Master 2025 Latest The Questions Courses and Certificates and Pass Cloud-Deployment-and-Operations Real Exam!
Penetration testers simulate Cloud-Deployment-and-Operations exam PDF
NEW QUESTION # 22
(A company is using Route 53 for Domain Name System (DNS) hosting. The company requires a zone that should only be accessible from instances in a Virtual Private Cloud (VPC). Which type of hosted zone should be used?)
- A. Public Hosted Zone
- B. DNS Zone
- C. Private Zone
- D. Lightsail DNS Zone
Answer: C
Explanation:
A Private Hosted Zone in Amazon Route 53 should be used to restrict DNS resolution to instances within a Virtual Private Cloud (VPC), ensuring that the zone is only accessible internally. This isolates DNS services from public internet access. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Hosted Zones) states, "A Private Hosted Zone in Route 53 limits DNS resolution to resources within a specified VPC, preventing external access and enhancing security for internal services." Public Hosted Zones, DNS Zones, and Lightsail DNS Zones do not provide this VPC-specific restriction.
NEW QUESTION # 23
(What can AWS Config directly invoke to cause remediation of findings?)
- A. Systems Manager document
- B. Lambda function
- C. CloudWatch alarm
- D. Control Tower guardrail
Answer: B
Explanation:
AWS Config can directly invoke an AWS Lambda function to cause remediation of findings by triggering automated responses to configuration changes or non-compliant resources. This integration enables real-time corrective actions. The WGU Cloud Deployment and Operations Study Guide (Section 6.1, AWS Config) states, "AWS Config can invoke a Lambda function as a remediation action, allowing automated fixes for non- compliant resources (e.g., terminating unauthorized instances)." Control Tower guardrails, CloudWatch alarms, and Systems Manager documents are not directly invoked by Config for this purpose.
NEW QUESTION # 24
(A company configures the CloudFront caching TTL to the following settings: Min: 0, Max: 172800. An administrator updates the Cache-Control setting to 432000. However, objects are only cached for 48 hours.
What is required to ensure objects are cached for up to 120 hours?)
- A. Configure the Cache-Control setting for 172800
- B. Configure the Min setting for 432000
- C. Configure the Max setting for 432000
- D. Configure the expiration setting for 172800
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
In Amazon CloudFront, the caching TTL is controlled by the minimum and maximum TTL settings, with the maximum TTL (in seconds) capping the cache duration. The current Max TTL is 172800 seconds (48 hours), and the Cache-Control setting of 432000 seconds (120 hours) is ignored because it exceeds the Max TTL. To cache objects for up to 120 hours, the Max setting must be configured to 432000 seconds. The WGU Cloud Deployment and Operations Study Guide (Section 4.4, CloudFront Caching) states, "The maximum TTL in CloudFront settings (e.g., 172800 seconds) overrides any higher Cache-Control value; to allow 120 hours (432000 seconds), the Max TTL must be set accordingly." Adjusting Min, expiration, or Cache-Control alone does not resolve this.
NEW QUESTION # 25
(Which CloudWatch metric filter includes log events with the word ERROR but excludes log events with the word WARNING?)
- A. "ERROR" WARN
- B. ERROR WARN
- C. ?ERROR ?WARN
- D. ERROR -WARN
Answer: D
Explanation:
A metric filter in Amazon CloudWatch Logs can be used to search for specific terms in log data and create metrics based on the matches. To include log events with the word "ERROR" and exclude those with the word "WARNING," the correct syntax involves using a filter pattern with a positive match for "ERROR" and a negation for "WARNING." The correct pattern is "ERROR -WARN," where the minus sign (-) indicates exclusion of log events containing "WARN." According to the WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs), metric filters use a pattern-based syntax where terms are included or excluded using positive matches and the negation operator (-). This ensures that only logs with
"ERROR" and without "WARN" are processed into the metric.
NEW QUESTION # 26
(Which solution should be used to host content to be processed for Amazon Made?)
- A. DynamoDB
- B. DocumentDB
- C. S3
- D. EC2
Answer: C
Explanation:
Amazon S3 (Simple Storage Service) should be used to host content to be processed for Amazon Made, as it provides scalable object storage ideal for storing and retrieving large amounts of data, such as media files or documents, for processing workflows. The WGU Cloud Deployment and Operations Study Guide (Section
2.1, Amazon S3) states, "S3 is the preferred solution for hosting content to be processed by services like Amazon Made, offering durable and highly available storage with support for lifecycle policies and integration with other AWS services." DocumentDB, DynamoDB, and EC2 are not designed for this content hosting purpose.
NEW QUESTION # 27
(Where does Patch Manager send compliance reports?)
- A. Simple Storage Service (S3)
- B. Elastic Block Store (EBS)
- C. OpsWorks
- D. Route 53
Answer: A
Explanation:
Patch Manager in AWS Systems Manager sends compliance reports to an Amazon S3 bucket, where they are stored for auditing and analysis. This allows administrators to track patch compliance status across EC2 instances and on-premises servers. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "Patch Manager compliance reports are delivered to an S3 bucket configured as a target, providing a centralized location for reviewing patch status and compliance data." OpsWorks, EBS, and Route 53 are not used for storing these reports.
NEW QUESTION # 28
(An AWS SysOps administrator needs to configure Amazon Route 53 to load balance customer requests across multiple identically configured websites. The load balancing method must ensure that the customer requests are directed to the website that offers the shortest round-trip time. Which routing policy should be used?)
- A. Weighted
- B. Latency
- C. Geoproximity
- D. Geolocation
Answer: B
Explanation:
The latency routing policy in Amazon Route 53 should be used to direct customer requests to the website with the shortest round-trip time (RTT). This policy routes traffic to the AWS region with the lowest latency based on the user's location, optimizing performance. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) states, "The latency-based routing policy in Route 53 measures RTT to direct users to the region with the lowest latency, improving user experience across multiple websites." Geolocation, geoproximity, and weighted policies do not prioritize RTT in this manner.
NEW QUESTION # 29
(Which component should be used to configure email notifications for a trigger by Amazon Made?)
- A. Simple Queue Service
- B. CodeDeploy
- C. Elastic Kubernetes Service
- D. EventBridge
Answer: D
Explanation:
Amazon EventBridge should be used to configure email notifications for a trigger by Amazon Made, as it can route events to targets like Amazon SNS (Simple Notification Service) for email delivery. EventBridge integrates with AWS services to handle event-driven notifications. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, EventBridge) states, "EventBridge can be configured to send events from Amazon Made to SNS, enabling email notifications by subscribing an email endpoint to the SNS topic." SQS, EKS, and CodeDeploy do not support this notification configuration.
NEW QUESTION # 30
(Which AWS solution can send email based on CloudWatch alarms?)
- A. Simple Notification Service (SNS)
- B. Amplify
- C. Simple Queue Service (SQS)
- D. Kinesis
Answer: A
Explanation:
Amazon CloudWatch alarms can trigger notifications when a metric breaches a defined threshold. The AWS solution designed to send emails based on these alarms is Amazon Simple Notification Service (SNS). SNS supports sending notifications via email, SMS, and other protocols when subscribed endpoints are triggered by CloudWatch alarms. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, Monitoring and Alarms) states that SNS is the primary service for delivering notifications from CloudWatch, allowing users to configure emailsubscriptions for alarm states. Other options like SQS, Amplify, and Kinesis are not designed for this purpose.
NEW QUESTION # 31
(Which service enables a company to enforce and manage governance rules across multiple AWS accounts?)
- A. Security Hub
- B. Control Tower
- C. Systems Manager
- D. GuardDuty
Answer: B
Explanation:
AWS Control Tower enables a company to enforce and manage governance rules across multiple AWS accounts by setting up a landing zone with preconfigured policies for security, compliance, and operations. It simplifies multi-account management. The WGU Cloud Deployment and Operations Study Guide (Section
6.5, Control Tower) states, "Control Tower provides a centralized solution to establish and enforce governance rules across multiple accounts, using guardrails and a landing zone to ensure compliance with organizational policies." Security Hub, GuardDuty, and Systems Manager do not offer this multi-account governance capability.
NEW QUESTION # 32
(What is the role of a patch baseline in Patch Manager?)
- A. Defines patches that should and should not be installed on EC2 instances
- B. Installs all patch updates as they become available by default
- C. Assigns an IAM role for services that can auto-approve patches upon release
- D. Notifies Config of any patch updates that need to be performed
Answer: A
Explanation:
A patch baseline in Patch Manager defines the patches that should and should not be installed on EC2 instances, specifying approval rules for security updates, other updates, and exclusions. This ensures controlled and compliant patching. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "A patch baseline specifies which patches are approved for installation and which are excluded, allowing customization of patch deployment (e.g., approving only critical security updates)." Options A, B, and D misrepresent the baseline's role, as it does not auto-install, assign IAM roles, or notify Config directly.
NEW QUESTION # 33
(A company uses KMS for key management. The company has a requirement to ensure that cryptographic material is not used longer than a year. Which solution should be used to meet this requirement with the least amount of effort?)
- A. Write a Lambda function to replace keys in KMS
- B. Move keys from KMS to CloudHSM
- C. Develop a custom key encryption protocol for KMS
- D. Enable automatic key rotation in KMS
Answer: D
Explanation:
Enabling automatic key rotation in AWS Key Management Service (KMS) is the least effort solution to ensure cryptographic material is not used longer than a year. KMS automatically rotates the cryptographic material of symmetric customer master keys (CMKs) every 365 days, meeting the requirement without manual intervention. The WGU Cloud Deployment and Operations Study Guide (Section 6.3, KMS) states,
"Automatic key rotation in KMS rotates the backing key material every year for symmetric CMKs, providing a low-effort way to comply with key usage limits." Moving to CloudHSM, custom protocols, or Lambda functions require more effort and complexity.
NEW QUESTION # 34
(A company has the following disaster recovery requirements: The loss of up to three hours of data is acceptable. Services must be restored within one hour of failure. Which recovery characteristics will allow the company to meet the requirements?)
- A. RPO 1 hour, RTO 4 hours
- B. RPO 1 hour, RTO 2 hours
- C. RPO 2 hours, RTO 1 hour
- D. RPO 4 hours, RTO 1 hour
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Recovery Point Objective (RPO) measures the maximum acceptable data loss, while Recovery Time Objective (RTO) measures the maximum acceptable downtime. The company requires an RPO of up to 3 hours (acceptable data loss) and an RTO of 1 hour (service restoration time). The correct option is RPO 4 hours, RTO 1 hour, as it meets the RPO requirement (allowing up to 3 hours of data loss is within 4 hours) and satisfies the RTO of 1 hour. The WGU Cloud Deployment and Operations Study Guide (Section 8.1, Disaster Recovery) states, "RPO defines the maximum data loss tolerance (e.g., 3 hours), and RTO defines the maximum downtime (e.g., 1 hour); a configuration of RPO 4 hours and RTO 1 hour aligns with these thresholds." Other options fail to meet both criteria simultaneously.
NEW QUESTION # 35
(Which two solutions are supported by CloudWatch? Choose 2 answers.)
- A. Threat detection
- B. Event response
- C. Instance monitoring
- D. Load balancing
Answer: B,C
Explanation:
Amazon CloudWatch supports several monitoring and management solutions, including event response and instance monitoring. Event response is facilitated through CloudWatch Events, which can trigger actions based on predefined rules, such as invoking AWS Lambda functions. Instance monitoring involves collecting and tracking metrics from Amazon EC2 instances, providing visibility into performance and health. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Overview) highlights that CloudWatch is designed for instance monitoring and event-driven responses, while load balancing and threat detection are handled by services like Elastic Load Balancing and GuardDuty, respectively.
NEW QUESTION # 36
(Which type of support plan provides a technical account manager and full use of Trusted Advisor?)
- A. Standard
- B. Developer
- C. Business
- D. Enterprise
Answer: D
Explanation:
The Enterprise support plan provides a technical account manager (TAM) and full use of Trusted Advisor, offering proactive guidance and comprehensive access to all checks. This plan is designed for large-scale, mission-critical workloads. The WGU Cloud Deployment and Operations Study Guide (Section 6.4, AWS Support Plans) states, "The Enterprise support plan includes a dedicated Technical Account Manager and full Trusted Advisor access, providing 24/7 support and proactive optimization recommendations." Developer, Standard, and Business plans offer limited or no TAM support and partial Trusted Advisor access.
NEW QUESTION # 37
(A company has deployed an application to AWS and a standby instance to its on-premises data center. The on-premises infrastructure is a scaled-down version of the AWS infrastructure. Which routing policy in Route
53 will allow the company to send 75% of the load to AWS and the remaining 25% to its on-premises infrastructure?)
- A. Simple routing policy
- B. Geolocation routing policy
- C. Failover routing policy
- D. Weighted routing policy
Answer: D
Explanation:
The weighted routing policy in Amazon Route 53 allows the company to distribute traffic with specific percentages, such as 75% to AWS and 25% to the on-premises infrastructure, by assigning weights to each resource record. This enables load balancing across hybrid environments. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) states, "Weighted routing policy assigns weights to resource record sets (e.g., 75 for AWS, 25 for on-premises), controlling the percentage of traffic directed to each endpoint." Geolocation, failover, and simple policies do not support percentage-based traffic splitting.
NEW QUESTION # 38
(An organization uses CloudFormation to deploy AWS infrastructure. The templates are built in JSON and deploy EC2 instances across multiple regions. Which solution should be used to set values in the template based on region-specific AMI IDs?)
- A. WaitCondition
- B. Outputs
- C. Mappings
- D. Resources
Answer: C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The Mappings section in a CloudFormation template should be used to set values based on region-specific AMI IDs. Mappings allow the template to define a lookup table that associates regions with corresponding AMI IDs, enabling dynamic selection during stack creation across multiple regions. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Mappings) states, "The Mappings section enables region-specific configurations, such as mapping AMI IDs to regions (e.g., 'us-east-1': 'ami-
123456'), ensuring the correct AMI is used based on the deployment region." Outputs, WaitCondition, and Resources do not provide this mapping functionality.
NEW QUESTION # 39
(A company builds an application that renders 3D movies for its users. The application does this by spawning a fleet of instances that each take a slice of the workload and then render a few hundred frames in around 30 minutes. If processing on a node is interrupted, the work can be moved to other running nodes. The cost to users is based on the underlying AWS cost plus a margin. Which EC2 instance type is most suitable to run workload pattern at the lowest cost?)
- A. Spot Instance
- B. Reserved Instance
- C. Dedicated Instance
- D. On-Demand Instance
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Spot Instances are the most suitable EC2 instance type for this workload pattern, offering the lowest cost for short, interruptible tasks like 3D rendering, where work can be redistributed if interrupted. This aligns with the company's cost-plus pricing model. The WGU Cloud Deployment and Operations Study Guide (Section
7.3, EC2 Instance Types) states, "Spot Instances provide significant cost savings (up to 90% off On-Demand) for fault-tolerant, short-term workloads like rendering, where interruptions can be handled by redistributing tasks to other nodes." On-Demand, Dedicated, and Reserved Instances are more expensive and less flexible for this use case.
NEW QUESTION # 40
(Which AWS service is used to provide remote workers with secure access to AWS resources?)
- A. NAT instance
- B. Transit Gateway
- C. Network Firewall
- D. Client VPN
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
AWS Client VPN is used to provide remote workers with secure access to AWS resources by establishing a VPN connection to the VPC, ensuring encrypted access to private networks. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Client VPN) states, "Client VPN enables secure remote access to AWS resources within a VPC, using mutual authentication and encryption to protect data for remote workers." Transit Gateway manages inter-VPC routing, Network Firewall filters traffic, and NAT instances handle outbound internet access, none of which are designed for remote worker access.
NEW QUESTION # 41
(A company that uses five Elastic IP addresses does not want to request more from AWS. Which solution should be used to route requests to a healthy endpoint?)
- A. Register a DNS name to an auto-assigned public IP address
- B. Adjust the TTL of the IP packets
- C. Use Systems Manager to update endpoints
- D. Edit the route table for the VPC
Answer: A
Explanation:
To route requests to a healthy endpoint without requesting additional Elastic IP addresses, the company should register a DNS name to an auto-assigned public IP address using a service like Route 53. This leverages dynamic DNS to distribute traffic, reducing reliance on fixed EIPs. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53) states, "Registering a DNS name with an auto-assigned public IP in Route 53 allows traffic routing to healthy instances, avoiding the need for additional Elastic IP addresses." TTL adjustment, route table edits, and Systems Manager are not relevant solutions.
NEW QUESTION # 42
(What needs to be configured in Systems Manager to run Automation documents on schedule?)
- A. Rate control
- B. Resource groups
- C. Session preferences
- D. Maintenance window
Answer: D
Explanation:
To run Automation documents on a schedule in AWS Systems Manager, a maintenance window must be configured. Maintenance windows define the time periods during which automated tasks, including the execution of Automation documents, can run. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Maintenance Windows) explains that maintenance windows are used to schedule and control the execution of Systems Manager tasks, ensuring they align with operational windows. Rate control, session preferences, and resource groups are not used for scheduling automation tasks.
NEW QUESTION # 43
(An endpoint is not responding to a request based on the failure threshold provided. What does Route 53 do once it considers the endpoint unhealthy?)
- A. Notifies CloudWatch
- B. Terminates the connection attempt
- C. Sends out an SNS notification
- D. Enables SQS
Answer: B
Explanation:
When Amazon Route 53 determines an endpoint is unhealthy based on a failure threshold (e.g., via health checks), it terminates the connection attempt to that endpoint and routes traffic to a healthy alternative, if available. This behavior ensures high availability using routing policies like failover or latency-based routing.
The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Health Checks) states,
"Route 53 stops routing traffic to an unhealthy endpoint by terminating connection attempts once the health check failure threshold is exceeded, redirecting to a healthy resource." Options A, C, and D are not direct actions taken by Route 53 in this scenario.
NEW QUESTION # 44
(Which two locations can Amazon Inspector publish its findings in when it has detected an anomaly? Choose
2 answers.)
- A. SQS
- B. CloudWatch
- C. SNS
- D. CloudTrail
Answer: B,C
Explanation:
Amazon Inspector can publish its findings when detecting anomalies to Amazon SNS for real-time notifications and to CloudWatch for metric and event logging, enabling monitoring and response. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, Amazon Inspector) states, "Inspector findings are published to SNS for immediate alerts and to CloudWatch for detailed logging, allowing integration with other AWS services for anomaly response." CloudTrail logs API calls, and SQS is a messaging queue, neither of which are primary destinations for Inspector findings.
NEW QUESTION # 45
(A company is developing an application with the following requirements: * Amazon EC2 instances must be restricted to Free Tier-eligible types. * Instances of unapproved types must be terminated automatically.
Which two services should be used? Choose 2 answers.)
- A. Systems Manager
- B. Config
- C. Launch Wizard
- D. OpsWorks
Answer: A,B
Explanation:
To meet the requirements of restricting EC2 instances to Free Tier-eligible types and automatically terminating unapproved instances, AWS Systems Manager and AWS Config should be used. Systems Manager can enforce instance compliance through automation documents that monitor and terminate non- compliant instances. AWS Config provides continuous monitoring and evaluation of resource configurations against defined rules, such as those limiting instance types to Free Tier-eligible options (e.g., t2.micro or t3.
micro). The WGU Cloud Deployment and Operations Study Guide (Section 6.1, AWS Config and Systems Manager) notes, "AWS Config can be configured with a rule to detect non-Free Tier EC2 instances, while Systems Manager Automation can execute a termination script based on Config findings." OpsWorks and Launch Wizard are not designed for this specific compliance and automation use case.
NEW QUESTION # 46
(Which service should be used to schedule the patching of EC2 instances and on-premises servers with security updates?)
- A. Systems Manager
- B. Config
- C. App Runner
- D. EventBridge
Answer: A
Explanation:
AWS Systems Manager should be used to schedule the patching of EC2 instances and on-premises servers with security updates, utilizing features like Patch Manager and maintenance windows. This service supports hybrid environments and automated patch deployment. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Systems Manager Patch Manager) states, "Systems Manager provides Patch Manager to schedule and deploy security updates to EC2 instances and on-premises servers during maintenance windows, ensuring consistent patching across hybrid environments." EventBridge, Config, and App Runner do not offer this patching capability.
NEW QUESTION # 47
......
Penetration testers simulate Cloud-Deployment-and-Operations exam: https://freecert.test4sure.com/Cloud-Deployment-and-Operations-exam-materials.html