッション
• #376

  A CloudOps Engineer has been asked to configure user-defined cost allocation tags for a new AWS account. The company is using AWS Organizations for account management. What should the Engineer do to enable user-defined cost allocation tags?

  • ALog in to the AWS Billing and Cost Management console of the new account, and use the Cost Allocation Tags manager to create the new user-defined cost allocation tags.
  • BLog in to the AWS Billing and Cost Management console of the payer account, and use Cost Allocation Tags manager to create the new user-defined cost allocation tags.
  • CLog in to the AWS Management Console of the new account, use the Tag Editor to create the new user-defined tags, then use the Cost Allocation Tags manager in the new account to mark the tags as cost allocation tags.
  • DLog in to the AWS Management Console of the new account, use the Tag Editor to create the new user-defined tags, then use the Cost Allocation Tags manager in the payer account to mark the tags as cost allocation tags.
  解答を表示
  💬ディスカッション
• #377

  A company recently performed a security audit of all its internal applications developed in house. Certain business-critical applications that handle sensitive data were flagged because they use Amazon ES clusters that are open for read/write to a wider user group that intended. Who is responsible for correcting the issue?

  • AAWS Premium Support.
  • BAmazon ES team.
  • CAWS IAM team.
  • DCloudOps Engineer.
  解答を表示
  💬ディスカッション
• #378

  A CloudOps Engineer is re-architecting an application. The CloudOps Engineer has moved the database from a public subnet, where the database used a public endpoint, into a private subnet to restrict access from the public network. After this change, an AWS Lambda function that requires read access to the database cannot connect to the database. The CloudOps Engineer must resolve this issue without compromising security. Which solution meets these requirements?

  • ACreate an AWS PrivateLink interface endpoint for the Lambda function. Connect to the database using its private endpoint.
  • BConnect the Lambda function to the database VPC. Connect to the database using its private endpoint.
  • CAttach an IAM role to the Lambda function with read permissions to the database.
  • DMove the database to a public subnet. Use security groups for secure access.
  解答を表示
  💬ディスカッション
• #379

  A company is using an Amazon DynamoDB table for data. A CloudOps Engineer must configure replication of the table to another AWS Region for disaster recovery. What should the CloudOps Engineer do to meet this requirement?

  • AEnable DynamoDB Accelerator (DAX).
  • BEnable DynamoDB Streams, and add a global secondary index (GSI).
  • CEnable DynamoDB Streams, and add a global table Region.
  • DEnable point-in-time recovery.
  解答を表示
  💬ディスカッション
• #380

  A company is running an application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are launched by an Auto Scaling group and are automatically registered in a target group. A CloudOps Engineer must set up a notification to alert application owners when targets fail health checks. What should the CloudOps Engineer do to meet these requirements?

  • ACreate an Amazon CloudWatch alarm on the UnHealthyHostCount metric. Configure an action to send an Amazon Simple Notification Service (Amazon SNS) notification when the metric is greater than 0.
  • BConfigure an Amazon EC2 Auto Scaling custom lifecycle action to send an Amazon Simple Notification Service (Amazon SNS) notification when an instance is in the Pending:Wait state.
  • CUpdate the Auto Scaling group. Configure an activity notification to send an Amazon Simple Notification Service (Amazon SNS) notification for the Unhealthy event type.
  • DUpdate the ALB health check to send an Amazon Simple Notification Service (Amazon SNS) notification when an instance is unhealthy.
  解答を表示
  💬ディスカッション

スコアの記録、時間制限付き模擬試験、AI解説をご利用になりますか？ 無料アカウントを作成