Free Practice Questions for the WGU Courses and Certificates Cloud-Deployment-and-Operations Exam (2026 Updated)

Comprehensive and Detailed Explanation From Exact Extract:

StackSets are used to change stacks across multiple AWS accounts and regions in a single operation, enabling centralized management of infrastructure deployments. StackSets allow administrators to create, update, or delete stacks consistently across specified accounts and regions. The WGU Cloud Deployment and Operations Study Guide (Section 5.4, StackSets) states, "StackSets provide the capability to manage and update stacks across multiple accounts and regions with a single operation, streamlining multi-region deployments." StackInstance, nested stacks, and stack policies do not support this multi-account, multi-region functionality.

To meet the requirements, the administrator should use an Amazon RDS Multi-AZ DB instance for multiple Availability Zones and failover support, and an Amazon Aurora DB instance with Aurora Replica for a read-only connection. The RDS Multi-AZ configuration automatically provisions a standby instance in a different AZ for failover, while Aurora Replicas provide read-only instances for scaling read traffic. The WGU Cloud Deployment and Operations Study Guide (Section 7.1, RDS and Aurora) states, "RDS Multi-AZ deploys a standby instance across AZs for failover, and Aurora Replicas are read-only instances that enhance performance by offloading read traffic from the primary instance." Options A and D are incorrect as multi-master replication and Multi-AZ clusters do not align with the read-only requirement.

AWS Fargate should be used to optimize the cost of a containerized application by eliminating the need for manual instance management, as it provides serverless container orchestration that automatically scales and charges only for resource usage. The WGU Cloud Deployment and Operations Study Guide (Section 7.5, Fargate) states, "Fargate optimizes costs for containerized applications by removing the overhead of managing EC2 instances, scaling automatically, and billing based on vCPU and memory usage, reducing manual deployment expenses." Aurora, RDS, and EFS are database or storage solutions not designed for container cost optimization.

Amazon Inspector can publish its findings when detecting anomalies to Amazon SNS for real-time notifications and to CloudWatch for metric and event logging, enabling monitoring and response. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, Amazon Inspector) states, "Inspector findings are published to SNS for immediate alerts and to CloudWatch for detailed logging, allowing integration with other AWS services for anomaly response." CloudTrail logs API calls, and SQS is a messaging queue, neither of which are primary destinations for Inspector findings.

To create a metric filter in the Amazon CloudWatch console, the first step is to select a log group from which the log data will be analyzed. A log group contains log streams, and metric filters are applied to the log data within these groups to extract metrics based on patterns. The WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs) specifies that the process begins by navigating to the CloudWatch console, selecting a log group, and then defining the filter pattern. Actions like enabling an alarm, defining a trace, or specifying a stream are subsequent or unrelated steps.

To ensure the route table with a default outbound route via an internet gateway takes effect, the administrator must create a subnet association, linking the route table to specific subnets within the VPC. This association applies the routing rules to the subnet's traffic. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Routing) states, "A route table must be associated with a subnet (subnet association) to enforce routing rules, such as the default route to an internet gateway, ensuring outbound traffic follows the defined path." Propagation, tags, and edge associations do not activate the route.

If a patch baseline is not explicitly defined in Patch Manager, it is attached to the default patch group. This default group applies a preconfigured baseline with AWS-recommended patches, ensuring basic compliance for instances without custom baselines. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "If no custom patch baseline is defined, instances are associated with the default patch group, which uses AWS-provided baseline settings for automatic patch approval." Options A, C, and D are not valid attachments for patch baselines.

The multivalue routing policy in Amazon Route 53 allows up to 8 healthy records to be returned in response to DNS queries, enabling load balancing across multiple resources. To ensure the maximum allowed number of records is utilized, the administrator should create 8 records. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) specifies, "Multivalue answer routing supports up to 8 healthy resource record sets per response, requiring the creation of 8 records to maximize the policy's capability." Options A, C, and D exceed or fall short of this limit.

Multipart uploads must be used when uploading files larger than 5 GB to Amazon S3, as this method splits the file into smaller parts for parallel upload, improving reliability and performance. The WGU Cloud Deployment and Operations Study Guide (Section 2.1, S3 Uploads) states, "For files exceeding 5 GB, multipart upload is required in S3, allowing the file to be divided into parts (minimum 5 MB each) for concurrent uploads, ensuring efficient and resumable transfers." Glacier Select, Transfer Acceleration, and Intelligent-Tiering are not designed for this upload optimization.

Comprehensive and Detailed Explanation From Exact Extract:

To deploy a static website to AWS, the bucket properties of an Amazon S3 bucket should be configured, specifically enabling static website hosting. This involves setting the bucket policy to allow public read access and configuring the index and error documents. The WGU Cloud Deployment and Operations Study Guide (Section 2.1, S3 Static Website Hosting) states, "Configuring bucket properties for static website hosting in S3 involves enabling the website endpoint, setting an index document (e.g., index.html), and applying a bucket policy for public access, making it suitable for hosting static content." RDS Proxy, S3 Versioning, and CloudTrail events are not relevant to this use case.

Amazon EventBridge is the AWS solution that can be used to send events from external sources like Shopify. EventBridge supports integration with third-party applications through its event bus, allowing custom events (e.g., from Shopify via webhooks) to be ingested and routed to AWS services or targets. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, EventBridge) notes that EventBridge is designed for event ingestion from SaaS applications, making it suitable for Shopify integration. CloudTrail, IoT Events, and Service events are not designed for this purpose.

Enabling automatic key rotation in AWS Key Management Service (KMS) is the least effort solution to ensure cryptographic material is not used longer than a year. KMS automatically rotates the cryptographic material of symmetric customer master keys (CMKs) every 365 days, meeting the requirement without manual intervention. The WGU Cloud Deployment and Operations Study Guide (Section 6.3, KMS) states, "Automatic key rotation in KMS rotates the backing key material every year for symmetric CMKs, providing a low-effort way to comply with key usage limits." Moving to CloudHSM, custom protocols, or Lambda functions require more effort and complexity.

Comprehensive and Detailed Explanation From Exact Extract:

AWS Client VPN is used to provide remote workers with secure access to AWS resources by establishing a VPN connection to the VPC, ensuring encrypted access to private networks. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Client VPN) states, "Client VPN enables secure remote access to AWS resources within a VPC, using mutual authentication and encryption to protect data for remote workers." Transit Gateway manages inter-VPC routing, Network Firewall filters traffic, and NAT instances handle outbound internet access, none of which are designed for remote worker access.

Amazon RDS Performance Insights supports retention periods of 7 days and 1 year for storing performance data, depending on the configuration and edition. The default retention is 7 days for standard monitoring, while enabling enhanced monitoring or the Performance Insights extended retention feature allows data to be retained for up to 1 year. The WGU Cloud Deployment and Operations Study Guide (Section 7.2, Performance Insights) states, "Performance Insights offers a 7-day retention period by default, with an option to extend to 1 year for detailed historical analysis, supporting cost and performance optimization." Options A (1 day) and D (2 years) are not supported retention periods.

AWS WAF (Web Application Firewall) is used to protect a server from Layer 7 (application layer) attacks, such as SQL injection or cross-site scripting, by filtering HTTP/HTTPS traffic based on defined rules. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, AWS WAF) states, "WAF protects web applications at Layer 7 by inspecting and blocking malicious requests, such as those involving SQL injection or XSS, when integrated with ALB or CloudFront." Shield protects against DDoS (Layer 3/4), CloudWatch monitors metrics, and KMS key rotation manages encryption, none of which address Layer 7 attacks.

AWS Systems Manager should be used to schedule the patching of EC2 instances and on-premises servers with security updates, utilizing features like Patch Manager and maintenance windows. This service supports hybrid environments and automated patch deployment. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Systems Manager Patch Manager) states, "Systems Manager provides Patch Manager to schedule and deploy security updates to EC2 instances and on-premises servers during maintenance windows, ensuring consistent patching across hybrid environments." EventBridge, Config, and App Runner do not offer this patching capability.

Comprehensive and Detailed Explanation From Exact Extract:

To make the EC2 instance accessible via a public DNS hostname like ec2-public-54.18.127.233.us-west-2.compute.amazonaws.com, the administrator must set the VPC attribute enableDnsHostnames to true. This enables the automatic assignment of public DNS hostnames to instances with public IP addresses in the VPC. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Configuration) states, "Setting enableDnsHostnames to true in the VPC configuration ensures that EC2 instances with public IPs receive a public DNS hostname (e.g., ec2-public- < ip > . < region > .compute.amazonaws.com), facilitating internet accessibility." Resource tags, disabling DNS support, and resource-based names do not enable this functionality. < /region > < /ip >