Free AWS CloudOps Engineer Associate practice test

A. ✓ Correct: Non-destructive restores because it creates a new resource with the backup being restored, protecting existing resources.

B. × Incorrect: Restore job statuses because they provide information about the status of restoration but do not prevent impact on live resources.

C. × Incorrect: Copy tags during a restore because this feature copies metadata from backups to restored resources and does not simulate restoration without impacting current resources.

D. × Incorrect: Restoring from cold storage because it refers to the process of retrieving data stored in long-term, low-cost storage which takes longer but does not prevent impact on live resources.

A. × Incorrect: AWS CloudTrail because it logs, monitors, and audits AWS API calls but does not manage encryption keys.

B. ✓ Correct: AWS Key Management Service (KMS) because it creates and manages keys for encrypting data at rest, protecting them with FIPS 140-3 Security Level 3 validated hardware security modules (HSM).

C. × Incorrect: AWS Secrets Manager because it stores, retrieves, and manages secrets such as database credentials but does not manage encryption keys directly.

D. × Incorrect: IAM because while it provides access control to AWS services, it does not handle the creation or management of encryption keys.

A. × Incorrect: Specify the destination, port range, and protocol for each outbound rule. This action does not ensure that response traffic reaches your computer as it pertains to outgoing traffic rather than incoming.

B. × Incorrect: Assign multiple security groups to a single resource. Assigning multiple security groups does not affect the stateful nature of security groups or their ability to allow return traffic.

C. × Incorrect: Ensure that the security group name is unique within the VPC. This action ensures naming uniqueness but has no bearing on allowing response traffic from an EC2 instance.

D. ✓ Correct: Create an inbound rule allowing SSH traffic from your network's IP address. Security groups are stateful, meaning they automatically permit return traffic for established connections.

A. ✓ Correct: Product constraints because administrators can add constraints such as resource tags to be used at provisioning, ensuring that only approved products are provisioned according to governance policies.

B. × Incorrect: IAM roles because while IAM roles manage access control for users and groups, they do not directly restrict the types of AWS resources that can be launched or tagged.

C. × Incorrect: S3 buckets because S3 buckets are storage services and do not provide features for managing approved products or adding constraints before provisioning.

D. × Incorrect: VPC configurations because VPC configurations manage network settings but do not offer capabilities to enforce governance policies on the types of AWS resources that can be provisioned.

A. × Incorrect: CloudWatch Metrics collect and track key performance data but do not provide automatic notifications when thresholds are breached.

B. × Incorrect: CloudWatch Dashboards offer a unified view of your resources and applications with visualizations, but they do not trigger alerts based on metric thresholds.

C. ✓ Correct: CloudWatch Alarms continuously monitor CloudWatch metrics against user-defined thresholds and can automatically alert you to breaches of the thresholds.

D. × Incorrect: CloudWatch Logs collect, store, and query logs from AWS services, but they do not provide real-time monitoring or threshold-based notifications.

A. ✓ Correct: Maintain at least one instance in each Availability Zone because it ensures that traffic is evenly distributed and maintains high availability during a failover event.

B. × Incorrect: Disable cross-zone load balancing to reduce network costs because this would limit the resiliency of your Auto Scaling group by not distributing traffic across zones effectively.

C. × Incorrect: Configure health checks only on the Auto Scaling group without enabling them on the instances because it is crucial that Elastic Load Balancing stops sending traffic to unhealthy instances and reroutes traffic to healthy ones, which requires proper configuration and enablement of health checks.

D. × Incorrect: Span your Auto Scaling group across multiple regions for geographic redundancy because while this provides additional protection against regional outages, it does not directly address the need for even distribution of traffic within Availability Zones.

A. × Incorrect: This because creating a new IAM user and attaching policies directly does not adhere to least privilege principles or facilitate cross-account access.

B. ✓ Correct: This because using an IAM role with cross-account trust relationships allows you to grant temporary, limited permissions to entities from another account while adhering to the principle of least privilege.

C. × Incorrect: This because granting full administrator access violates the principle of least privilege and exposes your environment to unnecessary risks.

D. × Incorrect: This because disabling MFA for all users in your AWS account reduces security without addressing cross-account or least privilege requirements.

A. × Incorrect: NAT Gateway enables outbound communication from private subnets to the internet but does not allow direct inbound communication or inter-subnet communication within a VPC.

B. ✓ Correct: Internet Gateway allows resources in your VPC to communicate with other networks over the Internet, providing a path for incoming and outgoing traffic between the public internet and your VPC.

C. × Incorrect: Security Group controls access to instances by specifying rules that allow or deny inbound and outbound network traffic but does not provide connectivity to the internet directly.

D. × Incorrect: Route Table defines routes for network traffic within a subnet and can direct traffic to other subnets or gateways, but it itself does not establish an external connection.

A. ✓ Correct: AWS Secrets Manager helps you manage, retrieve, and rotate database credentials throughout their lifecycles, including automatic rotation schedules.

B. × Incorrect: Amazon RDS manages databases but does not handle secret management or rotation schedules for database credentials.

C. × Incorrect: IAM manages access control policies and roles but does not provide the feature to configure automatic rotation schedules for secrets like database credentials.

D. × Incorrect: KMS provides encryption keys but does not manage or rotate database credentials.

A. ✓ Correct: The Infrequent Access log class incurs lower ingestion charges and supports secure archiving of logs for future analysis.

B. × Incorrect: Log groups organize and manage logs but do not provide specific archival features.

C. × Incorrect: Logs Insights enables interactive searching and analyzing, not archiving.

D. × Incorrect: Alarm actions define responses to CloudWatch alarms based on threshold conditions, unrelated to log archiving.