Cloud-Deployment-and-Operations WGUCloud Deployment and Operations Questions and Answers

Amazon EventBridge should be used to configure email notifications for a trigger by Amazon Made, as it can route events to targets like Amazon SNS (Simple Notification Service) for email delivery. EventBridge integrates with AWS services to handle event-driven notifications. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, EventBridge) states, "EventBridge can be configured to send events from Amazon Made to SNS, enabling email notifications by subscribing an email endpoint to the SNS topic." SQS, EKS, and CodeDeploy do not support this notification configuration.

Amazon CloudWatch supports several monitoring and management solutions, including event response and instance monitoring. Event response is facilitated through CloudWatch Events, which can trigger actions based on predefined rules, such as invoking AWS Lambda functions. Instance monitoring involves collecting and tracking metrics from Amazon EC2 instances, providing visibility into performance and health. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Overview) highlights that CloudWatch is designed for instance monitoring and event-driven responses, while load balancing and threat detection are handled by services like Elastic Load Balancing and GuardDuty, respectively.

Multipart uploads must be used when uploading files larger than 5 GB to Amazon S3, as this method splits the file into smaller parts for parallel upload, improving reliability and performance. The WGU Cloud Deployment and Operations Study Guide (Section 2.1, S3 Uploads) states, "For files exceeding 5 GB, multipart upload is required in S3, allowing the file to be divided into parts (minimum 5 MB each) for concurrent uploads, ensuring efficient and resumable transfers." Glacier Select, Transfer Acceleration, and Intelligent-Tiering are not designed for this upload optimization.

Security group rules in AWS support the Internet Control Message Protocol (ICMP) and User Datagram Protocol (UDP) for defining inbound and outbound traffic rules. These protocols are commonly used for network communication and monitoring. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Security Groups) states, "Security groups support protocols like ICMP for diagnostic traffic and UDP for streaming or low-latency applications, allowing fine-grained control over instance access." BGP and MPLS are routing or network layer protocols not supported by security group rules.

Systems Manager Automation documents can be created using JSON or YAML file formats to define workflows and actions based on AWS Config rules. These formats allow administrators to specify the steps and parameters for automation tasks, such as remediation actions triggered by Config rule evaluations. The WGU Cloud Deployment and Operations Study Guide (Section 5.1, Systems Manager Automation) states that both JSON and YAML are supported formats for writing Automation documents, providing flexibility in scripting automation logic. XML and CSV are not supported formats for this purpose.

Comprehensive and Detailed Explanation From Exact Extract:

In Amazon CloudFront, the caching TTL is controlled by the minimum and maximum TTL settings, with the maximum TTL (in seconds) capping the cache duration. The current Max TTL is 172800 seconds (48 hours), and the Cache-Control setting of 432000 seconds (120 hours) is ignored because it exceeds the Max TTL. To cache objects for up to 120 hours, the Max setting must be configured to 432000 seconds. The WGU Cloud Deployment and Operations Study Guide (Section 4.4, CloudFront Caching) states, "The maximum TTL in CloudFront settings (e.g., 172800 seconds) overrides any higher Cache-Control value; to allow 120 hours (432000 seconds), the Max TTL must be set accordingly." Adjusting Min, expiration, or Cache-Control alone does not resolve this.

To deploy a NAT gateway in an existing VPC subnet, the administrator must assign an elastic IP address to the NAT gateway for public internet access and configure the route table associated with the subnet to route traffic through the NAT gateway. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, NAT Gateway) states, "Deployment of a NAT gateway requires an elastic IP address for outbound internet connectivity and a route table update to direct private subnet traffic to the NAT gateway (e.g., 0.0.0.0/0 via NAT)." Private IP assignment and ACL configuration are not required steps.

Comprehensive and Detailed Explanation From Exact Extract:

The VPC flow log fields indicate the following: the source IP is 192.168.20.1, the destination IP is 203.0.113.66, the source port is 2066, the destination port is 22, and the action is "ACCEPT OK," meaning the traffic was permitted. This shows outbound traffic from the internal network (192.168.20.1) to an external IP (203.0.113.66) with destination port 2066. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Flow Logs) states, "In a flow log, the format includes source IP, destination IP, source port, destination port, and action; for example, 192.168.20.1 to 203.0.113.66 with source port 2066 and destination port 22 indicates permitted outbound traffic." Only option C correctly interprets this flow.

The multivalue routing policy in Amazon Route 53 allows up to 8 healthy records to be returned in response to DNS queries, enabling load balancing across multiple resources. To ensure the maximum allowed number of records is utilized, the administrator should create 8 records. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) specifies, "Multivalue answer routing supports up to 8 healthy resource record sets per response, requiring the creation of 8 records to maximize the policy's capability." Options A, C, and D exceed or fall short of this limit.

Amazon Route 53 is the AWS solution that sends DNS queries to separate AWS compute instances by leveraging routing policies to distribute traffic across multiple resources. It acts as a scalable Domain Name System (DNS) service, directing queries to healthy instances based on configurations like latency or weighted routing. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53) states, "Route 53 uses DNS to route end-user requests to multiple AWS compute instances, supporting features like health checks and traffic distribution." Elastic Beanstalk, CloudWatch, and EC2 Auto Scaling do not perform DNS query routing.

Enabling automatic key rotation in AWS Key Management Service (KMS) is the least effort solution to ensure cryptographic material is not used longer than a year. KMS automatically rotates the cryptographic material of symmetric customer master keys (CMKs) every 365 days, meeting the requirement without manual intervention. The WGU Cloud Deployment and Operations Study Guide (Section 6.3, KMS) states, "Automatic key rotation in KMS rotates the backing key material every year for symmetric CMKs, providing a low-effort way to comply with key usage limits." Moving to CloudHSM, custom protocols, or Lambda functions require more effort and complexity.

To reduce conversion delays caused by increased demand, the company should configure a CloudWatch alarm to scale the EC2 fleet based on the SQS queue length. This auto-scaling approach dynamically adjusts the number of EC2 instances to handle the workload, especially during peak evening hours and anticipated growth. The WGU Cloud Deployment and Operations Study Guide (Section 3.3, Auto Scaling and SQS) explains, "Auto Scaling can be triggered by a CloudWatch alarm monitoring SQS queue depth, ensuring the EC2 fleet scales out to process video conversion tasks efficiently as the queue length increases." Spot instances, dead-letter queues, and instance type upgrades do not directly address dynamic scaling needs.

Amazon RDS Performance Insights supports retention periods of 7 days and 1 year for storing performance data, depending on the configuration and edition. The default retention is 7 days for standard monitoring, while enabling enhanced monitoring or the Performance Insights extended retention feature allows data to be retained for up to 1 year. The WGU Cloud Deployment and Operations Study Guide (Section 7.2, Performance Insights) states, "Performance Insights offers a 7-day retention period by default, with an option to extend to 1 year for detailed historical analysis, supporting cost and performance optimization." Options A (1 day) and D (2 years) are not supported retention periods.

The `Ref` function in an AWS CloudFormation template is used to obtain values of components defined within the template, such as resource IDs, parameters, or outputs. This function allows dynamic referencing of resources during stack creation. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Functions) states, "The `Ref` function is used to reference the logical IDs of resources, parameters, or mappings defined in the template, enabling dynamic value retrieval (e.g., `Ref: MyEC2Instance` returns the instance ID)." ImportValue is used for cross-stack references, Cidr for IP range calculations, and GetAZs for availability zone lists, making them unsuitable here.

The `GetSessionToken` API call is needed to perform MFA before accessing a resource, as it generates temporary security credentials for an IAM user after MFA validation. This ensures secure access to AWS resources. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, IAM and MFA) states, "The `GetSessionToken` API is used with MFA to obtain temporary credentials, requiring a valid MFA code to authenticate the user before resource access is granted." GetCallerIdentity, GetFederationToken, and DecodeAuthorizationMessage serve different purposes and do not handle MFA authentication.

The latency routing policy in Amazon Route 53 should be used to direct customer requests to the website with the shortest round-trip time (RTT). This policy routes traffic to the AWS region with the lowest latency based on the user's location, optimizing performance. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) states, "The latency-based routing policy in Route 53 measures RTT to direct users to the region with the lowest latency, improving user experience across multiple websites." Geolocation, geoproximity, and weighted policies do not prioritize RTT in this manner.

When Amazon Route 53 determines an endpoint is unhealthy based on a failure threshold (e.g., via health checks), it terminates the connection attempt to that endpoint and routes traffic to a healthy alternative, if available. This behavior ensures high availability using routing policies like failover or latency-based routing. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Health Checks) states, "Route 53 stops routing traffic to an unhealthy endpoint by terminating connection attempts once the health check failure threshold is exceeded, redirecting to a healthy resource." Options A, C, and D are not direct actions taken by Route 53 in this scenario.