WGU Cloud-Deployment-and-Operations WGUCloud Deployment and Operations Exam Practice Test

A metric filter in Amazon CloudWatch Logs can be used to search for specific terms in log data and create metrics based on the matches. To include log events with the word "ERROR" and exclude those with the word "WARNING," the correct syntax involves using a filter pattern with a positive match for "ERROR" and a negation for "WARNING." The correct pattern is "ERROR -WARN," where the minus sign (-) indicates exclusion of log events containing "WARN." According to the WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs), metric filters use a pattern-based syntax where terms are included or excluded using positive matches and the negation operator (-). This ensures that only logs with "ERROR" and without "WARN" are processed into the metric.

Comprehensive and Detailed Explanation From Exact Extract:

Maximizing the time to live (TTL) of the cache in Amazon CloudFront reduces the frequency of requests to the origin server by serving content from edge locations for a longer period, lowering latency and costs. The WGU Cloud Deployment and Operations Study Guide (Section 4.4, CloudFront Caching) states, "A higher TTL in CloudFront caching minimizes origin requests by keeping objects in edge caches longer, reducing load on the origin server and optimizing performance and cost." Facilitating high request volumes, improving disaster recovery, and enhancing security are not primary benefits of maximizing TTL.

Systems Manager Automation documents can be created using JSON or YAML file formats to define workflows and actions based on AWS Config rules. These formats allow administrators to specify the steps and parameters for automation tasks, such as remediation actions triggered by Config rule evaluations. The WGU Cloud Deployment and Operations Study Guide (Section 5.1, Systems Manager Automation) states that both JSON and YAML are supported formats for writing Automation documents, providing flexibility in scripting automation logic. XML and CSV are not supported formats for this purpose.

To notify a response team when a high-security web server returns a 403 Forbidden error, two key steps are required. First, define a metric filter for Apache logs in CloudWatch to detect the 403 error code within the log data. This involves setting up a filter pattern to match "403" in the Apache access logs. Second, create an alarm for the metric filter and configure it to deliver alerts using Amazon SNS, which supports email or other notifications to the response team. The WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs and Alarms) confirms that metric filters and SNS-integrated alarms are the standard approach for monitoring and alerting on log-based events. Options B and D are incorrect as they involve unnecessary or unsupported configurations (e.g., binding Lambda to Apache or using SQS for alarms).

Comprehensive and Detailed Explanation From Exact Extract:

The VPC flow log fields indicate the following: the source IP is 192.168.20.1, the destination IP is 203.0.113.66, the source port is 2066, the destination port is 22, and the action is "ACCEPT OK," meaning the traffic was permitted. This shows outbound traffic from the internal network (192.168.20.1) to an external IP (203.0.113.66) with destination port 2066. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Flow Logs) states, "In a flow log, the format includes source IP, destination IP, source port, destination port, and action; for example, 192.168.20.1 to 203.0.113.66 with source port 2066 and destination port 22 indicates permitted outbound traffic." Only option C correctly interprets this flow.

Amazon Inspector can publish its findings when detecting anomalies to Amazon SNS for real-time notifications and to CloudWatch for metric and event logging, enabling monitoring and response. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, Amazon Inspector) states, "Inspector findings are published to SNS for immediate alerts and to CloudWatch for detailed logging, allowing integration with other AWS services for anomaly response." CloudTrail logs API calls, and SQS is a messaging queue, neither of which are primary destinations for Inspector findings.

Comprehensive and Detailed Explanation From Exact Extract:

CloudWatch should be used to identify and shut down idle EC2 instances by monitoring metrics such as CPU utilization or network activity. Custom alarms can be set to trigger an AWS Lambda function or Systems Manager automation to terminate idle instances, optimizing costs. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Metrics) states, "CloudWatch can monitor EC2 instance metrics like CPUUtilization; an alarm can be configured to invoke a Lambda function to terminate idle instances, ensuring cost efficiency." CloudFront, CloudSearch, and CloudTrail are not designed for this monitoring and automation task.

Comprehensive and Detailed Explanation From Exact Extract:

To set up self-managed permissions for CloudFormation StackSet operations, two roles are required: in the administrator account, create an IAM role named AWSCloudFormationStackSetAdministrationRole to manage StackSet operations, and in each target account, create a service role named AWSCloudFormationStackSetExecutionRole that trusts the administrator account to execute the stacks. The WGU Cloud Deployment and Operations Study Guide (Section 5.4, StackSets) states, "For self-managed permissions, the administrator account requires the AWSCloudFormationStackSetAdministrationRole, while each target account needs the AWSCloudFormationStackSetExecutionRole with a trust relationship to the administrator account for stack deployment." Roles B and D are incorrectly named or misplaced.

Amazon S3 (Simple Storage Service) should be used to host content to be processed for Amazon Made, as it provides scalable object storage ideal for storing and retrieving large amounts of data, such as media files or documents, for processing workflows. The WGU Cloud Deployment and Operations Study Guide (Section 2.1, Amazon S3) states, "S3 is the preferred solution for hosting content to be processed by services like Amazon Made, offering durable and highly available storage with support for lifecycle policies and integration with other AWS services." DocumentDB, DynamoDB, and EC2 are not designed for this content hosting purpose.

The AWS monitoring feature used to process events with AWS Lambda is CloudWatch Events, specifically through the use of rules. Rules define the events to monitor (e.g., based on event patterns) and specify targets like AWS Lambda functions to process those events. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, CloudWatch Events) explains that rules are the core component for event-driven architectures, enabling automation by linking events to Lambda for processing. Metrics, targets, and logs are related but not the primary feature for this function.

To route requests to a healthy endpoint without requesting additional Elastic IP addresses, the company should register a DNS name to an auto-assigned public IP address using a service like Route 53. This leverages dynamic DNS to distribute traffic, reducing reliance on fixed EIPs. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53) states, "Registering a DNS name with an auto-assigned public IP in Route 53 allows traffic routing to healthy instances, avoiding the need for additional Elastic IP addresses." TTL adjustment, route table edits, and Systems Manager are not relevant solutions.

The `disk_io_time` metric, collected by the CloudWatch agent on EC2 Linux instances, measures the total time (in milliseconds) that read and write requests have waited on I/O, helping to assess disk performance for instance sizing. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Agent Metrics) states, "The `disk_io_time` metric, available via the CloudWatch agent, tracks the time spent waiting for I/O operations, providing insight into disk contention for optimizing EC2 instance sizing." disk_read_ops, diskio_reads, and diskio_read_bytes measure operation counts or bytes, not wait times.

Comprehensive and Detailed Explanation From Exact Extract:

The CloudFormation template feature should be used to specify the AWS resources to be provisioned. A template is a JSON or YAML file that defines the resources (e.g., EC2 instances, S3 buckets) and their configurations for deployment. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Templates) states, "The template is the core component of CloudFormation, containing the resource specifications and properties that are provisioned when a stack is created." Change sets, exports, and stack sets serve different purposes (e.g., previewing changes, sharing outputs, managing multiple stacks).

Elastic Load Balancing (ELB) should be used to horizontally scale Amazon EC2 instances by distributing incoming traffic across multiple instances, improving availability and fault tolerance. ELB works in conjunction with Auto Scaling groups to add or remove instances based on demand. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Elastic Load Balancing) notes, "Elastic Load Balancing distributes traffic across EC2 instances, enabling horizontal scaling as part of an Auto Scaling group to handle increased load efficiently." Elastic IPs, elastic network interfaces, and Elastic Beanstalk do not provide this scaling functionality.

AWS WAF (Web Application Firewall) is used to protect a server from Layer 7 (application layer) attacks, such as SQL injection or cross-site scripting, by filtering HTTP/HTTPS traffic based on defined rules. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, AWS WAF) states, "WAF protects web applications at Layer 7 by inspecting and blocking malicious requests, such as those involving SQL injection or XSS, when integrated with ALB or CloudFront." Shield protects against DDoS (Layer 3/4), CloudWatch monitors metrics, and KMS key rotation manages encryption, none of which address Layer 7 attacks.

Enabling automatic key rotation in AWS Key Management Service (KMS) is the least effort solution to ensure cryptographic material is not used longer than a year. KMS automatically rotates the cryptographic material of symmetric customer master keys (CMKs) every 365 days, meeting the requirement without manual intervention. The WGU Cloud Deployment and Operations Study Guide (Section 6.3, KMS) states, "Automatic key rotation in KMS rotates the backing key material every year for symmetric CMKs, providing a low-effort way to comply with key usage limits." Moving to CloudHSM, custom protocols, or Lambda functions require more effort and complexity.

A patch baseline in Patch Manager defines the patches that should and should not be installed on EC2 instances, specifying approval rules for security updates, other updates, and exclusions. This ensures controlled and compliant patching. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "A patch baseline specifies which patches are approved for installation and which are excluded, allowing customization of patch deployment (e.g., approving only critical security updates)." Options A, B, and D misrepresent the baseline's role, as it does not auto-install, assign IAM roles, or notify Config directly.

Comprehensive and Detailed Explanation From Exact Extract:

To deploy a static website to AWS, the bucket properties of an Amazon S3 bucket should be configured, specifically enabling static website hosting. This involves setting the bucket policy to allow public read access and configuring the index and error documents. The WGU Cloud Deployment and Operations Study Guide (Section 2.1, S3 Static Website Hosting) states, "Configuring bucket properties for static website hosting in S3 involves enabling the website endpoint, setting an index document (e.g., index.html), and applying a bucket policy for public access, making it suitable for hosting static content." RDS Proxy, S3 Versioning, and CloudTrail events are not relevant to this use case.

Comprehensive and Detailed Explanation From Exact Extract:

Spot Instances are the most suitable EC2 instance type for this workload pattern, offering the lowest cost for short, interruptible tasks like 3D rendering, where work can be redistributed if interrupted. This aligns with the company’s cost-plus pricing model. The WGU Cloud Deployment and Operations Study Guide (Section 7.3, EC2 Instance Types) states, "Spot Instances provide significant cost savings (up to 90% off On-Demand) for fault-tolerant, short-term workloads like rendering, where interruptions can be handled by redistributing tasks to other nodes." On-Demand, Dedicated, and Reserved Instances are more expensive and less flexible for this use case.

Amazon RDS Performance Insights supports retention periods of 7 days and 1 year for storing performance data, depending on the configuration and edition. The default retention is 7 days for standard monitoring, while enabling enhanced monitoring or the Performance Insights extended retention feature allows data to be retained for up to 1 year. The WGU Cloud Deployment and Operations Study Guide (Section 7.2, Performance Insights) states, "Performance Insights offers a 7-day retention period by default, with an option to extend to 1 year for detailed historical analysis, supporting cost and performance optimization." Options A (1 day) and D (2 years) are not supported retention periods.