Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 261Question →

A SysOps Administrator is tasked with configuring high availability for an Amazon RDS for MariaDB DB instance. The database must support automated, synchronous failover with zero data loss in the event of an Availability Zone outage. Additionally, the administrator must offload read-heavy reporting queries to a separate database endpoint to minimize performance impact on the primary write instance. Which database configuration will satisfy these requirements?

Show answer & explanation

Answer: Modify the database to a Multi-AZ deployment, and create a Read Replica in a separate Availability Zone to handle reporting queries.

Answer

Modify the database to a Multi-AZ deployment, and create a Read Replica in a separate Availability Zone to handle reporting queries.
To satisfy both requirements, the database must be configured for Multi-AZ to enable synchronous replication and automatic DNS-based failover. A separate Read Replica must be created to handle the reporting queries because the standby instance in a standard Multi-AZ configuration is passive and cannot be accessed for read queries.

Step-by-Step Solution

1
Evaluate high availability requirements.
Automatic failover with zero data loss requires synchronous replication, which is provided by Amazon RDS Multi-AZ deployments.
Single-AZ deployments or standalone Read Replicas (which replicate asynchronously) do not support synchronous zero-data-loss failover.
2
Address read scaling requirements.
Read-heavy reporting queries should be offloaded to an RDS Read Replica.
The standby instance in a standard Multi-AZ deployment is passive and cannot accept read traffic, so a Read Replica is needed to provide a readable endpoint.
3
Combine configurations to meet both constraints.
The primary DB instance runs in Multi-AZ mode for automated failover, while one or more Read Replicas are created to serve the reporting queries.
This combined architecture ensures high availability for writes and offloads read performance issues.

Key Concept

RDS Multi-AZ vs. Read Replicas for High Availability and Read Scaling
Estimated Time:1m 30s
Question 262Question →

A SysOps Administrator is configuring an AWS Systems Manager Automation workflow to automate configuration checks across a fleet of Amazon EC2 instances using a custom runbook. The SSM Agent is installed and running on all instances, and the instances are configured with an IAM instance profile containing the AmazonSSMManagedInstanceCore managed policy. The custom runbook executes a script on the instances that decrypts secure string credentials from the Systems Manager Parameter Store.

When the administrator attempts to start the Automation workflow, the execution fails to start immediately with an access denied error. In addition, manual test runs of the command on the instances fail to retrieve and decrypt the credentials.

Which two actions must the SysOps Administrator take to resolve these issues and ensure the Automation workflow runs successfully? (Select two.)

Select all that apply

Show answer & explanation

Answer: Add the ssm:GetParameter permission and the kms:Decrypt permission for the parameter's KMS key to the IAM role associated with the EC2 instances' instance profile.; Add the iam:PassRole permission to the administrator's IAM user policy targeting the Systems Manager Automation service role.

Answer

Add the ssm:GetParameter permission and the kms:Decrypt permission for the parameter's KMS key to the IAM role associated with the EC2 instances' instance profile, and add the iam:PassRole permission to the administrator's IAM user policy targeting the Systems Manager Automation service role.
The correct configurations involve resolving the permission issues at two different boundaries: the Automation execution boundary and the EC2 instance execution boundary. First, the administrator needs the iam:PassRole permission to pass the Automation service role to Systems Manager. Second, the EC2 instance profile's IAM role must be updated to allow access to the Parameter Store (ssm:GetParameter) and the KMS key (kms:Decrypt) because the command runs in the context of the instance's credentials.

Step-by-Step Solution

1
Identify the cause of the Automation start failure.
The Systems Manager Automation workflow fails to start because the administrator's IAM identity lacks the permission to pass the Automation service role to Systems Manager.
When starting a workflow that executes under a service role, AWS requires the initiating user to have the iam:PassRole permission to prevent privilege escalation.
2
Identify the cause of the Parameter Store decryption failure on the instances.
The instance-level command execution fails because the EC2 instance profile IAM role has only the AmazonSSMManagedInstanceCore policy, which does not grant access to custom Parameter Store parameters or custom KMS keys.
AWS Systems Manager Agent runs commands on the EC2 instance using the credentials of the attached instance profile. The profile must be explicitly granted access to retrieve the parameter and decrypt it using the corresponding KMS key.
3
Configure the required permissions for the administrator and the EC2 instances.
Apply iam:PassRole to the administrator's policy, and apply ssm:GetParameter and kms:Decrypt to the EC2 instance profile's IAM role.
These updates satisfy both authorization requirements (initiating the automation workflow and decrypting secure credentials on the managed nodes).

Key Concept

Authorizing AWS Systems Manager Automation and providing managed nodes with secure access to KMS-encrypted Parameters
Estimated Time:3m 0s
Question 263Question →

A SysOps Administrator is monitoring an enterprise file synchronization agent that outputs space-delimited log entries to Amazon CloudWatch Logs. The log entries are formatted as follows:

`[Date] [Time] [AgentID] [SyncStatus] [DurationMs] [FilesSynced]`

An example log entry is:

`2026-07-14 17:30:00 AGENT-402 SUCCESS 1250 45`

The administrator needs to configure a CloudWatch metric filter to track the total number of files synced across all agents, but only for sync operations that completed successfully.

Which configuration will meet these requirements?

Show answer & explanation

Answer: Create a metric filter with the filter pattern `[date, time, agent_id, status = SUCCESS, duration, files_synced]` and set the metric value to `$files_synced`.

Answer

Create a metric filter with the filter pattern `[date, time, agent_id, status = SUCCESS, duration, files_synced]` and set the metric value to `$files_synced`.
The correct configuration uses the space-delimited pattern syntax `[date, time, agent_id, status = SUCCESS, duration, files_synced]`. Since the log entries are space-delimited, mapping them sequentially in brackets allows the metric filter to parse each field. Specifying `status = SUCCESS` filters the log events. Setting the metric value to `$files_synced` ensures that the numeric value in the sixth field is published to the custom CloudWatch metric, allowing CloudWatch to aggregate the total number of files synced.

Step-by-Step Solution

1
Analyze the log format and identify the filter pattern style.
The log format is space-delimited text. The metric filter pattern must use bracket syntax `[...]` to define the fields in sequential order.
Since the log is not in JSON format, JSON path querying cannot be used. Space-delimited logs require positional mapping of fields within brackets.
2
Formulate the filter pattern matching condition.
Map the fields: `[date, time, agent_id, status = SUCCESS, duration, files_synced]`. This filters events where the fourth field (status) is exactly SUCCESS.
We must only count files from sync operations that completed successfully, so we filter by status.
3
Determine the metric value assignment.
Assign `$files_synced` as the metric value.
To track the total number of files synced rather than just the number of sync occurrences, the metric filter must extract the numeric value from the sixth field, which is referenced as `$files_synced`.

Key Concept

CloudWatch Logs Metric Filters parse log data using pattern matching for space-delimited or JSON events and publish custom metrics based on extracted values.
Question 264Question →

A SysOps administrator needs to configure automated remediation for non-compliant Amazon EC2 instances. When an EC2 instance is flagged as non-compliant by the AWS Config rule `ec2-instance-no-public-ip`, the instance must be stopped automatically using the Systems Manager Automation document `AWS-StopEC2Instance`.

The administrator creates an Amazon EventBridge rule that triggers when AWS Config detects a compliance change for the rule.

How should the SysOps administrator configure the Amazon EventBridge rule target and the associated IAM permissions to automate this remediation?

Show answer & explanation

Answer: Configure the EventBridge rule target as Systems Manager Automation, specifying the `AWS-StopEC2Instance` document. Use an Input Transformer to map the non-compliant resource ID from `$.detail.resourceId` to the `InstanceId` parameter of the document. Assign the target an IAM execution role that contains permissions for `ssm:StartAutomationExecution` and `iam:PassRole` for the Systems Manager Automation service role.

Answer

Configure the EventBridge rule target as Systems Manager Automation, specifying the `AWS-StopEC2Instance` document, using an Input Transformer to map `$.detail.resourceId` to the `InstanceId` parameter, and assigning an IAM execution role with `ssm:StartAutomationExecution` and `iam:PassRole` permissions.
To remediate the non-compliant EC2 instance, the EventBridge rule target must invoke Systems Manager Automation using the `AWS-StopEC2Instance` document. An Input Transformer is required to dynamically map the resource ID (the EC2 instance ID) from the AWS Config compliance event payload (`$.detail.resourceId`) to the `InstanceId` parameter of the Automation document. The IAM execution role associated with the EventBridge target must have `ssm:StartAutomationExecution` permissions to initiate the execution and `iam:PassRole` permissions to pass the execution role that executes the stop API call.

Step-by-Step Solution

1
Select the correct Systems Manager capability for the remediation task.
Identify that stopping an EC2 instance is an AWS API-level task executed via a Systems Manager Automation document (`AWS-StopEC2Instance`), not via Run Command.
Run Command is for OS-level execution, whereas Automation is for AWS resource lifecycle actions.
2
Map the resource identifier from the AWS Config event payload to the target parameters.
Configure an EventBridge Input Transformer to extract the non-compliant instance ID using the JSONPath expression `$.detail.resourceId` and assign it to the `InstanceId` parameter of the Automation document.
EventBridge Event Patterns only filter events; parameter mapping requires an Input Transformer.
3
Configure the required IAM permissions for the EventBridge execution role.
Ensure the IAM role assigned to the EventBridge target contains `ssm:StartAutomationExecution` and `iam:PassRole` permissions targeting the Automation service role.
EventBridge must have permissions to initiate the automation execution and pass the service role that contains `ec2:StopInstances` permissions to Systems Manager.

Key Concept

Configuring Systems Manager Automation as an EventBridge target requires mapping the target parameters using an Input Transformer and granting EventBridge both `ssm:StartAutomationExecution` and `iam:PassRole` permissions.
Question 265Question →

A company has a critical application that stores backup archives in a primary Amazon S3 bucket. A SysOps Administrator must configure S3 Cross-Region Replication (CRR) to replicate these archives to a destination bucket in a secondary AWS Region for disaster recovery compliance. Additionally, the application database runs on an Amazon RDS for PostgreSQL instance. The database must be configured to automatically fail over to a standby instance in a different Availability Zone with minimal downtime if the primary instance becomes unavailable, while maintaining automated backups. Which actions must the SysOps Administrator take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Multi-AZ deployment on the RDS for PostgreSQL DB instance to provide automatic failover to a synchronous standby instance in another Availability Zone.; Enable S3 Versioning on both the source and destination S3 buckets, and configure a replication rule on the source bucket targeting the destination bucket.

Answer

Enable Multi-AZ deployment on the RDS for PostgreSQL DB instance, and enable S3 Versioning on both the source and destination S3 buckets while configuring the replication rule.
The solution requires configuring automated failover for RDS PostgreSQL and Cross-Region Replication for S3. Enabling Multi-AZ deployment on the RDS instance ensures synchronous replication and automated DNS failover to a standby instance in another Availability Zone. Enabling S3 Versioning on both source and destination S3 buckets is a mandatory prerequisite to configure S3 Cross-Region Replication successfully.

Step-by-Step Solution

1
Configure database high availability by modifying the RDS for PostgreSQL instance settings to enable the Multi-AZ deployment option.
Amazon RDS provisions a synchronous standby replica in a different Availability Zone and configures automatic DNS failover.
This satisfies the requirement for automatic database failover with minimal downtime.
2
Enable S3 Versioning on the source S3 bucket and the destination S3 bucket in the secondary Region.
Both buckets are now prepared to track object versions, which is a requirement for replication.
S3 Versioning is a strict prerequisite for Cross-Region Replication.
3
Configure the S3 replication rule on the source bucket targeting the destination bucket.
S3 automatically replicates new objects and object versions to the secondary Region.
This satisfies the disaster recovery replication compliance requirement.

Key Concept

Configuring RDS Multi-AZ for automated database failover and configuring S3 Cross-Region Replication (which requires versioning on both source and destination buckets) for backup storage reliability.
Question 266Question →

A SysOps Administrator is troubleshooting a fleet of Amazon EC2 instances that fail to appear as managed nodes in the AWS Systems Manager console. The SSM Agent is installed and running on all instances, but no IAM role is currently attached to them. The instances are located in a public subnet with a route to an Internet Gateway and have public IPv4 addresses. Which action will allow the instances to register as managed nodes with Systems Manager?

Show answer & explanation

Answer: Attach an IAM instance profile containing the AmazonSSMManagedInstanceCore managed policy to the EC2 instances.

Answer

Attach an IAM instance profile containing the AmazonSSMManagedInstanceCore managed policy to the EC2 instances.
For an EC2 instance to register as a managed node with AWS Systems Manager, it must meet three requirements: the SSM Agent must be installed and running, the instance must have network connectivity to Systems Manager endpoints, and an IAM instance profile containing the AmazonSSMManagedInstanceCore policy must be attached. Since the SSM Agent is running and the instances have internet access, attaching the correct IAM instance profile completes the prerequisites and allows registration.

Step-by-Step Solution

1
Verify that the SSM Agent is running on the instances and that they have network connectivity to the Systems Manager service.
The SSM Agent is running and the instances are in a public subnet with a route to an Internet Gateway.
This rules out agent status and network path issues.
2
Identify the authorization requirements for an EC2 instance to register as a managed node.
The instance must have an IAM instance profile attached that permits communication with the Systems Manager APIs.
Without an IAM role, the instance cannot authenticate and register with the service.
3
Select the correct IAM role configuration to attach to the instances.
Attach an IAM instance profile containing the AWS-managed AmazonSSMManagedInstanceCore policy.
This policy provides the minimum required permissions for Systems Manager core functionality.

Key Concept

Systems Manager Managed Node Prerequisites
Estimated Time:1m 0s
Question 267Question →

A company is using AWS Elastic Disaster Recovery (AWS DRS) to protect its on-premises virtual machines by replicating them to AWS. The company's security policy requires that all replication traffic and control plane communication occur privately over an existing AWS Direct Connect connection. No traffic is allowed to traverse the public internet. Which combination of actions must a SysOps Administrator perform to configure this environment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable the "Use private IP" option in the AWS DRS replication template.; Create interface VPC endpoints (AWS PrivateLink) for the AWS DRS service in the target VPC, and configure the on-premises DNS to resolve the DRS endpoints to these VPC endpoints.

Answer

Enable the "Use private IP" option in the AWS DRS replication template, and create interface VPC endpoints (AWS PrivateLink) for the AWS DRS service in the target VPC while configuring on-premises DNS to resolve the endpoints privately.
The correct options are enabling the private IP option in the replication template and creating interface VPC endpoints for DRS. By enabling the "Use private IP" setting, data replication traffic (port 1500) will be directed to the staging area's private IP addresses, routing it over the Direct Connect link. Since the source servers have no internet access, they cannot reach the public AWS DRS endpoints; therefore, interface VPC endpoints must be provisioned in the target VPC to allow the agent to perform control plane actions (port 443) privately.

Step-by-Step Solution

1
Configure the AWS DRS replication template to use private IP addresses.
The Replication Agent will send replication data (port 1500) to the private IP addresses of the replication servers in the staging subnet instead of public IPs.
This keeps data replication traffic on the private AWS Direct Connect path.
2
Create interface VPC endpoints (AWS PrivateLink) for the DRS service (com.amazonaws.[region].drs) in the target VPC.
Private IP addresses are allocated in the VPC subnets for DRS control plane communication.
Since the on-premises servers lack internet access, they must communicate with the DRS control plane via these private endpoints.
3
Configure the DNS on-premises to resolve the DRS control plane URLs to the interface VPC endpoint IPs.
The agent successfully establishes control plane communication over Direct Connect without traversing the public internet.
Ensures the agent connects to the interface endpoints for control plane actions.

Key Concept

AWS Elastic Disaster Recovery private replication and control plane connectivity over Direct Connect/VPN using private IPs and Interface VPC Endpoints.
Question 268Question →

A SysOps Administrator is configuring an AWS Lambda function to stop underutilized EC2 instances. The administrator has already created the required IAM execution role for Lambda with the correct permissions. However, when the administrator attempts to update the Lambda function configuration to use this execution role, the AWS Management Console displays an Access Denied error.

Which permission must be granted to the SysOps Administrator's IAM user policy to resolve this error?

Show answer & explanation

Answer: iam:PassRole on the Lambda execution role resource

Answer

iam:PassRole on the Lambda execution role resource
The correct answer is the option specifying 'iam:PassRole on the Lambda execution role resource'. When configuring an AWS service to assume an IAM role, the user performing the configuration action must have the iam:PassRole permission. This security control ensures that users cannot escalate their privileges by passing a highly privileged role to a service that they could then interact with or trigger.

Step-by-Step Solution

1
Identify the action causing the failure
The SysOps Administrator is attempting to associate (pass) an IAM role to an AWS service (AWS Lambda).
AWS services require permission to assume roles. To prevent users from passing roles with higher privileges than they themselves possess, AWS requires the configuring user to have the iam:PassRole permission.
2
Determine the required IAM permission for the configuring user
The configuring user's policy must include the iam:PassRole action with the Lambda execution role's ARN as the resource.
This grants the administrator the capability to delegate the role's permissions to the AWS Lambda service.

Key Concept

Delegating permissions to AWS services using the iam:PassRole policy permission
Estimated Time:1m 0s
Question 269Question →

An organization's security policy requires all Amazon Aurora DB clusters to have copy tags to snapshots enabled. A SysOps Administrator needs to use AWS Config to evaluate compliance and automatically remediate non-compliant DB clusters using an AWS Systems Manager (SSM) Automation document. The remediation must run with a specific service role.

Which of the following configurations must be implemented to ensure the automated remediation executes successfully? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the iam:PassRole permission for the remediation IAM role to the IAM identity configuring the remediation action in AWS Config.; Configure the IAM role used for remediation with a trust policy that allows the AWS Systems Manager service principal (ssm.amazonaws.com) to assume the role.

Answer

The correct configurations are: granting the iam:PassRole permission to the IAM identity configuring remediation, and configuring the remediation IAM role to trust the Systems Manager service principal (ssm.amazonaws.com).
To set up automated remediation using AWS Config rules and Systems Manager (SSM) Automation, two primary configuration requirements must be satisfied. First, the IAM identity (such as a user or role) that configures the remediation action in AWS Config must possess the iam:PassRole permission for the remediation execution role, allowing them to associate it with the remediation action. Second, because Systems Manager Automation executes the actual remediation API calls on behalf of the user, the remediation role's trust policy must allow the ssm.amazonaws.com service principal to assume it.

Step-by-Step Solution

1
Verify the role-based execution pattern of AWS Config automated remediation.
Determine that Config delegates execution of remediation to Systems Manager Automation.
This identifies Systems Manager (ssm.amazonaws.com) as the principal that must assume the remediation execution role.
2
Identify the identity-based permission needed to delegate the remediation role.
Verify that the SysOps Administrator or the pipeline configuring AWS Config must have the iam:PassRole permission.
The AWS service needs permission to pass the role to Systems Manager to run the remediation task on the resource.
3
Configure the trust policy of the execution role.
Ensure the trust policy allows ssm.amazonaws.com to assume the role.
Without this trust relationship, Systems Manager cannot assume the execution role to run the remediation document.

Key Concept

AWS Config Automated Remediation Configuration and IAM Permissions
Question 270Question →

A SysOps administrator is configuring an automated response to stop underutilized Amazon EC2 instances. The administrator sets up an Amazon EventBridge rule that is triggered when a specific Amazon CloudWatch alarm enters the ALARM state. The EventBridge rule is configured with a target to execute the `AWS-StopEC2Instance` Systems Manager (SSM) Automation document using a custom execution role named `SSMAutomationExecutionRole`. The `SSMAutomationExecutionRole` has the policy permissions to stop EC2 instances and trusts `ssm.amazonaws.com`. During testing, the alarm triggers but the execution fails to start.

Which configuration change will allow the EventBridge rule to successfully trigger the Systems Manager Automation?

Show answer & explanation

Answer: Grant the EventBridge execution role the `ssm:StartAutomationExecution` permission and the `iam:PassRole` permission for the `SSMAutomationExecutionRole`.

Answer

Grant the EventBridge execution role the `ssm:StartAutomationExecution` permission and the `iam:PassRole` permission for the `SSMAutomationExecutionRole`.
For EventBridge to trigger a Systems Manager Automation execution using a specific execution role (AutomationAssumeRole), the role assigned to EventBridge must possess the `ssm:StartAutomationExecution` permission. Additionally, it must have the `iam:PassRole` permission for the target execution role (`SSMAutomationExecutionRole`) so that it can securely pass the role to Systems Manager for execution.

Step-by-Step Solution

1
Analyze the event-driven automation flow.
EventBridge detects the CloudWatch alarm state change and attempts to invoke the target Systems Manager Automation document using the specified execution role.
Understanding the path helps identify where authorization checks occur.
2
Identify the permissions needed by the invoking service (EventBridge).
EventBridge needs permission to start the execution (`ssm:StartAutomationExecution`) and must be authorized to pass the target IAM role (`iam:PassRole`) to Systems Manager.
Since EventBridge is executing a service on behalf of the user using a specific role, it must have the PassRole permission.
3
Configure the EventBridge target execution role policy.
Add the `iam:PassRole` permission pointing to the ARN of the `SSMAutomationExecutionRole` in the EventBridge role's IAM policy.
This grants EventBridge the authority to delegate tasks to Systems Manager under the security context of the specified role.

Key Concept

Delegating permissions to AWS services using the PassRole permission when configuring event-driven remediation targets.
Question 271Question →

A SysOps Administrator uses AWS CloudFormation to manage a production infrastructure stack. The deployment is executed using a dedicated CloudFormation service role. The Administrator initiates a stack update to deploy a new version of an Amazon ECS service, which references a newly created ECS Task Execution IAM Role. During the deployment, the stack update fails because the service cannot start the new tasks, and CloudFormation transitions to UPDATE_ROLLBACK_IN_PROGRESS. However, the rollback operation also fails, and the stack ends up in the UPDATE_ROLLBACK_FAILED state. Upon reviewing the CloudFormation events, the Administrator discovers that the rollback failed because CloudFormation was unauthorized to associate the original ECS Task Execution Role back to the ECS service. Which of the following is the root cause of this failure, and how should it be resolved?

Show answer & explanation

Answer: The CloudFormation service role lacks the iam:PassRole permission for the original ECS Task Execution Role. To resolve this, attach an IAM policy granting the iam:PassRole permission for the original role to the CloudFormation service role, and then select the Continue update rollback action in the CloudFormation console.

Answer

The root cause is that the CloudFormation service role lacks the iam:PassRole permission for the original ECS Task Execution Role. The solution is to attach a policy granting this permission to the CloudFormation service role and choose Continue update rollback in the console.
The correct answer correctly identifies that the CloudFormation service role requires the iam:PassRole permission for the original ECS Task Execution Role to successfully revert the service configuration during rollback. Applying this permission to the service role and initiating 'Continue update rollback' allows the stack to successfully revert to its previous stable state.

Step-by-Step Solution

1
Analyze the CloudFormation stack state and the specific authorization error in the stack events.
Identify that the rollback failed (UPDATE_ROLLBACK_FAILED) specifically due to lack of authorization to associate the original ECS Task Execution Role.
To determine whether the issue lies with service-level execution permissions (the CloudFormation service role) or user permissions.
2
Update the CloudFormation service role permissions.
Attach an IAM policy allowing iam:PassRole on the original ECS Task Execution Role ARN to the CloudFormation service role.
When CloudFormation updates or rolls back an ECS service to use an IAM role, the CloudFormation service role must have explicit permission to pass that role to the ECS service.
3
Resume the failed rollback operation in the CloudFormation console.
Execute the 'Continue update rollback' action on the stack.
Stacks in UPDATE_ROLLBACK_FAILED cannot be updated or modified until the rollback is successfully completed or bypassed.

Key Concept

Troubleshooting CloudFormation rollback failures caused by missing service role permissions (specifically iam:PassRole) during ECS service updates.
Question 272Question →

A SysOps administrator is configuring a daily backup plan in AWS Backup to protect Amazon RDS databases. The administrator wants to use a custom IAM role to execute the backup jobs. Which of the following configuration steps are required to allow AWS Backup to run the backup jobs using this custom role? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A trust policy on the custom IAM role that allows the backup.amazonaws.com service principal to perform the sts:AssumeRole action; An IAM policy attached to the administrator's IAM identity that grants the iam:PassRole permission for the custom IAM role

Answer

The correct configurations are: a trust policy on the custom IAM role allowing the backup service to assume it, and an IAM policy on the administrator's identity allowing the role to be passed.
To delegate permissions to an AWS service like AWS Backup, the service needs a trust policy allowing it to assume the role via sts:AssumeRole. Additionally, the administrator configuring the service must have the iam:PassRole permission to safely associate that role with the service.

Step-by-Step Solution

1
Configure the trust relationship on the custom IAM role to trust the AWS Backup service.
The custom IAM role trust policy permits the backup.amazonaws.com service principal to execute the sts:AssumeRole API action.
This allows the AWS Backup service to dynamically assume the role and inherit its permissions when running backup jobs.
2
Configure the administrator's permissions to allow passing the role to AWS Backup.
The administrator's IAM policy is updated with the iam:PassRole action targeting the ARN of the custom IAM role.
This ensures the administrator is authorized to delegate the specific IAM role to the service, preventing unauthorized role escalation.

Key Concept

Delegating permissions to AWS services using trust relationships and PassRole authorization
Estimated Time:1m 0s
Question 273Question →

A SysOps Administrator is troubleshooting a cross-account Amazon S3 Cross-Region Replication (CRR) setup. The source bucket in Account A (us-east-1) contains objects encrypted with a customer managed KMS key. The destination bucket in Account B (us-west-2) is configured to store the replicated objects. Versioning is enabled on both buckets, and an IAM role has been created in Account A to perform the replication. However, only unencrypted objects are successfully appearing in the destination bucket. Which action should the administrator take to ensure the encrypted objects are replicated?

Show answer & explanation

Answer: Configure the replication rule to include KMS-encrypted objects, specify the destination KMS key in Account B, and grant the replication IAM role permissions to decrypt using the Account A key and encrypt using the Account B key.

Answer

Configure the replication rule to include KMS-encrypted objects, specify the destination KMS key in Account B, and grant the replication IAM role permissions to decrypt using the Account A key and encrypt using the Account B key.
The correct answer is to modify the replication rule to explicitly enable replication of KMS-encrypted objects, configure the destination KMS key, and provide the replication IAM role with decrypt permissions on the source key and encrypt/generate data key permissions on the destination key. S3 replication excludes KMS-encrypted objects by default and requires these configuration and permission updates to successfully replicate them.

Step-by-Step Solution

1
Enable KMS-encrypted object replication in the S3 replication rule configuration.
Amazon S3 identifies objects encrypted with SSE-KMS as eligible for replication.
By default, S3 replication excludes objects encrypted using KMS keys. This must be explicitly enabled under SourceSelectionCriteria.
2
Update the replication IAM role policy in Account A to allow kms:Decrypt on the source KMS key.
The replication service gains permission to read and decrypt the source encrypted objects.
S3 needs to decrypt the source objects in Account A before they can be replicated.
3
Update the replication IAM role policy in Account A to allow kms:Encrypt and kms:GenerateDataKey on the destination KMS key in Account B.
The replication service gains permission to encrypt the replicated objects in the destination bucket.
The replication role must have permissions to encrypt the destination objects using Account B's KMS key.
4
Configure the KMS key policy in Account B to trust the replication IAM role from Account A.
The key policy in the destination account allows the replication IAM role from the source account to perform the necessary cryptographic operations.
Cross-account access requires permissions to be granted on both the IAM role and the resource policy of the destination KMS key.

Key Concept

Replication of KMS-encrypted objects in S3 requires explicit activation in the replication rule, decryption permissions on the source KMS key, and encryption permissions on the destination KMS key.
Estimated Time:2m 30s
Question 274Question →

An organization hosts a production application on AWS Elastic Beanstalk. During updates, the application must maintain full capacity to handle consistent user traffic. Additionally, if the new application version fails health checks, the update must automatically roll back immediately with minimal impact on the production environment. Which two Elastic Beanstalk deployment policies should a SysOps Administrator configure to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Immutable; Traffic Splitting

Answer

The correct options are Immutable and Traffic Splitting.
The correct strategies are Immutable and Traffic Splitting. Immutable deployments launch a secondary Auto Scaling group with the new version, ensuring that the original instances remain untouched and active at 100% capacity. If the deployment fails health checks, Elastic Beanstalk automatically deletes the temporary Auto Scaling group, rolling back immediately. Traffic Splitting deployments also spin up a complete set of new instances and route a portion of traffic to them. If health checks fail during the evaluation period, traffic is shifted back to the original instances, and the new instances are terminated.

Step-by-Step Solution

1
Analyze the capacity requirement.
The application must maintain 100% capacity during updates. This rules out All at once and standard Rolling deployments, both of which take existing instances out of service, reducing capacity below 100%.
Ensuring capacity does not drop protects the system from degradation under traffic spikes.
2
Analyze the rollback requirement.
The rollback must be automatic, immediate, and clean. While Rolling with additional batch preserves capacity, it modifies instances in place. If it fails, rolling back requires a new rolling deployment of the older version, which is slow and not clean.
In-place modifications require inverse modifications to restore the environment, delaying recovery.
3
Identify strategies that satisfy both requirements.
Immutable and Traffic Splitting both provision a complete duplicate set of instances alongside the original environment (maintaining 100% capacity) and can roll back automatically by terminating the new resources if health checks fail.
Deploying to a separate set of resources avoids mutating the running production environment until it is proven stable.

Key Concept

AWS Elastic Beanstalk deployment policies and their capacity vs. rollback trade-offs.
Question 275Question →

A SysOps Administrator needs to implement automated compliance remediation to stop any Amazon EC2 instance that is found to be non-compliant with the AWS Config managed rule `ec2-instance-no-public-ip`. The administrator wants the compliance check and the remediation to happen automatically with the least operational overhead.

Which approach should the administrator take to meet these requirements?

Show answer & explanation

Answer: Associate the Systems Manager Automation document `AWS-StopEC2Instance` as a remediation action directly within the AWS Config rule, enable automatic remediation, and select the resource ID parameter mapping.

Answer

Associate the Systems Manager Automation document `AWS-StopEC2Instance` as a remediation action directly within the AWS Config rule, enable automatic remediation, and select the resource ID parameter mapping.
The correct option is to associate the Systems Manager Automation document directly within the AWS Config rule, enable automatic remediation, and map the resource ID. This uses the native automated remediation capability of AWS Config, which directly triggers the SSM Automation document whenever a resource is evaluated as non-compliant.

Step-by-Step Solution

1
Identify the native mechanism for automatic compliance remediation in AWS Config.
AWS Config provides built-in integration to trigger AWS Systems Manager Automation documents directly without external routing services.
Using native capabilities minimizes operational overhead and reduces points of failure.
2
Determine the parameter mapping requirements.
The target resource ID (the EC2 instance ID) must be mapped to the Automation document's input parameters.
This ensures that Systems Manager applies the action to the specific non-compliant resource flagged by AWS Config.
3
Verify execution requirements.
An IAM execution role with permissions to stop the EC2 instance must be defined, and the configuring administrator must have permissions to pass this role.
Security controls require explicit role delegation to allow automated tasks to run on AWS resources.

Key Concept

AWS Config native automated remediation leverages Systems Manager Automation documents to automatically correct non-compliant resources using resource ID mappings.
Estimated Time:1m 30s
Question 276Question →

A SysOps administrator is configuring event-driven remediation to automatically stop any Amazon EC2 instance that is flagged as non-compliant by an AWS Config rule. The administrator plans to use AWS Systems Manager Automation to execute the remediation runbook. The configuration must follow the principle of least privilege. Which two actions must the administrator take to ensure the auto-remediation executes successfully? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role for Systems Manager with a trust policy that allows ssm.amazonaws.com to assume the role, and attach a policy allowing the ec2:StopInstances action.; Attach an IAM policy to the administrator's identity that allows the iam:PassRole action targeting the Systems Manager Automation role.

Answer

To configure event-driven auto-remediation in AWS Config using Systems Manager, the administrator must create an IAM role for Systems Manager with a trust policy that allows ssm.amazonaws.com to assume the role (along with ec2:StopInstances permissions), and attach an IAM policy to the administrator's identity that allows the iam:PassRole action targeting the Systems Manager Automation role.
To implement auto-remediation in AWS Config using Systems Manager Automation, two critical IAM configurations are needed: first, an IAM service role (with a trust policy for ssm.amazonaws.com) containing the necessary permissions (such as ec2:StopInstances) to perform the remediation action on the target resource; second, the configuring administrator needs iam:PassRole permission on that service role to grant Systems Manager the authority to assume the role and execute the tasks.

Step-by-Step Solution

1
Define the remediation role for Systems Manager Automation.
An IAM role is created with a trust policy allowing ssm.amazonaws.com to assume it, and an inline or managed policy allowing the ec2:StopInstances action.
Systems Manager needs permissions to stop the EC2 instance on behalf of the administrator.
2
Configure the administrator's permissions to delegate the role.
The iam:PassRole permission is added to the administrator's IAM user or role policy, referencing the ARN of the Systems Manager Automation role.
This allows the administrator to pass the role to Systems Manager when setting up the remediation action.
3
Configure the remediation action in AWS Config.
The AWS Config rule is updated with an automatic remediation action that specifies the target as the Systems Manager Automation runbook and passes the SSM role.
To automate the response immediately upon detecting non-compliance.

Key Concept

Configuring event-driven remediation in AWS Config using Systems Manager Automation requires establishing a service trust relationship, granting the service permissions to take action, and authorizing the administrative user to pass the execution role using the iam:PassRole permission.
Estimated Time:2m 30s
Question 277Question →

A SysOps Administrator is configuring AWS Systems Manager Patch Manager to apply a custom patch baseline to a fleet of Amazon EC2 instances. The Administrator wants to organize these instances into a patch group named 'HR-Servers' to ensure they are patched together. Which of the following actions are required to successfully associate the EC2 instances with the custom patch baseline? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Tag the EC2 instances with a tag key of 'Patch Group' and a tag value of 'HR-Servers'.; Register the 'HR-Servers' patch group with the custom patch baseline in the AWS Systems Manager console.

Answer

To associate the instances with the custom baseline, the Administrator must tag the EC2 instances using the case-sensitive key 'Patch Group' with the value 'HR-Servers', and register the patch group name with the custom patch baseline in AWS Systems Manager Patch Manager.
To map instances to a specific patch baseline, you must use the exact, case-sensitive tag key 'Patch Group' on the instances. You must then register that patch group name with the desired custom patch baseline in AWS Systems Manager. This two-part mapping ensures the correct instances are targeted and patched with the correct rules.

Step-by-Step Solution

1
Apply a tag to the target EC2 instances.
Instances are configured with Key='Patch Group' and Value='HR-Servers'.
This establishes the logical grouping recognized by Systems Manager.
2
Register the patch group with the baseline.
The patch group 'HR-Servers' is mapped to the custom patch baseline in Systems Manager Patch Manager.
This tells Systems Manager to apply the custom baseline configurations rather than the default baseline to this patch group.

Key Concept

SSM Patch Manager Patch Group and Baseline Association
Question 278Question →

A SysOps administrator in a production AWS account (Account A: `111122223333`) is configuring cross-account logging. The administrator wants to stream application logs from a CloudWatch log group named `AppLogs` in Account A to a centralized CloudWatch Logs destination named `CentralLogDestination` in a security account (Account B: `444455556666`).

The administrator runs the following AWS CLI command in Account A:

bash
aws logs put-subscription-filter \
--log-group-name "AppLogs" \
--filter-name "CentralFilter" \
--filter-pattern "" \
--destination-arn "arn:aws:logs:us-east-1:444455556666:destination:CentralLogDestination"

The command fails with the following error:

`An error occurred (AccessDeniedException) when calling the PutSubscriptionFilter operation.`

Which configuration issue is the root cause of this failure?

Show answer & explanation

Answer: The access policy of the destination CentralLogDestination in Account B does not grant the logs:PutSubscriptionFilter permission to Account A (111122223333).

Answer

The access policy of the destination CentralLogDestination in Account B does not grant the logs:PutSubscriptionFilter permission to Account A (111122223333).
The correct answer is that the destination's access policy in the target account must grant logs:PutSubscriptionFilter permission to the source account. When creating a cross-account log subscription filter, CloudWatch Logs validates that the destination allows the source account to perform this action. If the destination's access policy is missing or misconfigured, the API call fails immediately with an AccessDeniedException.

Step-by-Step Solution

1
Understand the API flow of a cross-account CloudWatch Logs subscription filter setup.
Creating a subscription filter in a source account targeting a destination in another account requires authorization at the target resource level.
This helps identify where permissions are checked during the PutSubscriptionFilter API call.
2
Check the role of the destination access policy.
The destination resource (AWS::Logs::Destination) controls access via a resource-based policy that must explicitly list the source account ID and the logs:PutSubscriptionFilter action.
If this policy is missing or does not grant access to the source account, the PutSubscriptionFilter API call will immediately return an AccessDeniedException.
3
Differentiate between API call authorization and log delivery execution permissions.
The destination's execution role trust policy (trusting logs.amazonaws.com) is evaluated when log events are actually being delivered, not when the filter is registered.
This eliminates the role's trust policy as the cause of the immediate PutSubscriptionFilter AccessDeniedException.

Key Concept

Cross-account log subscription filter permissions rely on resource-based policies attached to the CloudWatch Logs Destination.
Estimated Time:2m 30s
Question 279Question →

A SysOps Administrator is configuring cross-account Amazon S3 Same-Region Replication (SRR) between a source bucket in Account A and a destination bucket in Account B. The source bucket contains objects encrypted with a customer managed AWS KMS key in Account A. The administrator creates an IAM replication role in Account A and configures the replication rule on the source bucket, but the objects fail to replicate to the destination bucket. Which two configurations are required to resolve this issue? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the replication rule to enable replication of KMS-encrypted objects, and grant the replication IAM role decrypt permissions for the customer managed KMS key in Account A.; Grant the replication IAM role in Account A encrypt permissions on the KMS key in Account B, and update the Account B key policy to trust the replication IAM role.

Answer

To resolve the replication failure, the replication rule must be configured to replicate KMS-encrypted objects with decrypt permissions for the source KMS key, and the replication IAM role must be granted encrypt permissions on the destination KMS key along with an updated key policy in the destination account.
To replicate objects encrypted with a customer managed KMS key, replication of KMS-encrypted objects must be explicitly enabled in the replication rule, and the replication IAM role must have decrypt permissions for the source KMS key. Additionally, because the destination bucket is in a different account, the replication IAM role needs permissions to encrypt objects using the destination KMS key, and the destination KMS key policy in Account B must be updated to trust the replication IAM role in Account A.

Step-by-Step Solution

1
Enable KMS-encrypted object replication in the replication rule.
Amazon S3 will attempt to replicate KMS-encrypted objects.
By default, S3 replication does not replicate objects encrypted with AWS KMS customer managed keys.
2
Grant the replication IAM role decrypt permissions on the source KMS key.
The replication role can decrypt the source objects to replicate them.
The S3 replication service requires access to decrypt the source objects before it can copy them.
3
Grant the replication IAM role encrypt permissions on the destination KMS key and update the key policy in Account B.
The replication role can encrypt objects using the KMS key in the destination account.
For cross-account replication with KMS, the source replication role needs cross-account permissions to use the destination KMS key, which requires both IAM permission and destination key policy permission.

Key Concept

Cross-account S3 replication with KMS encrypted objects requires explicit replication configuration enablement, source decrypt permissions, and destination cross-account encrypt permissions on the respective KMS keys.
Question 280Question →

A SysOps Administrator is setting up an AWS Config rule to evaluate whether Amazon DynamoDB tables have point-in-time recovery (PITR) enabled. The administrator wants to configure automated remediation using the AWS Systems Manager (SSM) Automation document AWS-EnableDynamoDbPointInTimeRecovery. Which of the following configuration steps are required to implement this automated remediation successfully? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the administrator's IAM identity the iam:PassRole permission for the Systems Manager Automation execution role.; Configure the trust policy of the Systems Manager Automation execution role to trust ssm.amazonaws.com and attach a policy allowing dynamodb:UpdateContinuousBackups.

Answer

Grant the administrator's IAM identity the iam:PassRole permission for the Systems Manager Automation execution role, and configure the trust policy of the Systems Manager Automation execution role to trust ssm.amazonaws.com and attach a policy allowing dynamodb:UpdateContinuousBackups.
To set up automated remediation for AWS Config rules using Systems Manager (SSM) Automation, two key IAM configurations are required: First, the Systems Manager service must be trusted to assume the execution role (ssm.amazonaws.com) and must have appropriate permissions (such as updating continuous backups on DynamoDB). Second, the IAM identity of the administrator who is configuring the remediation must have the iam:PassRole permission to pass the execution role to Systems Manager.

Step-by-Step Solution

1
Configure the execution role for the remediation action.
An IAM role is created with a trust policy allowing ssm.amazonaws.com to assume it, and a permission policy allowing dynamodb:UpdateContinuousBackups.
Systems Manager Automation requires permissions to modify the DynamoDB point-in-time recovery setting on the non-compliant tables.
2
Ensure the administrator configuring the remediation has permission to pass the role.
The administrator's IAM user or role is granted the iam:PassRole permission targeting the Systems Manager Automation execution role.
When associating an execution role with a remediation action, AWS requires the configuring user to have permissions to pass that role to the service.

Key Concept

AWS Config Rules automated remediation requires an execution role trusted by Systems Manager and iam:PassRole permissions granted to the administrator setting up the configuration.
Estimated Time:1m 30s
PreviousPage 14 / 49Next
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin