Cloud-Deployment-and-Operations Sample Questions Answers

AWS Config can directly invoke an AWS Lambda function to cause remediation of findings by triggering automated responses to configuration changes or non-compliant resources. This integration enables real-time corrective actions. The WGU Cloud Deployment and Operations Study Guide (Section 6.1, AWS Config) states, "AWS Config can invoke a Lambda function as a remediation action, allowing automated fixes for non-compliant resources (e.g., terminating unauthorized instances)." Control Tower guardrails, CloudWatch alarms, and Systems Manager documents are not directly invoked by Config for this purpose.

Comprehensive and Detailed Explanation From Exact Extract:

To make the EC2 instance accessible via a public DNS hostname like ec2-public-54.18.127.233.us-west-2.compute.amazonaws.com, the administrator must set the VPC attribute enableDnsHostnames to true. This enables the automatic assignment of public DNS hostnames to instances with public IP addresses in the VPC. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Configuration) states, "Setting enableDnsHostnames to true in the VPC configuration ensures that EC2 instances with public IPs receive a public DNS hostname (e.g., ec2-public-..compute.amazonaws.com), facilitating internet accessibility." Resource tags, disabling DNS support, and resource-based names do not enable this functionality.

The multivalue routing policy in Amazon Route 53 allows up to 8 healthy records to be returned in response to DNS queries, enabling load balancing across multiple resources. To ensure the maximum allowed number of records is utilized, the administrator should create 8 records. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) specifies, "Multivalue answer routing supports up to 8 healthy resource record sets per response, requiring the creation of 8 records to maximize the policy's capability." Options A, C, and D exceed or fall short of this limit.

To meet the requirements, the administrator should use an Amazon RDS Multi-AZ DB instance for multiple Availability Zones and failover support, and an Amazon Aurora DB instance with Aurora Replica for a read-only connection. The RDS Multi-AZ configuration automatically provisions a standby instance in a different AZ for failover, while Aurora Replicas provide read-only instances for scaling read traffic. The WGU Cloud Deployment and Operations Study Guide (Section 7.1, RDS and Aurora) states, "RDS Multi-AZ deploys a standby instance across AZs for failover, and Aurora Replicas are read-only instances that enhance performance by offloading read traffic from the primary instance." Options A and D are incorrect as multi-master replication and Multi-AZ clusters do not align with the read-only requirement.

The `Ref` function in an AWS CloudFormation template is used to obtain values of components defined within the template, such as resource IDs, parameters, or outputs. This function allows dynamic referencing of resources during stack creation. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Functions) states, "The `Ref` function is used to reference the logical IDs of resources, parameters, or mappings defined in the template, enabling dynamic value retrieval (e.g., `Ref: MyEC2Instance` returns the instance ID)." ImportValue is used for cross-stack references, Cidr for IP range calculations, and GetAZs for availability zone lists, making them unsuitable here.

To reduce conversion delays caused by increased demand, the company should configure a CloudWatch alarm to scale the EC2 fleet based on the SQS queue length. This auto-scaling approach dynamically adjusts the number of EC2 instances to handle the workload, especially during peak evening hours and anticipated growth. The WGU Cloud Deployment and Operations Study Guide (Section 3.3, Auto Scaling and SQS) explains, "Auto Scaling can be triggered by a CloudWatch alarm monitoring SQS queue depth, ensuring the EC2 fleet scales out to process video conversion tasks efficiently as the queue length increases." Spot instances, dead-letter queues, and instance type upgrades do not directly address dynamic scaling needs.

Comprehensive and Detailed Explanation From Exact Extract:

A Billing alarm in Amazon CloudWatch should be used to monitor estimated AWS charges by setting thresholds on cost metrics and triggering notifications when exceeded. This helps manage budgets effectively. The WGU Cloud Deployment and Operations Study Guide (Section 7.4, Cost Monitoring) states, "Billing alarms in CloudWatch monitor estimated charges against a defined threshold, sending alerts via SNS to prevent cost overruns." Cognito handles user authentication, Pricing Calculator estimates costs pre-deployment, and Forecast predicts usage, none of which monitor real-time charges.

To receive emails when a Lambda function returns an error, the administrator should use Amazon CloudWatch to monitor the function’s logs and metrics (e.g., errors) and Amazon Simple Notification Service (SNS) to send email notifications based on CloudWatch alarms. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, CloudWatch and SNS) states, "CloudWatch can detect Lambda errors via logs and trigger an alarm, which integrates with SNS to send email notifications to subscribed endpoints, ensuring timely error alerts." SQS and CloudTrail are not designed for this notification workflow.

Multipart uploads must be used when uploading files larger than 5 GB to Amazon S3, as this method splits the file into smaller parts for parallel upload, improving reliability and performance. The WGU Cloud Deployment and Operations Study Guide (Section 2.1, S3 Uploads) states, "For files exceeding 5 GB, multipart upload is required in S3, allowing the file to be divided into parts (minimum 5 MB each) for concurrent uploads, ensuring efficient and resumable transfers." Glacier Select, Transfer Acceleration, and Intelligent-Tiering are not designed for this upload optimization.

If a patch baseline is not explicitly defined in Patch Manager, it is attached to the default patch group. This default group applies a preconfigured baseline with AWS-recommended patches, ensuring basic compliance for instances without custom baselines. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "If no custom patch baseline is defined, instances are associated with the default patch group, which uses AWS-provided baseline settings for automatic patch approval." Options A, C, and D are not valid attachments for patch baselines.

Comprehensive and Detailed Explanation From Exact Extract:

The CloudFormation template feature should be used to specify the AWS resources to be provisioned. A template is a JSON or YAML file that defines the resources (e.g., EC2 instances, S3 buckets) and their configurations for deployment. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Templates) states, "The template is the core component of CloudFormation, containing the resource specifications and properties that are provisioned when a stack is created." Change sets, exports, and stack sets serve different purposes (e.g., previewing changes, sharing outputs, managing multiple stacks).

Comprehensive and Detailed Explanation From Exact Extract:

The Reachability Analyzer in AWS VPC should be used to troubleshoot connectivity issues from on-premises computers to EC2 instances, especially when a network security group (NSG) is suspected. It analyzes the network path and identifies blocked traffic due to NSG rules or route tables. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Troubleshooting) states, "Reachability Analyzer helps diagnose connectivity issues by simulating traffic paths, identifying if an NSG rule (e.g., blocked port) or route table is causing the problem from on-premises to EC2 public IPs." Flow Logs provide data but not analysis, PrivateLink is for private connections, and Traffic Mirroring is for monitoring.

Comprehensive and Detailed Explanation From Exact Extract:

After stopping and starting an EC2 instance, the public IP address may change (unless an Elastic IP is attached), but the security group rules remain intact. If the instance is no longer accessible via SSH, it’s likely due to an inbound rule (e.g., for port 22) not being correctly configured or applied. Adding or verifying a rule in the security group associated with the network interface (NIC) to allow SSH (port 22) from the administrator’s IP resolves this. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Security Groups) states, "Stopping and starting an EC2 instance may require verifying or adding an inbound SSH rule (port 22) in the security group if connectivity is lost due to IP or rule misconfiguration." Route table or IP changes are not the primary issue here.

Comprehensive and Detailed Explanation From Exact Extract:

AWS Client VPN is used to provide remote workers with secure access to AWS resources by establishing a VPN connection to the VPC, ensuring encrypted access to private networks. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Client VPN) states, "Client VPN enables secure remote access to AWS resources within a VPC, using mutual authentication and encryption to protect data for remote workers." Transit Gateway manages inter-VPC routing, Network Firewall filters traffic, and NAT instances handle outbound internet access, none of which are designed for remote worker access.

Comprehensive and Detailed Explanation From Exact Extract:

To deploy a static website to AWS, the bucket properties of an Amazon S3 bucket should be configured, specifically enabling static website hosting. This involves setting the bucket policy to allow public read access and configuring the index and error documents. The WGU Cloud Deployment and Operations Study Guide (Section 2.1, S3 Static Website Hosting) states, "Configuring bucket properties for static website hosting in S3 involves enabling the website endpoint, setting an index document (e.g., index.html), and applying a bucket policy for public access, making it suitable for hosting static content." RDS Proxy, S3 Versioning, and CloudTrail events are not relevant to this use case.

The `GetSessionToken` API call is needed to perform MFA before accessing a resource, as it generates temporary security credentials for an IAM user after MFA validation. This ensures secure access to AWS resources. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, IAM and MFA) states, "The `GetSessionToken` API is used with MFA to obtain temporary credentials, requiring a valid MFA code to authenticate the user before resource access is granted." GetCallerIdentity, GetFederationToken, and DecodeAuthorizationMessage serve different purposes and do not handle MFA authentication.

To notify a response team when a high-security web server returns a 403 Forbidden error, two key steps are required. First, define a metric filter for Apache logs in CloudWatch to detect the 403 error code within the log data. This involves setting up a filter pattern to match "403" in the Apache access logs. Second, create an alarm for the metric filter and configure it to deliver alerts using Amazon SNS, which supports email or other notifications to the response team. The WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs and Alarms) confirms that metric filters and SNS-integrated alarms are the standard approach for monitoring and alerting on log-based events. Options B and D are incorrect as they involve unnecessary or unsupported configurations (e.g., binding Lambda to Apache or using SQS for alarms).