Free and Premium WGU Cloud-Deployment-and-Operations Dumps Questions Answers

Comprehensive and Detailed Explanation From Exact Extract:

After stopping and starting an EC2 instance, the public IP address may change (unless an Elastic IP is attached), but the security group rules remain intact. If the instance is no longer accessible via SSH, it’s likely due to an inbound rule (e.g., for port 22) not being correctly configured or applied. Adding or verifying a rule in the security group associated with the network interface (NIC) to allow SSH (port 22) from the administrator’s IP resolves this. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Security Groups) states, "Stopping and starting an EC2 instance may require verifying or adding an inbound SSH rule (port 22) in the security group if connectivity is lost due to IP or rule misconfiguration." Route table or IP changes are not the primary issue here.

AWS Trusted Advisor provides recommendations to help follow AWS best practices, analyzing the environment for cost optimization, security, performance, and fault tolerance. It offers actionable insights to improve resource usage. The WGU Cloud Deployment and Operations Study Guide (Section 6.4, Trusted Advisor) states, "Trusted Advisor evaluates your AWS environment against best practices, providing recommendations in categories like cost optimization and security (e.g., enabling MFA or removing unused resources)." Options A, B, and C overstate or misrepresent its role, as it does not focus solely on unused IAM roles, holistic health overviews, or patch recommendations.

Comprehensive and Detailed Explanation From Exact Extract:

AWS Client VPN is used to provide remote workers with secure access to AWS resources by establishing a VPN connection to the VPC, ensuring encrypted access to private networks. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Client VPN) states, "Client VPN enables secure remote access to AWS resources within a VPC, using mutual authentication and encryption to protect data for remote workers." Transit Gateway manages inter-VPC routing, Network Firewall filters traffic, and NAT instances handle outbound internet access, none of which are designed for remote worker access.

Comprehensive and Detailed Explanation From Exact Extract:

A Billing alarm in Amazon CloudWatch should be used to monitor estimated AWS charges by setting thresholds on cost metrics and triggering notifications when exceeded. This helps manage budgets effectively. The WGU Cloud Deployment and Operations Study Guide (Section 7.4, Cost Monitoring) states, "Billing alarms in CloudWatch monitor estimated charges against a defined threshold, sending alerts via SNS to prevent cost overruns." Cognito handles user authentication, Pricing Calculator estimates costs pre-deployment, and Forecast predicts usage, none of which monitor real-time charges.

Patch Manager in AWS Systems Manager sends compliance reports to an Amazon S3 bucket, where they are stored for auditing and analysis. This allows administrators to track patch compliance status across EC2 instances and on-premises servers. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "Patch Manager compliance reports are delivered to an S3 bucket configured as a target, providing a centralized location for reviewing patch status and compliance data." OpsWorks, EBS, and Route 53 are not used for storing these reports.

Amazon CloudWatch alarms can trigger notifications when a metric breaches a defined threshold. The AWS solution designed to send emails based on these alarms is Amazon Simple Notification Service (SNS). SNS supports sending notifications via email, SMS, and other protocols when subscribed endpoints are triggered by CloudWatch alarms. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, Monitoring and Alarms) states that SNS is the primary service for delivering notifications from CloudWatch, allowing users to configure emailsubscriptions for alarm states. Other options like SQS, Amplify, and Kinesis are not designed for this purpose.

The `GetSessionToken` API call is needed to perform MFA before accessing a resource, as it generates temporary security credentials for an IAM user after MFA validation. This ensures secure access to AWS resources. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, IAM and MFA) states, "The `GetSessionToken` API is used with MFA to obtain temporary credentials, requiring a valid MFA code to authenticate the user before resource access is granted." GetCallerIdentity, GetFederationToken, and DecodeAuthorizationMessage serve different purposes and do not handle MFA authentication.

Comprehensive and Detailed Explanation From Exact Extract:

CloudWatch should be used to identify and shut down idle EC2 instances by monitoring metrics such as CPU utilization or network activity. Custom alarms can be set to trigger an AWS Lambda function or Systems Manager automation to terminate idle instances, optimizing costs. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Metrics) states, "CloudWatch can monitor EC2 instance metrics like CPUUtilization; an alarm can be configured to invoke a Lambda function to terminate idle instances, ensuring cost efficiency." CloudFront, CloudSearch, and CloudTrail are not designed for this monitoring and automation task.

The weighted routing policy in Amazon Route 53 allows the company to distribute traffic with specific percentages, such as 75% to AWS and 25% to the on-premises infrastructure, by assigning weights to each resource record. This enables load balancing across hybrid environments. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) states, "Weighted routing policy assigns weights to resource record sets (e.g., 75 for AWS, 25 for on-premises), controlling the percentage of traffic directed to each endpoint." Geolocation, failover, and simple policies do not support percentage-based traffic splitting.

Multipart uploads must be used when uploading files larger than 5 GB to Amazon S3, as this method splits the file into smaller parts for parallel upload, improving reliability and performance. The WGU Cloud Deployment and Operations Study Guide (Section 2.1, S3 Uploads) states, "For files exceeding 5 GB, multipart upload is required in S3, allowing the file to be divided into parts (minimum 5 MB each) for concurrent uploads, ensuring efficient and resumable transfers." Glacier Select, Transfer Acceleration, and Intelligent-Tiering are not designed for this upload optimization.

When Amazon Route 53 determines an endpoint is unhealthy based on a failure threshold (e.g., via health checks), it terminates the connection attempt to that endpoint and routes traffic to a healthy alternative, if available. This behavior ensures high availability using routing policies like failover or latency-based routing. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Health Checks) states, "Route 53 stops routing traffic to an unhealthy endpoint by terminating connection attempts once the health check failure threshold is exceeded, redirecting to a healthy resource." Options A, C, and D are not direct actions taken by Route 53 in this scenario.

To receive emails when a Lambda function returns an error, the administrator should use Amazon CloudWatch to monitor the function’s logs and metrics (e.g., errors) and Amazon Simple Notification Service (SNS) to send email notifications based on CloudWatch alarms. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, CloudWatch and SNS) states, "CloudWatch can detect Lambda errors via logs and trigger an alarm, which integrates with SNS to send email notifications to subscribed endpoints, ensuring timely error alerts." SQS and CloudTrail are not designed for this notification workflow.

A metric filter in Amazon CloudWatch Logs can be used to search for specific terms in log data and create metrics based on the matches. To include log events with the word "ERROR" and exclude those with the word "WARNING," the correct syntax involves using a filter pattern with a positive match for "ERROR" and a negation for "WARNING." The correct pattern is "ERROR -WARN," where the minus sign (-) indicates exclusion of log events containing "WARN." According to the WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs), metric filters use a pattern-based syntax where terms are included or excluded using positive matches and the negation operator (-). This ensures that only logs with "ERROR" and without "WARN" are processed into the metric.

The Wait event view in Amazon RDS Performance Insights provides information on hardware resources (e.g., CPU, I/O, memory) that may be causing bottlenecks by showing wait times for database operations. The WGU Cloud Deployment and Operations Study Guide (Section 7.2, Performance Insights) states, "The Wait event view in Performance Insights identifies resource bottlenecks (e.g., I/O wait times) by analyzing wait states, helping optimize database performance on hardware resources." Users, Hosts, and Statement views focus on different aspects and do not directly address hardware bottlenecks.

The latency routing policy in Amazon Route 53 should be used to direct customer requests to the website with the shortest round-trip time (RTT). This policy routes traffic to the AWS region with the lowest latency based on the user's location, optimizing performance. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) states, "The latency-based routing policy in Route 53 measures RTT to direct users to the region with the lowest latency, improving user experience across multiple websites." Geolocation, geoproximity, and weighted policies do not prioritize RTT in this manner.

To ensure the route table with a default outbound route via an internet gateway takes effect, the administrator must create a subnet association, linking the route table to specific subnets within the VPC. This association applies the routing rules to the subnet's traffic. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Routing) states, "A route table must be associated with a subnet (subnet association) to enforce routing rules, such as the default route to an internet gateway, ensuring outbound traffic follows the defined path." Propagation, tags, and edge associations do not activate the route.

Elastic Load Balancing (ELB) should be used to horizontally scale Amazon EC2 instances by distributing incoming traffic across multiple instances, improving availability and fault tolerance. ELB works in conjunction with Auto Scaling groups to add or remove instances based on demand. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Elastic Load Balancing) notes, "Elastic Load Balancing distributes traffic across EC2 instances, enabling horizontal scaling as part of an Auto Scaling group to handle increased load efficiently." Elastic IPs, elastic network interfaces, and Elastic Beanstalk do not provide this scaling functionality.

Comprehensive and Detailed Explanation From Exact Extract:

The Reachability Analyzer in AWS VPC should be used to troubleshoot connectivity issues from on-premises computers to EC2 instances, especially when a network security group (NSG) is suspected. It analyzes the network path and identifies blocked traffic due to NSG rules or route tables. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Troubleshooting) states, "Reachability Analyzer helps diagnose connectivity issues by simulating traffic paths, identifying if an NSG rule (e.g., blocked port) or route table is causing the problem from on-premises to EC2 public IPs." Flow Logs provide data but not analysis, PrivateLink is for private connections, and Traffic Mirroring is for monitoring.

The `disk_io_time` metric, collected by the CloudWatch agent on EC2 Linux instances, measures the total time (in milliseconds) that read and write requests have waited on I/O, helping to assess disk performance for instance sizing. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Agent Metrics) states, "The `disk_io_time` metric, available via the CloudWatch agent, tracks the time spent waiting for I/O operations, providing insight into disk contention for optimizing EC2 instance sizing." disk_read_ops, diskio_reads, and diskio_read_bytes measure operation counts or bytes, not wait times.

The `Ref` function in an AWS CloudFormation template is used to obtain values of components defined within the template, such as resource IDs, parameters, or outputs. This function allows dynamic referencing of resources during stack creation. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Functions) states, "The `Ref` function is used to reference the logical IDs of resources, parameters, or mappings defined in the template, enabling dynamic value retrieval (e.g., `Ref: MyEC2Instance` returns the instance ID)." ImportValue is used for cross-stack references, Cidr for IP range calculations, and GetAZs for availability zone lists, making them unsuitable here.