CLOUD-DEPLOYMENT-AND-OPERATIONS Practice Questions

AWS Trusted Advisor provides recommendations to help follow AWS best practices, analyzing the

environment for cost optimization, security, performance, and fault tolerance. It offers actionable

insights to improve resource usage. The WGU Cloud Deployment and Operations Study Guide

(Section 6.4, Trusted Advisor) states, "Trusted Advisor evaluates your AWS environment against best

practices, providing recommendations in categories like cost optimization and security (e.g., enabling

MFA or removing unused resources)." Options A, B, and C overstate or misrepresent its role, as it

does not focus solely on unused IAM roles, holistic health overviews, or patch recommendations.

To create a metric filter in the Amazon CloudWatch console, the first step is to select a log group from

which the log data will be analyzed. A log group contains log streams, and metric filters are applied

to the log data within these groups to extract metrics based on patterns. The WGU Cloud

Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs) specifies that the process

begins by navigating to the CloudWatch console, selecting a log group, and then defining the filter

pattern. Actions like enabling an alarm, defining a trace, or specifying a stream are subsequent or

unrelated steps.

A metric filter in Amazon CloudWatch Logs can be used to search for specific terms in log data and

create metrics based on the matches. To include log events with the word "ERROR" and exclude

those with the word "WARNING," the correct syntax involves using a filter pattern with a positive

match for "ERROR" and a negation for "WARNING." The correct pattern is "ERROR -WARN," where

the minus sign (-) indicates exclusion of log events containing "WARN." According to the WGU Cloud

Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs), metric filters use a pattern-

based syntax where terms are included or excluded using positive matches and the negation

operator (-). This ensures that only logs with "ERROR" and without "WARN" are processed into the

metric.

Comprehensive and Detailed Explanation From Exact Extract:

To reduce latency in region B due to increased demand for media files stored in region A, cross-

region replication (CRR) should be used. CRR replicates objects to an S3 bucket in another region

(e.g., region B), allowing users to access files from a closer location, thus minimizing latency. The

WGU Cloud Deployment and Operations Study Guide (Section 2.2, S3 Replication) states, "Cross-

Region Replication in S3 copies objects to a destination bucket in a different region, reducing latency

by enabling access to data from the nearest region, such as region B in this case." S3 Batch, S3

Versioning, and Same-Region replication do not address cross-region latency.

A Private Hosted Zone in Amazon Route 53 should be used to restrict DNS resolution to instances

within a Virtual Private Cloud (VPC), ensuring that the zone is only accessible internally. This isolates

DNS services from public internet access. The WGU Cloud Deployment and Operations Study Guide

(Section 3.1, Route 53 Hosted Zones) states, "A Private Hosted Zone in Route 53 limits DNS resolution

to resources within a specified VPC, preventing external access and enhancing security for internal

services." Public Hosted Zones, DNS Zones, and Lightsail DNS Zones do not provide this VPC-specific

restriction.

Comprehensive and Detailed Explanation From Exact Extract:

In Amazon CloudFront, the caching TTL is controlled by the minimum and maximum TTL settings,

with the maximum TTL (in seconds) capping the cache duration. The current Max TTL is 172800

seconds (48 hours), and the Cache-Control setting of 432000 seconds (120 hours) is ignored because

it exceeds the Max TTL. To cache objects for up to 120 hours, the Max setting must be configured to

432000 seconds. The WGU Cloud Deployment and Operations Study Guide (Section 4.4, CloudFront

Caching) states, "The maximum TTL in CloudFront settings (e.g., 172800 seconds) overrides any

higher Cache-Control value; to allow 120 hours (432000 seconds), the Max TTL must be set

accordingly." Adjusting Min, expiration, or Cache-Control alone does not resolve this.

Comprehensive and Detailed Explanation From Exact Extract:

AWS Client VPN is used to provide remote workers with secure access to AWS resources by

establishing a VPN connection to the VPC, ensuring encrypted access to private networks. The WGU

Cloud Deployment and Operations Study Guide (Section 3.2, Client VPN) states, "Client VPN enables

secure remote access to AWS resources within a VPC, using mutual authentication and encryption to

protect data for remote workers." Transit Gateway manages inter-VPC routing, Network Firewall

filters traffic, and NAT instances handle outbound internet access, none of which are designed for

remote worker access.

The `GetSessionToken` API call is needed to perform MFA before accessing a resource, as it generates

temporary security credentials for an IAM user after MFA validation. This ensures secure access to

AWS resources. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, IAM and

MFA) states, "The `GetSessionToken` API is used with MFA to obtain temporary credentials, requiring

a valid MFA code to authenticate the user before resource access is granted." GetCallerIdentity,

GetFederationToken, and DecodeAuthorizationMessage serve different purposes and do not handle

MFA authentication.

In AWS Systems Manager, the error threshold for automation documents is configured using rate

control. Rate control allows administrators to define the maximum number of errors or concurrent

executions that can occur before an automation task is throttled or stopped, ensuring system

stability. The WGU Cloud Deployment and Operations Study Guide (Section 5.1, Systems Manager

Automation) explicitly states, "Rate control settings in Automation documents can be used to specify

the maximum number of errors allowed during execution, helping to manage error thresholds

effectively." Resource groups, session p

Enabling automatic key rotation in AWS Key Management Service (KMS) is the least effort solution to

ensure cryptographic material is not used longer than a year. KMS automatically rotates the

cryptographic material of symmetric customer master keys (CMKs) every 365 days, meeting the

requirement without manual intervention. The WGU Cloud Deployment and Operations Study Guide

(Section 6.3, KMS) states, "Automatic key rotation in KMS rotates the backing key material every year

for symmetric CMKs, providing a low-effort way to comply with key usage limits." Moving to

CloudHSM, custom protocols, or Lambda functions require more effort and complexity.