AWS Certified CloudOps Engineer — Associate practice questions

1. Question 1 of 25

   A company has an application that runs on Amazon EC2 instances. The application stores data on an Amazon RDS for MySQL Single-AZ DB instance. Requests to the DB instance from the application include reads and writes. A CloudOps engineer must implement a solution that provides failover for the DB instance. The solution must minimize application downtime. Which solution will meet these requirements?

   • AModify the DB instance to be a Multi-AZ DB instance deployment.
   • BAdd a read replica in the same Availability Zone where the DB instance is deployed.
   • CAdd the DB instance to an Auto Scaling group that has a minimum capacity of 2 and a desired capacity of 2.
   • DUse RDS Proxy to configure a proxy in front of the DB instance.

   Show answer

   Correct answer: A

   How others answered

   • A100%

2. Question 2 of 25

   An application is running on an Amazon EC2 instance in a VPC with the default DHCP option set. The application connects to an on-premises Microsoft SQL Server database with the DNS name mssql.example.com. The application is unable to resolve the database DNS name. Which solution will fix this problem?

   • ACreate an Amazon Route 53 Resolver inbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.
   • BCreate an Amazon Route 53 Resolver inbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.
   • CCreate an Amazon Route 53 Resolver outbound endpoint. Add a forwarding rule for the domain example.com. Associate the forwarding rule with the VPC.
   • DCreate an Amazon Route 53 Resolver outbound endpoint. Add a system rule for the domain example.com. Associate the system rule with the VPC.

   Show answer

   Correct answer: C

   How others answered

   • C100%

3. Question 3 of 25

   A CloudOps engineer needs to give an existing AWS Lambda function access to an existing Amazon S3 bucket. Traffic between the Lambda function and the S3 bucket must not use public IP addresses. The Lambda function has been configured to run in a VPC. Which solution will meet these requirements?

   • AConfigure VPC sharing between the Lambda VPC and the S3 bucket.
   • BAttach a transit gateway to the Lambda VPC to allow the Lambda function to connect to the S3 bucket.
   • CCreate a NAT gateway. Associate the NAT gateway with the subnet where the Lambda function is configured to run.
   • DCreate an S3 interface endpoint. Change the Lambda function to use the new S3 DNS name.

   Show answer

   Correct answer: D

   How others answered

   • D100%

4. Question 4 of 25

   A company is expanding globally and needs to back up data on Amazon EBS volumes to a different AWS Region. Most of the EBS volumes that store the data are encrypted, but some of the EBS volumes are unencrypted. The company needs the backup data from all the EBS volumes to be encrypted. Which solution will meet these requirements with the LEAST management overhead?

   • AConfigure a lifecycle policy in Amazon Data Lifecycle Manager (Amazon DLM) to create the EBS volume snapshots with cross-Region backups enabled. Encrypt the snapshot copies by using AWS KMS.
   • BCreate a point-in-time snapshot of the EBS volumes. When the snapshot status is COMPLETED, copy the snapshots to another Region and set the Encrypted parameter to False.
   • CCreate a point-in-time snapshot of the EBS volumes. Copy the snapshots to an Amazon S3 bucket that uses server-side encryption. Turn on S3 CrossRegion Replication on the S3 bucket.
   • DSchedule an AWS Lambda function with the Python runtime. Configure the Lambda function to create the EBS volume snapshots, encrypt the unencrypted snapshots, and copy the snapshots to another Region.

   Show answer

   Correct answer: A

   How others answered

   • A100%

5. Question 5 of 25

   A company stores sensitive data in an Amazon S3 bucket. The company must log all access attempts to the S3 bucket. The company's risk team must receive immediate notification about any delete events. Which solution will meet these requirements?

   • AEnable S3 server access logging for audit logs. Set up an Amazon SNS notification for the S3 bucket. Select DeleteObject for the event type for the alert system.
   • BEnable S3 server access logging for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance to download the access logs each day and to scan for a DeleteObject event.
   • CUse Amazon CloudWatch Logs for audit logs. Use Amazon CloudWatch alarms with an Amazon SNS notification for the alert system.
   • DUse Amazon CloudWatch Logs for audit logs. Launch an Amazon EC2 instance for the alert system. Run a cron job on the EC2 instance each day to compare the list of the items with the list from the previous day. Configure the cron job to send a notification if an item is missing.

   Show answer

   Correct answer: A

   How others answered

   • A100%

6. Question 6 of 25

   A company uses a multi-account structure in the AWS Cloud. The company's environment includes a shared account for common resources. The environment also includes a development account for new application development. The company uses Amazon Route 53 for DNS management. The company manages all its Route 53 hosted zones from the shared account. A CloudOps engineer needs to obtain a new SSL/TLS certificate for an application that is deployed in the development account. What must the CloudOps engineer do to meet this requirement?

   • ACreate a new AWS KMS key in the shared account. Configure the key policy to give read access to the development account's root principal.
   • BRequest a new certificate by using AWS Certificate Manager (ACM) from the shared account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
   • CRequest a new certificate by using AWS Certificate Manager (ACM) from the development account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
   • DCreate a new AWS KMS key in the development account. Configure the key policy to give read access to the shared account's root principal. Use Route 53 from the shared account to create a validation record set that references the Amazon Resource Name (ARN) of the KMS key.

   Show answer

   Correct answer: C

   How others answered

   • C100%

7. Question 7 of 25

   A CloudOps engineer must load test a new Amazon CloudFront distribution to assess data transfer and latency performance. Which solution will meet this requirement?

   • ASend client requests from a single geographic region. Configure the load test so that each client makes an identical DNS request. Focus the client requests on the IP address that the DNS returns.
   • BSend client requests from a single geographic region. Configure the load test so that each client makes an independent DNS request. Spread the client requests across the set of IP addresses that the DNS returns.
   • CSend client requests from multiple geographic regions. Configure the load test so that each client makes an identical DNS request. Focus the client requests on the IP address that the DNS returns.
   • DSend client requests from multiple geographic regions. Configure the load test so that each client makes an independent DNS request. Spread the client requests across the set of IP addresses that the DNS returns.

   Show answer

   Correct answer: D

   How others answered

   • D100%

8. Question 8 of 25

   A company wants to automate the processing of photos that upload to an Amazon S3 bucket. A CloudOps engineer must invoke a 2-minute processing workflow immediately when a new photo uploads. The CloudOps engineer must initiate the workflow by using a native S3 notification destination. Which solution will meet these requirements with the LEAST operational overhead?

   • ASend an Amazon S3 event notification to an Amazon SQS queue to invoke an AWS Lambda function for processing.
   • BConfigure an Amazon S3 event notification to invoke an AWS Lambda function upon each object upload.
   • CConfigure an Amazon S3 event notification to publish events to an Amazon EventBridge bus that routes events to an AWS Lambda function.
   • DConfigure an Amazon S3 event notification to notify an AWS Step Functions state machine to start the transformation process.

   Show answer

   Correct answer: B

   How others answered

   • B100%

9. Question 9 of 25

   A company uses an AWS Cloud Formation template to provision an Amazon EC2 instance and an Amazon RDS DB instance. A CloudOps engineer must update the template to ensure that the DB instance is created before the EC2 instance is launched. What should the CloudOps engineer do to meet this requirement?

   • AAdd a wait condition to the template. Update the EC2 instance user data script to send a signal after the EC2 instance is started.
   • BAdd the DependsOn attribute to the EC2 instance resource, and provide the logical name of the RDS resource.
   • CChange the order of the resources in the template so that the RDS resource is listed before the EC2 instance resource.
   • DCreate multiple templates. Use AWS CloudFormation StackSets to wait for one stack to complete before the second stack is created.

   Show answer

   Correct answer: B

   How others answered

   • B100%

10. Question 10 of 25

    A company has an Amazon EC2 instance that has high CPU utilization. The EC2 instance is a t3.large instance and is running a test web application. The company discovers that the web application would operate better on a compute optimized large instance. What should a CloudOps engineer do to make this change?

    • AMigrate the EC2 instance to a compute optimized instance by using AWS VM Import/Export.
    • BEnable hibernation on the EC2 instance. Change the instance type to a compute optimized instance. Disable hibernation on the EC2 instance.
    • CStop the EC2 instance. Change the instance type to a compute optimized instance. Start the EC2 instance.
    • DChange the instance type to a compute optimized instance while the EC2 instance is running.

    Show answer

    Correct answer: C

    How others answered

    • C100%

11. Question 11 of 25

    A company runs an application on Amazon EC2 instances. The instances are in three Availability Zones behind an Auto Scaling group and an Application Load Balancer (ALB). The ALB maps to an Amazon Route 53 alias record. Amazon CloudWatch metrics show healthy instances in all three Availability Zones. However, instances in only two of the Availability Zones receive traffic. Which solution will resolve this issue?

    • AEnable cross-zone load balancing on the ALB.
    • BEnsure that all the required subnets are correctly associated with the ALB.
    • CDisable cross-zone load balancing on the ALB.
    • DUpdate the ALB's DNS mapping in Route 53 to use a CNAME record instead of an alias.

    Show answer

    Correct answer: B

    How others answered

    • B100%

12. Question 12 of 25

    A company stores critical files in an Amazon S3 bucket in the us-east-1 AWS Region. To comply with disaster recovery requirements, all new objects in the bucket must automatically replicate to a bucket in the us-west-2 Region. Which solution will meet this requirement with the LEAST operational overhead?

    • AEnable Cross-Region Replication (CRR) on the source bucket. Specify the destination bucket in the us-west-2 Region. Enable versioning on the source bucket.
    • BEnable Cross-Origin Resource Sharing (CORS) on both the us-east-1 bucket and the us-west-2 bucket.
    • CCreate an AWS Lambda function that copies the object to the destination bucket. Configure an Amazon EventBridge rule to run the Lambda function for each object that is created.
    • DEnable S3 Lifecycle policies to transition objects to a different storage class in the us-west-2 Region.

    Show answer

    Correct answer: A

    How others answered

    • A100%

13. Question 13 of 25

    A CloudOps engineer must ensure that all of a company's Amazon S3 buckets have versioning enabled. Which solution will meet this requirement?

    • AEnable AWS Config. Set up the s3-bucket-versioning-enabled AWS Config managed rule. Specify the configuration changes trigger type. Configure an automatic remediation action that uses an AWS Lambda function to enable versioning on noncompliant S3 buckets.
    • BEnable AWS Config. Set up the s3-bucket-versioning-enabled AWS Config managed rule. Specify the configuration changes trigger type. Configure an automatic remediation action that uses the AWS-ConfigureS3BucketVersioning AWS Systems Manager Automation runbook to enable versioning on noncompliant S3 buckets.
    • CEnable Amazon GuardDuty. Use GuardDuty to identify S3 buckets that have versioning disabled. Create an Amazon EventBridge rule that sends the GuardDuty findings to AWS Systems Manager Automation. Specify the AWS-ConfigureS3BucketVersioning Systems Manager Automation runbook to enable versioning on noncompliant S3 buckets.
    • DEnable Amazon GuardDuty. Use GuardDuty to identify S3 buckets that have versioning disabled. Create an Amazon EventBridge rule that sends the GuardDuty findings to a target AWS Lambda function. Configure the Lambda function to enable versioning on noncompliant S3 buckets.

    Show answer

    Correct answer: B

    How others answered

    • B100%

14. Question 14 of 25

    A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The instances are in an Amazon EC2 Auto Scaling group. The application is accessed with a public URL. A CloudOps engineer needs to implement a monitoring solution that checks the availability of the application and follows the same routes and actions as a customer. The CloudOps engineer must receive a notification if less than 95% of the monitoring runs find no errors. Which solution will meet these requirements?

    • ACreate an Amazon CloudWatch Synthetics canary with a script that follows customer routes. Schedule the canary to run on a recurring schedule. Create a CloudWatch alarm that publishes a message to an Amazon SNS topic when the SuccessPercent metric is less than 95%.
    • BCreate Amazon Route 53 health checks that monitor the availability of the endpoint. Create Amazon CloudWatch alarms that publish a message to an Amazon SNS topic when the HealthCheckPercentageHealthy metric is less than 95%.
    • CCreate a single AWS Lambda function to check whether the endpoints are available for each customer path. Schedule the Lambda function by using Amazon EventBridge. Configure the Lambda function to publish a message to an Amazon SNS topic when an endpoint returns an error.
    • DCreate an AWS Lambda function for each customer path to check whether that specific endpoint is available. Schedule the Lambda functions by using Amazon EventBridge. Configure each Lambda function to publish a custom metric to Amazon CloudWatch for the endpoint status. Create CloudWatch alarms based on each custom metric to publish a message to an Amazon SNS topic when an alarm is in the ALARM state.

    Show answer

    Correct answer: A

    How others answered

    • A100%

15. Question 15 of 25

    A CloudOps engineer needs to ensure that an Amazon RDS for PostgreSQL DB instance has available backups. The DB instance has automated backups turned on with a backup retention period of 7 days. However, no automated backups for the DB instance have been created in the past month. What could be the cause of the lack of automated backups?

    • AThe Amazon S3 bucket that stores the backups is full.
    • BThe DB instance is in the STORAGE_FULL state.
    • CThe DB instance is not configured for Multi-AZ.
    • DThe backup retention period must be 30 days.

    Show answer

    Correct answer: B

    How others answered

    • B100%

16. Question 16 of 25

    A gaming company uses Amazon EC2 Spot Instances to run game servers. Currently, the company uses small instance types. However, the company occasionally experiences spot unavailability. The company needs a solution that can automatically modify a spot request and add a new instance family when current instance types are unavailable. Which solution will meet this requirement?

    • AUse Amazon CloudWatch to log the event instance-stopped-no-capacity. Invoke an AWS Lambda function to modify the spot request.
    • BUse AWS CloudTrail to log EC2 spot request state changes. Configure an Amazon EventBridge rule on the CloudTrail log to invoke an AWS Lambda function to modify the spot request.
    • CUse Amazon CloudWatch logs and metrics to invoke an AWS Lambda function to modify the spot request.
    • DConfigure AWS Systems Manager Automation to detect spot request failures and run a runbook to implement the spot request.

    Show answer

    Correct answer: A

    How others answered

    • B100%

    Most people chose B, not A. Verify this one against the vendor documentation.

17. Question 17 of 25

    A company runs a website from Sydney, Australia. Users in the United States (US) and Europe are reporting that images and videos are taking a long time to load. However, local testing in Australia indicates no performance issues. The website has a large amount of static content in the form of images and videos that are stored in Amazon S3. Which solution will result in the MOST improvement in the user experience for users in the US and Europe?

    • AConfigure AWS PrivateLink for Amazon S3.
    • BConfigure S3 Transfer Acceleration.
    • CCreate an Amazon CloudFront distribution. Distribute the static content to the CloudFront edge locations.
    • DCreate an Amazon API Gateway API in each AWS Region. Cache the content locally.

    Show answer

    Correct answer: C

    How others answered

    • C100%

18. Question 18 of 25

    A company uses AWS Backup to back up critical Amazon EC2 instances daily. The company wants to test disaster recovery procedures by restoring an EC2 instance from a recent backup. Which solution will meet this requirement in the LEAST amount of time?

    • ARestore individual files from backups to the original EC2 instance to verify data integrity.
    • BRestore the most recent full backup to the original EC2 instance. Configure AWS Backup to update the instance by using changed blocks from subsequent incremental backups.
    • CIdentify the backup plan and recovery point for the EC2 instance. Use the restore backup option to create a new EC2 instance directly from the AMI-based recovery point.
    • DIdentify the backup plan and recovery point for the EC2 instance. Launch a new EC2 instance. Use AWS Backup root volume to restore the identified recovery point to the new instance.

    Show answer

    Correct answer: C

    How others answered

    • C100%

19. Question 19 of 25

    A CloudOps engineer is setting up a fleet of Amazon EC2 instances in an Auto Scaling group for an application. The fleet should have 50% CPU available at all times to accommodate bursts of traffic. The load will increase significantly between the hours of 09:00 and 17:00, 7 days a week. How should the CloudOps engineer configure the scaling of the EC2 instances to meet these requirements?

    • ACreate a target tracking scaling policy that runs when the CPU utilization is higher than 90%.
    • BCreate a target tracking scaling policy that runs when the CPU utilization is higher than 50%. Create a scheduled scaling policy that ensures that the fleet is available at 09:00. Create a second scheduled scaling policy that scales in the fleet at 17:00.
    • CSet the Auto Scaling group to start with 2 instances by setting the desired instances, maximum instances, and minimum instances to 2. Create a scheduled scaling policy that ensures that the fleet is available at 09:00.
    • DCreate a scheduled scaling policy that ensures that the fleet is available at 09:00. Create a second scheduled scaling policy that scales in the fleet at 17:00.

    Show answer

    Correct answer: B

    How others answered

    • B100%

20. Question 20 of 25

    A company has a policy that requires all Amazon EC2 instances to have a specific set of tags. If an EC2 instance does not have the required tags, the noncompliant instance should be terminated. What is the MOST operationally efficient solution that meets these requirements?

    • ACreate an Amazon EventBridge rule to send all EC2 instance state changes to an AWS Lambda function to determine if each instance is compliant. Terminate any noncompliant instances.
    • BCreate an IAM policy that enforces all EC2 instance tag requirements. If the required tags are not in place for an instance, the policy will terminate noncompliant instance.
    • CCreate an AWS Lambda function to determine if each EC2 instance is compliant and terminate an instance if it is noncompliant. Schedule the Lambda function to invoke every 5 minutes.
    • DCreate an AWS Config rule to check if the required tags are present. If an EC2 instance is noncompliant, invoke an AWS Systems Manager Automation runbook to terminate the instance.

    Show answer

    Correct answer: D

    How others answered

    • D100%

21. Question 21 of 25

    Select 2

    Users are reporting consistent forced logouts from a stateful web application. The web application is hosted on Amazon EC2 instances that are in an Auto Scaling group. The instances run behind an Application Load Balancer (ALB) that has multiple target groups with one listener rule. The ALB is configured as the origin in an Amazon CloudFront distribution. Which combination of actions should a CloudOps engineer take to resolve the logout problem? (Choose two.)

    • AChange to the least outstanding requests algorithm on the ALB target group.
    • BConfigure cookie forwarding in the CloudFront distribution's cache behavior settings.
    • CConfigure header forwarding in the CloudFront distribution's cache behavior settings.
    • DEnable group-level stickiness on the ALB listener rule for the target groups.
    • EConfigure weighted target groups on the ALB.

    Show answer

    Correct answer: B, D

    How others answered

    • BE100%

    Most people chose BE, not BD. Verify this one against the vendor documentation.

22. Question 22 of 25

    A company has a new application that runs on three Amazon EC2 instances. The EC2 instances are spread across three Availability Zones in a single AWS Region. The application is accessible on TCP port 1028. The company wants to balance traffic across all the EC2 instances. Which solution will meet these requirements with the LEAST operational overhead?

    • ACreate an Application Load Balancer with a listener configured to use port 1028. Create a target group on the listener for TCP port 1028. Register the EC2 instances with the target group.
    • BCreate a Network Load Balancer with a listener configured to use port 1028. Create a target group on the listener for TCP port 1028. Register the EC2 instances with the target group.
    • CCreate a Gateway Load Balancer with a listener configured to use port 1028. Create a target group on the listener for TCP port 1028. Register the EC2 instances with the target group.
    • DLaunch an EC2 instance with HAProxy configured that forwards requests to the three IP addresses.

    Show answer

    Correct answer: B

    How others answered

    • B100%

23. Question 23 of 25

    A company is using Amazon S3 buckets to store datasets. The company has several teams that use Amazon Athena to run one-time queries against the datasets. A CloudOps engineer must implement a solution that stores each team's Athena query results in that team's individual S3 bucket. Which solution will meet this requirement?

    • ACreate individual Athena workgroups that have separate S3 query result locations.
    • BConfigure an AWS Glue Data Catalog database for each team. Instruct the teams to run their queries on tables in their separate databases.
    • CRequire each team to use the primary Athena workgroup. Instruct the teams to set individual S3 result locations when they query Athena.
    • DCreate an AWS Glue security configuration. Associate the security configuration with each team.

    Show answer

    Correct answer: A

    How others answered

    • A100%

24. Question 24 of 25

    A company wants to use only IPv6 for all its Amazon EC2 instances. The EC2 instances must not be accessible from the internet, but the EC2 instances must be able to access the internet. The company creates a dual-stack VPC and IPv6-only subnets. How should a CloudOps engineer configure the VPC to meet these requirements?

    • ACreate and attach a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.
    • BCreate and attach an internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway. Attach the custom route table to the IPv6-only subnets.
    • CCreate and attach an egress-only internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the egress-only internet gateway. Attach the custom route table to the IPv6-only subnets.
    • DCreate and attach an internet gateway and a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway and all IPv4 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.

    Show answer

    Correct answer: C

    How others answered

    • C100%

25. Question 25 of 25

    A company has a VPC that contains a public subnet and a private subnet. The company deploys an Amazon EC2 instance that uses an Amazon Linux Amazon Machine Image (AMI) and has the AWS Systems Manager Agent (SSM Agent) installed in the private subnet. The EC2 instance is in a security group that allows only outbound traffic. A CloudOps engineer needs to give a group of privileged administrators the ability to connect to the instance through SSH without exposing the instance to the internet. Which solution will meet this requirement?

    • ACreate an EC2 Instance Connect endpoint in the private subnet. Update the security group to allow inbound SSH traffic. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
    • BCreate a Systems Manager endpoint in the private subnet. Update the security group to allow SSH traffic from the private network where the Systems Manager endpoint is connected. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
    • CCreate an EC2 Instance Connect endpoint in the public subnet. Update the security group to allow SSH traffic from the private network. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
    • DCreate a Systems Manager endpoint in the public subnet. Create an IAM role that has the AmazonSSMManagedInstanceCore permission for the EC2 instance. Create an IAM group for privileged administrators. Assign the AmazonEC2ReadOnlyAccess IAM policy to the IAM group.

    Show answer

    Correct answer: A

    How others answered

    • B50%
    • A50%

    Most people chose B, not A. Verify this one against the vendor documentation.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SOA-C03 practice, question 1 of 25