AWS Certified CloudOps Engineer - Associate practice questions

Question 1

A platform team is being asked to give developers a paved-road self-service experience for deploying serverless and container-based applications, where the platform team owns versioned templates that bundle infrastructure plus the CI/CD pipeline and developers just pick a template. The engineer is evaluating AWS Proton. Which statement matches the documented design?

Accepted Answer

AWS Proton is automated infrastructure as code provisioning and deployment of serverless and container-based applications; administrators create versioned service templates that define standardized infrastructure and deployment tooling, and application developers select from the available service templates to automate their application deployments, with platform teams using versioned infrastructure-as-code templates to define and manage standard application stacks that contain architecture, infrastructure, and the CI/CD pipeline.

Answer

Proton requires application developers to author their own raw CloudFormation templates from scratch, with no platform-team-managed template layer. Proton explicitly separates the administrator role (template authoring) from the developer role (template selection).

Answer

Proton is only a UI for AWS Service Catalog and does not support versioned service templates that bundle the CI/CD pipeline. The documentation describes Proton's own versioned service templates that bundle architecture, infrastructure, AND the CI/CD pipeline.

Answer

Proton refuses to identify existing service instances that are running an outdated template version, so platform teams cannot batch-upgrade fleets. The documentation explicitly states AWS Proton identifies all existing service instances that are using an outdated template version for you. Proton's documented operational model has administrators authoring versioned service templates AND application developers selecting from them, so any answer that erases the administrator role contradicts the documented two-pronged automation framework.

Question 2

Which AWS service collects data about the requests an application serves and shows the calls the application makes to downstream AWS resources, microservices, databases, and web APIs?

Accepted Answer

AWS X-Ray, which traces requests and the application's downstream service and database calls

Answer

CloudWatch Synthetics canaries, which script downstream calls to verify the customer experience

Answer

CloudWatch Container Insights, which aggregates downstream call metrics for ECS and EKS tasks

Answer

AWS CloudTrail, which records the management API calls that the application issues downstream

Question 3

An organization is adding resilience to content delivery so that if the primary origin fails or returns error status codes, requests are served from a backup origin automatically. Which CloudFront feature matches?

Accepted Answer

Origin failover with an origin group of a primary and a secondary origin that CloudFront switches to on failure.

Answer

A CloudFront field-level encryption policy that reroutes any failed requests to a secondary origin server for safety.

Answer

A single-origin distribution with a much longer cache TTL so stale content is served whenever the origin is down.

Answer

Lambda@Edge alone, because origin groups are not supported and edge functions must implement all the failover logic.

Question 4

A platform team is tasked with adding private, route-table-based access from a VPC to AWS storage services without using an internet gateway or NAT. Which TWO services support a gateway VPC endpoint?

Accepted Answer

Amazon S3, which is reachable through a gateway VPC endpoint added as a route-table prefix list

Accepted Answer

Amazon DynamoDB, which is reachable through a gateway VPC endpoint added as a route-table prefix

Answer

Amazon Kinesis Data Streams, which is reachable only through a PrivateLink interface endpoint

Answer

Amazon API Gateway, which is reachable only through a PrivateLink interface VPC endpoint

Question 5

A company is migrating large volumes of customer records into Amazon S3 and needs a managed service that uses machine learning and pattern matching to discover sensitive data and flag buckets that become publicly accessible. Which service fits?

Accepted Answer

Amazon Macie, which discovers sensitive S3 data with ML and pattern matching and raises a finding when one of the buckets becomes publicly accessible.

Answer

Amazon Inspector, which scans S3 objects for personally identifiable information and reports the buckets that are shared publicly or across accounts.

Answer

AWS Config, which classifies the sensitive records inside S3 objects and generates a finding whenever a monitored bucket turns publicly accessible.

Answer

Amazon GuardDuty, which inspects the contents of S3 objects to label sensitive data and alerts whenever bucket permissions begin to allow public access.

Question 6

An organization needs to define reusable, parameterized actions in JSON or YAML that Systems Manager runs against managed instances, reusing the 100+ Amazon-owned predefined ones where possible. Which construct is this?

Accepted Answer

An SSM document defines the parameterized actions Systems Manager runs on instances

Answer

A CloudFormation template provisions resources but runs no actions on the instances

Answer

A CodeDeploy AppSpec maps deployment lifecycle hooks, not general instance actions

Answer

An IAM policy document grants permissions but runs no operational steps on instances

Question 7

A company is designing an immutable audit store in which CloudTrail events are converted to a columnar format for fast retrieval and aggregated by advanced event selectors. Which option matches this design?

Accepted Answer

Create a CloudTrail Lake event data store that converts events to Apache ORC columnar format

Answer

Stream CloudTrail logs to CloudWatch Logs Insights and run piped queries over the JSON events

Answer

Aggregate CloudTrail events into an AWS Config aggregator and query relationships across accounts

Answer

Send CloudTrail events to an EventBridge bus and fan them out to immutable analytics targets

Question 8

A CloudOps engineer is being asked to give a single production RDS database high availability and automatic failover in case of a primary instance failure, without sharding or refactoring the application. The engineer is evaluating Amazon RDS Multi-AZ. Which statement matches the documented behavior?

Accepted Answer

In a Multi-AZ DB instance deployment, Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone, with the primary synchronously replicated to a standby to provide data redundancy and minimize latency spikes during system backups.

Answer

Multi-AZ requires the application to be sharded across two database endpoints and to manually fail over by reconfiguring its connection string at runtime. RDS Multi-AZ provides automatic failover support without sharding or per-deploy reconfiguration.

Answer

Multi-AZ for RDS deploys two read-only replicas asynchronously in the same Availability Zone, which gives no protection against an AZ-level outage. The documentation states the standby is synchronous and in a different Availability Zone.

Answer

Multi-AZ is only supported by Amazon DynamoDB and is not a feature of Amazon RDS DB instance deployments. Multi-AZ DB instance deployment is an RDS feature documented for high availability and failover support.

Question 9

A company is rolling out a global static website and wants each user request served from the data center that gives the lowest latency. Which AWS service delivers content from edge locations to meet this goal?

Accepted Answer

Amazon CloudFront, which delivers content from worldwide edge locations with the lowest latency

Answer

AWS Global Accelerator, which assigns two static anycast IPs and routes traffic to the nearest Region

Answer

Elastic Load Balancing, which spreads incoming requests across healthy targets within a single Region

Answer

Amazon Route 53, which answers DNS queries and applies routing policies to direct users to endpoints

Question 10

An organization is preparing for an external compliance audit and needs to download AWS SOC, ISO, and PCI reports to submit to its auditors as evidence. Which AWS service provides these documents?

Accepted Answer

AWS Artifact, which offers on-demand downloads of AWS security and compliance documents that you can submit to auditors as audit artifacts.

Answer

AWS Security Hub, which generates the AWS SOC and PCI audit reports about AWS infrastructure for customers to hand directly to their own auditors.

Answer

AWS Config, which produces downloadable ISO and PCI attestation documents describing the AWS data center controls for submission to regulators.

Answer

AWS Trusted Advisor, which compiles the AWS SOC and ISO compliance certifications into reports that customers then provide to their external auditors.

Question 11

An organization needs to offer teams a self-service menu of pre-approved products such as golden AMIs and vetted multi-tier stacks that users launch within IAM-scoped governance constraints. Which service fits?

Accepted Answer

AWS Service Catalog publishes approved products users launch under governance limits

Answer

AWS Config records resource configuration history but lists no launchable products

Answer

AWS Organizations groups accounts and applies SCPs but offers no product self-service

Answer

AWS CloudFormation authors the templates but provides no governed self-service catalog

Question 12

A company is rolling out a fleet of Amazon EC2 instances and needs in-guest memory and disk-utilization metrics that the default EC2 monitoring does not expose. Which approach collects these system-level metrics?

Accepted Answer

Install the CloudWatch agent on the instances to collect in-guest memory and disk metrics

Answer

Enable AWS Compute Optimizer to collect internal memory and disk metrics from the EC2 instances

Answer

Turn on CloudWatch Container Insights to surface guest memory and disk metrics for the fleet

Answer

Configure AWS X-Ray tracing to capture per-instance in-guest memory and disk metrics

Question 13

A company is turning on S3 Versioning for a bucket of critical configuration files and wants to know what happens the moment an application later deletes one of those objects. Which behavior matches the documented design?

Accepted Answer

Amazon S3 inserts a delete marker that becomes the current version, and the prior object version can still be restored.

Answer

Amazon S3 permanently purges the object along with every noncurrent version, leaving the company no way to restore it.

Answer

Amazon S3 rejects the delete request until cross-Region replication has been configured for the versioned bucket first.

Answer

Amazon S3 moves the object into the S3 Glacier Flexible Retrieval class rather than recording any delete marker at all.

Question 14

A team is tasked with raising the CloudFront cache hit ratio for objects that rarely change, reducing how often edge caches revalidate with the origin. Which configuration change directly increases the cache hit ratio?

Accepted Answer

Add a Cache-Control max-age directive with the longest practical value for these objects

Answer

Shorten the Cache-Control max-age so CloudFront revalidates with the origin more frequently

Answer

Disable caching for these objects and forward every request to the origin for the latest copy

Answer

Add a Cache-Control no-store directive so each edge location stores only one shared copy

Question 15

A CloudOps engineer is being asked to author an AWS Config custom Lambda rule and notices that previous custom rules cause spikes in Lambda invocations whenever resource churn is high. The engineer is reviewing Config rule scoping guidance. Which statement matches the documented recommendation?

Accepted Answer

AWS Config Custom Lambda Rules can cause a high number of Lambda function invocations if the rule is not scoped to one or more resource types, so to avoid increased activity associated with your account, it is highly recommended to provide resources in scope for your Custom Lambda rules.

Accepted Answer

When creating AWS Config custom lambda rules, it is highly recommended that you add logic to handle the evaluation of deleted resources, because when evaluation results are marked as NOT_APPLICABLE they will be marked for deletion and cleaned up.

Answer

Custom Lambda rules should always be left unscoped so AWS Config evaluates every resource type in the account, since unscoped rules give the broadest signal at no cost. The documentation explicitly recommends scoping custom Lambda rules to one or more resource types to avoid increased Lambda invocations.

Answer

Custom Lambda rules are evaluated entirely inside AWS Config without invoking Lambda, so invocation counts are not a concern. Custom Lambda rules explicitly invoke Lambda functions; high invocation rates are exactly the concern the documentation addresses.

AWS Certified CloudOps Engineer - Associate

Sample questions

Sources

Similar exams