All practice questions
976 questions
A SysOps Administrator needs to verify whether a specific Amazon S3 bucket within a large AWS CloudFormation stack has undergone any manual configuration changes. To minimize execution time and resource overhead, the administrator wants to check only this specific resource rather than the entire stack. Which action should the administrator take to accomplish this?
A company's security policy requires that all network communication from a database subnet be captured for audit purposes. A SysOps Administrator configures VPC Flow Logs at the subnet level to capture all traffic. During an audit, the compliance officer notices that queries sent from the database EC2 instances to the default Amazon Route 53 Resolver (at the VPC DNS server IP address) are not appearing in the flow logs. Which action should the SysOps Administrator take to log these DNS queries?
To enforce a security policy, an operations team uses a conformance pack containing the vpc-flow-logs-enabled AWS Config rule. A SysOps Administrator is responsible for setting up automated remediation. The administrator creates an IAM role named ConfigRemediationRole with a trust policy for ssm.amazonaws.com and attaches a permissions policy to enable flow logs. When configuring the automatic remediation action in AWS Config with the AWS-EnableVPCFlowLogs Systems Manager Automation document, the administrator receives an 'Access Denied' error upon saving the configuration. Which action should the administrator take to successfully save the remediation configuration?
An organization is transitioning an internal business API from an on-premises datacenter to AWS. During the migration phase, they want to establish an active-passive failover DNS strategy using Amazon Route 53 at the zone apex. The primary gateway is hosted on-premises and is accessible via a static public IP address. The secondary disaster recovery gateway is hosted behind an Application Load Balancer (ALB) in AWS. If the on-premises endpoint becomes unavailable, traffic must automatically route to the AWS ALB.
Which two DNS record configurations should a SysOps administrator implement to meet these requirements? (Select two.)
Select all that apply
A SysOps administrator needs to share an AWS Service Catalog portfolio with another AWS account. The administrator also wants to ensure that when users in the target account launch the products, the resources are created using a designated IAM role, regardless of the users' individual permissions. Which actions must the administrator take to configure this setup? (Select TWO.)
Select all that apply
A company hosts a critical web application behind an Application Load Balancer (ALB) at the zone apex in the eu-west-1 (Ireland) Region. The SysOps administrator wants to configure an active-passive failover routing policy in Amazon Route 53 to redirect user traffic to a static maintenance page hosted on an Amazon S3 bucket website endpoint in the us-west-2 (Oregon) Region. The failover must trigger if the HTTP 5xx error rate of the application exceeds a specific threshold (monitored by a CloudWatch alarm) or if the ALB target group becomes entirely unhealthy. The administrator wants to ensure that DNS failover occurs with minimal delay when a failure is detected.
Which combination of actions should the SysOps administrator take to meet these requirements? (Select TWO.)
Select all that apply
An organization uses an AWS CloudFormation stack to deploy an Application Load Balancer, an Auto Scaling group, and associated security groups. A stack update fails due to a configuration error in the Auto Scaling group launch template. During the subsequent automatic rollback, a security group that was manually modified outside of CloudFormation prevents the rollback from completing, leaving the stack in the UPDATE_ROLLBACK_FAILED state. Which actions must a SysOps Administrator perform to successfully recover the stack to a stable state and ensure the template and physical resources are aligned? (Select TWO.)
Select all that apply
A SysOps Administrator is configuring an Amazon CloudWatch dashboard to monitor an Amazon ECS service running on AWS Fargate. The Administrator has enabled Amazon CloudWatch Container Insights on the ECS cluster. The Administrator needs to display the CPU utilization of individual ECS tasks on the dashboard. However, when browsing the ECS/ContainerInsights namespace in CloudWatch Metrics, the Administrator only finds metrics aggregated at the cluster, service, and task definition family levels. Which action should the Administrator take to display the CPU utilization of individual tasks on the dashboard?
An application deployed on AWS Lambda writes execution logs to an Amazon CloudWatch Logs group. A SysOps Administrator needs to configure a metric filter and a CloudWatch alarm to track occurrences where a specific third-party integration named `StripePay` fails with a response time greater than .
A sample JSON log event from the application is:
{
"integrationName": "StripePay",
"status": "FAILED",
"responseTimeMs": 1250,
"errorCode": "GATEWAY_TIMEOUT"
}
Which of the following configuration options should the SysOps Administrator select to meet these requirements? (Select TWO.)
Select all that apply
A SysOps Administrator is setting up VPC Flow Logs for a new application VPC to capture network traffic and deliver the logs to Amazon CloudWatch Logs. To comply with company guidelines, the administrator must ensure that the VPC Flow Logs service has permission to write to the CloudWatch Logs log group, and that any log data older than 90 days is automatically deleted to manage storage costs.
Which of the following actions should the SysOps Administrator perform to meet these requirements? (Select TWO.)
Select all that apply
A SysOps Administrator needs to execute a script on a newly launched Amazon EC2 instance using AWS Systems Manager Run Command. Arrange the following steps in the correct sequential order to configure the instance and run the script.
Drag items to arrange them in the correct order
A company uses AWS Config to monitor resource compliance and has enabled the `s3-bucket-server-side-encryption-enabled` managed rule. A SysOps administrator wants to set up near-real-time automated remediation so that when a non-compliant Amazon S3 bucket is detected, a default server-side encryption configuration is applied using the `AWS-EnableS3BucketEncryption` Systems Manager Automation document. The remediation workflow must be orchestrated using Amazon EventBridge.
Which configuration actions must the administrator perform to establish this automated remediation pipeline? (Select TWO.)
Select all that apply
A SysOps Administrator is configuring automated compliance remediation for AWS Config. The administrator wants to ensure that any Amazon S3 bucket found to be non-compliant with the `s3-bucket-public-read-prohibited` managed rule is automatically remediated using the `AWS-DisableS3BucketPublicReadWrite` AWS Systems Manager (SSM) Automation document. The administrator creates an IAM role for the SSM Automation execution but needs to ensure the remediation can be successfully initiated from the AWS Config console. Which configuration is required to allow AWS Config to execute the automation successfully?
A SysOps Administrator wants to use AWS Systems Manager Run Command to execute a script on an Amazon EC2 instance. The SSM Agent is installed and running on the instance. However, the EC2 instance is not associated with any IAM role, and it does not appear in the list of managed instances in the Systems Manager console. Which of the following actions will resolve this issue?
A company runs a microservice application that writes JSON-formatted log events to an Amazon CloudWatch Logs group named `/aws/microservices/orders`. A SysOps Administrator needs to monitor guest checkout failures. The log events have the following structure:
{
"request_id": "req-402",
"payment_status": "DENIED",
"auth_type": "GUEST",
"amount": 250.00
}
The Administrator wants to track occurrences where the `payment_status` is `DENIED` and `auth_type` is `GUEST` by publishing a custom metric named `UnauthorizedCheckoutCount` in the `MicroserviceMonitoring` namespace. If no matching logs are processed during a reporting period, the metric must record a value of . Additionally, the logs must be retained for exactly days to minimize storage costs.
Which TWO actions should the SysOps Administrator take to meet these requirements? (Select TWO.)
Select all that apply
An application hosted on Amazon EC2 instances in an Auto Scaling group (ASG) experiences sudden spikes in traffic. The ASG is configured to scale out using a step scaling policy based on the average CPU utilization of the instances. Currently, the ASG takes up to minutes to respond to a traffic spike, which leads to degraded application performance. A SysOps administrator needs to configure the ASG to scale out more quickly during these spikes.
Which two changes should the SysOps administrator make to reduce the time it takes for the ASG to scale out? (Select TWO.)
Select all that apply
A SysOps Administrator is setting up automated compliance remediation within an AWS Config Conformance Pack. The conformance pack includes a custom rule that checks for unencrypted Amazon EBS volumes. The administrator wants to configure automatic remediation for this rule using an AWS Systems Manager (SSM) Automation document that encrypts the EBS volumes. Which of the following configuration steps are required to ensure the remediation executes successfully? (Select TWO.)
Select all that apply
A SysOps Administrator needs to execute an administrative script across a fleet of Amazon EC2 instances using AWS Systems Manager Run Command. The instances must be targeted as a group based on their department, and they must register successfully as managed instances. Currently, the SSM Agent is installed and running on the instances, and they have outbound internet access, but they do not appear in the Systems Manager console. Which two actions must the SysOps Administrator take to meet these requirements? (Select two.)
Select all that apply
A company's security compliance audit reveals that several Amazon EBS snapshots have been shared publicly. The SysOps administrator must implement a solution to automatically revert any publicly shared EBS snapshots to private. The administrator decides to use Amazon EventBridge to detect the change and trigger the AWS Systems Manager Automation runbook `AWS-ModifySnapshotAttribute`.
Which actions are required to configure the automation pipeline and ensure it has the necessary permissions? (Select TWO.)
Select all that apply
A SysOps Administrator is updating an AWS CloudFormation stack that manages an Auto Scaling group and an associated IAM role. The update fails, triggering an automatic rollback. During the rollback, the stack enters the UPDATE_ROLLBACK_FAILED state. The stack events show that the custom CloudFormation service role is missing the iam:PassRole permission required to associate the IAM instance profile with the Auto Scaling group's Launch Template.
Which two actions can the Administrator take to successfully complete the rollback and return the stack to a stable state? (Select TWO.)
Select all that apply