Free Practice Questions for WGU Cloud-Deployment-and-Operations Exam

AWS Control Tower enables a company to enforce and manage governance rules across multiple AWS accounts by setting up a landing zone with preconfigured policies for security, compliance, and operations. It simplifies multi-account management. The WGU Cloud Deployment and Operations Study Guide (Section 6.5, Control Tower) states, "Control Tower provides a centralized solution to establish and enforce governance rules across multiple accounts, using guardrails and a landing zone to ensure compliance with organizational policies." Security Hub, GuardDuty, and Systems Manager do not offer this multi-account governance capability.

Amazon Route 53 is the AWS solution that sends DNS queries to separate AWS compute instances by leveraging routing policies to distribute traffic across multiple resources. It acts as a scalable Domain Name System (DNS) service, directing queries to healthy instances based on configurations like latency or weighted routing. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53) states, "Route 53 uses DNS to route end-user requests to multiple AWS compute instances, supporting features like health checks and traffic distribution." Elastic Beanstalk, CloudWatch, and EC2 Auto Scaling do not perform DNS query routing.

Comprehensive and Detailed Explanation From Exact Extract:

After stopping and starting an EC2 instance, the public IP address may change (unless an Elastic IP is attached), but the security group rules remain intact. If the instance is no longer accessible via SSH, it’s likely due to an inbound rule (e.g., for port 22) not being correctly configured or applied. Adding or verifying a rule in the security group associated with the network interface (NIC) to allow SSH (port 22) from the administrator’s IP resolves this. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Security Groups) states, "Stopping and starting an EC2 instance may require verifying or adding an inbound SSH rule (port 22) in the security group if connectivity is lost due to IP or rule misconfiguration." Route table or IP changes are not the primary issue here.

If a patch baseline is not explicitly defined in Patch Manager, it is attached to the default patch group. This default group applies a preconfigured baseline with AWS-recommended patches, ensuring basic compliance for instances without custom baselines. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "If no custom patch baseline is defined, instances are associated with the default patch group, which uses AWS-provided baseline settings for automatic patch approval." Options A, C, and D are not valid attachments for patch baselines.

Comprehensive and Detailed Explanation From Exact Extract:

To set up self-managed permissions for CloudFormation StackSet operations, two roles are required: in the administrator account, create an IAM role named AWSCloudFormationStackSetAdministrationRole to manage StackSet operations, and in each target account, create a service role named AWSCloudFormationStackSetExecutionRole that trusts the administrator account to execute the stacks. The WGU Cloud Deployment and Operations Study Guide (Section 5.4, StackSets) states, "For self-managed permissions, the administrator account requires the AWSCloudFormationStackSetAdministrationRole, while each target account needs the AWSCloudFormationStackSetExecutionRole with a trust relationship to the administrator account for stack deployment." Roles B and D are incorrectly named or misplaced.

A metric filter in Amazon CloudWatch Logs can be used to search for specific terms in log data and create metrics based on the matches. To include log events with the word "ERROR" and exclude those with the word "WARNING," the correct syntax involves using a filter pattern with a positive match for "ERROR" and a negation for "WARNING." The correct pattern is "ERROR -WARN," where the minus sign (-) indicates exclusion of log events containing "WARN." According to the WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs), metric filters use a pattern-based syntax where terms are included or excluded using positive matches and the negation operator (-). This ensures that only logs with "ERROR" and without "WARN" are processed into the metric.

Comprehensive and Detailed Explanation From Exact Extract:

In Amazon CloudFront, the caching TTL is controlled by the minimum and maximum TTL settings, with the maximum TTL (in seconds) capping the cache duration. The current Max TTL is 172800 seconds (48 hours), and the Cache-Control setting of 432000 seconds (120 hours) is ignored because it exceeds the Max TTL. To cache objects for up to 120 hours, the Max setting must be configured to 432000 seconds. The WGU Cloud Deployment and Operations Study Guide (Section 4.4, CloudFront Caching) states, "The maximum TTL in CloudFront settings (e.g., 172800 seconds) overrides any higher Cache-Control value; to allow 120 hours (432000 seconds), the Max TTL must be set accordingly." Adjusting Min, expiration, or Cache-Control alone does not resolve this.

The Enterprise support plan provides a technical account manager (TAM) and full use of Trusted Advisor, offering proactive guidance and comprehensive access to all checks. This plan is designed for large-scale, mission-critical workloads. The WGU Cloud Deployment and Operations Study Guide (Section 6.4, AWS Support Plans) states, "The Enterprise support plan includes a dedicated Technical Account Manager and full Trusted Advisor access, providing 24/7 support and proactive optimization recommendations." Developer, Standard, and Business plans offer limited or no TAM support and partial Trusted Advisor access.

The AWS monitoring feature used to process events with AWS Lambda is CloudWatch Events, specifically through the use of rules. Rules define the events to monitor (e.g., based on event patterns) and specify targets like AWS Lambda functions to process those events. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, CloudWatch Events) explains that rules are the core component for event-driven architectures, enabling automation by linking events to Lambda for processing. Metrics, targets, and logs are related but not the primary feature for this function.

Comprehensive and Detailed Explanation From Exact Extract:

CloudWatch should be used to identify and shut down idle EC2 instances by monitoring metrics such as CPU utilization or network activity. Custom alarms can be set to trigger an AWS Lambda function or Systems Manager automation to terminate idle instances, optimizing costs. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Metrics) states, "CloudWatch can monitor EC2 instance metrics like CPUUtilization; an alarm can be configured to invoke a Lambda function to terminate idle instances, ensuring cost efficiency." CloudFront, CloudSearch, and CloudTrail are not designed for this monitoring and automation task.