[Nov 20, 2025] New WGU Cloud-Deployment-and-Operations Dumps with Test Engine and PDF (New Questions)
Pass Your Cloud-Deployment-and-Operations Exam Easily - Real Cloud-Deployment-and-Operations Practice Dump Updated
NEW QUESTION # 16
(Which AWS service is used to provide remote workers with secure access to AWS resources?)
- A. Transit Gateway
- B. Network Firewall
- C. NAT instance
- D. Client VPN
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
AWS Client VPN is used to provide remote workers with secure access to AWS resources by establishing a VPN connection to the VPC, ensuring encrypted access to private networks. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, Client VPN) states, "Client VPN enables secure remote access to AWS resources within a VPC, using mutual authentication and encryption to protect data for remote workers." Transit Gateway manages inter-VPC routing, Network Firewall filters traffic, and NAT instances handle outbound internet access, none of which are designed for remote worker access.
NEW QUESTION # 17
(Which function is used to obtain components defined in an AWS CloudFormation template?)
- A. GetAZs
- B. Cidr
- C. Ref
- D. ImportValue
Answer: C
Explanation:
The `Ref` function in an AWS CloudFormation template is used to obtain values of components defined within the template, such as resource IDs, parameters, or outputs. This function allows dynamic referencing of resources during stack creation. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Functions) states, "The `Ref` function is used to reference the logical IDs of resources, parameters, or mappings defined in the template, enabling dynamic value retrieval (e.g., `Ref:
MyEC2Instance` returns the instance ID)." ImportValue is used for cross-stack references, Cidr for IP range calculations, and GetAZs for availability zone lists, making them unsuitable here.
NEW QUESTION # 18
(What can AWS Config directly invoke to cause remediation of findings?)
- A. Lambda function
- B. Systems Manager document
- C. CloudWatch alarm
- D. Control Tower guardrail
Answer: A
Explanation:
AWS Config can directly invoke an AWS Lambda function to cause remediation of findings by triggering automated responses to configuration changes or non-compliant resources. This integration enables real-time corrective actions. The WGU Cloud Deployment and Operations Study Guide (Section 6.1, AWS Config) states, "AWS Config can invoke a Lambda function as a remediation action, allowing automated fixes for non- compliant resources (e.g., terminating unauthorized instances)." Control Tower guardrails, CloudWatch alarms, and Systems Manager documents are not directly invoked by Config for this purpose.
NEW QUESTION # 19
(An AWS SysOps administrator needs to configure Amazon Route 53 to load balance customer requests across multiple identically configured websites. The load balancing method must ensure that the customer requests are directed to the website that offers the shortest round-trip time. Which routing policy should be used?)
- A. Geolocation
- B. Latency
- C. Geoproximity
- D. Weighted
Answer: B
Explanation:
The latency routing policy in Amazon Route 53 should be used to direct customer requests to the website with the shortest round-trip time (RTT). This policy routes traffic to the AWS region with the lowest latency based on the user's location, optimizing performance. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) states, "The latency-based routing policy in Route 53 measures RTT to direct users to the region with the lowest latency, improving user experience across multiple websites." Geolocation, geoproximity, and weighted policies do not prioritize RTT in this manner.
NEW QUESTION # 20
(A company is using Route 53 for Domain Name System (DNS) hosting. The company requires a zone that should only be accessible from instances in a Virtual Private Cloud (VPC). Which type of hosted zone should be used?)
- A. Private Zone
- B. Lightsail DNS Zone
- C. Public Hosted Zone
- D. DNS Zone
Answer: A
Explanation:
A Private Hosted Zone in Amazon Route 53 should be used to restrict DNS resolution to instances within a Virtual Private Cloud (VPC), ensuring that the zone is only accessible internally. This isolates DNS services from public internet access. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Hosted Zones) states, "A Private Hosted Zone in Route 53 limits DNS resolution to resources within a specified VPC, preventing external access and enhancing security for internal services." Public Hosted Zones, DNS Zones, and Lightsail DNS Zones do not provide this VPC-specific restriction.
NEW QUESTION # 21
(What is the advantage of maximizing the time to live of the cache in CloudFront?)
- A. Improve a disaster recovery plan
- B. Improve security measures
- C. Facilitate a high number of requests
- D. Minimize requests to the origin
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
Maximizing the time to live (TTL) of the cache in Amazon CloudFront reduces the frequency of requests to the origin server by serving content from edge locations for a longer period, lowering latency and costs. The WGU Cloud Deployment and Operations Study Guide (Section 4.4, CloudFront Caching) states, "A higher TTL in CloudFront caching minimizes origin requests by keeping objects in edge caches longer, reducing load on the origin server and optimizing performance and cost." Facilitating high request volumes, improving disaster recovery, and enhancing security are not primary benefits of maximizing TTL.
NEW QUESTION # 22
(A company uses KMS for key management. The company has a requirement to ensure that cryptographic material is not used longer than a year. Which solution should be used to meet this requirement with the least amount of effort?)
- A. Develop a custom key encryption protocol for KMS
- B. Move keys from KMS to CloudHSM
- C. Enable automatic key rotation in KMS
- D. Write a Lambda function to replace keys in KMS
Answer: C
Explanation:
Enabling automatic key rotation in AWS Key Management Service (KMS) is the least effort solution to ensure cryptographic material is not used longer than a year. KMS automatically rotates the cryptographic material of symmetric customer master keys (CMKs) every 365 days, meeting the requirement without manual intervention. The WGU Cloud Deployment and Operations Study Guide (Section 6.3, KMS) states,
"Automatic key rotation in KMS rotates the backing key material every year for symmetric CMKs, providing a low-effort way to comply with key usage limits." Moving to CloudHSM, custom protocols, or Lambda functions require more effort and complexity.
NEW QUESTION # 23
(An administrator needs to set up self-managed permissions for AWS CloudFormation StackSet operations.
Which two roles should be created in the administrator account and in the target accounts? Choose 2 answers.)
- A. In each target account, create a service role named AWSCloudFormationStackSetExecutionRole that trusts the administrator account.
- B. In the administrator account, create an IAM role named AWSCloudFormationStackSetExecutionRole.
- C. In the administrator account, create an IAM role named
AWSCloudFormationStackSetAdministrationRole. - D. In each target account, create a service role named AWSCloudFormationStackSetAdministrationRole that trusts the administrator account.
Answer: A,C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
To set up self-managed permissions for CloudFormation StackSet operations, two roles are required: in the administrator account, create an IAM role named AWSCloudFormationStackSetAdministrationRole to manage StackSet operations, and in each target account, create a service role named AWSCloudFormationStackSetExecutionRole that trusts the administrator account to execute the stacks. The WGU Cloud Deployment and Operations Study Guide (Section 5.4, StackSets) states, "For self-managed permissions, the administrator account requires the AWSCloudFormationStackSetAdministrationRole, while each target account needs the AWSCloudFormationStackSetExecutionRole with a trust relationship to the administrator account for stack deployment." Roles B and D are incorrectly named or misplaced.
NEW QUESTION # 24
(A company that uses five Elastic IP addresses does not want to request more from AWS. Which solution should be used to route requests to a healthy endpoint?)
- A. Edit the route table for the VPC
- B. Register a DNS name to an auto-assigned public IP address
- C. Use Systems Manager to update endpoints
- D. Adjust the TTL of the IP packets
Answer: B
Explanation:
To route requests to a healthy endpoint without requesting additional Elastic IP addresses, the company should register a DNS name to an auto-assigned public IP address using a service like Route 53. This leverages dynamic DNS to distribute traffic, reducing reliance on fixed EIPs. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53) states, "Registering a DNS name with an auto-assigned public IP in Route 53 allows traffic routing to healthy instances, avoiding the need for additional Elastic IP addresses." TTL adjustment, route table edits, and Systems Manager are not relevant solutions.
NEW QUESTION # 25
(What is the role of AWS Trusted Advisor?)
- A. It provides recommendations to help follow AWS best practices.
- B. It provides an assessment on unused IAM roles.
- C. It provides a holistic overview of the health of architecture.
- D. It provides recommendations on patches to be performed on resources.
Answer: A
Explanation:
AWS Trusted Advisor provides recommendations to help follow AWS best practices, analyzing the environment for cost optimization, security, performance, and fault tolerance. It offers actionable insights to improve resource usage. The WGU Cloud Deployment and Operations Study Guide (Section 6.4, Trusted Advisor) states, "Trusted Advisor evaluates your AWS environment against best practices, providing recommendations in categories like cost optimization and security (e.g., enabling MFA or removing unused resources)." Options A, B, and C overstate or misrepresent its role, as it does not focus solely on unused IAM roles, holistic health overviews, or patch recommendations.
NEW QUESTION # 26
(What is used to change stacks across multiple accounts and Regions in a single operation?)
- A. Stack policies
- B. StackSets
- C. StackInstance
- D. Nested stacks
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
StackSets are used to change stacks across multiple AWS accounts and regions in a single operation, enabling centralized management of infrastructure deployments. StackSets allow administrators to create, update, or delete stacks consistently across specified accounts and regions. The WGU Cloud Deployment and Operations Study Guide (Section 5.4, StackSets) states, "StackSets provide the capability to manage and update stacks across multiple accounts and regions with a single operation, streamlining multi-region deployments." StackInstance, nested stacks, and stack policies do not support this multi-account, multi-region functionality.
NEW QUESTION # 27
(Media files are stored in an S3 bucket in region A. Demand for the files from region B has increased. Region B is suffering from some latency issues due to geographical location. Which type of replication will reduce the latency in region B?)
- A. Same-Region
- B. Cross-Region
- C. S3 Batch
- D. S3 Versioning
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
To reduce latency in region B due to increased demand for media files stored in region A, cross-region replication (CRR) should be used. CRR replicates objects to an S3 bucket in another region (e.g., region B), allowing users to access files from a closer location, thus minimizing latency. The WGU Cloud Deployment and Operations Study Guide (Section 2.2, S3 Replication) states, "Cross-Region Replication in S3 copies objects to a destination bucket in a different region, reducing latency by enabling access to data from the nearest region, such as region B in this case." S3 Batch, S3 Versioning, and Same-Region replication do not address cross-region latency.
NEW QUESTION # 28
(A company manages a containerized application by manually deploying AWS compute instances. Which solution should be used to optimize the cost of the application?)
- A. Fargate
- B. RDS
- C. EFS
- D. Aurora
Answer: A
Explanation:
AWS Fargate should be used to optimize the cost of a containerized application by eliminating the need for manual instance management, as it provides serverless container orchestration that automatically scales and charges only for resource usage. The WGU Cloud Deployment and Operations Study Guide (Section 7.5, Fargate) states, "Fargate optimizes costs for containerized applications by removing the overhead of managing EC2 instances, scaling automatically, and billing based on vCPU and memory usage, reducing manual deployment expenses." Aurora, RDS, and EFS are database or storage solutions not designed for container cost optimization.
NEW QUESTION # 29
(Which AWS solution can be used to send events from Shopify?)
- A. Service events
- B. IoT Events
- C. EventBridge
- D. CloudTrail events
Answer: C
Explanation:
Amazon EventBridge is the AWS solution that can be used to send events from external sources like Shopify.
EventBridge supports integration with third-party applications through its event bus, allowing custom events (e.g., from Shopify via webhooks) to be ingested and routed to AWS services or targets. The WGU Cloud Deployment and Operations Study Guide (Section 4.3, EventBridge) notes that EventBridge is designed for event ingestion from SaaS applications, making it suitable for Shopify integration. CloudTrail, IoT Events, and Service events are not designed for this purpose.
NEW QUESTION # 30
(What should be configured in Systems Manager to set the error threshold for automation documents?)
- A. Maintenance windows
- B. Rate control
- C. Resource group
- D. Session preferences
Answer: B
Explanation:
In AWS Systems Manager, the error threshold for automation documents is configured using rate control.
Rate control allows administrators to define the maximum number of errors or concurrent executions that can occur before an automation task is throttled or stopped, ensuring system stability. The WGU Cloud Deployment and Operations Study Guide (Section 5.1, Systems Manager Automation) explicitly states, "Rate control settings in Automation documents can be used to specify the maximum number of errors allowed during execution, helping to manage error thresholds effectively." Resource groups, session preferences, and maintenance windows do not directly address error thresholds.
NEW QUESTION # 31
(An organization uses CloudFormation to deploy AWS infrastructure. The templates are built in JSON and deploy EC2 instances across multiple regions. Which solution should be used to set values in the template based on region-specific AMI IDs?)
- A. Mappings
- B. Outputs
- C. WaitCondition
- D. Resources
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The Mappings section in a CloudFormation template should be used to set values based on region-specific AMI IDs. Mappings allow the template to define a lookup table that associates regions with corresponding AMI IDs, enabling dynamic selection during stack creation across multiple regions. The WGU Cloud Deployment and Operations Study Guide (Section 5.3, CloudFormation Mappings) states, "The Mappings section enables region-specific configurations, such as mapping AMI IDs to regions (e.g., 'us-east-1': 'ami-
123456'), ensuring the correct AMI is used based on the deployment region." Outputs, WaitCondition, and Resources do not provide this mapping functionality.
NEW QUESTION # 32
(Which type of support plan provides a technical account manager and full use of Trusted Advisor?)
- A. Standard
- B. Enterprise
- C. Developer
- D. Business
Answer: B
Explanation:
The Enterprise support plan provides a technical account manager (TAM) and full use of Trusted Advisor, offering proactive guidance and comprehensive access to all checks. This plan is designed for large-scale, mission-critical workloads. The WGU Cloud Deployment and Operations Study Guide (Section 6.4, AWS Support Plans) states, "The Enterprise support plan includes a dedicated Technical Account Manager and full Trusted Advisor access, providing 24/7 support and proactive optimization recommendations." Developer, Standard, and Business plans offer limited or no TAM support and partial Trusted Advisor access.
NEW QUESTION # 33
(Which two locations can Amazon Inspector publish its findings in when it has detected an anomaly? Choose
2 answers.)
- A. CloudWatch
- B. CloudTrail
- C. SQS
- D. SNS
Answer: A,D
Explanation:
Amazon Inspector can publish its findings when detecting anomalies to Amazon SNS for real-time notifications and to CloudWatch for metric and event logging, enabling monitoring and response. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, Amazon Inspector) states, "Inspector findings are published to SNS for immediate alerts and to CloudWatch for detailed logging, allowing integration with other AWS services for anomaly response." CloudTrail logs API calls, and SQS is a messaging queue, neither of which are primary destinations for Inspector findings.
NEW QUESTION # 34
(An administrator sees the following VPC flow log: 2 123456739010 eni-123bfecad12529 192.168.20.1
203.0.113.66 2066 22 20 7782 1645859356 1645859536 ACCEPT OK. What does the log indicate about the traffic flow?)
- A. Traffic from 203.0.113.66 to 192.168.20.1 with a destination port of 2066 has been permitted.
- B. Traffic from 203.0.113.66 to 192.168.20.1 with a source port of 22 has been permitted.
- C. Traffic from 192.168.20.1 to 203.0.113.66 with a source port of 2066 has been permitted.
- D. Traffic from 192.168.20.1 to 203.0.113.66 with a destination port of 2066 has been permitted.
Answer: D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The VPC flow log fields indicate the following: the source IP is 192.168.20.1, the destination IP is
203.0.113.66, the source port is 2066, the destination port is 22, and the action is "ACCEPT OK," meaning the traffic was permitted. This shows outbound traffic from the internal network (192.168.20.1) to an external IP (203.0.113.66) with destination port 2066. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Flow Logs) states, "In a flow log, the format includes source IP, destination IP, source port, destination port, and action; for example, 192.168.20.1 to 203.0.113.66 with source port 2066 and destination port 22 indicates permitted outbound traffic." Only option C correctly interprets this flow.
NEW QUESTION # 35
(What should be used to monitor estimated AWS charges?)
- A. Billing alarm
- B. Cognito
- C. Pricing Calculator
- D. Forecast
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
A Billing alarm in Amazon CloudWatch should be used to monitor estimated AWS charges by setting thresholds on cost metrics and triggering notifications when exceeded. This helps manage budgets effectively.
The WGU Cloud Deployment and Operations Study Guide (Section 7.4, Cost Monitoring) states, "Billing alarms in CloudWatch monitor estimated charges against a defined threshold, sending alerts via SNS to prevent cost overruns." Cognito handles user authentication, Pricing Calculator estimates costs pre- deployment, and Forecast predicts usage, none of which monitor real-time charges.
NEW QUESTION # 36
(An administrator needs to create Systems Manager Automation documents to take action based on AWS Config rules. Which two file formats should be used? Choose 2 answers.)
- A. CSV
- B. JSON
- C. YAML
- D. XML
Answer: B,C
Explanation:
Systems Manager Automation documents can be created using JSON or YAML file formats to define workflows and actions based on AWS Config rules. These formats allow administrators to specify the steps and parameters for automation tasks, such as remediation actions triggered by Config rule evaluations. The WGU Cloud Deployment and Operations Study Guide (Section 5.1, Systems Manager Automation) states that both JSON and YAML are supported formats for writing Automation documents, providing flexibility in scripting automation logic. XML and CSV are not supported formats for this purpose.
NEW QUESTION # 37
(Which solution is used to protect a server from Layer 7 attacks?)
- A. CloudWatch
- B. WAF
- C. Shield
- D. KMS key rotation
Answer: B
Explanation:
AWS WAF (Web Application Firewall) is used to protect a server from Layer 7 (application layer) attacks, such as SQL injection or cross-site scripting, by filtering HTTP/HTTPS traffic based on defined rules. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, AWS WAF) states, "WAF protects web applications at Layer 7 by inspecting and blocking malicious requests, such as those involving SQL injection or XSS, when integrated with ALB or CloudFront." Shield protects against DDoS (Layer 3/4), CloudWatch monitors metrics, and KMS key rotation manages encryption, none of which address Layer 7 attacks.
NEW QUESTION # 38
(What is a patch baseline attached to if it is not defined in Patch Manager?)
- A. Patch process
- B. Default patch group
- C. Baseline data set
- D. Accelerate patch baseline
Answer: B
Explanation:
If a patch baseline is not explicitly defined in Patch Manager, it is attached to the default patch group. This default group applies a preconfigured baseline with AWS-recommended patches, ensuring basic compliance for instances without custom baselines. The WGU Cloud Deployment and Operations Study Guide (Section
5.2, Patch Manager) states, "If no custom patch baseline is defined, instances are associated with the default patch group, which uses AWS-provided baseline settings for automatic patch approval." Options A, C, and D are not valid attachments for patch baselines.
NEW QUESTION # 39
(A company has implemented multifactor authentication (MFA) for access to its AWS tenant. Which API call is needed to perform MFA before accessing a resource?)
- A. GetSessionToken
- B. GetFederationToken
- C. GetCallerIdentity
- D. DecodeAuthorizationMessage
Answer: A
Explanation:
The `GetSessionToken` API call is needed to perform MFA before accessing a resource, as it generates temporary security credentials for an IAM user after MFA validation. This ensures secure access to AWS resources. The WGU Cloud Deployment and Operations Study Guide (Section 6.2, IAM and MFA) states,
"The `GetSessionToken` API is used with MFA to obtain temporary credentials, requiring a valid MFA code to authenticate the user before resource access is granted." GetCallerIdentity, GetFederationToken, and DecodeAuthorizationMessage serve different purposes and do not handle MFA authentication.
NEW QUESTION # 40
......
Pass4training just published the WGU Cloud-Deployment-and-Operations exam dumps!: https://www.pass4training.com/Cloud-Deployment-and-Operations-pass-exam-training.html
For your comfort, Pass4training provides you the convenience of free Courses and Certificates braindumps demo: https://drive.google.com/open?id=1i21yQZkhMDVXTh1ai-KoMpnjXFJA5kuY
