Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 1Question →

A SysOps Administrator is configuring automatic remediation for an AWS Config rule named `s3-bucket-ssl-requests-only` using the `AWS-PublishSNSNotification` Systems Manager (SSM) Automation document. The administrator has created a custom IAM role named `SSMRemediationRole` containing the necessary permissions to publish to the Amazon SNS topic. When the administrator attempts to associate this remediation action with the AWS Config rule in the AWS Management Console, the operation fails with an authorization error. Which of the following actions should the administrator perform to resolve this issue and ensure that the remediation executes successfully? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the `SSMRemediationRole` ARN.; Configure the trust policy of the `SSMRemediationRole` to allow the `ssm.amazonaws.com` service principal to assume the role.

Answer

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the SSMRemediationRole ARN, and configure the trust policy of the SSMRemediationRole to allow the ssm.amazonaws.com service principal to assume the role.
To successfully configure and run automatic remediation for an AWS Config rule using a Systems Manager (SSM) Automation document with a custom execution role, two key permissions are required. First, the administrator setting up the remediation in the console or via the API must have the `iam:PassRole` permission on their IAM identity, referencing the ARN of the execution role. This allows the administrator to pass the role to the service. Second, because Systems Manager is the service that assumes the role to run the remediation document, the trust policy of the execution role must trust the `ssm.amazonaws.com` service principal.

Step-by-Step Solution

1
Identify the identity attempting to configure the remediation action and verify its permissions.
The identity lacks the iam:PassRole permission on the target role, resulting in an authorization error during configuration.
When configuring AWS Config automatic remediation with an SSM Automation document, the user or role performing the configuration must be authorized to pass the execution role to the service.
2
Add the iam:PassRole permission to the administrator's IAM policy for the specific SSMRemediationRole ARN.
The authorization error is resolved, allowing the remediation action to be successfully associated with the AWS Config rule.
This grants the administrator the ability to delegate the execution role to the target service.
3
Configure the trust relationship policy of the SSMRemediationRole.
The trust policy allows ssm.amazonaws.com to assume the role.
When AWS Config triggers the remediation, AWS Systems Manager assumes the specified role to execute the automation document; therefore, the role must trust the Systems Manager service principal.

Key Concept

Configuring automatic remediation in AWS Config rules requires the configuring administrator to have iam:PassRole permissions for the execution role, and the execution role must trust the ssm.amazonaws.com service principal since Systems Manager executes the automation.
Question 2Question →

A SysOps administrator is configuring a blue/green deployment for a microservice hosted on Amazon ECS with AWS Fargate. The deployment pipeline uses AWS CodeDeploy. The administrator wants to route 10% of the production traffic to the new version of the microservice for a duration of 15 minutes before routing the remaining traffic. Additionally, if the new version displays elevated HTTP 5XX error rates during this test period, the deployment must automatically roll back. Which of the following configuration steps should the administrator perform to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Specify the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration in the CodeDeploy deployment group.; Create an Amazon CloudWatch alarm that monitors the HTTP 5XX metric of the replacement (green) target group, and add it as a rollback trigger in the CodeDeploy deployment group.

Answer

Specify the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration in the CodeDeploy deployment group, and create an Amazon CloudWatch alarm that monitors the HTTP 5XX metric of the replacement (green) target group and add it as a rollback trigger in the CodeDeploy deployment group.
To implement the required canary traffic shifting, the administrator must choose the predefined CodeDeploy deployment configuration for ECS that corresponds to shifting 10% of traffic for 15 minutes, which is CodeDeployDefault.ECSCanary10Percent15Minutes. To automate the rollback based on application errors, the administrator must configure a CloudWatch alarm targeting the green (replacement) target group's HTTP 5XX metrics and add that alarm as a rollback trigger to the CodeDeploy deployment group.

Step-by-Step Solution

1
Select the appropriate canary deployment configuration in AWS CodeDeploy.
CodeDeployDefault.ECSCanary10Percent15Minutes is selected, which matches the required traffic shifting behavior (10% traffic shifted to the new task set, followed by the remaining 90% after 15 minutes).
This configuration directly automates the 10% canary traffic allocation for the specified 15-minute duration without requiring manual DNS or routing adjustments.
2
Configure a monitoring alarm for rollback triggers.
An Amazon CloudWatch alarm is created to track the HTTP 5XX error rate metric specifically for the green (replacement) target group under the Application Load Balancer.
Monitoring the green target group ensures that issues affecting only the new version of the service are detected.
3
Link the alarm to the CodeDeploy deployment group.
The CloudWatch alarm is designated as a rollback trigger in the CodeDeploy deployment group configuration.
This linkage enables CodeDeploy to automatically abort the deployment and shift 100% of the traffic back to the original (blue) task set if the alarm enters the ALARM state during the deployment process.

Key Concept

AWS CodeDeploy deployment configurations and rollback triggers for Amazon ECS blue/green deployments.
Question 3Question →

A SysOps Administrator is configuring cross-account, cross-region replication for an Amazon S3 bucket. The source bucket is in Account A (us-east-1) and contains objects encrypted with an AWS KMS customer managed key. The destination bucket is in Account B (us-west-2). The administrator has enabled versioning on the source bucket, created the replication configuration in Account A, and specified a new replication IAM role in Account A. However, the replication is failing, and no objects are appearing in the destination bucket. Which two actions must the administrator take to successfully replicate the KMS-encrypted objects?

Select all that apply

Show answer & explanation

Answer: Enable bucket versioning on the destination bucket in Account B.; Modify the KMS key policy in Account B to grant the replication IAM role from Account A permissions to perform kms:GenerateDataKey and kms:Encrypt actions.

Answer

Enable bucket versioning on the destination bucket in Account B, and modify the KMS key policy in Account B to grant the replication IAM role from Account A permissions to perform kms:GenerateDataKey and kms:Encrypt actions.
Replicating KMS-encrypted objects across accounts requires S3 versioning to be enabled on both the source and destination buckets, as S3 replication requires versioning to track and sync objects. Additionally, the replication IAM role in Account A must have permissions to encrypt objects in the destination bucket using Account B's KMS key. This is accomplished by updating the KMS key policy in Account B to grant kms:GenerateDataKey and kms:Encrypt permissions to the replication role in Account A.

Step-by-Step Solution

1
Enable versioning on the destination bucket in Account B.
Meets the core prerequisite that both source and destination buckets in an S3 replication setup must have versioning enabled.
S3 replication relies on versioning metadata to track and sync object states, so replication will fail if the destination bucket lacks versioning.
2
Update the KMS key policy for the destination key in Account B.
Grants the replication IAM role (from Account A) permission to encrypt objects at the destination using Account B's KMS key.
Since the replication role resides in Account A, the cross-account KMS key policy in Account B must explicitly permit that role to call kms:Encrypt and kms:GenerateDataKey.

Key Concept

Amazon S3 Cross-Account Replication with KMS Encryption
Question 4Question →

A SysOps Administrator initiates an update on an AWS CloudFormation stack. During the update, a resource creation fails. CloudFormation attempts to roll back the stack to its previous stable state, but the rollback process fails, leaving the stack in the UPDATE_ROLLBACK_FAILED state. Which of the following is a common cause for this rollback failure?

Show answer & explanation

Answer: A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.

Answer

A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.
The correct answer is that a resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted. When resources are modified or deleted out-of-band, the stack suffers from drift. During a rollback, CloudFormation attempts to return the resources to their previous configuration. If a resource no longer exists or is in an unexpected state, the rollback operation will fail, placing the stack in the UPDATE_ROLLBACK_FAILED state.

Step-by-Step Solution

1
Analyze the stack status transitions.
The stack went from UPDATE_IN_PROGRESS to UPDATE_ROLLBACK_IN_PROGRESS and finally to UPDATE_ROLLBACK_FAILED.
Understanding the status flow helps pinpoint where the failure occurred.
2
Determine why CloudFormation would fail to revert a resource during a rollback.
If the resource state has drifted or if the resource was deleted manually outside of CloudFormation, CloudFormation's internal engine cannot reconcile the expected state.
Identifying the root cause of rollback failures is key to resolving stack update errors.

Key Concept

AWS CloudFormation Rollback Failures and Drift Management
Question 5Question →

A SysOps administrator is configuring an Amazon EC2 Auto Scaling group (ASG) to launch instances using a new launch template. The launch template specifies an IAM instance profile with an associated IAM role for the instances. When the ASG attempts to launch instances to meet the desired capacity, all launch attempts fail with the status message: "You are not authorized to perform this operation." The administrator verified that the administrator's IAM identity has the necessary permissions to create the ASG and the launch template. Which configuration change will resolve the launch failures?

Show answer & explanation

Answer: Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.

Answer

Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.
The correct answer is to attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role. AWS requires that any identity configuring an AWS service to act on its behalf must have permission to pass the associated role. Without this permission, the EC2 service cannot associate the IAM role with the newly launched instances, resulting in an authorization error.

Step-by-Step Solution

1
Analyze the error message 'You are not authorized to perform this operation' in the ASG activity history.
Determine that the failure is caused by an IAM authorization issue when attempting to launch instances with an associated IAM role.
The launch template includes an IAM instance profile, meaning the launching entity must have permission to pass this role to EC2.
2
Identify the required IAM action for passing roles to AWS services.
The iam:PassRole action is identified as the required permission on the calling identity's policy.
AWS enforces iam:PassRole to prevent users from escalating their privileges by passing roles with greater permissions than they have.
3
Add the iam:PassRole permission targeting the specific IAM role ARN to the administrator's IAM policy.
The ASG successfully passes the IAM role to EC2, allowing instances to launch without authorization errors.
This completes the required permission chain for the ASG to launch instances with the specified IAM role.

Key Concept

IAM PassRole requirement for EC2 Auto Scaling launches
Question 6Question →

A SysOps Administrator is using AWS CodeDeploy to deploy an update to an application running on a fleet of Amazon EC2 instances. The deployment must guarantee that at least 75%75\% of the instances are healthy and serving traffic at any given time during the deployment. If any instance fails the update, the deployment must automatically revert to the previous working version.

Which configuration will meet these requirements?

Show answer & explanation

Answer: Create a custom deployment configuration with the minimum healthy hosts set to 75%75\% using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Answer

Create a custom deployment configuration with the minimum healthy hosts set to 75%75\% using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.
Creating a custom deployment configuration with the minimum healthy hosts set to 75%75\% ensures that CodeDeploy updates at most 25%25\% of the instances at a time, keeping at least 75%75\% of the fleet healthy. Enabling the automatic rollback option on deployment failure in the deployment group ensures that CodeDeploy automatically reverts to the last known good version if any instance fails to deploy successfully.

Step-by-Step Solution

1
Determine the required minimum healthy host threshold and create a custom CodeDeploy deployment configuration.
A custom configuration is created specifying minimum healthy hosts as 75%75\% (percentage type).
Predefined configurations like HalfAtATime (50%50\%) or AllAtOnce (0%0\%) do not guarantee that at least 75%75\% of the fleet remains online.
2
Configure the rollback behavior on the CodeDeploy deployment group.
The deployment group is updated to automatically roll back when a deployment failure occurs.
This fulfills the requirement to automatically revert to the previous working version upon failure without manual intervention.
3
Execute the deployment specifying the newly created custom deployment configuration.
The deployment runs, updating at most 25%25\% of the instances at any time, and automatically rolls back if a failure is encountered.
This maintains the required application capacity and safety during the update process.

Key Concept

AWS CodeDeploy Deployment Configurations and Automatic Rollback Settings
Question 7Question →

A SysOps Administrator is configuring VPC Flow Logs to capture traffic from a critical production subnet and deliver the logs to an Amazon CloudWatch Logs log group. After creating the flow log, the administrator notices that the log group remains empty and no log streams are generated. The administrator verifies that the flow log status is active but no logs are being delivered.

Which of the following configuration issues are likely causing this problem? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The trust policy of the IAM role assigned to the flow log does not list the vpc-flow-logs.amazonaws.com service principal as a trusted entity.; The IAM policy attached to the flow log's IAM role does not grant the logs:CreateLogStream and logs:PutLogEvents permissions for the destination log group.

Answer

The correct answers are that the IAM role's trust policy must trust the vpc-flow-logs.amazonaws.com service principal, and the policy attached to the role must grant the logs:CreateLogStream and logs:PutLogEvents permissions.
To successfully publish VPC Flow Logs to CloudWatch Logs, the flow log service requires an IAM role. The trust policy of this IAM role must allow the vpc-flow-logs.amazonaws.com service principal to perform the sts:AssumeRole action. Additionally, the permissions policy attached to the role must grant logs:CreateLogStream and logs:PutLogEvents permissions for the target CloudWatch Logs log group. If either of these is missing, VPC Flow Logs will be unable to deliver logs even if the flow log status is active.

Step-by-Step Solution

1
Analyze the IAM role trust policy.
Ensure that the trust relationship allows the VPC Flow Logs service principal (vpc-flow-logs.amazonaws.com) to assume the role.
Without this trust relationship, AWS cannot assume the role to write logs to CloudWatch Logs.
2
Verify the IAM role permissions policy.
Confirm that the role has permissions to create log streams and put log events (logs:CreateLogStream, logs:PutLogEvents) in the target log group.
Even if the role is trusted, it must have the necessary access permissions to write the log data.

Key Concept

VPC Flow Logs requires an IAM role with a trust policy allowing the vpc-flow-logs.amazonaws.com service principal to assume the role, and an attached policy allowing logs:CreateLogStream and logs:PutLogEvents.
Estimated Time:2m 0s
Question 8Question →

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. The company wants to set up an active-passive failover configuration at the zone apex (example.com). If the ALB or the backend instances become unhealthy, Route 53 must automatically redirect traffic to a static maintenance website hosted in an Amazon S3 bucket in the us-west-2 Region. Which configuration will meet these requirements with the fastest failover response and the least configuration overhead?

Show answer & explanation

Answer: Create an Alias record at the zone apex using a Failover routing policy. Set the primary record to point to the ALB with Evaluate Target Health set to Yes. Set the secondary record to point to the S3 bucket website endpoint.

Answer

Create an Alias record at the zone apex using a Failover routing policy, pointing the primary record to the Application Load Balancer with Evaluate Target Health enabled, and pointing the secondary record to the Amazon S3 bucket website endpoint.
The correct option is the configuration that creates an Alias record at the zone apex using a Failover routing policy, points the primary record to the Application Load Balancer (ALB) with 'Evaluate Target Health' enabled, and points the secondary record to the Amazon S3 bucket website endpoint. This setup is standard, complies with zone apex limitations by using an Alias record instead of a CNAME, and provides rapid failover by having Route 53 directly evaluate the ALB target health without needing a separate health check or a delayed CloudWatch alarm.

Step-by-Step Solution

1
Select the zone apex record (example.com) and set the routing policy to Failover.
Allows creation of primary and secondary records for active-passive failover.
Failover routing is the standard policy for active-passive disaster recovery setups.
2
Configure the primary record as an Alias record pointing to the Application Load Balancer, and set 'Evaluate Target Health' to Yes.
Route 53 will automatically check the health of the ALB and its targets without requiring a manual Route 53 health check setup.
Alias records to ALBs can leverage 'Evaluate Target Health' to quickly detect ALB target group health changes.
3
Configure the secondary record as an Alias record pointing to the S3 bucket website endpoint.
Traffic will failover to the S3 static website when the ALB is determined to be unhealthy.
Provides a cost-effective and highly available passive backup endpoint.

Key Concept

Route 53 active-passive DNS failover using Alias records and target health evaluation.
Question 9Question →

A SysOps Administrator is using AWS CloudFormation to update a production application hosted on an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The administrator is updating the launch template inside the CloudFormation template. The deployment must maintain full capacity at all times during the update to prevent performance degradation. Additionally, if the new instances fail application health checks during deployment, the stack must automatically roll back to its previous state.

Which two configurations should the administrator implement to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the AutoScalingRollingUpdate policy's MinInstancesInService parameter to match the desired capacity of the Auto Scaling group.; Set up CloudFormation rollback triggers in the RollbackConfiguration parameter to monitor CloudWatch alarms associated with the Application Load Balancer target group's health.

Answer

Configure the AutoScalingRollingUpdate policy's MinInstancesInService parameter to match the desired capacity of the Auto Scaling group, and set up CloudFormation rollback triggers in the RollbackConfiguration parameter to monitor CloudWatch alarms associated with the Application Load Balancer target group's health.
To maintain full capacity during a rolling update, the AutoScalingRollingUpdate policy's MinInstancesInService parameter must equal the desired capacity. This forces CloudFormation to launch new instances before terminating old ones. To automate rollback based on health checks, CloudFormation rollback triggers (RollbackConfiguration) must monitor CloudWatch alarms. If the alarms are triggered due to unhealthy instances, CloudFormation automatically rolls back the stack.

Step-by-Step Solution

1
Configure the AutoScalingRollingUpdate policy on the Auto Scaling group in the CloudFormation template.
The MinInstancesInService parameter matches the desired capacity of the group.
This guarantees that CloudFormation launches new instances first before terminating any old instances, maintaining 100%100\% capacity during the update.
2
Create CloudWatch alarms that monitor the Application Load Balancer target group's health metrics.
A configured alarm transitions into the ALARM state if the new deployment fails application-level health checks.
CloudWatch alarms are required to detect operational failures during the deployment process.
3
Associate the CloudWatch alarms with the CloudFormation stack's RollbackConfiguration triggers.
Automated monitoring of the alarms during and for a specified time after the stack update.
If any alarm breaches, CloudFormation detects it via the rollback triggers and automatically rolls back the stack to the last stable state.

Key Concept

Using CloudFormation AutoScalingRollingUpdate policies to preserve capacity combined with RollbackConfiguration to automate rollback on health check failure.
Estimated Time:2m 0s
Question 10Question →

A SysOps Administrator is setting up an active-passive disaster recovery solution using Amazon Route 53 for a public web application. The primary infrastructure runs in the us-west-2 Region behind an Application Load Balancer (ALB), and the backup infrastructure runs in the us-east-1 Region behind another ALB. The administrator wants to route all user traffic to us-west-2 under normal conditions, and automatically redirect traffic to us-east-1 if the primary application becomes unavailable. Which combination of actions must the administrator perform to configure this failover mechanism? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Alias record pointing to the primary Application Load Balancer in us-west-2, select the Failover routing policy, set the Failover Record Type to Primary, and set Evaluate Target Health to Yes.; Create an Alias record pointing to the backup Application Load Balancer in us-east-1, select the Failover routing policy, set the Failover Record Type to Secondary, and set Evaluate Target Health to Yes.

Answer

The correct configuration requires creating a primary Failover Alias record pointing to the primary Application Load Balancer in us-west-2 with Evaluate Target Health set to Yes, and a secondary Failover Alias record pointing to the backup Application Load Balancer in us-east-1 with Evaluate Target Health set to Yes.
To configure an active-passive failover in Amazon Route 53 using Alias records pointing to Application Load Balancers, the administrator must create a primary record for the active endpoint and a secondary record for the standby endpoint. Setting the routing policy to Failover and configuring the Failover Record Type to Primary and Secondary respectively aligns with active-passive design. Enabling 'Evaluate Target Health' on both Alias records allows Route 53 to automatically evaluate the health of the load balancers based on the health of their registered targets, triggering the failover when the primary ALB's targets become unhealthy.

Step-by-Step Solution

1
Identify the routing policy and record type required for the primary endpoint.
A Failover routing policy with the Failover Record Type set to Primary pointing to the primary Application Load Balancer.
Active-passive disaster recovery setups in Route 53 require a Failover routing policy where the primary record represents the main active resource.
2
Determine how to monitor the health of the Application Load Balancer without extra cost or configuration.
Enable the 'Evaluate Target Health' setting on the Alias record.
When Evaluate Target Health is set to Yes, Route 53 inherits the health status of the Application Load Balancer from the backend EC2 targets registered with the ALB's target groups.
3
Configure the standby endpoint for failover.
A Failover routing policy with the Failover Record Type set to Secondary pointing to the backup ALB in the us-east-1 Region, with Evaluate Target Health set to Yes.
This ensures Route 53 will route DNS queries to the standby ALB when the primary ALB's health checks fail.

Key Concept

Active-passive Route 53 DNS failover configuration using Alias records and the Evaluate Target Health feature.
Question 11Question →

A company is designing a backup and disaster recovery strategy for a critical multi-tier application. The application stores transaction logs in an Amazon S3 bucket and uses an Amazon RDS for PostgreSQL DB instance. The backup policy requires all database backups to be replicated to a secondary AWS Region to enable point-in-time recovery (PITR) with a minimum recovery time. Additionally, the S3 transaction logs must be replicated to the secondary Region while retaining full version history. Which combination of actions should the SysOps Administrator take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable versioning on both the source S3 bucket and the destination S3 bucket, and configure S3 Cross-Region Replication (CRR).; Enable cross-Region automated backups replication for the Amazon RDS DB instance to replicate automated backups to the secondary Region.

Answer

To meet the requirements, the SysOps Administrator must enable versioning on both the source and destination S3 buckets and configure S3 Cross-Region Replication (CRR), and enable cross-Region automated backups replication for the Amazon RDS DB instance.
Enabling versioning on both the source and destination S3 buckets is a prerequisite for configuring Cross-Region Replication (CRR). Replicating RDS automated backups to a secondary Region provides the capability to restore the DB instance to any point in time within the backup retention window in the destination Region.

Step-by-Step Solution

1
Enable versioning on both S3 buckets.
Both source and destination S3 buckets are versioning-enabled.
S3 Cross-Region Replication (CRR) requires versioning to be enabled on both the source and destination buckets to function properly.
2
Configure Cross-Region Replication.
S3 objects and version history are automatically copied to the secondary Region.
This configuration satisfies the S3 replication requirements while maintaining version history.
3
Configure Amazon RDS cross-Region automated backup replication.
RDS automated backups are replicated to the secondary Region.
This allows the administrator to perform point-in-time recovery (PITR) in the secondary Region directly from the replicated automated backups.

Key Concept

Configuring S3 Cross-Region Replication with versioning and RDS cross-Region automated backup replication for disaster recovery.
Question 12Question →

An organization wants to establish an automated response system when an Amazon EC2 instance's CPU utilization exceeds 95%95\% for more than 15 minutes, which indicates a runaway process. A SysOps administrator configures an Amazon EventBridge rule triggered by the corresponding Amazon CloudWatch alarm state change to `ALARM`. The remediation strategy is to trigger a custom AWS Systems Manager Automation runbook named `ResolveRunawayProcess` that will restart the problematic service on the instance. The runbook requires a service role (`SSMAutomationServiceRole`) to execute its steps. Which configuration and permission setup will successfully execute the remediation with the least privilege?

Show answer & explanation

Answer: Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission for the document and the iam:PassRole permission for the SSMAutomationServiceRole resource.

Answer

Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission for the document and the iam:PassRole permission for the SSMAutomationServiceRole resource.
The correct configuration establishes a path where EventBridge acts as the caller. It invokes the Systems Manager Automation target (`ResolveRunawayProcess` document) and passes the execution role (`SSMAutomationServiceRole`) to Systems Manager using `iam:PassRole` permissions. Without `iam:PassRole`, Systems Manager cannot execute the Automation runbook steps under the specified service role context.

Step-by-Step Solution

1
Identify the target orchestration service for the remediation.
The target must be Systems Manager Automation since the action requires executing a custom SSM Automation runbook.
Systems Manager Automation is the correct service for executing workflows/runbooks, unlike Run Command which executes scripts directly on managed instances.
2
Determine the necessary IAM permissions for EventBridge to invoke Systems Manager Automation.
The EventBridge execution role needs the ssm:StartAutomationExecution permission for the ResolveRunawayProcess document.
EventBridge must have explicit permission to trigger the execution of the target SSM document.
3
Configure the role-passing capability for the target execution.
Grant the EventBridge execution role iam:PassRole permission targeting the SSMAutomationServiceRole.
Since the Automation workflow executes steps using the SSMAutomationServiceRole, the calling service (EventBridge) must have permission to pass this execution role to Systems Manager.

Key Concept

EventBridge and Systems Manager Automation Remediation IAM Permissions
Question 13Question →

A company hosts a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the eu-central-1 (Frankfurt) region. The company wants to implement an active-passive disaster recovery strategy using Amazon Route 53. If the application's response latency exceeds 5 seconds, traffic must fail over to a static maintenance page hosted on an Amazon S3 bucket configured for website hosting in the eu-west-1 (Ireland) region. The latency metric is monitored via a custom CloudWatch metric. Which two configuration steps must the SysOps Administrator perform to set up this Route 53 DNS failover configuration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create the CloudWatch alarm for the latency metric in the us-east-1 (N. Virginia) Region, and associate the Route 53 health check with this alarm.; Create a primary Route 53 Failover record pointing to the ALB with the custom health check associated, and a secondary Route 53 Failover record pointing to the S3 bucket website endpoint.

Answer

Creating the CloudWatch alarm for the latency metric in the us-east-1 Region to link with the Route 53 health check, and creating a primary Route 53 Failover record pointing to the ALB alongside a secondary Route 53 Failover record pointing to the S3 website endpoint.
To set up Route 53 active-passive failover based on custom metrics like latency, the SysOps Administrator must use a CloudWatch alarm. Route 53 can only integrate with CloudWatch alarms residing in the us-east-1 region, meaning the alarm must be created there even if the metric data originates elsewhere. Additionally, the DNS configuration requires defining a primary Failover record associated with the health check and a secondary Failover record pointing to the passive destination (the S3 bucket website hosting endpoint).

Step-by-Step Solution

1
Configure metric publishing to the us-east-1 region, or configure a cross-region CloudWatch alarm in us-east-1 that evaluates the custom metric data coming from the eu-central-1 region.
A CloudWatch alarm monitoring the response latency is created in the us-east-1 Region.
Amazon Route 53 health checks are global and only integrate with CloudWatch alarms created in the us-east-1 region.
2
Create a Route 53 health check that monitors the state of the newly created CloudWatch alarm in us-east-1.
A Route 53 health check is established that reports unhealthy status when the CloudWatch alarm transitions to the ALARM state.
This links the application-layer latency metric directly to the DNS failover logic.
3
Create a primary routing record (e.g., an Alias A record for the zone apex or a standard CNAME) pointing to the ALB in eu-central-1, configure it with the Failover routing policy, and associate it with the created Route 53 health check.
The primary record will route traffic to the ALB as long as the health check reports healthy.
Associating the health check ensures that Route 53 will detect latency spikes and stop resolving queries to the primary ALB.
4
Create a secondary routing record with the same name, configure it with the Failover routing policy, and point it to the S3 bucket website endpoint in eu-west-1.
The secondary record will serve traffic to the maintenance page when the primary endpoint is unhealthy.
Completes the active-passive failover configuration.

Key Concept

Amazon Route 53 DNS Active-Passive Failover with CloudWatch Alarms
Estimated Time:2m 30s
Question 14Question →

A SysOps administrator is configuring automated remediation to isolate Amazon EC2 instances when Amazon GuardDuty detects command-and-control (C&C) activity. The administrator wants to use Amazon EventBridge to detect the GuardDuty finding and trigger the AWS Systems Manager Automation document AWS-StopEC2Instance to stop the affected instance. Which combination of target configuration and IAM permissions will successfully implement this automated remediation?

Show answer & explanation

Answer: Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.

Answer

Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.
The correct option correctly configures the EventBridge rule target to the Systems Manager Automation document, and grants EventBridge the necessary IAM permissions. Specifically, it allows EventBridge to assume a role to call ssm:StartAutomationExecution on the target document and includes the iam:PassRole permission so that EventBridge can pass the Systems Manager Automation execution role to the Systems Manager service, which executes the actions.

Step-by-Step Solution

1
Configure the Amazon EventBridge rule pattern to match Amazon GuardDuty findings representing command-and-control activity.
GuardDuty finding events will match the rule pattern and trigger the designated targets.
This establishes the detection trigger in the event flow.
2
Set the EventBridge rule target to the AWS Systems Manager Automation document AWS-StopEC2Instance, specifying the EC2 instance ID from the event as a parameter.
The target document is selected and mapped to the affected resource.
This establishes the remediation action in the event flow.
3
Create an IAM role for EventBridge with a trust policy allowing events.amazonaws.com and a permissions policy allowing ssm:StartAutomationExecution and iam:PassRole for the execution role.
EventBridge receives permissions to execute the automation and pass the necessary service role to Systems Manager.
EventBridge requires these permissions to initiate the automation run under the context of the automation execution role.

Key Concept

Configuring event-driven automated remediation using Amazon EventBridge and AWS Systems Manager Automation requires setting up an IAM service role for EventBridge with both the ssm:StartAutomationExecution permission and the iam:PassRole permission to securely pass the execution role to Systems Manager.
Estimated Time:3m 0s
Question 15Question →

An organization configures Amazon CloudWatch Logs subscription filters to stream log events to an Amazon Kinesis Data Firehose delivery stream. The delivery stream writes the log data to a destination Amazon S3 bucket. Both the delivery stream and the destination S3 bucket are encrypted using a Customer Managed Key (CMK) managed by AWS Key Management Service (AWS KMS). The SysOps Administrator observes that the S3 bucket is empty and log delivery has failed. Which of the following troubleshooting steps should the administrator perform to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the IAM policy attached to the CloudWatch Logs role to allow the firehose:PutRecord action on the delivery stream and the kms:GenerateDataKey action on the KMS key used by Kinesis Data Firehose.; Configure the KMS key policy of the S3 bucket's encryption key to grant the Kinesis Data Firehose delivery role permissions to perform the kms:GenerateDataKey and kms:Encrypt actions.

Answer

Configure the IAM policy attached to the CloudWatch Logs role to allow the firehose:PutRecord action on the delivery stream and the kms:GenerateDataKey action on the KMS key used by Kinesis Data Firehose, and configure the KMS key policy of the S3 bucket's encryption key to grant the Kinesis Data Firehose delivery role permissions to perform the kms:GenerateDataKey and kms:Encrypt actions.
The correct troubleshooting actions involve ensuring that CloudWatch Logs has permissions to write to the encrypted Kinesis Data Firehose stream (which requires both the firehose:PutRecord action and the kms:GenerateDataKey action on the stream's encryption key), and ensuring that the Firehose delivery role has permissions to write to the encrypted S3 bucket (which requires the kms:GenerateDataKey and kms:Encrypt actions on the bucket's KMS key policy).

Step-by-Step Solution

1
Verify CloudWatch Logs permissions to write to Kinesis Data Firehose.
Ensure the CloudWatch Logs subscription role includes firehose:PutRecord permissions.
CloudWatch Logs needs direct write permissions to deliver log records into the Kinesis Data Firehose stream.
2
Analyze KMS permissions for Kinesis Data Firehose ingestion.
Ensure the CloudWatch Logs role is granted kms:GenerateDataKey on the Customer Managed Key (CMK) encrypting Kinesis Data Firehose.
Since the stream is encrypted, writing to it requires generating data keys using the stream's KMS key.
3
Analyze KMS permissions for Kinesis Data Firehose S3 delivery.
Update the S3 bucket's KMS key policy to permit the Kinesis Data Firehose delivery role to perform kms:GenerateDataKey and kms:Encrypt.
Firehose must be able to generate encryption keys and encrypt data objects before uploading them to the encrypted S3 bucket.

Key Concept

Troubleshooting CloudWatch Logs subscription filter delivery issues involving AWS KMS key policies and IAM service permissions.
Question 16Question →

A SysOps Administrator is configuring a blue/green deployment strategy for a containerized application running on Amazon Elastic Container Service (Amazon ECS) behind an Application Load Balancer (ALB). The updates must be deployed using AWS CodeDeploy. The administrator needs to ensure that the deployment automatically rolls back if the new tasks fail to launch or fail target group health checks, or if application performance degradation (such as elevated error rates) occurs during traffic shifting. Which two configuration steps must the administrator perform to meet these requirements? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Update the ECS service definition to set the deployment controller type to CodeDeploy, and associate the deployment group with two target groups: one for the active traffic environment and one for the standby environment.; Create Amazon CloudWatch alarms that monitor application metrics, and add these alarms to the CodeDeploy deployment group's automatic rollback configuration.

Answer

To configure the blue/green deployment for Amazon ECS using AWS CodeDeploy with automatic rollback capabilities, the administrator must configure the ECS service deployment controller type to CodeDeploy, associate the deployment group with blue and green target groups, and configure Amazon CloudWatch alarms to trigger automatic rollbacks in the CodeDeploy deployment group.
The correct options specify configuring the ECS service to use the CodeDeploy deployment controller with two target groups (blue and green) to enable the blue/green deployment pattern, and configuring CloudWatch alarms in the CodeDeploy deployment group's automatic rollback settings to monitor metrics during deployment and trigger a rollback if needed.

Step-by-Step Solution

1
Configure the deployment controller on the ECS service definition.
The ECS service is set to use the CodeDeploy deployment controller type instead of the default ECS rolling update controller.
This allows AWS CodeDeploy to manage the tasks, traffic shifting, and lifecycle hooks of the deployment.
2
Associate two target groups with the CodeDeploy deployment group.
CodeDeploy can direct traffic between the active target group (blue) and the target group running the new task version (green).
Two target groups are required in a blue/green deployment configuration to allow isolated testing and seamless traffic shifting.
3
Add CloudWatch alarms to the CodeDeploy rollback configuration.
If the metrics (like 5XX errors or response times) exceed limits, CodeDeploy detects the alarm and automatically reverts the traffic back to the original target group.
This meets the requirement to automatically roll back the deployment upon detecting application performance degradation.

Key Concept

AWS CodeDeploy manages ECS blue/green deployments by shifting traffic between two target groups and can automate rollbacks using native CloudWatch alarm integration.
Question 17Question →

A SysOps administrator is configuring an automated remediation workflow to enable Amazon S3 Block Public Access on any S3 bucket when a PutBucketPolicy API call is detected. The administrator creates an Amazon EventBridge rule that filters CloudTrail API events for PutBucketPolicy and targets the AWS Systems Manager Automation document AWS-ConfigureS3BucketPublicAccessBlock. The Automation document requires an execution role (AutomationAssumeRole) to perform the configuration changes. However, the execution fails to start when a policy changes.

Which of the following configuration steps must the SysOps administrator perform to successfully implement this automated remediation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document.; Grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.

Answer

Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document, and grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.
To successfully execute automated remediation using Amazon EventBridge and AWS Systems Manager Automation, two authorization steps are necessary: first, the EventBridge rule must assume a role that permits starting the automation execution (ssm:StartAutomationExecution). Second, because Systems Manager must assume an execution role to perform the S3 bucket configuration change, the EventBridge role must be permitted to pass this execution role (iam:PassRole) to Systems Manager.

Step-by-Step Solution

1
Ensure EventBridge is authorized to trigger the Systems Manager execution.
EventBridge target is associated with an IAM service role containing the ssm:StartAutomationExecution action for the AWS-ConfigureS3BucketPublicAccessBlock document.
By default, EventBridge does not have permissions to execute Systems Manager Automation documents unless explicitly granted via a service role.
2
Ensure the Systems Manager Automation execution role can be passed to the Systems Manager service.
The EventBridge target execution role has iam:PassRole permissions targeting the SSM Automation execution role (AutomationAssumeRole).
When a target service executes using a specified role, the calling service (EventBridge) must have permission to pass that role to the target service.

Key Concept

Configuring correct IAM permissions and service integration targets for event-driven Systems Manager Automation via Amazon EventBridge.
Question 18Question →

A company is designing a backup, restore, and high availability strategy for a critical transactional database running on Amazon RDS. The SysOps Administrator must satisfy the following requirements:
1. Automated daily backups must be replicated to a destination bucket in a secondary AWS Region.
2. In the event of an Availability Zone outage, the database must automatically failover to a standby instance in another Availability Zone within 2 minutes without requiring changes to application connection strings.
3. The replicated backups must be encrypted with a Customer Managed Key (CMK) in the destination Region, and access to decrypt these backups must be managed using IAM policies.

Which configuration must the SysOps Administrator implement to satisfy these requirements?

Show answer & explanation

Answer: Configure the primary database to use Multi-AZ deployment. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.

Answer

Configure the primary database to use Multi-AZ deployment, enable S3 versioning on both the source and destination buckets for CRR, and modify the destination KMS key policy to allow the root principal to delegate key permissions via IAM.
The correct configuration combines Multi-AZ deployment to achieve automated, synchronous failover within 2 minutes without altering connection strings, enables S3 versioning on both buckets to allow S3 Cross-Region Replication (CRR) of the database backups, and configures the destination KMS key policy to permit the root principal to delegate key operations, enabling IAM policies to successfully control decryption access.

Step-by-Step Solution

1
Select Multi-AZ deployment for Amazon RDS
Synchronous database replication is established across Availability Zones, enabling automatic DNS failover in under 2 minutes without endpoint changes.
Meets the high availability RTO requirement without requiring application configuration changes.
2
Enable S3 versioning on the source and destination buckets and configure S3 CRR
Automated backups uploaded to the source S3 bucket are successfully replicated to the secondary Region destination S3 bucket.
S3 Cross-Region Replication has a hard prerequisite that versioning must be enabled on both source and destination buckets.
3
Modify the Customer Managed Key (CMK) policy in the destination Region to enable IAM policy delegation
The KMS key policy includes the default statement allowing the root principal (`arn:aws:iam::ACCOUNT_ID:root`) to perform key actions, which delegates policy control to IAM.
Without this statement in the KMS key policy, IAM policies cannot grant permissions to access or decrypt using the KMS key due to KMS policy evaluation precedence.

Key Concept

Integrating high availability, backup replication prerequisites, and KMS key policy delegation
Question 19Question →

A SysOps administrator needs to configure active-passive DNS failover for a public-facing API. The primary endpoint is hosted in an on-premises datacenter, and the secondary disaster recovery endpoint is hosted on an Amazon EC2 instance in AWS. If the on-premises endpoint becomes unreachable, Route 53 must automatically redirect traffic to the EC2 instance. How should the administrator configure Amazon Route 53 to meet these requirements?

Show answer & explanation

Answer: Configure a Route 53 health check for the on-premises endpoint. Create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check. Create a secondary record with a Failover routing policy pointing to the EC2 instance IP address.

Answer

Configure a Route 53 health check for the on-premises endpoint. Create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check. Create a secondary record with a Failover routing policy pointing to the EC2 instance IP address.
The correct configuration is to configure a Route 53 health check for the on-premises endpoint, then create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check, and finally create a secondary record with a Failover routing policy pointing to the EC2 instance IP address. This properly defines an active-passive failover configuration where DNS queries resolve to the primary endpoint until the associated health check fails, at which point Route 53 begins responding with the secondary endpoint IP address.

Step-by-Step Solution

1
Create a Route 53 health check that monitors the IP address or domain name of the primary on-premises API endpoint.
Amazon Route 53 will begin actively probing the on-premises endpoint to determine its health status.
Route 53 requires a health check to monitor the primary record's health state before it can execute an automated failover.
2
Create the primary DNS record in the hosted zone using the Failover routing policy, point it to the on-premises IP, and associate it with the created health check.
A primary failover record is established with an active monitor.
This establishes the default path for client traffic under normal operating conditions.
3
Create the secondary DNS record with the same record name, select the Failover routing policy, configure it as the secondary record, and point it to the EC2 instance's public IP address.
A secondary failover record is created.
This provides a backup destination for DNS queries when Route 53 detects that the primary endpoint is unhealthy.

Key Concept

Route 53 active-passive DNS failover requires a primary record with a health check and a secondary record, both configured with the Failover routing policy.
Question 20Question →

A SysOps administrator is launching a new Amazon EC2 instance that must run an application that accesses an Amazon S3 bucket. An IAM role with the necessary S3 permissions has already been created. The administrator needs to configure the EC2 instance to run the application using this role.

Which two actions are required to successfully complete this configuration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate the IAM role with an instance profile, and attach the instance profile to the EC2 instance.; Ensure the administrator's IAM user identity is granted the iam:PassRole permission for the specific IAM role.

Answer

The correct actions are associating the IAM role with an instance profile to attach it to the EC2 instance, and ensuring the administrator's IAM user identity has the iam:PassRole permission.
To configure an EC2 instance to run an application with specific IAM permissions, you must wrap the IAM role inside an instance profile and attach it to the EC2 instance. Furthermore, the administrator who performs this attachment must possess the iam:PassRole permission to authorize passing the role to the EC2 service.

Step-by-Step Solution

1
Determine how roles are attached to EC2 instances.
EC2 instances require an instance profile wrapper to hold the IAM role.
The EC2 service uses instance profiles to pass role credentials to the instance's metadata service.
2
Determine the required user permissions for delegating the role.
The user launching or configuring the instance must have the iam:PassRole permission.
To prevent unauthorized delegation of administrative privileges, AWS requires that users have explicit permission to pass roles to services.

Key Concept

Delegating AWS permissions to EC2 instances using Instance Profiles and the iam:PassRole permission
Page 1 / 49Next