Cloud-Deployment-and-Operations Exam Dumps - WGUCloud Deployment and Operations

To ensure the route table with a default outbound route via an internet gateway takes effect, the administrator must create a subnet association, linking the route table to specific subnets within the VPC. This association applies the routing rules to the subnet's traffic. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Routing) states, "A route table must be associated with a subnet (subnet association) to enforce routing rules, such as the default route to an internet gateway, ensuring outbound traffic follows the defined path." Propagation, tags, and edge associations do not activate the route.

To run Automation documents on a schedule in AWS Systems Manager, a maintenance window must be configured. Maintenance windows define the time periods during which automated tasks, including the execution of Automation documents, can run. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Maintenance Windows) explains that maintenance windows are used to schedule and control the execution of Systems Manager tasks, ensuring they align with operational windows. Rate control, session preferences, and resource groups are not used for scheduling automation tasks.

Comprehensive and Detailed Explanation From Exact Extract:

Recovery Point Objective (RPO) measures the maximum acceptable data loss, while Recovery Time Objective (RTO) measures the maximum acceptable downtime. The company requires an RPO of up to 3 hours (acceptable data loss) and an RTO of 1 hour (service restoration time). The correct option is RPO 4 hours, RTO 1 hour, as it meets the RPO requirement (allowing up to 3 hours of data loss is within 4 hours) and satisfies the RTO of 1 hour. The WGU Cloud Deployment and Operations Study Guide (Section 8.1, Disaster Recovery) states, "RPO defines the maximum data loss tolerance (e.g., 3 hours), and RTO defines the maximum downtime (e.g., 1 hour); a configuration of RPO 4 hours and RTO 1 hour aligns with these thresholds." Other options fail to meet both criteria simultaneously.

Enabling automatic key rotation in AWS Key Management Service (KMS) is the least effort solution to ensure cryptographic material is not used longer than a year. KMS automatically rotates the cryptographic material of symmetric customer master keys (CMKs) every 365 days, meeting the requirement without manual intervention. The WGU Cloud Deployment and Operations Study Guide (Section 6.3, KMS) states, "Automatic key rotation in KMS rotates the backing key material every year for symmetric CMKs, providing a low-effort way to comply with key usage limits." Moving to CloudHSM, custom protocols, or Lambda functions require more effort and complexity.

Comprehensive and Detailed Explanation From Exact Extract:

AWS Client VPN is used to provide remote workers with secure access to AWS resources by establishing a VPN connection to the VPC, ensuring encrypted access to private networks. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Client VPN) states, "Client VPN enables secure remote access to AWS resources within a VPC, using mutual authentication and encryption to protect data for remote workers." Transit Gateway manages inter-VPC routing, Network Firewall filters traffic, and NAT instances handle outbound internet access, none of which are designed for remote worker access.

Comprehensive and Detailed Explanation From Exact Extract:

CloudWatch should be used to identify and shut down idle EC2 instances by monitoring metrics such as CPU utilization or network activity. Custom alarms can be set to trigger an AWS Lambda function or Systems Manager automation to terminate idle instances, optimizing costs. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Metrics) states, "CloudWatch can monitor EC2 instance metrics like CPUUtilization; an alarm can be configured to invoke a Lambda function to terminate idle instances, ensuring cost efficiency." CloudFront, CloudSearch, and CloudTrail are not designed for this monitoring and automation task.

To deploy a NAT gateway in an existing VPC subnet, the administrator must assign an elastic IP address to the NAT gateway for public internet access and configure the route table associated with the subnet to route traffic through the NAT gateway. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, NAT Gateway) states, "Deployment of a NAT gateway requires an elastic IP address for outbound internet connectivity and a route table update to direct private subnet traffic to the NAT gateway (e.g., 0.0.0.0/0 via NAT)." Private IP assignment and ACL configuration are not required steps.

The `NetworkIn` metric in Amazon CloudWatch should be used to determine the number of bytes received by an EC2 instance across all network interfaces, aiding in proper instance sizing based on inbound traffic. The WGU Cloud Deployment and Operations Study Guide (Section 4.1, CloudWatch Metrics) states, "The `NetworkIn` metric measures the total number of bytes received on all network interfaces of an EC2 instance, providing critical data for sizing decisions to handle inbound traffic effectively." NetworkPacketsIn, NetworkOut, and NetworkPacketsOut measure packet counts or outbound data, which are less relevant for this purpose.