Examkin

Question

Difficulty: MediumAWS Elastic Disaster Recovery

A company replicates its critical Amazon EC2 workloads from a primary Availability Zone to a secondary Availability Zone in the same AWS Region using AWS Elastic Disaster Recovery (AWS DRS). A SysOps Administrator is designing a disaster recovery (DR) drill. The administrator needs to configure the environment so that recovery EC2 instances are successfully provisioned with their designated instance IAM roles, and client traffic is automatically routed to the recovery instances if the primary Availability Zone experiences an outage. Which combination of actions must the SysOps Administrator take to meet these requirements? (Select TWO.)

  1. Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the IAM role specified in the AWS DRS launch settings.Answer
  2. Configure Amazon Route 53 with an active-passive failover routing policy, associating a health check with the primary record and pointing the secondary record to the recovery endpoint.Answer
  3. C
    Modify the trust relationship of the recovery instance IAM role to allow the sts:AssumeRole action for the AWS DRS replication service endpoint.
  4. D
    Configure Amazon Route 53 with an active-active failover routing policy and assign equal weights to both the primary and recovery record sets without health checks.
  5. E
    Create a CNAME record at the zone apex pointing to the AWS DRS staging area subnet's Elastic Network Interfaces (ENIs).

Answer

The correct actions are to grant the iam:PassRole permission to the administrator's IAM identity for the role specified in the launch settings, and to configure Amazon Route 53 with an active-passive failover routing policy that uses a health check on the primary record.
To achieve the desired disaster recovery setup, the administrator must ensure both IAM permissions and DNS routing are correctly configured. First, when launching recovery instances, the administrator's IAM identity needs the permission to pass the EC2 instance role to the EC2 service. Second, an active-passive failover routing policy in Route 53 ensures that traffic is automatically redirected to the recovery endpoint only after the primary health check fails.

Step-by-Step Solution

1
Determine the required permission for launching EC2 instances with associated IAM roles via AWS DRS.
Identify that iam:PassRole must be granted to the calling IAM identity.
When launching recovery instances, AWS DRS requires the calling user or role to have permission to associate the target IAM role with the EC2 instances.
2
Determine the correct routing configuration for automatic redirection during a disaster.
Identify that an active-passive failover routing policy with a health check is required.
Active-passive configuration keeps the secondary (recovery) endpoint idle until the primary endpoint's health check fails, preventing traffic from being sent to unlaunched or unready instances prematurely.

Key Concept

AWS Elastic Disaster Recovery (AWS DRS) launch configuration and Route 53 disaster recovery integration.
Rate this question

Topics

AWS Elastic Disaster Recovery

More questions from this topic