Free AWS Certified CloudOps Engineer - Associate Practice Questions

Sample Practice Questions

Try these 10 sample questions from the AWS Certified CloudOps Engineer - Associate practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An operator needs memory utilization from inside an EC2 instance in CloudWatch. Which setup supplies that system-level metric?

   1. A. Enable only EC2 basic monitoring.
   2. B. Install and configure the CloudWatch agent.
   3. C. Create a CloudTrail trail for the instance.
   4. D. Create a CloudWatch dashboard for the instance.

   Answer: B

   Explanation: AWS says the agent can "Collect internal system-level metrics from Amazon EC2 instances across operating systems." Memory utilization is an in-guest metric, so the agent supplies it; basic EC2 monitoring, a trail, and a dashboard do not collect that host metric.

   Reference: Collect metrics, logs, and traces using the CloudWatch agent — CloudWatch agent capabilities, system-level metrics

2. 2An EC2 Auto Scaling group must maintain a chosen average CPU utilization as demand changes. Which dynamic scaling policy directly uses a metric target to adjust capacity?

   1. A. A target tracking scaling policy
   2. B. A step scaling policy with breach bands
   3. C. A simple scaling policy with a cooldown
   4. D. A scheduled scaling action at fixed times

   Answer: A

   Explanation: AWS states, "A target tracking scaling policy automatically scales the capacity of your Auto Scaling group based on a target metric value." The requested metric target calls for target tracking. The alternatives use breach adjustments or fixed times.

   Reference: Target tracking scaling policies for Amazon EC2 Auto Scaling — Target tracking scaling policies / opening

3. 3An EC2 Image Builder pipeline must produce an AMI from a chosen base image and install software during the build. Which pipeline component specifies the base image and build components?

   1. A. The AMI image recipe
   2. B. The distribution settings
   3. C. The infrastructure settings
   4. D. The output AMI launch template

   Answer: A

   Explanation: AWS directs operators to "Select an AMI image recipe that includes a base image" and says recipe components "Add and remove software" during the build. Thus the recipe defines both input image and software changes.

   Reference: Create and update AMI image pipelines — Create and update AMI image pipelines / recipe

4. 4An IAM identity policy allows an action, but a resource policy explicitly denies it. What is the effective result?

   1. A. The action is allowed by the identity policy.
   2. B. The action is denied by the resource policy.
   3. C. The action is allowed when both policies are attached.
   4. D. The action is allowed if the identity uses a role.

   Answer: B

   Explanation: "An explicit deny in either of these policies overrides the allow." The explicit deny wins over the identity policy's allow.

   Reference: Policy evaluation logic - AWS Identity and Access Management — Evaluating identity-based policies with resource-based policies

5. 5A subnet has no explicit route table association. Which route table controls its traffic?

   1. A. The VPC's main route table
   2. B. The first custom route table
   3. C. The internet gateway route table
   4. D. A route table chosen per packet

   Answer: A

   Explanation: "the subnet is implicitly associated with the main route table." The main route table supplies routing when no explicit association exists.

   Reference: Subnet route tables - Amazon Virtual Private Cloud — Subnet route tables / Subnet route table association

6. 6A CloudWatch agent configuration must receive custom application metrics through collectd. Which host operating system meets the documented collectd support condition?

   1. A. Linux only
   2. B. Windows Server only
   3. C. Linux or Windows Server
   4. D. Any operating system supported by StatsD

   Answer: A

   Explanation: The agent documentation states, "collectd is supported only on Linux servers." StatsD's broader support does not extend collectd to Windows Server.

   Reference: Collect metrics, logs, and traces using the CloudWatch agent — CloudWatch agent capabilities, StatsD and collectd

7. 7For an EC2 Auto Scaling target tracking policy, who creates and manages the CloudWatch alarms that trigger scaling when the metric deviates from the target?

   1. A. The operator creates and manages both alarms manually.
   2. B. Amazon EC2 Auto Scaling creates and manages the alarms.
   3. C. The Application Load Balancer manages the alarms.
   4. D. AWS CloudTrail creates and manages the alarms.

   Answer: B

   Explanation: AWS says, "Amazon EC2 Auto Scaling creates and manages the CloudWatch alarms that invoke scaling events when the metric deviates from the target." The target tracking service manages these alarms.

   Reference: Target tracking scaling policies for Amazon EC2 Auto Scaling — Target tracking scaling policies / opening

8. 8An EC2 Image Builder pipeline must deliver its output AMI to a second AWS Region and account. Which configuration should the operator define?

   1. A. Pipeline logging defaults
   2. B. Distribution settings
   3. C. Build instance key pair
   4. D. Image test timeout

   Answer: B

   Explanation: AWS says, "Define distribution settings to deliver your images to destination AWS Regions and accounts." This configuration controls AMI destinations.

   Reference: Create and update AMI image pipelines — Create and update AMI image pipelines / distribution

9. 9A user has an identity policy that allows an API action, while the user's permissions boundary does not allow it. What happens?

   1. A. The identity policy grants the action.
   2. B. The permissions boundary grants the action.
   3. C. The action is outside the user's effective permissions.
   4. D. The action is allowed if a policy simulator is used.

   Answer: C

   Explanation: "the resulting permissions are the intersection of the two categories." The action must be allowed within both categories, so the identity policy alone is insufficient.

   Reference: Policy evaluation logic - AWS Identity and Access Management — Evaluating identity-based policies with permissions boundaries

10. 10An operator adds a route for internet-bound IPv4 traffic through a VPC internet gateway. Which route destination and target pair expresses that route?

    1. A. Destination 0.0.0.0/0; target internet gateway
    2. B. Destination the VPC CIDR; target internet gateway
    3. C. Destination 0.0.0.0/0; target local
    4. D. Destination the subnet CIDR; target NAT gateway

    Answer: A

    Explanation: AWS specifies a default IPv4 route: "The destination for the route is 0.0.0.0/0" and "The target is the internet gateway that's attached to your VPC." The destination and target pair in A matches both parts.

    Reference: Subnet route tables - Amazon Virtual Private Cloud — Subnet route tables / Routes