WGU Cloud Deployment and Operations Exam Questions

A patch baseline in Patch Manager defines the patches that should and should not be installed on EC2 instances, specifying approval rules for security updates, other updates, and exclusions. This ensures controlled and compliant patching. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, 'A patch baseline specifies which patches are approved for installation and which are excluded, allowing customization of patch deployment (e.g., approving only critical security updates).' Options A, B, and D misrepresent the baseline's role, as it does not auto-install, assign IAM roles, or notify Config directly.

Comprehensive and Detailed Explanation From Exact Extract:

To make the EC2 instance accessible via a public DNS hostname like ec2-public-54.18.127.233.us-west-2.compute.amazonaws.com, the administrator must set the VPC attribute enableDnsHostnames to true. This enables the automatic assignment of public DNS hostnames to instances with public IP addresses in the VPC. The WGU Cloud Deployment and Operations Study Guide (Section 3.2, VPC Configuration) states, 'Setting enableDnsHostnames to true in the VPC configuration ensures that EC2 instances with public IPs receive a public DNS hostname (e.g., ec2-public-<ip>.<region>.compute.amazonaws.com), facilitating internet accessibility.' Resource tags, disabling DNS support, and resource-based names do not enable this functionality.</region></ip>

The weighted routing policy in Amazon Route 53 allows the company to distribute traffic with specific percentages, such as 75% to AWS and 25% to the on-premises infrastructure, by assigning weights to each resource record. This enables load balancing across hybrid environments. The WGU Cloud Deployment and Operations Study Guide (Section 3.1, Route 53 Routing Policies) states, 'Weighted routing policy assigns weights to resource record sets (e.g., 75 for AWS, 25 for on-premises), controlling the percentage of traffic directed to each endpoint.' Geolocation, failover, and simple policies do not support percentage-based traffic splitting.

To notify a response team when a high-security web server returns a 403 Forbidden error, two key steps are required. First, define a metric filter for Apache logs in CloudWatch to detect the 403 error code within the log data. This involves setting up a filter pattern to match '403' in the Apache access logs. Second, create an alarm for the metric filter and configure it to deliver alerts using Amazon SNS, which supports email or other notifications to the response team. The WGU Cloud Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs and Alarms) confirms that metric filters and SNS-integrated alarms are the standard approach for monitoring and alerting on log-based events. Options B and D are incorrect as they involve unnecessary or unsupported configurations (e.g., binding Lambda to Apache or using SQS for alarms).

If a patch baseline is not explicitly defined in Patch Manager, it is attached to the default patch group. This default group applies a preconfigured baseline with AWS-recommended patches, ensuring basic compliance for instances without custom baselines. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, 'If no custom patch baseline is defined, instances are associated with the default patch group, which uses AWS-provided baseline settings for automatic patch approval.' Options A, C, and D are not valid attachments for patch baselines.