Question bank
AWS Certified CloudOps Engineer – Associate
43 AWS Certified CloudOps Engineer – Associate questions with the correct answer and a written explanation, organised across 6 exam domains.
- 43 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Cost and Performance Optimization
5 questions in this domain
- Question 1Single Choice
What is the typical data latency for AWS Cost Explorer when viewing current day costs?
- AUp to 1 hour
- BUp to 12 hours
- CUp to 24 hoursCorrect answer
- DNear real-time (under 5 minutes)
Why this is the answer
Cost Explorer data is collected and reported with a latency of up to 24 hours for the current day. Real-time billing data is available via CloudWatch billing metrics.
- Question 2Multiple Select
Which two of the following are valid AWS Budgets types? (Choose two.)
- ACost BudgetCorrect answer
- BReservation BudgetCorrect answer
- CSecurity Budget
- DPerformance Budget
Why this is the answer
AWS Budgets supports three types: Cost budgets (against total cost), Usage budgets (against resource usage), and Reservation budgets (for RI/Savings Plans utilization or coverage). Security and Performance are not budget types.
- Question 3Interactive
The following Python code is part of a Lambda function that runs periodically. What is the primary purpose of this code?
- AIt stops EC2 instances that are not tagged with 'AutoStop:No'.Correct answer
- BIt terminates EC2 instances that are older than 7 days.
- CIt creates a backup of EC2 instances.
- DIt restarts EC2 instances that have low CPU utilization.
Why this is the answer
The code filters EC2 instances by tag 'AutoStop:No' (inverted check) and then calls the stop_instances API. It is a simple stop operation for instances that are not excluded.
- Question 4Single Choice
Before AWS Budgets can filter costs by a cost allocation tag, where must the tag be activated?
- AAWS Config
- BBilling and Cost Management consoleCorrect answer
- CAWS Organizations console
- DAmazon EC2 console
Why this is the answer
Cost allocation tags must be activated in the Billing and Cost Management console. Simply tagging resources is not enough; activation is required for cost tracking tools like Budgets and Cost Explorer.
- Question 5Multiple Select
Which two statements are true about Compute Savings Plans? (Choose two.)
- AThey provide a capacity reservation for EC2 instances.
- BThey cover EC2, Fargate, and Lambda compute usage.Correct answer
- CThey are tied to a specific instance family and region.
- DThey require a commitment to a consistent hourly spend.Correct answer
Why this is the answer
Compute Savings Plans apply to EC2, Fargate, and Lambda usage and require a commitment in $/hour. They do not provide capacity reservations and are not tied to a specific family/region (they offer flexibility across families and regions).
Deployment, Provisioning, and Automation
8 questions in this domain
- Question 6Single Choice
What is the primary purpose of AWS CloudFormation?
- ADeploy applications as a PaaS
- BDeclaratively provision AWS resourcesCorrect answer
- CMonitor EC2 instance health
- DAutomate code building and testing
Why this is the answer
CloudFormation is a declarative infrastructure-as-code service to provision AWS resources in an orderly, repeatable manner.
- Question 7Multiple Select
Which two features are components of an AWS CloudFormation template?
- AResourcesCorrect answer
- BOutputs
- CParameters
- DAWSTemplateFormatVersionCorrect answer
Why this is the answer
Every CloudFormation template must include AWSTemplateFormatVersion and Resources. Outputs and Parameters are optional.
- Question 8Interactive
Based on the code snippet, what is the CloudFormation resource type?
- AAWS::EC2::SecurityGroup
- BAWS::EC2::InstanceCorrect answer
- CAWS::IAM::Role
- DAWS::S3::Bucket
Why this is the answer
The snippet defines an EC2 instance with specified properties like ImageId and InstanceType.
- Question 9Single Choice
What is the function of a change set in CloudFormation?
- AExecute stack updates immediately
- BPreview modifications before applying themCorrect answer
- CRoll back a failed stack update
- DDelete a stack and its resources
Why this is the answer
A change set provides a preview of the changes CloudFormation will make, allowing review before execution.
- Question 10Multiple Select
Which two deployment policies are supported by AWS Elastic Beanstalk?
- ARollingCorrect answer
- BBlue/GreenCorrect answer
- CAll at Once
- DCanary
Why this is the answer
Elastic Beanstalk supports Rolling, Immutable, Blue/Green, Rolling with Additional Batch, and All at Once.
- Question 11Interactive
What does this Elastic Beanstalk deployment policy achieve?
- AUpdates all instances at once with downtime
- BLaunches a new environment and swaps CNAMECorrect answer
- CReplaces instances one at a time
- DRoutes traffic gradually to new instances
Why this is the answer
The code configures a blue/green deployment which creates a new environment and swaps the URL.
- Question 12Single Choice
Which AWS service is used to orchestrate a CI/CD pipeline?
- AAWS CodeBuild
- BAWS CodePipelineCorrect answer
- CAWS CodeDeploy
- DAWS CodeCommit
Why this is the answer
CodePipeline orchestrates the CI/CD pipeline by connecting source, build, test, and deploy stages.
- Question 13Multiple Select
Which two actions are valid stages in an AWS CodePipeline?
- ASourceCorrect answer
- BBuildCorrect answer
- CTest
- DMonitor
Why this is the answer
Common stages in CodePipeline include Source, Build, Test, and Deploy. 'Monitor' is not a standard stage.
Monitoring, Logging, and Remediation
8 questions in this domain
- Question 14Single Choice
Which AWS service records API activity in an AWS account for auditing?
- AAmazon CloudWatch
- BAWS CloudTrailCorrect answer
- CAWS Config
- DAWS Systems Manager
Why this is the answer
AWS CloudTrail records API activity in your account, providing auditing and security analysis. CloudWatch monitors metrics, Config evaluates configurations, and Systems Manager manages operations.
- Question 15Multiple Select
Which two actions can a CloudWatch alarm trigger directly? (Choose two.)
- ASend a message to an SNS topicCorrect answer
- BInvoke a Lambda function directly
- CExecute an SSM Automation document
- DTrigger an Auto Scaling policyCorrect answer
Why this is the answer
CloudWatch alarms can directly trigger SNS notifications and Auto Scaling policies. Lambda invocation requires SNS as intermediary; SSM Automation is not a direct alarm action.
- Question 16Interactive
Examine the following CloudWatch alarm configuration snippet. What action will this alarm perform when it transitions to ALARM state?
- AIt sends a notification to an SNS topic.Correct answer
- BIt terminates the EC2 instance.
- CIt starts an SSM Automation document.
- DIt triggers a Lambda function.
Why this is the answer
The alarm configuration includes an AlarmActions array with an SNS topic ARN, meaning it sends a notification when the alarm is in ALARM state.
- Question 17Single Choice
Which component does AWS Config use to automatically fix non-compliant resources?
- ACloudWatch Alarm
- BSSM Automation documentCorrect answer
- CSNS Topic
- DLambda function directly
Why this is the answer
AWS Config automatic remediation uses SSM Automation documents (or Lambda) to fix non‑compliant resources. CloudWatch alarms detect metric breaches; SNS is for notifications.
- Question 18Multiple Select
Which three tools can a CloudOps engineer use to analyze performance bottlenecks? (Choose three.)
- ACloudWatch Logs InsightsCorrect answer
- BAWS X-RayCorrect answer
- CAWS CloudTrail
- DVPC Flow LogsCorrect answer
Why this is the answer
CloudWatch Logs Insights queries logs, X-Ray traces requests across services, and VPC Flow Logs analyze network performance. CloudTrail records API calls, not performance.
- Question 19Interactive
The following CloudWatch Logs Insights query processes application log data. What does it calculate?
- AAverage request latency
- B99th percentile request latencyCorrect answer
- CTotal number of requests
- DMaximum request size
Why this is the answer
The query uses `stats pct(@duration, 99)` which calculates the 99th percentile of the duration field, indicating the latency experienced by the slowest 1% of requests.
- Question 20Single Choice
What is the recommended approach to centralize CloudTrail logs from multiple AWS accounts?
- AUse S3 Cross-Region Replication
- BConfigure an organization trail with a central S3 bucketCorrect answer
- CSet up individual trails and manually copy logs
- DUse CloudWatch Logs subscription filters
Why this is the answer
An organization trail in AWS Organizations delivers CloudTrail logs from all accounts to a single S3 bucket. CRR duplicates objects, manual copying is inefficient, and subscriptions are for real‑time logs.
- Question 21Multiple Select
Which two features help meet long‑term log retention compliance requirements? (Choose two.)
- AS3 Lifecycle policiesCorrect answer
- BS3 Object LockCorrect answer
- CCloudWatch Logs export to S3
- DCloudTrail default retention
Why this is the answer
S3 Lifecycle policies transition logs to lower-cost storage and expire them after a set period. S3 Object Lock prevents deletion or overwrite during the retention window. Export is for moving data, not retention control; CloudTrail default retention is limited.
Networking and Content Delivery
8 questions in this domain
- Question 22Single Choice
What characteristic of a VPC CIDR block cannot be modified after creation?
- ASize
- BRangeCorrect answer
- CSubnet mask
- DIP version
Why this is the answer
The CIDR block range (e.g., 10.0.0.0/16) cannot be changed after VPC creation; only the range is immutable.
- Question 23Multiple Select
Which two statements correctly describe differences between security groups and network ACLs?
- ASecurity groups are statefulCorrect answer
- BNACLs are stateful
- CNACLs support deny rulesCorrect answer
- DSecurity groups support deny rules
Why this is the answer
Security groups are stateful and only allow rules; NACLs are stateless and support both allow and deny rules.
- Question 24Interactive
Review the NACL configuration. Why are inbound HTTP responses being dropped?
- AMissing outbound rule for ephemeral portsCorrect answer
- BInbound rule for HTTPS is missing
- CSecurity group blocks outbound traffic
- DNACL inbound rule priority is too low
Why this is the answer
NACLs are stateless; return traffic uses ephemeral ports, which must be explicitly allowed in outbound rules.
- Question 25Single Choice
Which Virtual Interface type is used to access S3 over Direct Connect without traversing the internet?
- APrivate VIF
- BPublic VIFCorrect answer
- CTransit VIF
- DBGP VIF
Why this is the answer
A public VIF provides access to AWS public services (S3, DynamoDB) over Direct Connect without internet.
- Question 26Multiple Select
Which two are benefits of using Amazon CloudFront for content delivery?
- AReduced latency for global usersCorrect answer
- BAutomatic encryption of data at rest
- CLower origin load through cachingCorrect answer
- DEliminates need for security groups
Why this is the answer
CloudFront caches content at edge locations, reducing latency and offloading origin infrastructure.
- Question 27Interactive
An e-commerce site needs to block traffic from Country X at the edge. Which CloudFront feature serves this purpose?
- AGeo-restrictionCorrect answer
- BWAF geo-match rule
- CSigned URLs
- DCustom error response
Why this is the answer
CloudFront geo-restriction blocks requests based on country codes at the edge without additional cost.
- Question 28Single Choice
What must be done for a private hosted zone to be resolvable from a VPC?
- AAssociate the zone with the VPCCorrect answer
- BEnable public DNS resolution
- CAttach an Internet Gateway
- DCreate a resolver rule
Why this is the answer
A private hosted zone must be explicitly associated with each VPC where it should be resolvable.
- Question 29Multiple Select
Which two fields are captured by VPC Flow Logs?
- ASource IP addressCorrect answer
- BSource MAC address
- CDestination portCorrect answer
- DApplication protocol header
Why this is the answer
Flow Logs capture srcaddr, dstaddr, srcport, dstport, protocol, and action (ACCEPT/REJECT).
Reliability and Business Continuity
7 questions in this domain
- Question 30Single Choice
Which AWS service automatically distributes incoming application traffic across multiple targets to improve fault tolerance?
- AAuto Scaling
- BElastic Load BalancingCorrect answer
- CAWS Global Accelerator
- DRoute 53
Why this is the answer
Elastic Load Balancing distributes traffic and performs health checks, improving fault tolerance.
- Question 31Multiple Select
Which of the following are characteristics of Amazon RDS Multi-AZ deployments? (Select two.)
- AThe standby can serve read traffic.
- BSynchronous replication to a standby in a different Availability Zone.Correct answer
- CAutomatic failover in the event of a failure.Correct answer
- DStandby is in a different region.
Why this is the answer
Multi-AZ provides synchronous replication and automatic failover; the standby does not serve reads and is in the same region.
- Question 32Interactive
Consider the Auto Scaling group configuration in the code block. When an EC2 instance fails its ELB health check, what action does the Auto Scaling group take?
- AThe instance is immediately terminated by ELB.
- BThe ASG will consider the instance unhealthy and replace it.Correct answer
- CThe instance remains running unless EC2 status check fails.
- DThe ELB automatically adds a new instance.
Why this is the answer
If the ASG has ELB health checks enabled, it will mark the instance unhealthy and launch a replacement.
- Question 33Single Choice
What is the primary purpose of enabling cross-zone load balancing on an Application Load Balancer?
- ATo distribute traffic across all registered targets in all enabled Availability ZonesCorrect answer
- BTo keep traffic within a single Availability Zone
- CTo enable sticky sessions
- DTo reduce latency by using the nearest zone
Why this is the answer
Cross-zone load balancing distributes traffic evenly across all targets in all enabled AZs.
- Question 34Multiple Select
Which of the following are valid scaling policy types for Auto Scaling groups? (Select two.)
- ATarget TrackingCorrect answer
- BScheduled Scaling
- CStep ScalingCorrect answer
- DSimple Scaling
Why this is the answer
Target Tracking and Step Scaling are dynamic scaling policies; Simple and Scheduled are also types but the question asks for two of the dynamic ones.
- Question 35Interactive
Review the AWS CLI command to create a snapshot. What will happen if you delete an older incremental snapshot?
- AAll subsequent snapshots become invalid.
- BOnly the unique blocks from that snapshot are removed; later snapshots remain intact.Correct answer
- CThe snapshot deletion is blocked if any later snapshot exists.
- DThe snapshot is deleted but the data is preserved in the next snapshot.
Why this is the answer
Incremental snapshots only remove unique blocks; later snapshots retain all blocks needed for restore.
- Question 36Single Choice
In Route 53 DNS failover, what primary factor determines how quickly clients are redirected to a healthy endpoint after a health check failure?
- AThe health check interval
- BThe DNS TTL valueCorrect answer
- CThe number of health checkers
- DThe failover routing policy type
Why this is the answer
DNS TTL determines how long resolvers cache the response, impacting failover propagation.
Security and Compliance
7 questions in this domain
- Question 37Single Choice
What is the principle of least privilege in AWS IAM?
- AGive every user full administrative access to all services.
- BGrant only the minimum permissions necessary for a task.Correct answer
- CGrant permissions based on the user's job title.
- DAllow all actions but deny specific risky actions.
Why this is the answer
Least privilege means granting only the minimum permissions needed to perform a function, reducing risk.
- Question 38Multiple Select
Which of the following are capabilities of IAM Access Analyzer? (Select two.)
- AIdentifies resources shared with external principalsCorrect answer
- BGenerates policy suggestions based on actual usageCorrect answer
- CAutomatically rotates IAM user access keys
- DBlocks all public access to S3 buckets
Why this is the answer
IAM Access Analyzer finds externally shared resources and can generate refined policies from CloudTrail logs.
- Question 39Interactive
Review the diagram showing encryption options for S3. Which option uses customer-provided keys?
- ASSE-S3
- BSSE-KMS
- CSSE-CCorrect answer
- DClient-Side Encryption
Why this is the answer
SSE-C requires the customer to provide the encryption key with each request; S3 does not store the key.
- Question 40Single Choice
What data sources does Amazon GuardDuty analyze for threat detection?
- AVPC Flow Logs, CloudTrail, and DNS logsCorrect answer
- BOnly CloudTrail management events
- COnly VPC Flow Logs
- DAWS Config configuration history
Why this is the answer
GuardDuty analyzes VPC Flow Logs, CloudTrail events, and DNS logs for malicious activity.
- Question 41Multiple Select
Which services can send findings to AWS Security Hub? (Select two.)
- AAmazon GuardDutyCorrect answer
- BAWS ConfigCorrect answer
- CAmazon Route 53
- DAWS CloudFormation
Why this is the answer
Security Hub ingests findings from GuardDuty and AWS Config, among other services.
- Question 42Interactive
Examine the comparison chart. Which feature is available in Secrets Manager but NOT in SSM Parameter Store?
- AAutomatic secret rotationCorrect answer
- BEncryption at rest using KMS
- CSecureString parameter type
- DIAM policy based access control
Why this is the answer
Secrets Manager natively supports automatic rotation; Parameter Store requires custom solutions.
- Question 43Single Choice
What is the effect of a Service Control Policy (SCP) on a member account?
- AIt grants additional permissions to the account.
- BIt restricts the maximum permissions for all principals in the account.Correct answer
- CIt automatically remediates non-compliant resources.
- DIt only applies to IAM users, not roles.
Why this is the answer
SCPs define the maximum permissions available to all principals in a member account; they cannot grant permissions.
Frequently asked questions
Everything about the AWS Certified CloudOps Engineer – Associate question bank and how to use it.