Pass the WGU Courses and Certificates Cloud-Deployment-and-Operations Questions and answers with ExamsMirror

Amazon S3 (Simple Storage Service) should be used to host content to be processed for Amazon Made, as it provides scalable object storage ideal for storing and retrieving large amounts of data, such as media files or documents, for processing workflows. The WGU Cloud Deployment and Operations Study Guide (Section 2.1, Amazon S3) states, "S3 is the preferred solution for hosting content to be processed by services like Amazon Made, offering durable and highly available storage with support for lifecycle policies and integration with other AWS services." DocumentDB, DynamoDB, and EC2 are not designed for this content hosting purpose.

AWS Control Tower enables a company to enforce and manage governance rules across multiple AWS accounts by setting up a landing zone with preconfigured policies for security, compliance, and operations. It simplifies multi-account management. The WGU Cloud Deployment and Operations Study Guide (Section 6.5, Control Tower) states, "Control Tower provides a centralized solution to establish and enforce governance rules across multiple accounts, using guardrails and a landing zone to ensure compliance with organizational policies." Security Hub, GuardDuty, and Systems Manager do not offer this multi-account governance capability.

Patch Manager in AWS Systems Manager sends compliance reports to an Amazon S3 bucket, where they are stored for auditing and analysis. This allows administrators to track patch compliance status across EC2 instances and on-premises servers. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "Patch Manager compliance reports are delivered to an S3 bucket configured as a target, providing a centralized location for reviewing patch status and compliance data." OpsWorks, EBS, and Route 53 are not used for storing these reports.

Comprehensive and Detailed Explanation From Exact Extract:

Maximizing the time to live (TTL) of the cache in Amazon CloudFront reduces the frequency of requests to the origin server by serving content from edge locations for a longer period, lowering latency and costs. The WGU Cloud Deployment and Operations Study Guide (Section 4.4, CloudFront Caching) states, "A higher TTL in CloudFront caching minimizes origin requests by keeping objects in edge caches longer, reducing load on the origin server and optimizing performance and cost." Facilitating high request volumes, improving disaster recovery, and enhancing security are not primary benefits of maximizing TTL.

AWS WAF (Web Application Firewall) is used to protect a server from Layer 7 (application layer) attacks, such as SQL injection or cross-site scripting, by filtering HTTP/HTTPS traffic based on defined rules. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, AWS WAF) states, "WAF protects web applications at Layer 7 by inspecting and blocking malicious requests, such as those involving SQL injection or XSS, when integrated with ALB or CloudFront." Shield protects against DDoS (Layer 3/4), CloudWatch monitors metrics, and KMS key rotation manages encryption, none of which address Layer 7 attacks.

Comprehensive and Detailed Explanation From Exact Extract:

The Reachability Analyzer in AWS VPC should be used to troubleshoot connectivity issues from on-premises computers to EC2 instances, especially when a network security group (NSG) is suspected. It analyzes the network path and identifies blocked traffic due to NSG rules or route tables. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Troubleshooting) states, "Reachability Analyzer helps diagnose connectivity issues by simulating traffic paths, identifying if an NSG rule (e.g., blocked port) or route table is causing the problem from on-premises to EC2 public IPs." Flow Logs provide data but not analysis, PrivateLink is for private connections, and Traffic Mirroring is for monitoring.

Comprehensive and Detailed Explanation From Exact Extract:

To make the EC2 instance accessible via a public DNS hostname like ec2-public-54.18.127.233.us-west-2.compute.amazonaws.com, the administrator must set the VPC attribute enableDnsHostnames to true. This enables the automatic assignment of public DNS hostnames to instances with public IP addresses in the VPC. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Configuration) states, "Setting enableDnsHostnames to true in the VPC configuration ensures that EC2 instances with public IPs receive a public DNS hostname (e.g., ec2-public-..compute.amazonaws.com), facilitating internet accessibility." Resource tags, disabling DNS support, and resource-based names do not enable this functionality.

To receive emails when a Lambda function returns an error, the administrator should use Amazon CloudWatch to monitor the function’s logs and metrics (e.g., errors) and Amazon Simple Notification Service (SNS) to send email notifications based on CloudWatch alarms. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, CloudWatch and SNS) states, "CloudWatch can detect Lambda errors via logs and trigger an alarm, which integrates with SNS to send email notifications to subscribed endpoints, ensuring timely error alerts." SQS and CloudTrail are not designed for this notification workflow.

To notify a response team when a high-security web server returns a 403 Forbidden error, two key steps are required. First, define a metric filter for Apache logs in CloudWatch to detect the 403 error code within the log data. This involves setting up a filter pattern to match "403" in the Apache access logs. Second, create an alarm for the metric filter and configure it to deliver alerts using Amazon SNS, which supports email or other notifications to the response team. The WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs and Alarms) confirms that metric filters and SNS-integrated alarms are the standard approach for monitoring and alerting on log-based events. Options B and D are incorrect as they involve unnecessary or unsupported configurations (e.g., binding Lambda to Apache or using SQS for alarms).

The `disk_io_time` metric, collected by the CloudWatch agent on EC2 Linux instances, measures the total time (in milliseconds) that read and write requests have waited on I/O, helping to assess disk performance for instance sizing. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Agent Metrics) states, "The `disk_io_time` metric, available via the CloudWatch agent, tracks the time spent waiting for I/O operations, providing insight into disk contention for optimizing EC2 instance sizing." disk_read_ops, diskio_reads, and diskio_read_bytes measure operation counts or bytes, not wait times.