All practice questions

976 questions

Question 241Question

A SysOps Administrator needs to verify whether a specific Amazon S3 bucket within a large AWS CloudFormation stack has undergone any manual configuration changes. To minimize execution time and resource overhead, the administrator wants to check only this specific resource rather than the entire stack. Which action should the administrator take to accomplish this?

Show answer & explanation

Answer: Run drift detection specifically for the Amazon S3 bucket resource within the CloudFormation console or using the AWS CLI.

Answer

Run drift detection specifically for the Amazon S3 bucket resource within the CloudFormation console or using the AWS CLI.
The correct option is to run drift detection specifically for the S3 bucket resource. AWS CloudFormation supports detecting drift on specific resources rather than the entire stack. This can be done via the CloudFormation console under the stack's resources tab, or by executing the 'aws cloudformation detect-stack-resource-drift' CLI command. This targeted check reduces execution time and focuses solely on the resource of interest.

Step-by-Step Solution

1
Identify the target resource (the Amazon S3 bucket) and its physical ID within the AWS CloudFormation stack.
The target resource is isolated for drift checking.
This avoids scanning all other resources in the stack, reducing overhead.
2
Initiate drift detection for the specific resource using the console or the CLI command 'aws cloudformation detect-stack-resource-drift'.
CloudFormation compares the current configuration of the S3 bucket with its expected template configuration.
This provides a targeted drift status (e.g., IN_SYNC or MODIFIED) for only the selected resource.

Key Concept

CloudFormation Individual Resource Drift Detection
Estimated Time:45s
Question 242Question

A company's security policy requires that all network communication from a database subnet be captured for audit purposes. A SysOps Administrator configures VPC Flow Logs at the subnet level to capture all traffic. During an audit, the compliance officer notices that queries sent from the database EC2 instances to the default Amazon Route 53 Resolver (at the VPC DNS server IP address) are not appearing in the flow logs. Which action should the SysOps Administrator take to log these DNS queries?

Show answer & explanation

Answer: Configure Amazon Route 53 Resolver query logging for the VPC and specify a destination such as a CloudWatch Logs log group.

Answer

Configure Amazon Route 53 Resolver query logging for the VPC and specify a destination such as a CloudWatch Logs log group.
VPC Flow Logs have built-in exclusions and do not capture traffic sent to the default Amazon DNS server (Route 53 Resolver). To capture and audit these DNS queries, Amazon Route 53 Resolver query logging must be configured for the target VPC.

Step-by-Step Solution

1
Identify the limitation of VPC Flow Logs regarding DNS queries.
Determine that VPC Flow Logs do not capture traffic generated by instances when they contact the default Amazon DNS server (Route 53 Resolver).
Understanding the built-in exclusions of VPC Flow Logs prevents troubleshooting efforts focused on modifying existing flow log settings.
2
Select the appropriate native AWS tool for capturing DNS query logs.
Identify Route 53 Resolver query logging as the feature designed to log DNS queries made by resources within a VPC.
This service logs queries, responses, and metadata for DNS requests generated inside the VPC.
3
Configure the query logging destination.
Set up Route 53 Resolver query logging to deliver logs to a supported target, such as a CloudWatch Logs log group, an S3 bucket, or a Kinesis Data Firehose stream.
Specifying the destination ensures that compliance officers can access and audit the logged queries.

Key Concept

VPC Flow Logs exclude traffic sent to the Amazon Route 53 Resolver (VPC DNS server). To capture these logs, Route 53 Resolver query logging must be enabled.
Estimated Time:1m 30s
Question 243Question

To enforce a security policy, an operations team uses a conformance pack containing the vpc-flow-logs-enabled AWS Config rule. A SysOps Administrator is responsible for setting up automated remediation. The administrator creates an IAM role named ConfigRemediationRole with a trust policy for ssm.amazonaws.com and attaches a permissions policy to enable flow logs. When configuring the automatic remediation action in AWS Config with the AWS-EnableVPCFlowLogs Systems Manager Automation document, the administrator receives an 'Access Denied' error upon saving the configuration. Which action should the administrator take to successfully save the remediation configuration?

Show answer & explanation

Answer: Add a policy to the administrator's IAM user or role that permits the iam:PassRole action on the ConfigRemediationRole resource.

Answer

Add a policy to the administrator's IAM user or role that permits the iam:PassRole action on the ConfigRemediationRole resource.
The correct answer is correct because AWS Config requires the user configuring automated remediation to have the `iam:PassRole` permission for the role passed to Systems Manager Automation. This permission must be attached to the IAM identity of the administrator who is saving the configuration.

Step-by-Step Solution

1
Analyze the error context.
The 'Access Denied' error occurs when saving the remediation configuration in AWS Config, indicating that the administrator's IAM identity lacks the necessary permissions to associate the execution role with the Config remediation rule.
AWS Config needs to pass the ConfigRemediationRole to Systems Manager to execute the remediation document.
2
Determine the required IAM permission.
The identity configuring the remediation must be authorized to pass the remediation role. This requires the iam:PassRole permission.
The iam:PassRole permission is a security control that prevents users from passing roles with higher privileges than their own to AWS services.
3
Apply the permission to the administrator's policy.
Adding the iam:PassRole action targeting the ConfigRemediationRole ARN to the administrator's IAM policy successfully resolves the Access Denied error and allows the configuration to save.
This grants the administrator permission to associate the specific role with the remediation configuration.

Key Concept

AWS Config Remediation IAM Permissions
Estimated Time:2m 30s
Question 244Question

An organization is transitioning an internal business API from an on-premises datacenter to AWS. During the migration phase, they want to establish an active-passive failover DNS strategy using Amazon Route 53 at the zone apex. The primary gateway is hosted on-premises and is accessible via a static public IP address. The secondary disaster recovery gateway is hosted behind an Application Load Balancer (ALB) in AWS. If the on-premises endpoint becomes unavailable, traffic must automatically route to the AWS ALB.

Which two DNS record configurations should a SysOps administrator implement to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create a Route 53 health check that monitors the on-premises public IP address, and associate this health check with a primary Failover A record pointing to the on-premises IP.; Create a secondary Failover Alias A record pointing to the Application Load Balancer, and configure Evaluate Target Health to Yes.

Answer

Create a Route 53 health check to monitor the on-premises public IP and associate it with a primary Failover A record, and create a secondary Failover Alias A record pointing to the Application Load Balancer with Evaluate Target Health set to Yes.
To set up active-passive failover at the zone apex, the primary record must be a standard A record (since CNAMEs are not allowed at the zone apex) with a Failover routing policy and an associated health check to monitor the on-premises endpoint. The secondary record should be an Alias A record pointing to the Application Load Balancer, configured with a Failover routing policy and 'Evaluate Target Health' enabled so that Route 53 automatically tracks the health of the backend targets behind the ALB.

Step-by-Step Solution

1
Configure a Route 53 health check for the on-premises public IP address.
A health check is established that regularly pings the on-premises gateway to determine its availability.
Route 53 cannot natively check the health of non-AWS endpoints without an explicit Route 53 health check.
2
Configure the primary DNS record at the zone apex pointing to the on-premises gateway.
An A record is created at the zone apex with a Failover routing policy, marked as Primary, and associated with the health check created in Step 1.
Zone apex records cannot be CNAMEs due to DNS standards, so a standard A record with failover configuration is used.
3
Configure the secondary DNS record pointing to the AWS Application Load Balancer.
An Alias A record is created at the zone apex with a Failover routing policy, marked as Secondary, with Evaluate Target Health set to Yes.
Setting Evaluate Target Health to Yes allows Route 53 to use the health checks of the ALB's target group, eliminating the need to create a separate Route 53 health check for the secondary endpoint.

Key Concept

Route 53 active-passive DNS failover configuration for hybrid environments
Estimated Time:2m 0s
Question 245Question

A SysOps administrator needs to share an AWS Service Catalog portfolio with another AWS account. The administrator also wants to ensure that when users in the target account launch the products, the resources are created using a designated IAM role, regardless of the users' individual permissions. Which actions must the administrator take to configure this setup? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Share the portfolio with the target AWS account or organization unit.; Associate a launch constraint with the portfolio, specifying the designated IAM role.

Answer

Share the portfolio with the target account or organization unit, and associate a launch constraint with the portfolio that specifies the designated IAM role.
To distribute products to another account and control launch permissions, the administrator must share the portfolio and apply a launch constraint specifying the target IAM role. The launch constraint ensures that AWS Service Catalog assumes the specified role to provision resources, bypassing the end users' permissions.

Step-by-Step Solution

1
Distribute the portfolio to the target account.
The portfolio and its products become visible in the target account's AWS Service Catalog console.
Before users in another account can launch a product, the portfolio containing it must be explicitly shared.
2
Create and apply a launch constraint using an IAM role.
AWS Service Catalog will use this role's permissions to provision the resources during product launch.
A launch constraint allows users to deploy products even if they do not have direct permissions to create the underlying AWS resources.

Key Concept

Sharing AWS Service Catalog portfolios and applying launch constraints to manage provisioning permissions across accounts.
Question 246Question

A company hosts a critical web application behind an Application Load Balancer (ALB) at the zone apex in the eu-west-1 (Ireland) Region. The SysOps administrator wants to configure an active-passive failover routing policy in Amazon Route 53 to redirect user traffic to a static maintenance page hosted on an Amazon S3 bucket website endpoint in the us-west-2 (Oregon) Region. The failover must trigger if the HTTP 5xx error rate of the application exceeds a specific threshold (monitored by a CloudWatch alarm) or if the ALB target group becomes entirely unhealthy. The administrator wants to ensure that DNS failover occurs with minimal delay when a failure is detected.

Which combination of actions should the SysOps administrator take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a CloudWatch alarm in the us-east-1 Region to monitor the application's 5xx error rate metric in eu-west-1 using detailed monitoring (1-minute intervals), and configure a Route 53 health check that monitors this alarm.; Create a primary failover Alias A record at the zone apex pointing to the ALB, associate the record with the CloudWatch-alarm-based Route 53 health check, and set Evaluate Target Health to Yes.

Answer

Create a CloudWatch alarm in the us-east-1 Region using detailed monitoring to track the HTTP 5xx error rate metric and create a Route 53 health check to monitor it. Additionally, create a primary failover Alias A record at the zone apex pointing to the ALB with Evaluate Target Health set to Yes and associate it with the Route 53 health check.
To set up active-passive failover based on custom metrics with minimal delay, a CloudWatch-alarm-based Route 53 health check is required. The alarm must be created in the us-east-1 Region (even though the application is in eu-west-1) and configured with detailed monitoring (1-minute intervals) to ensure quick response times. At the zone apex, a CNAME cannot be used, so a primary failover Alias A record pointing to the ALB is required. Associating the record with the Route 53 health check and enabling Evaluate Target Health ensures failover occurs if either the application health checks fail or the error-rate alarm triggers.

Step-by-Step Solution

1
Configure a CloudWatch alarm in the us-east-1 Region monitoring the HTTP 5xx metric of the ALB located in the eu-west-1 Region, ensuring detailed monitoring (1-minute intervals) is enabled for fast detection.
The metric alarm is active in the required us-east-1 Region.
Route 53 health checks can only monitor CloudWatch alarms that are created in the us-east-1 Region.
2
Create a Route 53 health check of type 'State of CloudWatch alarm' pointing to the newly created alarm in us-east-1.
The Route 53 health check changes to unhealthy when the CloudWatch alarm is triggered.
This links the application-level degradation metric to Route 53's failover logic.
3
Create a primary failover Alias A record at the zone apex pointing to the ALB. Associate the Route 53 health check with this record and enable 'Evaluate Target Health'.
Route 53 evaluates the health of the ALB targets and the CloudWatch alarm health check.
If either the target group fails or the 5xx error rate alarm is triggered, the record is marked unhealthy, triggering failover. An Alias record must be used because CNAMEs cannot be placed at the zone apex.

Key Concept

Route 53 active-passive DNS failover using Alias records, Evaluate Target Health, and cross-region CloudWatch alarm integrations.
Question 247Question

An organization uses an AWS CloudFormation stack to deploy an Application Load Balancer, an Auto Scaling group, and associated security groups. A stack update fails due to a configuration error in the Auto Scaling group launch template. During the subsequent automatic rollback, a security group that was manually modified outside of CloudFormation prevents the rollback from completing, leaving the stack in the UPDATE_ROLLBACK_FAILED state. Which actions must a SysOps Administrator perform to successfully recover the stack to a stable state and ensure the template and physical resources are aligned? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Perform a Continue Update Rollback operation, specifying the blocked security group as a resource to skip during the rollback.; After the rollback completes, manually update the skipped security group to match its expected configuration in the CloudFormation template.

Answer

To recover the stack and align it with the template, perform a Continue Update Rollback operation while skipping the blocked security group. Once the rollback completes, manually update the skipped security group to match its expected configuration in the template.
Continuing the update rollback and specifying the blocked security group to be skipped allows the stack to successfully roll back and reach the stable UPDATE_ROLLBACK_COMPLETE state. After the rollback completes, the skipped resource must be manually updated to match its expected template definition because skipping it leaves it in an inconsistent state relative to the template.

Step-by-Step Solution

1
Initiate Continue Update Rollback
Bypasses the block on the security group by selecting it as a resource to skip during rollback.
Allows CloudFormation to return the other resources to their pre-update state and transition the stack out of the failed rollback status.
2
Verify Stack Status
The stack transitions to UPDATE_ROLLBACK_COMPLETE.
Confirms the stack is in a stable state where update operations are permitted again.
3
Manually Reconcile Skipped Resource
The physical security group configuration is manually updated to match the CloudFormation template.
Ensures the resources match the template configuration, resolving the drift introduced by skipping the resource during rollback.

Key Concept

Recovering from CloudFormation UPDATE_ROLLBACK_FAILED state by skipping blocked resources and manually reconciling drift.
Estimated Time:3m 0s
Question 248Question

A SysOps Administrator is configuring an Amazon CloudWatch dashboard to monitor an Amazon ECS service running on AWS Fargate. The Administrator has enabled Amazon CloudWatch Container Insights on the ECS cluster. The Administrator needs to display the CPU utilization of individual ECS tasks on the dashboard. However, when browsing the ECS/ContainerInsights namespace in CloudWatch Metrics, the Administrator only finds metrics aggregated at the cluster, service, and task definition family levels. Which action should the Administrator take to display the CPU utilization of individual tasks on the dashboard?

Show answer & explanation

Answer: Create a CloudWatch Logs Insights widget on the dashboard that queries the /aws/ecs/containerinsights/{ClusterName}/performance log group to extract and display task-level CPU utilization metrics from the performance log events.

Answer

Create a CloudWatch Logs Insights widget on the dashboard that queries the performance log group to extract and display the task-level CPU utilization.
For Amazon ECS clusters running on AWS Fargate, Container Insights aggregates metrics in the ECS/ContainerInsights namespace at the cluster, service, and task definition family levels to prevent high-cardinality costs. However, task-level performance events are still stored as JSON logs in CloudWatch Logs under the log group /aws/ecs/containerinsights/{ClusterName}/performance. To visualize task-level metrics like CPU utilization on a dashboard, the Administrator must write a CloudWatch Logs Insights query against this log group to parse the TaskId and CpuUtilized fields, and then pin the query to the dashboard as a widget.

Step-by-Step Solution

1
Identify where task-level metric details are stored in Container Insights.
Container Insights performance logs are stored in the CloudWatch Logs group /aws/ecs/containerinsights/{ClusterName}/performance.
Since standard CloudWatch metrics in the ECS/ContainerInsights namespace do not include the TaskId dimension to avoid high metric costs, task-level performance events must be retrieved from the log group.
2
Use CloudWatch Logs Insights to query the performance logs.
Write a query targeting the /aws/ecs/containerinsights/{ClusterName}/performance log group, filtering for records where the Type field equals 'Task', and selecting the TaskId and CpuUtilized fields.
This extracts the specific metric data for individual tasks directly from the performance log JSON payloads.
3
Add the Logs Insights query to the CloudWatch dashboard.
Save the query as a dashboard widget (such as a table or line chart).
This displays the live query results on the custom dashboard, meeting the requirement to monitor individual task CPU utilization.

Key Concept

Visualizing ECS Fargate task-level Container Insights metrics using CloudWatch Logs Insights query widgets on a dashboard.
Question 249Question

An application deployed on AWS Lambda writes execution logs to an Amazon CloudWatch Logs group. A SysOps Administrator needs to configure a metric filter and a CloudWatch alarm to track occurrences where a specific third-party integration named `StripePay` fails with a response time greater than 1000 ms1000\text{ ms}.

A sample JSON log event from the application is:

{
"integrationName": "StripePay",
"status": "FAILED",
"responseTimeMs": 1250,
"errorCode": "GATEWAY_TIMEOUT"
}

Which of the following configuration options should the SysOps Administrator select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define a metric filter with the pattern `{ (.integrationName = "StripePay") && (.status = "FAILED") && ($.responseTimeMs > 1000) }`.; Set the metric value in the metric transformation configuration to `1` to increment the metric count for each log event that matches the filter pattern.

Answer

To monitor the third-party failures, the administrator must define a metric filter with the JSON pattern checking for StripePay, FAILED status, and responseTimeMs greater than 1000, and set the metric transformation value to 1 to count the occurrences of matching events.
The correct options are defining the metric filter with the JSON pattern selecting StripePay, FAILED status, and response time greater than 1000, and setting the metric transformation value to 1. This ensures that every matching log event increments the count of the custom metric by 1 in real-time.

Step-by-Step Solution

1
Select the correct CloudWatch Logs JSON filter pattern syntax.
The pattern `{ (.integrationName = "StripePay") && (.status = "FAILED") && ($.responseTimeMs > 1000) }` matches the structure of the JSON log event.
JSON metric filters use JSON path notation with `$.` to access properties and boolean operators like `&&` to combine conditions.
2
Configure the metric transformation properties for the custom metric.
Assign a metric value of `1` for each match.
Setting the metric value to 1 allows the custom metric to increment by one per matching log event, reflecting the frequency of StripePay failures.
3
Create a CloudWatch Alarm to monitor the custom metric.
The alarm triggers when the metric value exceeds the desired threshold.
An alarm is necessary to notify administrators or trigger remediation via EventBridge when the failure count is too high.

Key Concept

CloudWatch Logs Metric Filters analyze incoming log streams in real-time using pattern matching rules to publish custom CloudWatch metrics.
Question 250Question

A SysOps Administrator is setting up VPC Flow Logs for a new application VPC to capture network traffic and deliver the logs to Amazon CloudWatch Logs. To comply with company guidelines, the administrator must ensure that the VPC Flow Logs service has permission to write to the CloudWatch Logs log group, and that any log data older than 90 days is automatically deleted to manage storage costs.

Which of the following actions should the SysOps Administrator perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role, and attach a policy with logs:CreateLogStream and logs:PutLogEvents permissions.; Configure the retention setting on the target Amazon CloudWatch Logs log group to 90 days.

Answer

To configure VPC Flow Logs to deliver to CloudWatch Logs and manage retention, you must create an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role, and attach a policy with logs:CreateLogStream and logs:PutLogEvents permissions. Additionally, configure the retention setting on the target Amazon CloudWatch Logs log group to 90 days.
The correct options involve creating the delivery IAM role with the correct trust policy (allowing vpc-flow-logs.amazonaws.com to assume the role) and permissions policy (logs:CreateLogStream, logs:PutLogEvents), and configuring the retention period directly on the destination CloudWatch Logs log group.

Step-by-Step Solution

1
Configure the CloudWatch Logs destination retention.
The log group is configured with a 90-day retention policy, ensuring older logs are deleted.
This meets the requirement to delete logs older than 90 days to manage storage costs.
2
Create the delivery IAM role and policies.
An IAM role is created with the trust policy for the vpc-flow-logs.amazonaws.com service principal and permissions for logs:CreateLogStream and logs:PutLogEvents.
This provides the required authorization for the VPC Flow Logs service to publish logs to the log group.
3
Enable the VPC Flow Logs targeting the log group using the created IAM role.
VPC Flow Logs begin publishing network flow data to the destination log group.
This completes the setup of network monitoring.

Key Concept

VPC Flow Logs publication permissions and CloudWatch Logs retention management
Question 251Question

A SysOps Administrator needs to execute a script on a newly launched Amazon EC2 instance using AWS Systems Manager Run Command. Arrange the following steps in the correct sequential order to configure the instance and run the script.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: Attach the IAM instance profile to the EC2 instance, verify the instance appears under Managed Nodes, navigate to Run Command to choose the AWS-RunShellScript document, specify the targets and parameters, and then execute the command while monitoring the output.
The correct sequence begins with setting up permissions (attaching the IAM role) so that the instance can register with the Systems Manager service. Once verified in the Managed Nodes list, you select the Run Command interface and choose the execution document (AWS-RunShellScript). You then configure the targets and parameters, and finally execute the script and observe the logs.

Step-by-Step Solution

1
Attach an IAM instance profile with AmazonSSMManagedInstanceCore to the EC2 instance.
The EC2 instance is authorized to interact with Systems Manager APIs.
SSM Agent requires these permissions to authenticate and register the instance.
2
Verify the instance is listed as a Managed Node in the console.
Confirms the instance has successfully established communication with AWS Systems Manager.
An instance must be online and managed before commands can be targeted to it.
3
Open Run Command and select the AWS-RunShellScript document.
The console loads the interface for shell script execution.
SSM documents define the actions and capabilities for the Systems Manager execution.
4
Select the target instance and input the script parameters.
Specifies the payload and destination node configuration.
Run Command must map the script payload to the appropriate managed node target.
5
Execute the command and review the console logs.
Runs the script on the target instance and returns execution metrics.
Allows checking the output and verifying if the script executed successfully.

Key Concept

Configuring EC2 instances for Systems Manager management and executing commands via Run Command.
Question 252Question

A company uses AWS Config to monitor resource compliance and has enabled the `s3-bucket-server-side-encryption-enabled` managed rule. A SysOps administrator wants to set up near-real-time automated remediation so that when a non-compliant Amazon S3 bucket is detected, a default server-side encryption configuration is applied using the `AWS-EnableS3BucketEncryption` Systems Manager Automation document. The remediation workflow must be orchestrated using Amazon EventBridge.

Which configuration actions must the administrator perform to establish this automated remediation pipeline? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the Amazon EventBridge rule with an event pattern that matches events from `aws.config` with a detail-type of `Config Rules Compliance Change` where the compliance type is `NON_COMPLIANT` for the specific S3 encryption rule.; Configure the Amazon EventBridge rule target to point to the `AWS-EnableS3BucketEncryption` Systems Manager Automation document, and assign an IAM execution role to the rule that contains both `ssm:StartAutomationExecution` permissions and `iam:PassRole` permissions for the Systems Manager Automation execution role.

Answer

Configure the Amazon EventBridge rule with an event pattern matching non-compliant AWS Config compliance change events, and set the EventBridge rule target to the Automation document with an IAM execution role containing the start automation and pass role permissions.
To automate resource remediation, Amazon EventBridge must detect the compliance status change from AWS Config by filtering for compliance events containing the `NON_COMPLIANT` state for the specific Config rule. To execute the remediation, the rule targets the `AWS-EnableS3BucketEncryption` Systems Manager Automation document. The EventBridge rule execution role must be granted `ssm:StartAutomationExecution` to run the document, as well as `iam:PassRole` permissions to pass the remediation service role to Systems Manager.

Step-by-Step Solution

1
Define the event detection pattern.
Create an EventBridge rule that filters for `aws.config` events, matching the detail-type `Config Rules Compliance Change` and filtering for the specific `s3-bucket-server-side-encryption-enabled` rule with a compliance status of `NON_COMPLIANT`.
This ensures that remediation is only triggered immediately when a bucket is evaluated as non-compliant by AWS Config.
2
Configure the target and execution permissions.
Set the rule target to the `AWS-EnableS3BucketEncryption` Systems Manager Automation document, and assign an IAM execution role to the EventBridge rule.
EventBridge needs permissions to initiate the execution of the Automation document.
3
Grant PassRole permissions to the execution role.
Include the `iam:PassRole` permission in the EventBridge execution role, referencing the Amazon Resource Name (ARN) of the Systems Manager Automation service role.
Since the Automation document executes actions on S3 using a delegated service role, the initiator (EventBridge) must have permission to pass this service role to Systems Manager.

Key Concept

Event-driven remediation using Amazon EventBridge rules to detect AWS Config compliance changes and invoke AWS Systems Manager Automation documents with proper execution and role-passing permissions.
Estimated Time:2m 30s
Question 253Question

A SysOps Administrator is configuring automated compliance remediation for AWS Config. The administrator wants to ensure that any Amazon S3 bucket found to be non-compliant with the `s3-bucket-public-read-prohibited` managed rule is automatically remediated using the `AWS-DisableS3BucketPublicReadWrite` AWS Systems Manager (SSM) Automation document. The administrator creates an IAM role for the SSM Automation execution but needs to ensure the remediation can be successfully initiated from the AWS Config console. Which configuration is required to allow AWS Config to execute the automation successfully?

Show answer & explanation

Answer: Configure remediation directly within the AWS Config rule using the SSM Automation document, and grant the administrator's IAM identity the `iam:PassRole` permission for the Automation execution role.

Answer

Configure remediation directly within the AWS Config rule using the SSM Automation document, and grant the administrator's IAM identity the `iam:PassRole` permission for the Automation execution role.
The correct option correctly identifies that the administrator needs the `iam:PassRole` permission. When configuring AWS Config remediation with a custom SSM Automation execution role, the user setting up the automation must have the permission to pass that role to the Systems Manager service.

Step-by-Step Solution

1
Select the remediation target in the AWS Config console.
The AWS Config rule `s3-bucket-public-read-prohibited` is configured to use the Systems Manager Automation document `AWS-DisableS3BucketPublicReadWrite`.
AWS Config uses Systems Manager Automation documents to orchestrate automated remediation of non-compliant resources.
2
Ensure the administrator setting up the remediation has the necessary IAM permissions to delegate the execution role.
The administrator's IAM policy is updated to include the `iam:PassRole` permission targeting the ARN of the SSM Automation execution role.
When configuring AWS services to assume an IAM role on your behalf, you must have the `iam:PassRole` permission to prevent unauthorized privilege escalation.

Key Concept

AWS Config automated remediation requires the user configuring the rule to have `iam:PassRole` permissions to pass the execution role to the Systems Manager service.
Estimated Time:1m 30s
Question 254Question

A SysOps Administrator wants to use AWS Systems Manager Run Command to execute a script on an Amazon EC2 instance. The SSM Agent is installed and running on the instance. However, the EC2 instance is not associated with any IAM role, and it does not appear in the list of managed instances in the Systems Manager console. Which of the following actions will resolve this issue?

Show answer & explanation

Answer: Attach an IAM instance profile containing the AmazonSSMManagedInstanceCore policy to the EC2 instance.

Answer

Attach an IAM instance profile containing the AmazonSSMManagedInstanceCore policy to the EC2 instance.
For an EC2 instance to register with AWS Systems Manager and appear as a managed instance, it must meet two main requirements: the SSM Agent must be installed and running, and the instance must have an IAM instance profile attached with permissions to communicate with the Systems Manager service (typically via the AmazonSSMManagedInstanceCore policy). Since the SSM Agent is already running but no IAM role is attached, attaching the instance profile resolves the registration issue.

Step-by-Step Solution

1
Identify the missing requirement for SSM managed instances.
Managed instances require the SSM Agent to be running and an IAM role with the correct permissions attached.
Establishing a trust relationship between the EC2 instance and the Systems Manager service is necessary for registration.
2
Attach the appropriate IAM instance profile.
Attach the instance profile containing the AmazonSSMManagedInstanceCore policy to the EC2 instance.
This grants the instance the permissions required to communicate with Systems Manager APIs.
3
Verify that the instance registers as a managed instance.
The instance now appears in the Systems Manager console under Managed Instances and is ready for Run Command.
With both the agent running and the IAM role attached, registration completes successfully.

Key Concept

Systems Manager EC2 Instance Prerequisites
Question 255Question

A company runs a microservice application that writes JSON-formatted log events to an Amazon CloudWatch Logs group named `/aws/microservices/orders`. A SysOps Administrator needs to monitor guest checkout failures. The log events have the following structure:

{
"request_id": "req-402",
"payment_status": "DENIED",
"auth_type": "GUEST",
"amount": 250.00
}

The Administrator wants to track occurrences where the `payment_status` is `DENIED` and `auth_type` is `GUEST` by publishing a custom metric named `UnauthorizedCheckoutCount` in the `MicroserviceMonitoring` namespace. If no matching logs are processed during a reporting period, the metric must record a value of 00. Additionally, the logs must be retained for exactly 3030 days to minimize storage costs.

Which TWO actions should the SysOps Administrator take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon CloudWatch metric filter on the log group using the filter pattern `{ (.payment_status = "DENIED") && (.auth_type = "GUEST") }`, specifying a metric value of 11 and a default value of 00.; Configure the retention settings of the `/aws/microservices/orders` log group to 3030 days.

Answer

The correct actions are: creating an Amazon CloudWatch metric filter on the log group using the filter pattern `{ (.payment_status = "DENIED") && (.auth_type = "GUEST") }` (with a metric value of 11 and a default value of 00), and configuring the retention settings of the log group to 3030 days.
The correct options state that the Administrator should create a metric filter on the log group using the filter pattern `{ (.payment_status = "DENIED") && (.auth_type = "GUEST") }` (with a metric value of 11 and default value of 00), and change the retention settings of the log group to 3030 days. This combines the correct JSON selector syntax for filters, configures the metric to publish a 00 value when logs are absent, and natively manages log lifecycle.

Step-by-Step Solution

1
Parse JSON properties using the correct CloudWatch Logs filter pattern syntax.
The filter pattern `{ (.payment_status = "DENIED") && (.auth_type = "GUEST") }` is configured to target matching logs.
This syntax correctly targets JSON fields, applying boolean matching on log event elements.
2
Set the metric value and default value in the metric filter configuration.
Metric value is set to 11 to count events, and default value is set to 00.
Setting the default value to 00 ensures that CloudWatch records data points during time intervals where no logs match the filter criteria.
3
Configure the native log group retention setting.
The `/aws/microservices/orders` log group retention is modified from 'Never expire' to '3030 days'.
This is the native, low-overhead method to delete logs after the specified storage duration.

Key Concept

CloudWatch Logs JSON Metric Filters and Native Log Group Retention
Estimated Time:2m 0s
Question 256Question

An application hosted on Amazon EC2 instances in an Auto Scaling group (ASG) experiences sudden spikes in traffic. The ASG is configured to scale out using a step scaling policy based on the average CPU utilization of the instances. Currently, the ASG takes up to 1515 minutes to respond to a traffic spike, which leads to degraded application performance. A SysOps administrator needs to configure the ASG to scale out more quickly during these spikes.

Which two changes should the SysOps administrator make to reduce the time it takes for the ASG to scale out? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable detailed monitoring in the launch template used by the Auto Scaling group.; Decrease the evaluation periods for the CloudWatch alarm that triggers the scaling policy.

Answer

The correct answers are enabling detailed monitoring in the launch template and decreasing the evaluation periods for the CloudWatch alarm.
To minimize the delay in scaling out during traffic spikes, the SysOps administrator must reduce both the time it takes for metrics to be reported and the time it takes for the alarm to trigger. Enabling detailed monitoring in the launch template changes the CPU utilization reporting interval from 55 minutes to 11 minute. Decreasing the evaluation periods for the CloudWatch alarm ensures that the alarm transitions to the ALARM state quickly when the threshold is crossed, rather than waiting for multiple metric intervals to pass.

Step-by-Step Solution

1
Analyze the default metric reporting interval for EC2 instance CPU utilization.
Standard monitoring reports metrics to CloudWatch at 55-minute intervals, leading to a delay in detection.
Detailed monitoring must be enabled to increase the metric frequency to 11-minute intervals so that traffic spikes are detected faster.
2
Examine the CloudWatch alarm evaluation parameters.
Alarms with high evaluation periods require the threshold to be breached over multiple cycles before triggering.
Reducing the evaluation periods allows the alarm to trigger a scaling action faster after the CPU threshold is crossed.

Key Concept

Auto Scaling responsiveness optimization using metric resolution and alarm evaluation settings
Estimated Time:1m 30s
Question 257Question

A SysOps Administrator is setting up automated compliance remediation within an AWS Config Conformance Pack. The conformance pack includes a custom rule that checks for unencrypted Amazon EBS volumes. The administrator wants to configure automatic remediation for this rule using an AWS Systems Manager (SSM) Automation document that encrypts the EBS volumes. Which of the following configuration steps are required to ensure the remediation executes successfully? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Specify an IAM execution role in the remediation configuration that has permissions to encrypt EBS volumes and has a trust policy allowing the Systems Manager service (ssm.amazonaws.com) to assume it.; Grant the IAM identity deploying the conformance pack the iam:PassRole permission for the specified IAM execution role.

Answer

Specify an IAM execution role in the remediation configuration that has a trust policy allowing Systems Manager to assume it, and grant the deploying IAM identity the iam:PassRole permission for that execution role.
For automatic remediation to work natively within AWS Config, the remediation action specifies a Systems Manager Automation document. The Systems Manager service must assume the specified IAM execution role to perform the remediation, requiring the role's trust policy to allow ssm.amazonaws.com. Additionally, the identity configuring or deploying the remediation must have iam:PassRole permissions to pass this execution role to Systems Manager.

Step-by-Step Solution

1
Configure the IAM execution role with the required permissions to perform the EBS encryption remediation actions and edit its trust policy.
The trust policy allows the service principal ssm.amazonaws.com to assume the role.
Since Systems Manager Automation executes the remediation workflow, the SSM service must be allowed to assume the role.
2
Ensure the administrator or service role deploying the conformance pack has the necessary permissions.
The deployment role has the iam:PassRole permission for the execution role configured in step 1.
AWS security requires the deploying identity to have iam:PassRole to delegate permissions to another AWS service via the execution role.
3
Define the remediation configuration within the AWS Config Conformance Pack template, specifying the target SSM Automation document and the execution role ARN.
The conformance pack is successfully deployed with active automated remediation.
This links the AWS Config rule evaluation directly to the Systems Manager remediation workflow.

Key Concept

Configuring automatic remediation in AWS Config Conformance Packs requires setting up an IAM execution role that trusts Systems Manager (ssm.amazonaws.com), and the deploying identity must have iam:PassRole permissions for that execution role.
Question 258Question

A SysOps Administrator needs to execute an administrative script across a fleet of Amazon EC2 instances using AWS Systems Manager Run Command. The instances must be targeted as a group based on their department, and they must register successfully as managed instances. Currently, the SSM Agent is installed and running on the instances, and they have outbound internet access, but they do not appear in the Systems Manager console. Which two actions must the SysOps Administrator take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM role containing the AmazonSSMManagedInstanceCore policy to the EC2 instances via an instance profile.; Apply a resource tag with a department key and value to the EC2 instances, and target them using this tag in Run Command.

Answer

Attaching an IAM role containing the AmazonSSMManagedInstanceCore policy to the EC2 instances and applying a resource tag to target them dynamically in Run Command are the correct actions.
To successfully execute Run Command on EC2 instances, they must first be registered as managed instances. This requires attaching an IAM role with the AmazonSSMManagedInstanceCore policy to the instances via an instance profile. To target the instances dynamically as a group based on their department, a resource tag (such as Department=Sales) must be applied to the instances, allowing the SysOps Administrator to specify the tag when executing the Run Command.

Step-by-Step Solution

1
Ensure the EC2 instances have the required IAM permissions to communicate with the Systems Manager API by attaching an IAM role with the AmazonSSMManagedInstanceCore policy via an instance profile.
The EC2 instances register successfully as managed instances in the Systems Manager console.
Managed instances require permissions to call Systems Manager APIs to register and check for run commands.
2
Apply a tag to the instances representing their department (e.g., Department=Finance) and use the tag-based targeting option when running the command in Systems Manager.
Run Command executes the script only on the instances matching the specified tag.
Tag-based targeting allows dynamic grouping and execution without having to select instance IDs manually.

Key Concept

To run commands on EC2 instances using AWS Systems Manager Run Command, instances must be configured as managed instances (requiring the SSM Agent and the AmazonSSMManagedInstanceCore IAM policy) and can be targeted dynamically using resource tags.
Question 259Question

A company's security compliance audit reveals that several Amazon EBS snapshots have been shared publicly. The SysOps administrator must implement a solution to automatically revert any publicly shared EBS snapshots to private. The administrator decides to use Amazon EventBridge to detect the change and trigger the AWS Systems Manager Automation runbook `AWS-ModifySnapshotAttribute`.

Which actions are required to configure the automation pipeline and ensure it has the necessary permissions? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an IAM role for the EventBridge rule target that grants the `ssm:StartAutomationExecution` permission for the `AWS-ModifySnapshotAttribute` runbook.; Configure an IAM service role for the Systems Manager Automation execution that contains the `ec2:ModifySnapshotAttribute` permission.

Answer

The correct actions are: configuring an IAM role for the EventBridge rule target that grants `ssm:StartAutomationExecution` for the target runbook, and configuring an IAM service role for the Systems Manager Automation execution that contains the `ec2:ModifySnapshotAttribute` permission.
To automate the remediation of public EBS snapshots, the EventBridge rule must have permission to invoke the Systems Manager Automation target, which is achieved by assigning an IAM role with the `ssm:StartAutomationExecution` permission. Additionally, the Systems Manager Automation runbook must have a service role (Automation Assume Role) with the necessary `ec2:ModifySnapshotAttribute` permission to execute the action of making the snapshot private.

Step-by-Step Solution

1
Determine the service integration triggers and the permissions needed for EventBridge to invoke Systems Manager Automation.
EventBridge requires a role with `ssm:StartAutomationExecution` to run the Systems Manager Automation target.
By default, EventBridge rules need explicit permissions to trigger target resources. An IAM role is associated with the target to allow the start execution action on the `AWS-ModifySnapshotAttribute` runbook.
2
Determine the permissions required for the execution of the Systems Manager Automation runbook to modify snapshot configurations.
Systems Manager Automation requires an execution role (Automation Assume Role) with the `ec2:ModifySnapshotAttribute` permission.
The runbook itself modifies the EC2 EBS snapshot attribute to make it private, which requires calling the EC2 API. This action is authorized using the Systems Manager Automation execution role.

Key Concept

Automating remediation of public resources using EventBridge and Systems Manager Automation.
Estimated Time:2m 30s
Question 260Question

A SysOps Administrator is updating an AWS CloudFormation stack that manages an Auto Scaling group and an associated IAM role. The update fails, triggering an automatic rollback. During the rollback, the stack enters the UPDATE_ROLLBACK_FAILED state. The stack events show that the custom CloudFormation service role is missing the iam:PassRole permission required to associate the IAM instance profile with the Auto Scaling group's Launch Template.

Which two actions can the Administrator take to successfully complete the rollback and return the stack to a stable state? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Modify the policy attached to the current custom CloudFormation service role to grant the iam:PassRole permission for the instance profile's IAM role, and then invoke the Continue Update Rollback operation.; Invoke the Continue Update Rollback operation and specify the ARN of a different IAM service role that already has the required iam:PassRole permission.

Answer

Modify the policy attached to the current custom CloudFormation service role to grant the iam:PassRole permission for the instance profile's IAM role, and then invoke the Continue Update Rollback operation. Alternatively, invoke the Continue Update Rollback operation and specify the ARN of a different IAM service role that already has the required iam:PassRole permission.
The correct options involve resolving the permissions gap and completing the rollback using the Continue Update Rollback API. A SysOps Administrator can either update the current service role's policy to add the required `iam:PassRole` permissions, or specify a different service role (using the `--role-arn` parameter) that has the correct permissions. Both methods allow the CloudFormation service to successfully execute the rollback operations and return the stack to a stable state.

Step-by-Step Solution

1
Analyze the stack status and events to determine the cause of the failure.
Identify that the stack is in the UPDATE_ROLLBACK_FAILED state due to the custom service role missing the iam:PassRole permission.
Before performing remediation, the administrator must inspect the CloudFormation events to pinpoint the exact resource and permission that caused the rollback to fail.
2
Select a recovery approach: either update the existing role or use a different role.
Decide to either attach a policy containing the iam:PassRole action to the existing role, or identify an alternative role that already has this policy.
Since CloudFormation requires the service role to have permissions to make changes to target resources and pass required roles, the permission gap must be bridged before the rollback can resume.
3
Execute the Continue Update Rollback operation.
Trigger Continue Update Rollback, optionally passing the ARN of the new service role if the second approach is selected.
Stacks in the UPDATE_ROLLBACK_FAILED state can only be returned to a stable state (such as UPDATE_ROLLBACK_COMPLETE) by completing the rollback process via the Continue Update Rollback command.

Key Concept

CloudFormation Stack Recovery and Service Role Permissions
PreviousPage 13 / 49Next
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin