AWS CloudOps Engineer Associate Practice Test

Answer choices

1. A. Use CloudWatch cross-account observability and shared dashboards for the source accounts, as selected.
2. B. Replace the application CloudFormation templates with dashboard widgets, within this design.
3. C. Store root account credentials in CloudWatch so alarms can authenticate, as the recommended response to this scenario.
4. D. Use monthly invoice reports as the operational dashboard, for the stated monitoring and logging requirement.

Wrong-answer review

• B. Replace the application CloudFormation templates with dashboard widgets, within this design.: CloudFormation templates define infrastructure and do not replace monitoring dashboards.
• C. Store root account credentials in CloudWatch so alarms can authenticate, as the recommended response to this scenario.: Root credentials should not be stored in CloudWatch or used for alarm authentication.
• D. Use monthly invoice reports as the operational dashboard, for the stated monitoring and logging requirement.: Invoice reports are billing artifacts and are not an operational telemetry dashboard.

Answer choices

1. A. Depend on a single instance because replacement creates noise, for the described technical objective and its associated operational control requirements, for consideration.
2. B. Use application or load balancer health signals with alarms and scaling policies to replace failed capacity, for evaluation.
3. C. Use only a monthly cost report to detect health failures, as the recommended implementation across the complete governed service lifecycle.
4. D. Delete Auto Scaling policies after launch, as the proposed design for the complete governed operational workflow.

Answer choices

1. A. Write a custom cron script in each EC2 instance that checks the billing API and executes a self-termination command, for the described technical objective and its associated operational control requirements, as the primary proposed approach.
2. B. Configure AWS Cost Explorer to automatically delete any Auto Scaling group that launches p-type instances, for the described technical objective and its associated operational control requirements, as the primary proposed approach.
3. C. Create an AWS Budget in the account and configure a Budget Action to apply a Service Control Policy (SCP) that denies `ec2:RunInstances` for p-type instances when the budgeted cost exceeds 100%, within the documented operational, security, ownership, and validation requirements.
4. D. Deploy an Amazon CloudWatch Alarm that triggers a Systems Manager Automation runbook to delete the AWS Billing account, for the described technical objective and its associated operational control requirements, within the defined security and accountability boundaries.

Answer choices

1. A. Use AWS Billing console reports as the remediation engine, for the required operational result and control objective.
2. B. Use AWS Systems Manager Automation runbooks for repeatable remediation workflows, within the documented scope, ownership, and validation boundaries.
3. C. Disable the runbook after its first successful run, for the stated automation and remediation requirement.
4. D. Require an operator to SSH to every instance before each step, in this situation.

Answer choices

1. A. The EC2 instance does not have a public IP address assigned to its primary network interface, as the recommended response to this scenario.
2. B. The NAT Gateway was deployed in the private subnet instead of a public subnet that has a route to the Internet Gateway, under the organization’s defined implementation and exception-management process.
3. C. The NAT Gateway security group does not allow outbound traffic on port 80 and 443, for the described technical objective and its associated operational control requirements, under the stated decision criteria.
4. D. The VPC does not have DNS Resolution (`enableDnsSupport`) enabled in its attributes, for the described technical objective and its associated operational control requirements, for review.

Answer choices

1. A. Create an S3 lifecycle rule to expire the log stream after each error, under end-to-end security-and-governance requirements.
2. B. Open an AWS Support case whenever the application writes an error line, for the stated requirement.
3. C. Create an AWS Config rule that evaluates each log event as a resource, for the stated security, delivery, and accountability requirements.
4. D. Create a CloudWatch Logs metric filter for the error pattern and alarm on the resulting metric, under the described monitoring and logging criteria.

Answer choices

1. A. AWS Systems Manager Session Manager requiring unordered manual commands, for this scenario.
2. B. AWS Systems Manager Patch Manager creating Route 53 records, as selected.
3. C. AWS Systems Manager Automation runbooks defining ordered execution steps, for the required automation and remediation outcome.
4. D. AWS Systems Manager Explorer disabling operational history, for the stated automation and remediation requirement.

Answer choices

1. A. S3 lifecycle policies and Cost Explorer filters, within the proposed design.
2. B. IAM password policy and Reserved Instance terms, for the described technical objective.
3. C. Security groups and network ACLs, along with the subnet route tables, within the proposed design.
4. D. CloudFormation stack tags only, for the described technical objective and its associated operational control requirements, as configured.

Answer choices

1. A. Create an Active-Active Latency routing record for both regions, configuring the TTL to 0 seconds so clients bypass DNS caches, for the described technical objective and its associated operational control requirements, for the described technical objective and its associated operational control requirements, in practice.
2. B. Create a Weighted routing record with weight 100 for us-east-1 and weight 0 for us-west-2, relying on the internal JVM DNS cache to route traffic during failure, for the described technical objective and its associated operational control requirements, under the organization’s defined implementation and exception-management process.
3. C. Create a Primary routing policy record pointing to us-east-1 and associate it with an active Route 53 health check. Create a Secondary routing policy record pointing to us-west-2. Set both to use Failover routing, under the stated technical, operational, and governance constraints.
4. D. Create a Geolocation routing record that routes all international traffic to us-east-1 and national traffic to us-west-2, for the described technical objective and its associated operational control requirements, under the documented operational and governance requirements.

Answer choices

1. A. Establish a full-mesh VPC Peering topology between all 15 VPCs, and enable route propagation on each peering connection, for the described technical objective and its associated operational control requirements, as the selected approach for the stated technical and business outcome, within the described operational context.
2. B. Configure a Site-to-Site VPN from each spoke VPC directly to the NAT Gateways in the egress VPC, for the described technical objective and its associated operational control requirements, for the described technical objective and its associated operational control requirements, within the defined security and accountability boundaries.
3. C. Create an AWS Transit Gateway. Connect all VPCs to the Transit Gateway. Configure the route tables of the spoke VPCs to route `0.0.0.0/0` to the Transit Gateway attachment, and configure the Transit Gateway route table to route internet-bound traffic to the central egress VPC
4. D. Use an AWS Client VPN endpoint in each VPC to tunnel traffic directly to the centralized NAT Gateway interface, for the described technical objective and its associated operational control requirements, for the described technical objective and its associated operational control requirements, for the stated networking operations requirement.