WGU Cloud-Deployment-and-Operations WGUCloud Deployment and Operations Exam Practice Test

Comprehensive and Detailed Explanation From Exact Extract:

In Amazon CloudFront, the caching TTL is controlled by the minimum and maximum TTL settings, with the maximum TTL (in seconds) capping the cache duration. The current Max TTL is 172800 seconds (48 hours), and the Cache-Control setting of 432000 seconds (120 hours) is ignored because it exceeds the Max TTL. To cache objects for up to 120 hours, the Max setting must be configured to 432000 seconds. The WGU Cloud Deployment and Operations Study Guide (Section 4.4, CloudFront Caching) states, "The maximum TTL in CloudFront settings (e.g., 172800 seconds) overrides any higher Cache-Control value; to allow 120 hours (432000 seconds), the Max TTL must be set accordingly." Adjusting Min, expiration, or Cache-Control alone does not resolve this.

To deploy a NAT gateway in an existing VPC subnet, the administrator must assign an elastic IP address to the NAT gateway for public internet access and configure the route table associated with the subnet to route traffic through the NAT gateway. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, NAT Gateway) states, "Deployment of a NAT gateway requires an elastic IP address for outbound internet connectivity and a route table update to direct private subnet traffic to the NAT gateway (e.g., 0.0.0.0/0 via NAT)." Private IP assignment and ACL configuration are not required steps.

To create a metric filter in the Amazon CloudWatch console, the first step is to select a log group from which the log data will be analyzed. A log group contains log streams, and metric filters are applied to the log data within these groups to extract metrics based on patterns. The WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs) specifies that the process begins by navigating to the CloudWatch console, selecting a log group, and then defining the filter pattern. Actions like enabling an alarm, defining a trace, or specifying a stream are subsequent or unrelated steps.

Comprehensive and Detailed Explanation From Exact Extract:

The CloudFormation template feature should be used to specify the AWS resources to be provisioned. A template is a JSON or YAML file that defines the resources (e.g., EC2 instances, S3 buckets) and their configurations for deployment. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Templates) states, "The template is the core component of CloudFormation, containing the resource specifications and properties that are provisioned when a stack is created." Change sets, exports, and stack sets serve different purposes (e.g., previewing changes, sharing outputs, managing multiple stacks).

To reduce conversion delays caused by increased demand, the company should configure a CloudWatch alarm to scale the EC2 fleet based on the SQS queue length. This auto-scaling approach dynamically adjusts the number of EC2 instances to handle the workload, especially during peak evening hours and anticipated growth. The WGU Cloud Deployment and Operations Study Guide (Section 3.3, Auto Scaling and SQS) explains, "Auto Scaling can be triggered by a CloudWatch alarm monitoring SQS queue depth, ensuring the EC2 fleet scales out to process video conversion tasks efficiently as the queue length increases." Spot instances, dead-letter queues, and instance type upgrades do not directly address dynamic scaling needs.

Comprehensive and Detailed Explanation From Exact Extract:

Maximizing the time to live (TTL) of the cache in Amazon CloudFront reduces the frequency of requests to the origin server by serving content from edge locations for a longer period, lowering latency and costs. The WGU Cloud Deployment and Operations Study Guide (Section 4.4, CloudFront Caching) states, "A higher TTL in CloudFront caching minimizes origin requests by keeping objects in edge caches longer, reducing load on the origin server and optimizing performance and cost." Facilitating high request volumes, improving disaster recovery, and enhancing security are not primary benefits of maximizing TTL.

The latency routing policy in Amazon Route 53 should be used to direct customer requests to the website with the shortest round-trip time (RTT). This policy routes traffic to the AWS region with the lowest latency based on the user's location, optimizing performance. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) states, "The latency-based routing policy in Route 53 measures RTT to direct users to the region with the lowest latency, improving user experience across multiple websites." Geolocation, geoproximity, and weighted policies do not prioritize RTT in this manner.

The `disk_io_time` metric, collected by the CloudWatch agent on EC2 Linux instances, measures the total time (in milliseconds) that read and write requests have waited on I/O, helping to assess disk performance for instance sizing. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Agent Metrics) states, "The `disk_io_time` metric, available via the CloudWatch agent, tracks the time spent waiting for I/O operations, providing insight into disk contention for optimizing EC2 instance sizing." disk_read_ops, diskio_reads, and diskio_read_bytes measure operation counts or bytes, not wait times.

If a patch baseline is not explicitly defined in Patch Manager, it is attached to the default patch group. This default group applies a preconfigured baseline with AWS-recommended patches, ensuring basic compliance for instances without custom baselines. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "If no custom patch baseline is defined, instances are associated with the default patch group, which uses AWS-provided baseline settings for automatic patch approval." Options A, C, and D are not valid attachments for patch baselines.

Comprehensive and Detailed Explanation From Exact Extract:

Spot Instances are the most suitable EC2 instance type for this workload pattern, offering the lowest cost for short, interruptible tasks like 3D rendering, where work can be redistributed if interrupted. This aligns with the company’s cost-plus pricing model. The WGU Cloud Deployment and Operations Study Guide (Section 7.3, EC2 Instance Types) states, "Spot Instances provide significant cost savings (up to 90% off On-Demand) for fault-tolerant, short-term workloads like rendering, where interruptions can be handled by redistributing tasks to other nodes." On-Demand, Dedicated, and Reserved Instances are more expensive and less flexible for this use case.

Amazon Inspector can publish its findings when detecting anomalies to Amazon SNS for real-time notifications and to CloudWatch for metric and event logging, enabling monitoring and response. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, Amazon Inspector) states, "Inspector findings are published to SNS for immediate alerts and to CloudWatch for detailed logging, allowing integration with other AWS services for anomaly response." CloudTrail logs API calls, and SQS is a messaging queue, neither of which are primary destinations for Inspector findings.

When Amazon Route 53 determines an endpoint is unhealthy based on a failure threshold (e.g., via health checks), it terminates the connection attempt to that endpoint and routes traffic to a healthy alternative, if available. This behavior ensures high availability using routing policies like failover or latency-based routing. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Health Checks) states, "Route 53 stops routing traffic to an unhealthy endpoint by terminating connection attempts once the health check failure threshold is exceeded, redirecting to a healthy resource." Options A, C, and D are not direct actions taken by Route 53 in this scenario.

AWS WAF (Web Application Firewall) is used to protect a server from Layer 7 (application layer) attacks, such as SQL injection or cross-site scripting, by filtering HTTP/HTTPS traffic based on defined rules. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, AWS WAF) states, "WAF protects web applications at Layer 7 by inspecting and blocking malicious requests, such as those involving SQL injection or XSS, when integrated with ALB or CloudFront." Shield protects against DDoS (Layer 3/4), CloudWatch monitors metrics, and KMS key rotation manages encryption, none of which address Layer 7 attacks.

Comprehensive and Detailed Explanation From Exact Extract:

AWS Client VPN is used to provide remote workers with secure access to AWS resources by establishing a VPN connection to the VPC, ensuring encrypted access to private networks. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Client VPN) states, "Client VPN enables secure remote access to AWS resources within a VPC, using mutual authentication and encryption to protect data for remote workers." Transit Gateway manages inter-VPC routing, Network Firewall filters traffic, and NAT instances handle outbound internet access, none of which are designed for remote worker access.

To run Automation documents on a schedule in AWS Systems Manager, a maintenance window must be configured. Maintenance windows define the time periods during which automated tasks, including the execution of Automation documents, can run. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Maintenance Windows) explains that maintenance windows are used to schedule and control the execution of Systems Manager tasks, ensuring they align with operational windows. Rate control, session preferences, and resource groups are not used for scheduling automation tasks.

Patch Manager in AWS Systems Manager sends compliance reports to an Amazon S3 bucket, where they are stored for auditing and analysis. This allows administrators to track patch compliance status across EC2 instances and on-premises servers. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "Patch Manager compliance reports are delivered to an S3 bucket configured as a target, providing a centralized location for reviewing patch status and compliance data." OpsWorks, EBS, and Route 53 are not used for storing these reports.

To receive emails when a Lambda function returns an error, the administrator should use Amazon CloudWatch to monitor the function’s logs and metrics (e.g., errors) and Amazon Simple Notification Service (SNS) to send email notifications based on CloudWatch alarms. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, CloudWatch and SNS) states, "CloudWatch can detect Lambda errors via logs and trigger an alarm, which integrates with SNS to send email notifications to subscribed endpoints, ensuring timely error alerts." SQS and CloudTrail are not designed for this notification workflow.

Comprehensive and Detailed Explanation From Exact Extract:

The Mappings section in a CloudFormation template should be used to set values based on region-specific AMI IDs. Mappings allow the template to define a lookup table that associates regions with corresponding AMI IDs, enabling dynamic selection during stack creation across multiple regions. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Mappings) states, "The Mappings section enables region-specific configurations, such as mapping AMI IDs to regions (e.g., 'us-east-1': 'ami-123456'), ensuring the correct AMI is used based on the deployment region." Outputs, WaitCondition, and Resources do not provide this mapping functionality.

The multivalue routing policy in Amazon Route 53 allows up to 8 healthy records to be returned in response to DNS queries, enabling load balancing across multiple resources. To ensure the maximum allowed number of records is utilized, the administrator should create 8 records. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) specifies, "Multivalue answer routing supports up to 8 healthy resource record sets per response, requiring the creation of 8 records to maximize the policy's capability." Options A, C, and D exceed or fall short of this limit.

Comprehensive and Detailed Explanation From Exact Extract:

The VPC flow log fields indicate the following: the source IP is 192.168.20.1, the destination IP is 203.0.113.66, the source port is 2066, the destination port is 22, and the action is "ACCEPT OK," meaning the traffic was permitted. This shows outbound traffic from the internal network (192.168.20.1) to an external IP (203.0.113.66) with destination port 2066. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Flow Logs) states, "In a flow log, the format includes source IP, destination IP, source port, destination port, and action; for example, 192.168.20.1 to 203.0.113.66 with source port 2066 and destination port 22 indicates permitted outbound traffic." Only option C correctly interprets this flow.