[Full-Version] 2026 Updated WGU Study Guide Cloud-Deployment-and-Operations Dumps Questions
Newest Cloud-Deployment-and-Operations Exam Dumps Achieve Success in Actual Cloud-Deployment-and-Operations Exam
WGU Cloud-Deployment-and-Operations Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 42
(An administrator is unable to make an AMI public. What is the cause?)
- A. Bookmark is absent
- B. Boot volume is encrypted
- C. Legacy BIOS boot mode is used
- D. Paravirtual virtualization is used
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The inability to make an AMI public is caused by an encrypted boot volume. AWS does not allow AMIs with encrypted EBS snapshots to be shared publicly due to security constraints; sharing is limited to specific AWS accounts. The WGU Cloud Deployment and Operations Study Guide (Section 6.3, AMI Management) states,
"An AMI cannot be made public if its boot volume is encrypted; encryption restricts sharing to authorized accounts only, requiring decryption keys to be managed separately." Legacy BIOS, paravirtual virtualization, and the absence of a bookmark do not impact AMI sharing.
NEW QUESTION # 43
(A company stores critical data on general-purpose Amazon EBS volumes. The company can only tolerate the loss of up to one hour of data. Which solution should be used to protect data from loss?)
- A. Schedule automated volume snapshots using CloudWatch Events
- B. Enable automated volume backups in Cloud Control
- C. Replace existing volumes with local storage
- D. Switch to Block Express volume type
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
To protect critical data on EBS volumes with a maximum tolerable data loss of one hour, the company should schedule automated volume snapshots using CloudWatch Events. Snapshots capture the state of the volume at a point in time, and regular scheduling (e.g., every hour) ensures data loss is limited to the snapshot interval.
The WGU Cloud Deployment and Operations Study Guide (Section 7.3, EBS and Snapshots) states,
"Automated EBS snapshots can be scheduled using CloudWatch Events rules to create backups at defined intervals, ensuring an RPO of one hour by capturing volume data regularly." Local storage, Cloud Control backups, and Block Express are not viable solutions for this automated snapshot requirement.
NEW QUESTION # 44
(Which performance optimization method must be used when uploading files larger than 5 GB to S3?)
- A. Intelligent-Tiering
- B. Glacier Select
- C. Multipart uploads
- D. Transfer Acceleration
Answer: C
Explanation:
Multipart uploads must be used when uploading files larger than 5 GB to Amazon S3, as this method splits the file into smaller parts for parallel upload, improving reliability and performance. The WGU Cloud Deployment and Operations Study Guide (Section 2.1, S3 Uploads) states, "For files exceeding 5 GB, multipart upload is required in S3, allowing the file to be divided into parts (minimum 5 MB each) for concurrent uploads, ensuring efficient and resumable transfers." Glacier Select, Transfer Acceleration, and Intelligent-Tiering are not designed for this upload optimization.
NEW QUESTION # 45
(Which service should be used to schedule the patching of EC2 instances and on-premises servers with security updates?)
- A. EventBridge
- B. App Runner
- C. Config
- D. Systems Manager
Answer: D
Explanation:
AWS Systems Manager should be used to schedule the patching of EC2 instances and on-premises servers with security updates, utilizing features like Patch Manager and maintenance windows. This service supports hybrid environments and automated patch deployment. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Systems Manager Patch Manager) states, "Systems Manager provides Patch Manager to schedule and deploy security updates to EC2 instances and on-premises servers during maintenance windows, ensuring consistent patching across hybrid environments." EventBridge, Config, and App Runner do not offer this patching capability.
NEW QUESTION # 46
(An administrator needs to set up self-managed permissions for AWS CloudFormation StackSet operations.
Which two roles should be created in the administrator account and in the target accounts? Choose 2 answers.)
- A. In each target account, create a service role named AWSCloudFormationStackSetAdministrationRole that trusts the administrator account.
- B. In each target account, create a service role named AWSCloudFormationStackSetExecutionRole that trusts the administrator account.
- C. In the administrator account, create an IAM role named AWSCloudFormationStackSetExecutionRole.
- D. In the administrator account, create an IAM role named
AWSCloudFormationStackSetAdministrationRole.
Answer: B,D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
To set up self-managed permissions for CloudFormation StackSet operations, two roles are required: in the administrator account, create an IAM role named AWSCloudFormationStackSetAdministrationRole to manage StackSet operations, and in each target account, create a service role named AWSCloudFormationStackSetExecutionRole that trusts the administrator account to execute the stacks. The WGU Cloud Deployment and Operations Study Guide (Section 5.4, StackSets) states, "For self-managed permissions, the administrator account requires the AWSCloudFormationStackSetAdministrationRole, while each target account needs the AWSCloudFormationStackSetExecutionRole with a trust relationship to the administrator account for stack deployment." Roles B and D are incorrectly named or misplaced.
NEW QUESTION # 47
(An administrator needs to troubleshoot a connectivity issue from on-premises computers to public IP addresses assigned to EC2 instances. The administrator suspects the cause to be a network security group.
Which VPC feature should be used to troubleshoot the issue?)
- A. Flow Logs
- B. Reachability Analyzer
- C. Traffic Mirroring
- D. PrivateLink
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The Reachability Analyzer in AWS VPC should be used to troubleshoot connectivity issues from on-premises computers to EC2 instances, especially when a network security group (NSG) is suspected. It analyzes the network path and identifies blocked traffic due to NSG rules or route tables. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Troubleshooting) states, "Reachability Analyzer helps diagnose connectivity issues by simulating traffic paths, identifying if an NSG rule (e.g., blocked port) or route table is causing the problem from on-premises to EC2 public IPs." Flow Logs provide data but not analysis, PrivateLink is for private connections, and Traffic Mirroring is for monitoring.
NEW QUESTION # 48
(A company is using the CloudWatch agent on its EC2 Linux instances. The company needs to determine how long read requests have waited on the instance's I/O for proper sizing of the instance. Which metric should the company use?)
- A. diskio_reads
- B. disk_io_time
- C. diskio_read_bytes
- D. disk_read_ops
Answer: B
Explanation:
The `disk_io_time` metric, collected by the CloudWatch agent on EC2 Linux instances, measures the total time (in milliseconds) that read and write requests have waited on I/O, helping to assess disk performance for instance sizing. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Agent Metrics) states, "The `disk_io_time` metric, available via the CloudWatch agent, tracks the time spent waiting for I/O operations, providing insight into disk contention for optimizing EC2 instance sizing." disk_read_ops, diskio_reads, and diskio_read_bytes measure operation counts or bytes, not wait times.
NEW QUESTION # 49
(A company is using CloudWatch on its EC2 instances. The company needs to determine the number of bytes received by an instance on all network interfaces for proper sizing of the instance. Which metric should the company use?)
- A. NetworkOut
- B. NetworkPacketsIn
- C. NetworkPacketsOut
- D. NetworkIn
Answer: D
Explanation:
The `NetworkIn` metric in Amazon CloudWatch should be used to determine the number of bytes received by an EC2 instance across all network interfaces, aiding in proper instance sizing based on inbound traffic. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Metrics) states, "The
`NetworkIn` metric measures the total number of bytes received on all network interfaces of an EC2 instance, providing critical data for sizing decisions to handle inbound traffic effectively." NetworkPacketsIn, NetworkOut, and NetworkPacketsOut measure packet counts or outbound data, which are less relevant for this purpose.
NEW QUESTION # 50
(What can AWS Config directly invoke to cause remediation of findings?)
- A. Lambda function
- B. Control Tower guardrail
- C. Systems Manager document
- D. CloudWatch alarm
Answer: A
Explanation:
AWS Config can directly invoke an AWS Lambda function to cause remediation of findings by triggering automated responses to configuration changes or non-compliant resources. This integration enables real-time corrective actions. The WGU Cloud Deployment and Operations Study Guide (Section 6.1, AWS Config) states, "AWS Config can invoke a Lambda function as a remediation action, allowing automated fixes for non- compliant resources (e.g., terminating unauthorized instances)." Control Tower guardrails, CloudWatch alarms, and Systems Manager documents are not directly invoked by Config for this purpose.
NEW QUESTION # 51
(Which solution should be used to identify and shut down idle EC2 instances in an AWS account?)
- A. CloudSearch
- B. CloudTrail
- C. CloudFront
- D. CloudWatch
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
CloudWatch should be used to identify and shut down idle EC2 instances by monitoring metrics such as CPU utilization or network activity. Custom alarms can be set to trigger an AWS Lambda function or Systems Manager automation to terminate idle instances, optimizing costs. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Metrics) states, "CloudWatch can monitor EC2 instance metrics like CPUUtilization; an alarm can be configured to invoke a Lambda function to terminate idle instances, ensuring cost efficiency." CloudFront, CloudSearch, and CloudTrail are not designed for this monitoring and automation task.
NEW QUESTION # 52
(A company has deployed an application to AWS and a standby instance to its on-premises data center. The on-premises infrastructure is a scaled-down version of the AWS infrastructure. Which routing policy in Route
53 will allow the company to send 75% of the load to AWS and the remaining 25% to its on-premises infrastructure?)
- A. Failover routing policy
- B. Geolocation routing policy
- C. Simple routing policy
- D. Weighted routing policy
Answer: D
Explanation:
The weighted routing policy in Amazon Route 53 allows the company to distribute traffic with specific percentages, such as 75% to AWS and 25% to the on-premises infrastructure, by assigning weights to each resource record. This enables load balancing across hybrid environments. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) states, "Weighted routing policy assigns weights to resource record sets (e.g., 75 for AWS, 25 for on-premises), controlling the percentage of traffic directed to each endpoint." Geolocation, failover, and simple policies do not support percentage-based traffic splitting.
NEW QUESTION # 53
(Which AWS solution can be used to send events from Shopify?)
- A. EventBridge
- B. Service events
- C. CloudTrail events
- D. IoT Events
Answer: A
Explanation:
Amazon EventBridge is the AWS solution that can be used to send events from external sources like Shopify.
EventBridge supports integration with third-party applications through its event bus, allowing custom events (e.g., from Shopify via webhooks) to be ingested and routed to AWS services or targets. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, EventBridge) notes that EventBridge is designed for event ingestion from SaaS applications, making it suitable for Shopify integration. CloudTrail, IoT Events, and Service events are not designed for this purpose.
NEW QUESTION # 54
(Which function is used to obtain components defined in an AWS CloudFormation template?)
- A. Ref
- B. GetAZs
- C. ImportValue
- D. Cidr
Answer: A
Explanation:
The `Ref` function in an AWS CloudFormation template is used to obtain values of components defined within the template, such as resource IDs, parameters, or outputs. This function allows dynamic referencing of resources during stack creation. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Functions) states, "The `Ref` function is used to reference the logical IDs of resources, parameters, or mappings defined in the template, enabling dynamic value retrieval (e.g., `Ref:
MyEC2Instance` returns the instance ID)." ImportValue is used for cross-stack references, Cidr for IP range calculations, and GetAZs for availability zone lists, making them unsuitable here.
NEW QUESTION # 55
(Media files are stored in an S3 bucket in region A. Demand for the files from region B has increased. Region B is suffering from some latency issues due to geographical location. Which type of replication will reduce the latency in region B?)
- A. S3 Batch
- B. Same-Region
- C. S3 Versioning
- D. Cross-Region
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
To reduce latency in region B due to increased demand for media files stored in region A, cross-region replication (CRR) should be used. CRR replicates objects to an S3 bucket in another region (e.g., region B), allowing users to access files from a closer location, thus minimizing latency. The WGU Cloud Deployment and Operations Study Guide (Section 2.2, S3 Replication) states, "Cross-Region Replication in S3 copies objects to a destination bucket in a different region, reducing latency by enabling access to data from the nearest region, such as region B in this case." S3 Batch, S3 Versioning, and Same-Region replication do not address cross-region latency.
NEW QUESTION # 56
(Which action must be used to create a metric filter in the Amazon CloudWatch console?)
- A. Select a log group
- B. Specify a stream
- C. Enable an alarm
- D. Define a trace
Answer: A
Explanation:
To create a metric filter in the Amazon CloudWatch console, the first step is to select a log group from which the log data will be analyzed. A log group contains log streams, and metric filters are applied to the log data within these groups to extract metrics based on patterns. The WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs) specifies that the process begins by navigating to the CloudWatch console, selecting a log group, and then defining the filter pattern. Actions like enabling an alarm, defining a trace, or specifying a stream are subsequent or unrelated steps.
NEW QUESTION # 57
(A company has implemented multifactor authentication (MFA) for access to its AWS tenant. Which API call is needed to perform MFA before accessing a resource?)
- A. DecodeAuthorizationMessage
- B. GetCallerIdentity
- C. GetFederationToken
- D. GetSessionToken
Answer: D
Explanation:
The `GetSessionToken` API call is needed to perform MFA before accessing a resource, as it generates temporary security credentials for an IAM user after MFA validation. This ensures secure access to AWS resources. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, IAM and MFA) states,
"The `GetSessionToken` API is used with MFA to obtain temporary credentials, requiring a valid MFA code to authenticate the user before resource access is granted." GetCallerIdentity, GetFederationToken, and DecodeAuthorizationMessage serve different purposes and do not handle MFA authentication.
NEW QUESTION # 58
(A company uses KMS for key management. The company has a requirement to ensure that cryptographic material is not used longer than a year. Which solution should be used to meet this requirement with the least amount of effort?)
- A. Move keys from KMS to CloudHSM
- B. Write a Lambda function to replace keys in KMS
- C. Enable automatic key rotation in KMS
- D. Develop a custom key encryption protocol for KMS
Answer: C
Explanation:
Enabling automatic key rotation in AWS Key Management Service (KMS) is the least effort solution to ensure cryptographic material is not used longer than a year. KMS automatically rotates the cryptographic material of symmetric customer master keys (CMKs) every 365 days, meeting the requirement without manual intervention. The WGU Cloud Deployment and Operations Study Guide (Section 6.3, KMS) states,
"Automatic key rotation in KMS rotates the backing key material every year for symmetric CMKs, providing a low-effort way to comply with key usage limits." Moving to CloudHSM, custom protocols, or Lambda functions require more effort and complexity.
NEW QUESTION # 59
(An endpoint is not responding to a request based on the failure threshold provided. What does Route 53 do once it considers the endpoint unhealthy?)
- A. Terminates the connection attempt
- B. Enables SQS
- C. Sends out an SNS notification
- D. Notifies CloudWatch
Answer: A
Explanation:
When Amazon Route 53 determines an endpoint is unhealthy based on a failure threshold (e.g., via health checks), it terminates the connection attempt to that endpoint and routes traffic to a healthy alternative, if available. This behavior ensures high availability using routing policies like failover or latency-based routing.
The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Health Checks) states,
"Route 53 stops routing traffic to an unhealthy endpoint by terminating connection attempts once the health check failure threshold is exceeded, redirecting to a healthy resource." Options A, C, and D are not direct actions taken by Route 53 in this scenario.
NEW QUESTION # 60
(A cloud engineer needs to notify the response team whenever a high-security web server responds with a 403 Forbidden error. Which two steps can enable this functionality? Choose 2 answers.)
- A. Define a metric filter for Apache logs in CloudWatch
- B. Bind a Lambda function to an Apache process
- C. Create an alarm for the metric filter to deliver alerts using Amazon SNS
- D. Send alarms from the Lambda function using Amazon SQS
Answer: A,C
Explanation:
To notify a response team when a high-security web server returns a 403 Forbidden error, two key steps are required. First, define a metric filter for Apache logs in CloudWatch to detect the 403 error code within the log data. This involves setting up a filter pattern to match "403" in the Apache access logs. Second, create an alarm for the metric filter and configure it to deliver alerts using Amazon SNS, which supports email or other notifications to the response team. The WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs and Alarms) confirms that metric filters and SNS-integrated alarms are the standard approach for monitoring and alerting on log-based events. Options B and D are incorrect as they involve unnecessary or unsupported configurations (e.g., binding Lambda to Apache or using SQS for alarms).
NEW QUESTION # 61
(What is the role of AWS Trusted Advisor?)
- A. It provides recommendations on patches to be performed on resources.
- B. It provides an assessment on unused IAM roles.
- C. It provides a holistic overview of the health of architecture.
- D. It provides recommendations to help follow AWS best practices.
Answer: D
Explanation:
AWS Trusted Advisor provides recommendations to help follow AWS best practices, analyzing the environment for cost optimization, security, performance, and fault tolerance. It offers actionable insights to improve resource usage. The WGU Cloud Deployment and Operations Study Guide (Section 6.4, Trusted Advisor) states, "Trusted Advisor evaluates your AWS environment against best practices, providing recommendations in categories like cost optimization and security (e.g., enabling MFA or removing unused resources)." Options A, B, and C overstate or misrepresent its role, as it does not focus solely on unused IAM roles, holistic health overviews, or patch recommendations.
NEW QUESTION # 62
......
Updated WGU Cloud-Deployment-and-Operations Dumps – Check Free Cloud-Deployment-and-Operations Exam Dumps: https://www.topexamcollection.com/Cloud-Deployment-and-Operations-vce-collection.html
Valid Cloud-Deployment-and-Operations exam with WGU Real Exam Questions: https://drive.google.com/open?id=14vQm1E_uAa5sY_sVx1UdCZDFC7GQTuEw
