WGU Cloud-Deployment-and-Operations WGUCloud Deployment and Operations Exam Practice Test

Comprehensive and Detailed Explanation From Exact Extract:

The inability to make an AMI public is caused by an encrypted boot volume. AWS does not allow AMIs with encrypted EBS snapshots to be shared publicly due to security constraints; sharing is limited to specific AWS accounts. The WGU Cloud Deployment and Operations Study Guide (Section 6.3, AMI Management) states, "An AMI cannot be made public if its boot volume is encrypted; encryption restricts sharing to authorized accounts only, requiring decryption keys to be managed separately." Legacy BIOS, paravirtual virtualization, and the absence of a bookmark do not impact AMI sharing.

To create a metric filter in the Amazon CloudWatch console, the first step is to select a log group from which the log data will be analyzed. A log group contains log streams, and metric filters are applied to the log data within these groups to extract metrics based on patterns. The WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs) specifies that the process begins by navigating to the CloudWatch console, selecting a log group, and then defining the filter pattern. Actions like enabling an alarm, defining a trace, or specifying a stream are subsequent or unrelated steps.

To run Automation documents on a schedule in AWS Systems Manager, a maintenance window must be configured. Maintenance windows define the time periods during which automated tasks, including the execution of Automation documents, can run. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Maintenance Windows) explains that maintenance windows are used to schedule and control the execution of Systems Manager tasks, ensuring they align with operational windows. Rate control, session preferences, and resource groups are not used for scheduling automation tasks.

The `Ref` function in an AWS CloudFormation template is used to obtain values of components defined within the template, such as resource IDs, parameters, or outputs. This function allows dynamic referencing of resources during stack creation. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Functions) states, "The `Ref` function is used to reference the logical IDs of resources, parameters, or mappings defined in the template, enabling dynamic value retrieval (e.g., `Ref: MyEC2Instance` returns the instance ID)." ImportValue is used for cross-stack references, Cidr for IP range calculations, and GetAZs for availability zone lists, making them unsuitable here.

Amazon CloudWatch alarms can trigger notifications when a metric breaches a defined threshold. The AWS solution designed to send emails based on these alarms is Amazon Simple Notification Service (SNS). SNS supports sending notifications via email, SMS, and other protocols when subscribed endpoints are triggered by CloudWatch alarms. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, Monitoring and Alarms) states that SNS is the primary service for delivering notifications from CloudWatch, allowing users to configure emailsubscriptions for alarm states. Other options like SQS, Amplify, and Kinesis are not designed for this purpose.

Amazon Route 53 is the AWS solution that sends DNS queries to separate AWS compute instances by leveraging routing policies to distribute traffic across multiple resources. It acts as a scalable Domain Name System (DNS) service, directing queries to healthy instances based on configurations like latency or weighted routing. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53) states, "Route 53 uses DNS to route end-user requests to multiple AWS compute instances, supporting features like health checks and traffic distribution." Elastic Beanstalk, CloudWatch, and EC2 Auto Scaling do not perform DNS query routing.

The weighted routing policy in Amazon Route 53 allows the company to distribute traffic with specific percentages, such as 75% to AWS and 25% to the on-premises infrastructure, by assigning weights to each resource record. This enables load balancing across hybrid environments. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) states, "Weighted routing policy assigns weights to resource record sets (e.g., 75 for AWS, 25 for on-premises), controlling the percentage of traffic directed to each endpoint." Geolocation, failover, and simple policies do not support percentage-based traffic splitting.

To receive emails when a Lambda function returns an error, the administrator should use Amazon CloudWatch to monitor the function’s logs and metrics (e.g., errors) and Amazon Simple Notification Service (SNS) to send email notifications based on CloudWatch alarms. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, CloudWatch and SNS) states, "CloudWatch can detect Lambda errors via logs and trigger an alarm, which integrates with SNS to send email notifications to subscribed endpoints, ensuring timely error alerts." SQS and CloudTrail are not designed for this notification workflow.

Amazon EventBridge is the AWS solution that can be used to send events from external sources like Shopify. EventBridge supports integration with third-party applications through its event bus, allowing custom events (e.g., from Shopify via webhooks) to be ingested and routed to AWS services or targets. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, EventBridge) notes that EventBridge is designed for event ingestion from SaaS applications, making it suitable for Shopify integration. CloudTrail, IoT Events, and Service events are not designed for this purpose.

To meet the requirements of restricting EC2 instances to Free Tier-eligible types and automatically terminating unapproved instances, AWS Systems Manager and AWS Config should be used. Systems Manager can enforce instance compliance through automation documents that monitor and terminate non-compliant instances. AWS Config provides continuous monitoring and evaluation of resource configurations against defined rules, such as those limiting instance types to Free Tier-eligible options (e.g., t2.micro or t3.micro). The WGU Cloud Deployment and Operations Study Guide (Section 6.1, AWS Config and Systems Manager) notes, "AWS Config can be configured with a rule to detect non-Free Tier EC2 instances, while Systems Manager Automation can execute a termination script based on Config findings." OpsWorks and Launch Wizard are not designed for this specific compliance and automation use case.

Amazon CloudWatch supports several monitoring and management solutions, including event response and instance monitoring. Event response is facilitated through CloudWatch Events, which can trigger actions based on predefined rules, such as invoking AWS Lambda functions. Instance monitoring involves collecting and tracking metrics from Amazon EC2 instances, providing visibility into performance and health. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Overview) highlights that CloudWatch is designed for instance monitoring and event-driven responses, while load balancing and threat detection are handled by services like Elastic Load Balancing and GuardDuty, respectively.

To reduce conversion delays caused by increased demand, the company should configure a CloudWatch alarm to scale the EC2 fleet based on the SQS queue length. This auto-scaling approach dynamically adjusts the number of EC2 instances to handle the workload, especially during peak evening hours and anticipated growth. The WGU Cloud Deployment and Operations Study Guide (Section 3.3, Auto Scaling and SQS) explains, "Auto Scaling can be triggered by a CloudWatch alarm monitoring SQS queue depth, ensuring the EC2 fleet scales out to process video conversion tasks efficiently as the queue length increases." Spot instances, dead-letter queues, and instance type upgrades do not directly address dynamic scaling needs.

If a patch baseline is not explicitly defined in Patch Manager, it is attached to the default patch group. This default group applies a preconfigured baseline with AWS-recommended patches, ensuring basic compliance for instances without custom baselines. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "If no custom patch baseline is defined, instances are associated with the default patch group, which uses AWS-provided baseline settings for automatic patch approval." Options A, C, and D are not valid attachments for patch baselines.

Comprehensive and Detailed Explanation From Exact Extract:

CloudWatch should be used to identify and shut down idle EC2 instances by monitoring metrics such as CPU utilization or network activity. Custom alarms can be set to trigger an AWS Lambda function or Systems Manager automation to terminate idle instances, optimizing costs. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Metrics) states, "CloudWatch can monitor EC2 instance metrics like CPUUtilization; an alarm can be configured to invoke a Lambda function to terminate idle instances, ensuring cost efficiency." CloudFront, CloudSearch, and CloudTrail are not designed for this monitoring and automation task.

Comprehensive and Detailed Explanation From Exact Extract:

AWS CloudFormation uses YAML and JSON languages to define infrastructure as code (IaC) templates, specifying resources, parameters, and configurations. These formats are human-readable and support the creation of stacks for provisioning AWS resources. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation) states, "CloudFormation templates can be written in YAML or JSON, both of which are supported for defining infrastructure resources like EC2 instances and S3 buckets." XML and C# are not supported languages for CloudFormation templates.

The AWS monitoring feature used to process events with AWS Lambda is CloudWatch Events, specifically through the use of rules. Rules define the events to monitor (e.g., based on event patterns) and specify targets like AWS Lambda functions to process those events. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, CloudWatch Events) explains that rules are the core component for event-driven architectures, enabling automation by linking events to Lambda for processing. Metrics, targets, and logs are related but not the primary feature for this function.

Security group rules in AWS support the Internet Control Message Protocol (ICMP) and User Datagram Protocol (UDP) for defining inbound and outbound traffic rules. These protocols are commonly used for network communication and monitoring. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Security Groups) states, "Security groups support protocols like ICMP for diagnostic traffic and UDP for streaming or low-latency applications, allowing fine-grained control over instance access." BGP and MPLS are routing or network layer protocols not supported by security group rules.

Patch Manager in AWS Systems Manager sends compliance reports to an Amazon S3 bucket, where they are stored for auditing and analysis. This allows administrators to track patch compliance status across EC2 instances and on-premises servers. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "Patch Manager compliance reports are delivered to an S3 bucket configured as a target, providing a centralized location for reviewing patch status and compliance data." OpsWorks, EBS, and Route 53 are not used for storing these reports.

The `GetSessionToken` API call is needed to perform MFA before accessing a resource, as it generates temporary security credentials for an IAM user after MFA validation. This ensures secure access to AWS resources. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, IAM and MFA) states, "The `GetSessionToken` API is used with MFA to obtain temporary credentials, requiring a valid MFA code to authenticate the user before resource access is granted." GetCallerIdentity, GetFederationToken, and DecodeAuthorizationMessage serve different purposes and do not handle MFA authentication.

When Amazon Route 53 determines an endpoint is unhealthy based on a failure threshold (e.g., via health checks), it terminates the connection attempt to that endpoint and routes traffic to a healthy alternative, if available. This behavior ensures high availability using routing policies like failover or latency-based routing. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Health Checks) states, "Route 53 stops routing traffic to an unhealthy endpoint by terminating connection attempts once the health check failure threshold is exceeded, redirecting to a healthy resource." Options A, C, and D are not direct actions taken by Route 53 in this scenario.