Cloud-Deployment-and-Operations Questions and Answers

To receive emails when a Lambda function returns an error, the administrator should use Amazon CloudWatch to monitor the function’s logs and metrics (e.g., errors) and Amazon Simple Notification Service (SNS) to send email notifications based on CloudWatch alarms. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, CloudWatch and SNS) states, "CloudWatch can detect Lambda errors via logs and trigger an alarm, which integrates with SNS to send email notifications to subscribed endpoints, ensuring timely error alerts." SQS and CloudTrail are not designed for this notification workflow.

Patch Manager in AWS Systems Manager sends compliance reports to an Amazon S3 bucket, where they are stored for auditing and analysis. This allows administrators to track patch compliance status across EC2 instances and on-premises servers. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, "Patch Manager compliance reports are delivered to an S3 bucket configured as a target, providing a centralized location for reviewing patch status and compliance data." OpsWorks, EBS, and Route 53 are not used for storing these reports.

To deploy a NAT gateway in an existing VPC subnet, the administrator must assign an elastic IP address to the NAT gateway for public internet access and configure the route table associated with the subnet to route traffic through the NAT gateway. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, NAT Gateway) states, "Deployment of a NAT gateway requires an elastic IP address for outbound internet connectivity and a route table update to direct private subnet traffic to the NAT gateway (e.g., 0.0.0.0/0 via NAT)." Private IP assignment and ACL configuration are not required steps.

Enabling automatic key rotation in AWS Key Management Service (KMS) is the least effort solution to ensure cryptographic material is not used longer than a year. KMS automatically rotates the cryptographic material of symmetric customer master keys (CMKs) every 365 days, meeting the requirement without manual intervention. The WGU Cloud Deployment and Operations Study Guide (Section 6.3, KMS) states, "Automatic key rotation in KMS rotates the backing key material every year for symmetric CMKs, providing a low-effort way to comply with key usage limits." Moving to CloudHSM, custom protocols, or Lambda functions require more effort and complexity.

To reduce conversion delays caused by increased demand, the company should configure a CloudWatch alarm to scale the EC2 fleet based on the SQS queue length. This auto-scaling approach dynamically adjusts the number of EC2 instances to handle the workload, especially during peak evening hours and anticipated growth. The WGU Cloud Deployment and Operations Study Guide (Section 3.3, Auto Scaling and SQS) explains, "Auto Scaling can be triggered by a CloudWatch alarm monitoring SQS queue depth, ensuring the EC2 fleet scales out to process video conversion tasks efficiently as the queue length increases." Spot instances, dead-letter queues, and instance type upgrades do not directly address dynamic scaling needs.

Comprehensive and Detailed Explanation From Exact Extract:

To reduce latency in region B due to increased demand for media files stored in region A, cross-region replication (CRR) should be used. CRR replicates objects to an S3 bucket in another region (e.g., region B), allowing users to access files from a closer location, thus minimizing latency. The WGU Cloud Deployment and Operations Study Guide (Section 2.2, S3 Replication) states, "Cross-Region Replication in S3 copies objects to a destination bucket in a different region, reducing latency by enabling access to data from the nearest region, such as region B in this case." S3 Batch, S3 Versioning, and Same-Region replication do not address cross-region latency.

Comprehensive and Detailed Explanation From Exact Extract:

AWS CloudFormation uses YAML and JSON languages to define infrastructure as code (IaC) templates, specifying resources, parameters, and configurations. These formats are human-readable and support the creation of stacks for provisioning AWS resources. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation) states, "CloudFormation templates can be written in YAML or JSON, both of which are supported for defining infrastructure resources like EC2 instances and S3 buckets." XML and C# are not supported languages for CloudFormation templates.

To meet the requirements of restricting EC2 instances to Free Tier-eligible types and automatically terminating unapproved instances, AWS Systems Manager and AWS Config should be used. Systems Manager can enforce instance compliance through automation documents that monitor and terminate non-compliant instances. AWS Config provides continuous monitoring and evaluation of resource configurations against defined rules, such as those limiting instance types to Free Tier-eligible options (e.g., t2.micro or t3.micro). The WGU Cloud Deployment and Operations Study Guide (Section 6.1, AWS Config and Systems Manager) notes, "AWS Config can be configured with a rule to detect non-Free Tier EC2 instances, while Systems Manager Automation can execute a termination script based on Config findings." OpsWorks and Launch Wizard are not designed for this specific compliance and automation use case.

Amazon EventBridge should be used to configure email notifications for a trigger by Amazon Made, as it can route events to targets like Amazon SNS (Simple Notification Service) for email delivery. EventBridge integrates with AWS services to handle event-driven notifications. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, EventBridge) states, "EventBridge can be configured to send events from Amazon Made to SNS, enabling email notifications by subscribing an email endpoint to the SNS topic." SQS, EKS, and CodeDeploy do not support this notification configuration.

AWS WAF (Web Application Firewall) is used to protect a server from Layer 7 (application layer) attacks, such as SQL injection or cross-site scripting, by filtering HTTP/HTTPS traffic based on defined rules. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, AWS WAF) states, "WAF protects web applications at Layer 7 by inspecting and blocking malicious requests, such as those involving SQL injection or XSS, when integrated with ALB or CloudFront." Shield protects against DDoS (Layer 3/4), CloudWatch monitors metrics, and KMS key rotation manages encryption, none of which address Layer 7 attacks.

The AWS monitoring feature used to process events with AWS Lambda is CloudWatch Events, specifically through the use of rules. Rules define the events to monitor (e.g., based on event patterns) and specify targets like AWS Lambda functions to process those events. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, CloudWatch Events) explains that rules are the core component for event-driven architectures, enabling automation by linking events to Lambda for processing. Metrics, targets, and logs are related but not the primary feature for this function.

Comprehensive and Detailed Explanation From Exact Extract:

After stopping and starting an EC2 instance, the public IP address may change (unless an Elastic IP is attached), but the security group rules remain intact. If the instance is no longer accessible via SSH, it’s likely due to an inbound rule (e.g., for port 22) not being correctly configured or applied. Adding or verifying a rule in the security group associated with the network interface (NIC) to allow SSH (port 22) from the administrator’s IP resolves this. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Security Groups) states, "Stopping and starting an EC2 instance may require verifying or adding an inbound SSH rule (port 22) in the security group if connectivity is lost due to IP or rule misconfiguration." Route table or IP changes are not the primary issue here.

When Amazon Route 53 determines an endpoint is unhealthy based on a failure threshold (e.g., via health checks), it terminates the connection attempt to that endpoint and routes traffic to a healthy alternative, if available. This behavior ensures high availability using routing policies like failover or latency-based routing. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Health Checks) states, "Route 53 stops routing traffic to an unhealthy endpoint by terminating connection attempts once the health check failure threshold is exceeded, redirecting to a healthy resource." Options A, C, and D are not direct actions taken by Route 53 in this scenario.

AWS Control Tower enables a company to enforce and manage governance rules across multiple AWS accounts by setting up a landing zone with preconfigured policies for security, compliance, and operations. It simplifies multi-account management. The WGU Cloud Deployment and Operations Study Guide (Section 6.5, Control Tower) states, "Control Tower provides a centralized solution to establish and enforce governance rules across multiple accounts, using guardrails and a landing zone to ensure compliance with organizational policies." Security Hub, GuardDuty, and Systems Manager do not offer this multi-account governance capability.

To route requests to a healthy endpoint without requesting additional Elastic IP addresses, the company should register a DNS name to an auto-assigned public IP address using a service like Route 53. This leverages dynamic DNS to distribute traffic, reducing reliance on fixed EIPs. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53) states, "Registering a DNS name with an auto-assigned public IP in Route 53 allows traffic routing to healthy instances, avoiding the need for additional Elastic IP addresses." TTL adjustment, route table edits, and Systems Manager are not relevant solutions.