AWS CloudOps Engineer Associate Practice Test

Answer choices

1. A. Grant only the permissions required and retain audit evidence of administrative activity
2. B. Share the root user for faster ticket resolution
3. C. Disable CloudTrail to reduce log volume
4. D. Postpone patching because AWS owns all security tasks

Wrong-answer review

• B. Share the root user for faster ticket resolution: Sharing the root user removes accountability and creates excessive privilege.
• C. Disable CloudTrail to reduce log volume: Disabling CloudTrail reduces the evidence available for review.
• D. Postpone patching because AWS owns all security tasks: Customers still handle security tasks such as patching in many operating models.

Answer choices

1. A. S3 lifecycle policies and Cost Explorer filters
2. B. IAM password policy and Reserved Instance terms
3. C. Security groups and network ACLs, along with the subnet route tables
4. D. CloudFormation stack tags only

Answer choices

1. A. Pin maximum capacity all day and ignore utilization
2. B. Use only a monthly invoice after spend has already occurred
3. C. Scale with demand, review utilization, right-size resources, and use budgets for guardrails
4. D. Remove monitoring to make the workload cheaper

Answer choices

1. A. AWS Systems Manager Run Command invoking a custom Bash script via cron on a cron-based schedule on the operating system level
2. B. AWS Systems Manager Patch Manager with a custom baseline that checks for application-level compliance and alerts the administrator
3. C. AWS Systems Manager Session Manager configured to open a persistent shell and execute diagnostic commands continuously on all targets
4. D. AWS Systems Manager State Manager using an association with the `AWS-ConfigureAWSPackage` document, configured to run on a set schedule with auto-remediation enabled

Answer choices

1. A. Remove alarms after the first successful deployment
2. B. Run the service on one unmonitored instance indefinitely
3. C. Use health checks, alarms, scaling, and Multi-AZ placement where the workload requires it
4. D. Use tags as the only high-availability mechanism

Answer choices

1. A. Create an S3 lifecycle rule to expire the log stream after each error
2. B. Open an AWS Support case whenever the application writes an error line
3. C. Create an AWS Config rule that evaluates each log event as a resource
4. D. Create a CloudWatch Logs metric filter for the error pattern and alarm on the resulting metric

Answer choices

1. A. Unrestricted administrator access for all users
2. B. Audit logging, controlled access, least privilege, and patch management
3. C. No audit retention after deployment
4. D. A policy that declares patching outside CloudOps scope

Answer choices

1. A. Check route symmetry, security groups, network ACLs, and endpoint or gateway configuration
2. B. Check whether budgets are named after the subnet
3. C. Check whether Route 53 registered the instance password
4. D. Check whether CloudTrail stores packet payloads

Answer choices

1. A. Select the most expensive instance family for every service
2. B. Set every Auto Scaling group minimum to peak demand forever
3. C. Delete cost and usage visibility after launch
4. D. Right-size resources using usage data and pair scaling with budget alerts

Answer choices

1. A. Create an Amazon EventBridge rule that triggers a Systems Manager Automation runbook named `AWS-StopEC2Instance` followed by `AWS-StartEC2Instance`
2. B. Configure a CloudWatch alarm for `StatusCheckFailed_System` metric and set the alarm action to 'Recover this instance'
3. C. Schedule an AWS Lambda function to poll the `DescribeInstanceStatus` API every 10 seconds and call `RebootInstances` if system check fails
4. D. Enable AWS Auto Scaling with a scaling policy triggered when the system status check is equal to 1 for more than 5 minutes