All practice questions

976 questions

All types976 Multiple choice502 Multiple select450 Ordering24

A SysOps administrator is reviewing recommendations to optimize AWS infrastructure spending. The administrator wants to identify underutilized resources using AWS Trusted Advisor checks.

Which two of the following findings are reported by AWS Trusted Advisor cost optimization checks? (Select TWO.)

Select all that apply

Unassociated Elastic IP Addresses

Idle Load Balancers

Detailed CloudWatch monitoring enabled on EC2 instances

Amazon S3 lifecycle rules that attempt to transition objects to a warmer storage class

Amazon S3 buckets containing untagged resources that have not been activated in the billing console

Show answer & explanation

Answer: Unassociated Elastic IP Addresses; Idle Load Balancers

Answer

Unassociated Elastic IP Addresses and Idle Load Balancers

AWS Trusted Advisor includes specific cost optimization checks to identify resources that are running but not being utilized effectively. The checks for 'Unassociated Elastic IP Addresses' and 'Idle Load Balancers' directly identify unused network resources that incur ongoing hourly charges, allowing administrators to release or delete them to reduce costs.

Step-by-Step Solution

Review the purpose of AWS Trusted Advisor cost optimization checks, which focus on identifying unused, underutilized, or idle active resources that incur fees.

Identify that checks such as idle load balancers and unassociated Elastic IP addresses are primary sources of unnecessary spend flagged by Trusted Advisor.

This establishes the scope of Trusted Advisor cost checks.

Differentiate between actual Trusted Advisor active resource cost checks and general configuration mistakes (such as lifecycle policies, tagging errors, or standard vs. detailed monitoring configurations).

Recognize that invalid transitions, untagged resources, and CloudWatch detailed monitoring settings are not checked by Trusted Advisor's cost module.

This eliminates the distractors.

Key Concept

AWS Trusted Advisor Cost Optimization Checks

Estimated Time:1m 0s

Question 322Question →

A company has an AWS Transit Gateway connecting three VPCs to their on-premises datacenter. The network connects to the on-premises network via two paths: a primary path using an AWS Direct Connect connection with a Transit VIF terminating on a Direct Connect Gateway associated with the Transit Gateway, and a backup path using an AWS Site-to-Site VPN connection attached directly to the Transit Gateway. Both connections use BGP to dynamically advertise the on-premises network prefix $10.0.0.0/16$ . During a failover simulation, the SysOps Administrator notices that traffic destined for the on-premises network continuously routes over the backup Site-to-Site VPN connection even though the Direct Connect path is healthy and operational. Which of the following actions should the SysOps Administrator take to resolve this routing issue? Select two.

Select all that apply

Remove any static routes for the on-premises prefix pointing to the Site-to-Site VPN attachment from the Transit Gateway route table.

Ensure that the on-premises router does not advertise more specific prefixes over the Site-to-Site VPN connection than over the Direct Connect connection.

Configure the Transit Gateway route table to increase the BGP Multi-Exit Discriminator (MED) value for the routes received via the Direct Connect Gateway attachment.

Prepend the on-premises Autonomous System Number (ASN) multiple times on the BGP advertisements sent over the Direct Connect connection.

Disable route propagation for the Site-to-Site VPN attachment on the Transit Gateway route table.

Show answer & explanation

Answer: Remove any static routes for the on-premises prefix pointing to the Site-to-Site VPN attachment from the Transit Gateway route table.; Ensure that the on-premises router does not advertise more specific prefixes over the Site-to-Site VPN connection than over the Direct Connect connection.

Answer

Remove any static routes for the on-premises prefix pointing to the Site-to-Site VPN attachment from the Transit Gateway route table, and ensure that the on-premises router does not advertise more specific prefixes over the Site-to-Site VPN connection than over the Direct Connect connection.

Under normal routing operations on an AWS Transit Gateway, routes are evaluated by prefix length (longest prefix match first) and then by static definition over dynamic propagation. If a static route pointing to the VPN attachment is present, it will always be preferred over dynamically learned BGP routes from a Direct Connect Gateway. Additionally, if the on-premises router advertises more specific subnets over the VPN, the Transit Gateway will forward traffic via the VPN due to longest prefix match. Removing the static route and ensuring identical prefix advertisements over both connections forces the Transit Gateway to use dynamic routing logic, which inherently prefers Direct Connect paths over Site-to-Site VPN paths when the prefix and AS-Path lengths match.

Step-by-Step Solution

Inspect the Transit Gateway route tables for static routes.

Identify if a static route to the VPN attachment exists for the prefix.

Static routes override dynamically learned BGP routes regardless of metric or interface type.

Remove the identified static route targeting the VPN attachment.

The Transit Gateway route table now evaluates dynamic BGP routing advertisements from both paths.

To allow BGP path selection to determine the active route.

Analyze BGP advertisements on the on-premises router.

Verify if prefix lengths differ (e.g., VPN advertising sub-prefixes while Direct Connect advertises the summary prefix).

Longest prefix match is evaluated before routing protocol preferences.

Configure uniform prefix advertisements across both interfaces.

Ensure identical prefix lengths are advertised dynamically over both the VPN and Direct Connect paths.

To allow the Transit Gateway to select the Direct Connect path based on default path preferences and AS-Path length.

Key Concept

AWS Transit Gateway route evaluation order and path selection criteria for Direct Connect and Site-to-Site VPN.

Estimated Time:3m 0s

Question 323Question →

A SysOps administrator is troubleshooting a low cache hit ratio on an Amazon CloudFront distribution that serves a dynamic API. The application origin, hosted on EC2 instances behind an Application Load Balancer (ALB), requires the custom 'country-code' query string to return localized content, and the 'Authorization' header to authenticate each client request. Currently, the distribution's cache behavior is configured to forward all headers and query strings to the origin. Which configuration will maximize the cache hit ratio at the edge locations while ensuring the application still functions correctly?

Create a custom Cache Policy that includes only the 'country-code' query string parameter in the cache key, and does not include the 'Authorization' header. Create a custom Origin Request Policy that forwards the 'Authorization' header to the origin, and associate both policies with the default cache behavior.

Create a CNAME record at the zone apex in Amazon Route 53 pointing to the CloudFront distribution domain name, and configure a custom Cache Policy that includes both the 'country-code' query string and the 'Authorization' header in the cache key.

Configure Route 53 active-passive DNS failover routing to point to the ALB and a backup static origin, and configure the Cache Policy to include the 'Authorization' header while disabling query string caching.

Create a custom Cache Policy that excludes the 'Authorization' header from the cache key, and update the stateless network access control list (NACL) of the ALB subnets to deny outbound ephemeral port ranges (1024-65535) to protect the authorization tokens.

Show answer & explanation

Answer: Create a custom Cache Policy that includes only the 'country-code' query string parameter in the cache key, and does not include the 'Authorization' header. Create a custom Origin Request Policy that forwards the 'Authorization' header to the origin, and associate both policies with the default cache behavior.

Answer

The correct answer provides the optimal configuration by using a Cache Policy to define the cache key based only on the localized query string parameter, thereby keeping the cache hit ratio high. Simultaneously, the Origin Request Policy ensures that the authorization header is passed to the origin so that authentication checks succeed.

Step-by-Step Solution

Analyze cache behavior settings and separate caching keys from origin forwarding requirements.

Identify that the 'country-code' query string is required for caching variations, while the unique 'Authorization' header is only required by the origin server for validation.

Including unique headers like 'Authorization' in the cache key causes a low cache hit ratio because each client's request results in a unique cache key.

Create a custom Cache Policy in CloudFront.

Configure the Cache Policy to include 'country-code' as a query string cache key dependency and exclude the 'Authorization' header from the cache key settings.

This ensures CloudFront edge servers cache and serve common localized pages based on the country, maximizing cache hit rates.

Create a custom Origin Request Policy in CloudFront.

Configure the Origin Request Policy to forward the 'Authorization' header to the origin, while leaving it out of the cache key.

This allows the origin ALB and EC2 instances to receive the necessary credentials to authenticate the client requests.

Associate both policies with the distribution's cache behavior.

Apply the new Cache Policy and Origin Request Policy to the default cache behavior of the distribution.

This binds the new forwarding and caching logic to incoming client requests.

Key Concept

CloudFront Cache Policies determine what is cached (cache key), while Origin Request Policies determine what is sent to the origin. Separating these concerns allows forwarding credentials without destroying cache efficiency.

Question 324Question →

An application's frontend is distributed globally using an Amazon CloudFront distribution, with an Application Load Balancer (ALB) configured as the origin. A SysOps administrator needs to configure the apex domain (example.com) to route traffic to the CloudFront distribution. The administrator also wants to secure the origin by restricting direct public access to the ALB while ensuring client-to-ALB communication functions correctly. Which configuration correctly satisfies these routing and security requirements?

Create an Amazon Route 53 Alias record at the zone apex pointing to the CloudFront distribution. Configure the ALB security group to allow inbound HTTPS traffic from the CloudFront IP ranges, and ensure outbound rules allow responses to return to CloudFront.

Create an Amazon Route 53 CNAME record at the zone apex pointing to the CloudFront distribution domain name. Configure the ALB security group to allow inbound HTTPS traffic from the CloudFront IP ranges.

Create an Amazon Route 53 Alias record at the zone apex pointing to the CloudFront distribution. Configure the stateless Network Access Control List (NACL) for the ALB subnets to allow inbound traffic from the CloudFront IP ranges on port 443, but block outbound traffic on ephemeral ports (1024-65535) to prevent unauthorized outbound connections.

Create an Amazon Route 53 Alias record at the zone apex pointing to the CloudFront distribution. Configure the ALB target group health check port to require client-side SSL/TLS certificate authentication from CloudFront to verify origin integrity.

Show answer & explanation

Answer: Create an Amazon Route 53 Alias record at the zone apex pointing to the CloudFront distribution. Configure the ALB security group to allow inbound HTTPS traffic from the CloudFront IP ranges, and ensure outbound rules allow responses to return to CloudFront.

Answer

Create an Amazon Route 53 Alias record at the zone apex pointing to the CloudFront distribution, configure the ALB security group to allow inbound HTTPS traffic from CloudFront IP ranges, and ensure outbound rules allow responses to return to CloudFront.

The correct configuration uses a Route 53 Alias record to map the zone apex to the CloudFront distribution domain, resolving the DNS limitation of CNAME records. To secure the origin, the ALB's security group limits inbound traffic to CloudFront's IP ranges. Because security groups are stateful, return traffic is automatically allowed.

Step-by-Step Solution

Select the correct DNS record type for the zone apex.

Identify that an Alias record, rather than a CNAME record, is required at the zone apex (example.com) to point to the CloudFront distribution.

DNS protocol specifications (RFC 1035) prohibit CNAME records at the zone apex because other records (like SOA and NS) must exist there, whereas Route 53 Alias records bypass this limitation.

Configure origin security and traffic flow control.

Ensure that the ALB's security group allows inbound HTTPS (port 443) traffic from CloudFront's IP address ranges.

Restricting the ALB's ingress to CloudFront IP ranges prevents clients from bypassing the CloudFront distribution and accessing the ALB directly.

Ensure return traffic is permitted through stateful and stateless firewalls.

Verify that return traffic is not blocked by stateless NACLs or stateful security group rules.

Security groups are stateful and automatically track connections, whereas stateless NACLs require explicit rules allowing outbound ephemeral ports (1024-65535) for response traffic.

Key Concept

Configuring CloudFront with an ALB origin requires combining DNS Alias records at the zone apex with correct security group and NACL configurations to ensure safe, routing-compliant traffic flow.

Question 325Question →

A SysOps administrator is configuring an AWS Site-to-Site VPN connection to establish hybrid connectivity between an on-premises network and a private subnet within an Amazon VPC. Which two steps must the administrator take to allow network traffic to flow between the private subnet and the on-premises network? (Select TWO.)

Select all that apply

Attach a Virtual Private Gateway to the VPC.

Add a route in the subnet route table that points the on-premises CIDR block to the Virtual Private Gateway.

Attach an Internet Gateway to the VPC and add a route pointing the on-premises CIDR block to the Internet Gateway.

Create a Gateway VPC Endpoint for the connection and associate it with the subnet route table.

Configure a NAT Gateway in the private subnet and route the on-premises traffic through the NAT Gateway.

Show answer & explanation

Answer: Attach a Virtual Private Gateway to the VPC.; Add a route in the subnet route table that points the on-premises CIDR block to the Virtual Private Gateway.

Answer

To establish hybrid Site-to-Site VPN connectivity, the administrator must attach a Virtual Private Gateway to the VPC and add a route in the subnet route table pointing the on-premises destination CIDR block to the Virtual Private Gateway.

To establish hybrid network connectivity over an AWS Site-to-Site VPN, the AWS VPC must have a Virtual Private Gateway attached to act as the VPN concentrator. Furthermore, the route tables of any subnets that need to communicate with the on-premises network must have an explicit route pointing the on-premises CIDR block to the Virtual Private Gateway. These two actions enable both the termination of the VPN tunnel and the proper routing of outbound traffic from the private subnets.

Step-by-Step Solution

Create and attach a Virtual Private Gateway (VGW) to the target VPC.

The VPC is equipped with an AWS-side VPN endpoint capable of terminating IPSec VPN tunnels.

A Virtual Private Gateway is required to anchor the VPN connection on the AWS end.

Configure the subnet route table by adding a static route or enabling route propagation.

The route table includes a route where the destination is the on-premises network CIDR block and the target is the Virtual Private Gateway.

Traffic originating from the private subnet needs to know that packets destined for the on-premises CIDR should be sent to the Virtual Private Gateway.

Key Concept

Establishing AWS Site-to-Site VPN routing requires attaching a Virtual Private Gateway (or Transit Gateway) to the VPC and updating the VPC subnet route tables to direct traffic destined for the on-premises network to that gateway.

Estimated Time:1m 0s

Question 326Question →

A company hosts a secure microservice behind a Network Load Balancer (NLB) in a Service Provider VPC. A SysOps Administrator configures an AWS PrivateLink VPC Endpoint Service for this NLB. In a Service Consumer VPC, the administrator creates an Interface VPC Endpoint targeting the Endpoint Service and enables Private DNS. The Consumer VPC is connected to an on-premises network via an AWS Direct Connect connection terminated at a Transit Gateway. On-premises servers must be able to resolve the service's private DNS hostname and securely access the microservice. Which two configuration steps must the SysOps Administrator perform to satisfy these requirements? (Select TWO.)

Select all that apply

Configure a Route 53 Resolver Inbound Endpoint in the Consumer VPC, and configure the on-premises DNS resolver to forward queries for the service's private DNS hostname to the IP addresses of the Inbound Endpoint.

Modify the security group associated with the Interface VPC Endpoint's network interfaces to allow inbound traffic on the service's port from the CIDR range of the on-premises servers.

Add a route to the route tables of the subnets in the Consumer VPC, specifying the on-premises CIDR range as the destination and the Interface VPC Endpoint ID (vpce-xxxxxxxx) as the target.

Configure a Route 53 Resolver Outbound Endpoint in the Consumer VPC, and create an outbound resolver rule that forwards queries for the service's private DNS hostname to the IP addresses of the on-premises DNS servers.

Enable Private DNS on the Route 53 Resolver Inbound Endpoint and associate the private hosted zone with the Transit Gateway route table to automatically propagate the endpoint's DNS records to the on-premises network.

Show answer & explanation

Answer: Configure a Route 53 Resolver Inbound Endpoint in the Consumer VPC, and configure the on-premises DNS resolver to forward queries for the service's private DNS hostname to the IP addresses of the Inbound Endpoint.; Modify the security group associated with the Interface VPC Endpoint's network interfaces to allow inbound traffic on the service's port from the CIDR range of the on-premises servers.

Answer

Configure a Route 53 Resolver Inbound Endpoint in the Consumer VPC to receive forwarded DNS queries from the on-premises DNS resolver, and modify the Interface VPC Endpoint's security group to allow inbound traffic from the on-premises CIDR range.

For an on-premises network connected via Direct Connect to access an Interface VPC Endpoint with Private DNS, two key setups are required. First, a Route 53 Resolver Inbound Endpoint must be created in the Consumer VPC. This provides IP addresses that are reachable from the on-premises network. The on-premises DNS server is then configured to forward requests for the Private DNS domain to these IP addresses. Second, the security group assigned to the network interfaces of the Interface VPC Endpoint must allow inbound traffic from the client CIDR block on the port designated for the service.

Step-by-Step Solution

Analyze client DNS requirements

Identify that the on-premises DNS server must forward queries for the Private DNS hostname to an IP address reachable over Direct Connect.

On-premises clients cannot query the VPC's internal DNS resolver at the default link-local IP directly.

Deploy Route 53 Resolver Inbound Endpoint

Provision the Inbound Endpoint in the Consumer VPC, allocating private IP addresses in multiple subnets for high availability.

This endpoint exposes DNS listener interfaces that are reachable from the on-premises network over Direct Connect.

Configure on-premises DNS forwarding rules

Add a conditional forwarding rule on the on-premises DNS server targeting the domain name of the endpoint service and pointing to the Inbound Endpoint IPs.

Ensures requests for the endpoint service resolve to the endpoint's private IP addresses.

Configure Interface Endpoint Security Group rules

Verify and modify the security group rules on the Interface VPC Endpoint's Elastic Network Interfaces (ENIs).

Traffic from on-premises clients must be permitted inbound on the service's port (e.g., port

443

for HTTPS) by the security group attached to the ENIs.

Key Concept

Integration of Interface VPC Endpoints with hybrid networks requiring private DNS resolution and security group configuration.

Question 327Question →

A company hosts a production workload on a fleet of Amazon EC2 $t3.medium$ Linux instances in the $us-east-1$ region. The workload runs $24/7$ , and the company plans to migrate the fleet to $t4g.medium$ instances within the next $3$ months. The company wants to optimize costs immediately by committing to a $1$ -year term, ensuring that the discount applies to the current $t3$ instances and automatically transitions to the new $t4g$ instances post-migration. Which purchasing option will meet these requirements at the lowest cost?

Purchase a

1

-year Compute Savings Plan.

Purchase a

1

-year EC2 Instance Savings Plan for the

t3

instance family.

Purchase a

1

-year EC2 Instance Savings Plan for the

t4g

instance family.

Purchase a

1

-year Standard Reserved Instance for the

t3

instance family.

Show answer & explanation

Answer: Purchase a $1$ -year Compute Savings Plan.

Answer

Purchase a

1

-year Compute Savings Plan.

The correct answer is purchasing a

1

-year Compute Savings Plan because it provides the necessary flexibility to automatically apply discounts across different EC2 instance families (from

t3

t4g

) during the term of the agreement, covering the instances both before and after the migration.

Step-by-Step Solution

Analyze the workload characteristics and migration path.

The current workload runs on

t3

instances, but will migrate to

t4g

instances within the next

3

months during a

1

-year commitment window.

This establishes that the discount mechanism must support a change in instance families (from

t3

t4g

) mid-term without losing the applied savings.

Evaluate the flexibility of different AWS pricing models.

EC2 Instance Savings Plans and Standard Reserved Instances are locked to specific instance families within a region. Only Compute Savings Plans allow changes across instance families, regions, operating systems, and tenancies.

This rules out EC2 Instance Savings Plans and Standard RIs as they cannot span the transition from

t3

t4g

without incurring wasted commitment or On-Demand rates.

Select the option that covers both phases of the migration at the lowest cost.

1

-year Compute Savings Plan immediately applies to the active

t3

instances and seamlessly transitions to cover the

t4g

instances after the migration, preventing any gap in discount coverage.

This satisfies all operational constraints and ensures the maximum possible cost savings throughout the entire

1

-year term.

Key Concept

Compute Savings Plans offer the flexibility to change instance families (e.g.,

t3

t4g

) during the commitment term, whereas EC2 Instance Savings Plans and Standard Reserved Instances restrict discounts to a single instance family.

Question 328Question →

An application running on Amazon EC2 instances in a private subnet frequently downloads large datasets from an Amazon S3 bucket in the same AWS Region. The subnet routes all outbound internet traffic through a NAT Gateway. A SysOps administrator notices high NAT Gateway data processing charges on the monthly AWS bill. Which action should the administrator take to eliminate these data processing charges in the most cost-effective manner?

Create a Gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet.

Create a Gateway VPC endpoint for Amazon S3 but do not modify the route tables of the private subnet.

Provision an Interface VPC endpoint for Amazon S3 and update the application to use the endpoint's private DNS name.

Deploy a second NAT Gateway in a different Availability Zone and distribute the S3 traffic across both gateways.

Show answer & explanation

Answer: Create a Gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet.

Answer

Create a Gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet.

The correct answer is to create a Gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet. Gateway VPC endpoints for Amazon S3 are free and do not incur data processing or hourly charges. Associating the endpoint with the route table of the private subnet ensures that any outbound traffic destined for S3 bypasses the default NAT Gateway route and is directed to the endpoint instead, eliminating NAT Gateway data processing charges.

Step-by-Step Solution

Analyze the source and destination of the expensive traffic.

The source is EC2 instances in a private subnet, and the destination is Amazon S3 in the same AWS Region.

This establishes that the traffic is destined for an AWS service that supports Gateway VPC endpoints.

Evaluate the cost characteristics of alternative routing options.

Gateway VPC endpoints for S3 are free of charge, whereas NAT Gateways and Interface VPC endpoints incur hourly and data processing fees.

This identifies the most cost-effective method to bypass the NAT Gateway for S3 traffic.

Ensure routing is correctly updated to apply the optimization.

Associating the Gateway VPC endpoint with the private subnet's route table inserts a routing entry for the S3 prefix list.

This configuration is required to actually redirect the S3 traffic away from the NAT Gateway.

Key Concept

Gateway VPC Endpoints for S3 cost optimization

Question 329Question →

A company uses an Amazon CloudFront distribution to serve private content from a primary Amazon S3 bucket. The company has configured a secondary S3 bucket in a different AWS Region as a backup origin within a CloudFront origin group. All objects in both S3 buckets are encrypted using regional customer managed keys (SSE-KMS). A SysOps administrator needs to ensure that CloudFront can securely retrieve and decrypt content from both S3 buckets, and that failover can occur seamlessly when needed.

Which TWO actions should the SysOps administrator take to meet these requirements? (Select TWO.)

Select all that apply

Create a CloudFront Origin Access Control (OAC) and associate it with both S3 origins in the CloudFront distribution.

Modify the key policies for the customer managed KMS keys in both regions to grant decrypt permissions (kms:Decrypt) to the CloudFront service principal (cloudfront.amazonaws.com), restricting access to the distribution ARN.

Attach an IAM policy containing kms:Decrypt to the CloudFront distribution's IAM execution role to delegate decrypt permissions without altering the key policies.

Configure an active-passive DNS failover routing policy in Amazon Route 53 to redirect client traffic to the secondary S3 bucket's regional endpoint when CloudFront returns origin connection errors.

Configure S3 Cross-Region Replication (CRR) to replicate the encrypted files to the secondary S3 bucket, while keeping S3 Versioning disabled on the secondary bucket to minimize storage costs.

Show answer & explanation

Answer: Create a CloudFront Origin Access Control (OAC) and associate it with both S3 origins in the CloudFront distribution.; Modify the key policies for the customer managed KMS keys in both regions to grant decrypt permissions (kms:Decrypt) to the CloudFront service principal (cloudfront.amazonaws.com), restricting access to the distribution ARN.

Answer

Create a CloudFront Origin Access Control (OAC) and associate it with both S3 origins in the CloudFront distribution, and modify the key policies for the customer managed KMS keys in both regions to grant decrypt permissions to the CloudFront service principal.

To secure the private S3 buckets and allow CloudFront to serve the KMS-encrypted files, the administrator must create an Origin Access Control (OAC) and assign it to both origins. Additionally, because the files are encrypted with customer managed keys, the KMS key policy in both regions must grant the CloudFront service principal decrypt permissions, restricted to the distribution ARN.

Step-by-Step Solution

Associate an Origin Access Control (OAC) with the origins.

CloudFront uses OAC to sign requests to both the primary and secondary S3 origins in the origin group.

OAC is required to restrict access to S3 origins and supports KMS-encrypted objects.

Update the KMS key policies in both regions.

The CloudFront service principal is authorized to call the decrypt API.

Since customer managed keys are used for encryption, CloudFront needs explicit decryption permissions in the key policy.

Ensure S3 bucket policies allow CloudFront access.

S3 permits GetObject requests from the CloudFront service principal targeting the specific distribution.

Both private S3 buckets must trust the CloudFront distribution to serve their contents.

Key Concept

Securing a CloudFront multi-region S3 origin group with Origin Access Control (OAC) and AWS KMS decryption permissions.

Question 330Question →

An organization wants to establish a dedicated connection from their on-premises datacenter to a private subnet in a single VPC using an existing AWS Direct Connect connection. Which type of virtual interface (VIF) should the SysOps administrator configure on the Direct Connect connection to meet this requirement?

A Private VIF

A Public VIF

A Transit VIF

A Hosted VIF

Show answer & explanation

Answer: A Private VIF

Answer

A Private VIF

A Private VIF is the correct choice because it is designed to establish private connectivity between an on-premises network and a Virtual Private Gateway (VGW) associated with a single VPC using private IP addresses.

Step-by-Step Solution

Identify the destination and routing requirements.

The target is a private subnet within a single VPC, requiring private IP routing over the dedicated physical connection.

This determines whether the connection must route to private VPC endpoints or public AWS service endpoints.

Evaluate the virtual interface options based on destination.

A Private VIF routes to a virtual private gateway or Direct Connect Gateway for VPC private resources. A Public VIF routes to public AWS services. A Transit VIF routes to a Transit Gateway.

Choosing the correct VIF type ensures the routing behavior matches the target VPC environment.

Select the option that matches the single-VPC private subnet requirement.

A Private VIF is chosen because it directly maps to the Virtual Private Gateway associated with the target VPC.

This establishes the necessary private routing paths for the on-premises network to communicate with the VPC resources.

Key Concept

AWS Direct Connect Virtual Interface Types

Question 331Question →

A company manages a multi-account AWS environment using AWS Organizations with consolidated billing. A SysOps Administrator has successfully deployed a Tag Policy across all member accounts to ensure that resources are tagged with the key `InitiativeID`. Although member accounts have started applying the tag to EC2 instances and S3 buckets, the `InitiativeID` tag is not yet appearing as a filtering option in Cost Explorer. Which of the following actions must the SysOps Administrator perform to resolve this issue and begin tracking costs by this tag? (Select TWO.)

Select all that apply

Log in to the management account of the organization, navigate to the Billing and Cost Management console, and activate the `InitiativeID` tag under Cost Allocation Tags.

Wait for up to 24 hours after activation for the tag key to become active and start appearing in Cost Explorer.

Navigate to the Billing and Cost Management console within each member account and individually activate the `InitiativeID` tag.

Define a Tag Policy in AWS Organizations with the `InitiativeID` key, as this automatically registers and activates the tag for cost allocation.

Configure an AWS Budgets alert filtered by the `InitiativeID` tag, which will automatically trigger the activation of the tag in Cost Explorer.

Show answer & explanation

Answer: Log in to the management account of the organization, navigate to the Billing and Cost Management console, and activate the `InitiativeID` tag under Cost Allocation Tags.; Wait for up to 24 hours after activation for the tag key to become active and start appearing in Cost Explorer.

Answer

Log in to the management account of the organization to activate the tag in the Billing and Cost Management console, and wait up to 24 hours for the tag to appear in Cost Explorer.

The correct options state that the administrator must log in to the management account to activate the `InitiativeID` tag in the Billing and Cost Management console, and wait up to 24 hours for the change to propagate. Under consolidated billing in AWS Organizations, only the management account has the authority to activate cost allocation tags, and these tags do not appear immediately in Cost Explorer due to the processing time required by AWS Billing.

Step-by-Step Solution

Locate the account that has administrative control over consolidated billing.

Identify the management (payer) account in the AWS Organization.

Only the management account has the permissions to activate cost allocation tags for the entire organization.

Navigate to the Cost Allocation Tags interface.

Go to the Billing and Cost Management console in the management account, select Cost Allocation Tags, search for `InitiativeID`, and activate it.

Applying tags to resources is not enough; they must be explicitly activated in the Billing console to be processed as cost allocation tags.

Allow time for AWS to process the cost data.

Wait up to 24 hours for the activation to propagate.

AWS processes billing data in batches, and cost allocation tag activation takes up to 24 hours to reflect in Cost Explorer and billing reports.

Key Concept

Cost allocation tags must be activated in the Billing and Cost Management console of the management account, and they take up to 24 hours to appear in billing reports and Cost Explorer.

Estimated Time:2m 0s

Question 332Question →

A SysOps Administrator is configuring VPC Flow Logs for a multi-tier application. The administrator creates a flow log to capture all traffic and selects an Amazon S3 bucket named 'app-traffic-logs-prod' in the same AWS account as the destination. The S3 bucket is configured with default Amazon S3 managed encryption keys (SSE-S3). Shortly after creation, the administrator checks the S3 bucket but finds that no flow log data has been delivered. Which of the following explains why the logs are failing to deliver?

The IAM user who created the flow log does not have the iam:PassRole permission for the log delivery role.

The S3 bucket has not been configured with an active object lifecycle policy, causing AWS to block delivery to prevent unlimited log storage accumulation.

The bucket policy on the Amazon S3 bucket does not grant s3:PutObject permissions to the log delivery service principal (delivery.logs.amazonaws.com).

The S3 bucket is encrypted using a Customer Managed Key (CMK) and the administrator attempted to grant access via an IAM user policy rather than modifying the KMS key policy.

Show answer & explanation

Answer: The bucket policy on the Amazon S3 bucket does not grant s3:PutObject permissions to the log delivery service principal (delivery.logs.amazonaws.com).

Answer

The bucket policy on the Amazon S3 bucket does not grant s3:PutObject permissions to the log delivery service principal (delivery.logs.amazonaws.com).

The correct answer is that the bucket policy on the destination S3 bucket must explicitly grant 's3:PutObject' and 's3:GetBucketAcl' permissions to the AWS Log Delivery service principal ('delivery.logs.amazonaws.com'). S3 bucket log delivery is cross-service and does not use an IAM role or role delegation.

Step-by-Step Solution

Analyze the destination target of the VPC Flow Logs.

The destination is an Amazon S3 bucket using default server-side encryption (SSE-S3).

This determines which authorization mechanism is evaluated by AWS.

Determine the service integration requirements for S3 log delivery.

VPC Flow Logs deliver data to S3 using the Log Delivery service principal (delivery.logs.amazonaws.com), which requires S3 bucket policy permissions.

This rules out IAM roles and PassRole permissions since S3 delivery bypasses IAM roles.

Check the encryption configuration.

SSE-S3 is used, meaning no customer-managed KMS key policies need to be updated.

This eliminates KMS key policy restriction errors from being the root cause.

Key Concept

VPC Flow Logs S3 delivery permissions

Estimated Time:1m 30s

Question 333Question →

A company has an on-premises data center connected to an AWS VPC via an AWS Direct Connect connection. A SysOps Administrator needs to enable private access to Amazon S3 for both the on-premises servers and the EC2 instances in a private subnet of the VPC. To minimize data transfer costs, the EC2 instances must use an existing S3 Gateway VPC Endpoint, while the on-premises servers must use a newly created S3 Interface VPC Endpoint.

After deploying the Interface VPC Endpoint for Amazon S3 in the VPC, the administrator notices that the EC2 instances have started routing S3 traffic through the Interface VPC Endpoint, incurring unexpected charges, while the on-premises servers are unable to connect to S3.

Which combination of actions should the SysOps Administrator take to resolve these issues?

Enable Private DNS on the S3 Interface VPC Endpoint. Add a route to the private subnet's Route Table for the Amazon S3 prefix list targeting the Interface VPC Endpoint ID. Ensure the security group attached to the Interface VPC Endpoint allows inbound TCP port 443 traffic from the on-premises network range.

Disable Private DNS on the S3 Interface VPC Endpoint. Add the S3 Interface VPC Endpoint ID to the private subnet's Route Table. Create an inbound rule in the security group of the S3 Gateway VPC Endpoint to allow HTTPS traffic from the on-premises network range.

Disable Private DNS on the S3 Interface VPC Endpoint. Configure the on-premises servers to use the S3 Interface VPC Endpoint's specific DNS names for S3 requests. Update the security group attached to the Interface VPC Endpoint to allow inbound TCP port 443 traffic from the on-premises network range.

Enable Private DNS on the S3 Interface VPC Endpoint. Remove the S3 Gateway VPC Endpoint route from the private subnet's Route Table to resolve the routing conflict. Configure a Route 53 Resolver inbound endpoint to resolve the public S3 DNS hostname to the Gateway VPC Endpoint.

Show answer & explanation

Answer: Disable Private DNS on the S3 Interface VPC Endpoint. Configure the on-premises servers to use the S3 Interface VPC Endpoint's specific DNS names for S3 requests. Update the security group attached to the Interface VPC Endpoint to allow inbound TCP port 443 traffic from the on-premises network range.

Answer

Disable Private DNS on the S3 Interface VPC Endpoint, configure the on-premises servers to use the S3 Interface VPC Endpoint's specific DNS names for S3 requests, and update the security group attached to the Interface VPC Endpoint to allow inbound TCP port 443 traffic from the on-premises network range.

Disabling Private DNS on the S3 Interface VPC Endpoint ensures that the public DNS name for S3 continues to resolve to public IP addresses within the VPC, allowing EC2 instances to utilize the Gateway VPC Endpoint via the subnet's Route Table. On-premises servers must use the endpoint-specific DNS names because the Gateway VPC Endpoint cannot be accessed from on-premises, and disabling Private DNS means standard S3 URLs will not route through the Interface VPC Endpoint automatically. Finally, the Interface VPC Endpoint's security group must permit inbound HTTPS traffic from the on-premises CIDR block to allow successful connection.

Step-by-Step Solution

Disable Private DNS on the S3 Interface VPC Endpoint.

DNS queries for s3.us-east-1.amazonaws.com within the VPC resolve to public S3 IP addresses.

This allows the EC2 instances to match the S3 prefix list route in their subnet Route Table and continue using the Gateway VPC Endpoint, avoiding data processing charges.

Configure on-premises applications and servers to use the Interface VPC Endpoint's specific DNS names.

On-premises DNS requests resolve to the private IP addresses of the S3 Interface VPC Endpoint network interfaces.

Since Private DNS is disabled on the Interface VPC Endpoint and Gateway VPC Endpoints are not reachable from on-premises, servers must target the Interface VPC Endpoint explicitly using its unique regional or zonal DNS names.

Update the security group of the S3 Interface VPC Endpoint to allow inbound TCP port 443 traffic from the on-premises CIDR block.

The Interface VPC Endpoint permits HTTPS connections originating from the on-premises data center.

By default, Interface VPC Endpoint security groups block inbound traffic unless explicitly permitted, so allowing port 443 from the on-premises range is required for successful connectivity.

Key Concept

Coexistence of Gateway and Interface VPC Endpoints for S3 to support hybrid architectures while optimizing data transfer costs.

Estimated Time:3m 0s

Question 334Question →

A SysOps administrator is configuring AWS Budgets to control costs in a testing environment. The administrator wants to use AWS Budgets Actions to automatically take action when actual costs exceed a predefined threshold. Which of the following actions can be natively executed by AWS Budgets Actions to prevent further cost overruns? (Select TWO.)

Select all that apply

Stop specific Amazon EC2 or Amazon RDS instances.

Apply a restrictive IAM policy to an IAM user, group, or role.

Trigger AWS Cost Anomaly Detection to terminate anomalous resources.

Configure a CloudWatch billing alarm to directly delete the resources.

Automatically activate cost allocation tags in the billing console for untagged resources.

Show answer & explanation

Answer: Stop specific Amazon EC2 or Amazon RDS instances.; Apply a restrictive IAM policy to an IAM user, group, or role.

Answer

The natively supported AWS Budgets Actions are stopping specific Amazon EC2 or Amazon RDS instances, and applying a restrictive IAM policy to an IAM user, group, or role.

AWS Budgets Actions allows administrators to configure automated responses when a budget threshold is exceeded. The native actions supported are: applying an IAM policy to a user, group, or role; applying an SCP to an OU or account; and stopping target EC2 or RDS instances. Therefore, stopping specific Amazon EC2 or Amazon RDS instances and applying a restrictive IAM policy to an IAM user, group, or role are correct.

Step-by-Step Solution

Identify the capabilities of AWS Budgets Actions.

AWS Budgets Actions allows three native action types: applying IAM policies, applying Service Control Policies (SCPs), and stopping target EC2 or RDS instances.

This determines which options are natively supported by the Budgets service.

Evaluate the choices against the identified capabilities.

Stopping EC2/RDS instances and applying IAM policies are supported, while triggering Cost Anomaly Detection, utilizing CloudWatch billing alarms to delete resources, and activating cost allocation tags are not.

This filters the correct selections from the incorrect options.

Key Concept

AWS Budgets Actions native integration and target actions

Question 335Question →

A SysOps Administrator is troubleshooting a connectivity issue for a web server hosted on an Amazon EC2 instance with private IP address 10.0.1.100. Clients are unable to load pages from the web server. The administrator enables VPC Flow Logs on the instance's elastic network interface (ENI) and observes the following log records:

2 123456789012 eni-1234567890abcdef 203.0.113.10 10.0.1.100 50001 80 6 10 520 1620000000 1620000060 ACCEPT OK
2 123456789012 eni-1234567890abcdef 10.0.1.100 203.0.113.10 80 50001 6 5 260 1620000000 1620000060 REJECT OK

Which action should the administrator take to resolve this issue?

Add an outbound rule to the Network ACL associated with the subnet to allow TCP traffic to destination ports 1024-65535.

Add an outbound rule to the Security Group associated with the EC2 instance to allow TCP traffic to destination port 50001.

Add a route targeting the Internet Gateway (IGW) in the subnet's route table for the destination 203.0.113.10/32.

Recreate the VPC Flow Log using an IAM role that has the iam:PassRole permission.

Show answer & explanation

Answer: Add an outbound rule to the Network ACL associated with the subnet to allow TCP traffic to destination ports 1024-65535.

Answer

Add an outbound rule to the Network ACL associated with the subnet to allow TCP traffic to destination ports 1024-65535.

The correct answer is to add an outbound rule to the Network ACL associated with the subnet to allow TCP traffic to destination ports 1024-65535. Network ACLs are stateless, meaning return traffic must be explicitly allowed. Since the client's request on port 80 uses an ephemeral source port (50001), the outbound response from the web server is destined for port 50001. Outbound rules in the Network ACL must permit this ephemeral range.

Step-by-Step Solution

Analyze the VPC Flow Log records to identify the traffic flow.

The first log record shows inbound traffic from client IP 203.0.113.10 (port 50001) to the web server 10.0.1.100 (port 80) was ACCEPTed. The second log record shows outbound return traffic from the web server 10.0.1.100 (port 80) to the client 203.0.113.10 (port 50001) was REJECTed.

Understanding the source, destination, ports, and action of both requests helps pinpoint where the packet drop occurs.

Evaluate the stateful/stateless nature of the security controls.

Since Security Groups are stateful, any inbound traffic that is allowed automatically permits the return outbound traffic. Because the inbound request was accepted but the outbound response was rejected, the block must be due to a stateless control (a Network ACL).

Distinguishing between stateful Security Groups and stateless Network ACLs is critical for identifying the cause of outbound traffic rejection.

Determine the necessary rule modification for the stateless control.

The outbound return traffic is destined for port 50001, which is in the ephemeral port range (1024-65535). An outbound rule must be added to the Network ACL to allow traffic to these ports.

Stateless Network ACLs require explicit rules for both inbound and outbound traffic, including client ephemeral ports.

Key Concept

Stateless nature of Network ACLs requiring explicit outbound rules for ephemeral ports

Estimated Time:1m 30s

Question 336Question →

During a department transition, a SysOps Administrator in a member account of an AWS Organization is asked to categorize cloud expenses. The administrator tags all local Amazon EC2 and Amazon Aurora resources with the tag key `BillingGroup`. However, when the administrator tries to build a cost budget filtered by this key in the member account, the tag is missing from the Billing console. What must be done to resolve this issue?

The member account administrator must enable the tag key under the Cost Explorer settings in their local console.

The management account administrator must activate the `BillingGroup` tag key in the Billing console.

The administrator must register the tag key in the AWS Resource Groups console to make it visible to AWS Budgets.

The tag key will automatically become active in the member account once it has been applied to at least one resource for 48 hours.

Show answer & explanation

Answer: The management account administrator must activate the `BillingGroup` tag key in the Billing console.

Answer

The management account administrator must activate the `BillingGroup` tag key in the Billing console.

In a consolidated billing setup under AWS Organizations, all billing and cost-tracking configurations—including the activation of cost allocation tags—must be managed from the management (payer) account. The member accounts apply the tags to their resources, but the management account administrator must log into the Billing console and activate the specific tag key (in this case, `BillingGroup`). Once activated, the tag becomes available for cost budgets and Cost Explorer filtering across all accounts in the organization.

Step-by-Step Solution

Identify the account structure and billing type.

The setup is an AWS Organization using consolidated billing with member accounts and a management account.

Permissions for cost allocation tags differ between the management account and member accounts in consolidated billing.

Determine who can activate cost allocation tags.

Only the management (payer) account has the authority to activate cost allocation tags for the entire organization.

Member accounts cannot manage billing-related configurations like cost allocation tags in consolidated billing.

Identify the status of the applied tag.

The tag key `BillingGroup` was applied to resources but has not yet been activated in the Billing console.

Applying tags to resources does not automatically enable them for cost tracking, budgeting, or Cost Explorer.

Key Concept

Cost allocation tags must be manually activated in the Billing console of the management (payer) account in an AWS Organizations environment.

Estimated Time:2m 0s

Question 337Question →

A company has an AWS Organization with multiple member accounts. A SysOps administrator is tasked with implementing a cost management strategy to address unexpected cost spikes. The strategy must achieve the following:

1. Identify unexpected spend anomalies specifically for resources tagged with the key ProjectID and notify the project team via Slack.
2. Enable member accounts to access AWS Cost Explorer to view their own historical costs and three-month cost forecasts, while restricting them from viewing any billing data of other member accounts.

Which two actions should the SysOps administrator take to meet these requirements? (Select two.)

Select all that apply

Activate the ProjectID tag key as a user-defined cost allocation tag in the Billing console of the management account. In AWS Cost Anomaly Detection, create a Cost Allocation Tag monitor for the ProjectID tag key, and configure an alert subscription to send notifications to the project's Slack channel via AWS Chatbot.

Enable Linked Account Access to AWS Cost Explorer under the Cost Management Preferences of the management account. This allows member accounts to log in and natively view their own cost forecasts and historical data without access to other accounts' billing information.

Create a multi-account budget in AWS Budgets in the management account, set the scope to the ProjectID tag, and configure an Amazon SNS topic to publish alerts to the Slack channel when forecasted usage exceeds the threshold.

Apply the ProjectID tag to resources in all member accounts. In AWS Cost Anomaly Detection, create a Cost Category monitor that groups costs by the ProjectID tag, and configure a daily subscription report to be emailed directly to the Slack channel's email integration address.

Configure an Amazon EventBridge rule that monitors AWS Cost Anomaly Detection events and triggers an AWS Systems Manager Automation document to execute a script that exports Cost Explorer forecasts to an S3 bucket in each member account.

Show answer & explanation

Answer: Activate the ProjectID tag key as a user-defined cost allocation tag in the Billing console of the management account. In AWS Cost Anomaly Detection, create a Cost Allocation Tag monitor for the ProjectID tag key, and configure an alert subscription to send notifications to the project's Slack channel via AWS Chatbot.; Enable Linked Account Access to AWS Cost Explorer under the Cost Management Preferences of the management account. This allows member accounts to log in and natively view their own cost forecasts and historical data without access to other accounts' billing information.

Answer

The correct configurations are to activate the ProjectID cost allocation tag in the Billing console and create a Cost Allocation Tag monitor in AWS Cost Anomaly Detection with an AWS Chatbot Slack subscription, and to enable Linked Account Access to AWS Cost Explorer in the Cost Management Preferences of the management account.

To satisfy the first requirement, the ProjectID tag must be activated as a cost allocation tag in the management account, which then allows the creation of a Cost Allocation Tag monitor in AWS Cost Anomaly Detection to detect unexpected spikes. The alert subscription is configured to target an AWS Chatbot Slack channel for real-time notifications. To satisfy the second requirement, enabling Linked Account Access in the Cost Management Preferences of the management account permits member accounts to natively use Cost Explorer to view their own cost history and forecasts without seeing billing data from other accounts.

Step-by-Step Solution

Activate the tag key in the billing system.

The ProjectID tag key is registered as a user-defined cost allocation tag in the management account, allowing AWS billing services to track and group costs using this dimension.

Before any resource tags can be used in AWS Cost Explorer or Cost Anomaly Detection, they must be activated as cost allocation tags.

Set up cost anomaly detection and alerting.

An AWS Cost Anomaly Detection Cost Allocation Tag monitor is created for the ProjectID tag, and an alert subscription is configured to send alerts to the project team's Slack channel via AWS Chatbot.

This detects machine-learning-based anomalies for the specific tag and routes alerts to Slack in real-time.

Configure Cost Explorer permissions for member accounts.

Linked Account Access is enabled in the Cost Management Preferences of the management account, allowing member accounts to access Cost Explorer directly.

This native feature allows member accounts to view their own billing history and three-month forecasts while preventing them from viewing the costs of other member accounts.

Key Concept

AWS Cost Anomaly Detection uses machine learning to identify unexpected cost spikes based on dimensions like Cost Allocation Tags, and alert subscription destinations like AWS Chatbot can route these notifications to Slack. AWS Cost Explorer access can be granted to member accounts via Linked Account Access, restricting their view to only their own account's data.

Question 338Question →

A media company is planning to modernize its image processing workload currently running on Amazon EC2 $c5.2xlarge$ Linux instances in a single AWS account. Over the next $6$ months, the engineering team plans to migrate $50\%$ of the workload to AWS Fargate, and upgrade the remaining EC2 instances to the newer $c6g.2xlarge$ Graviton-based instance family. A SysOps administrator must recommend a $1$ -year commitment plan that provides the maximum cost savings while automatically applying to all stages of this migration. Which commitment option should the administrator recommend to meet these requirements?

1

-year EC2 Instance Savings Plan for the

c5

instance family

1

-year Convertible Reserved Instance for the

c5

instance family

1

-year Compute Savings Plan

1

-year EC2 Instance Savings Plan for the

c6g

instance family

Show answer & explanation

Answer: A $1$ -year Compute Savings Plan

Answer

1

-year Compute Savings Plan

The correct option is the Compute Savings Plan. This plan offers the highest level of flexibility, automatically applying discounts of up to

66\%

to usage across any EC2 instance family (such as shifting from

c5

c6g

), regardless of region, operating system, or tenancy. Crucially, it also applies to AWS Fargate, ensuring that both parts of the migrated workload are covered throughout the transition period.

Step-by-Step Solution

Analyze the workload requirements and migration roadmap.

The workload is shifting from EC2

c5

instances to a mix of AWS Fargate (

50\%

) and EC2

c6g

Graviton-based instances (

50\%

) over a

6

-month period.

Identifying the target resource types and migration phases is necessary to determine which savings mechanism offers the required scope.

Evaluate the coverage of each commitment option against the target resources.

EC2 Instance Savings Plans and Reserved Instances are restricted to specific EC2 instance families and do not cover containerized tasks running on AWS Fargate. Only Compute Savings Plans cover both EC2 (any family, including

c5

and

c6g

) and AWS Fargate.

Comparing coverage boundaries prevents purchasing commitments that become underutilized as workloads transition.

Select the option that automatically applies to the changing infrastructure without manual exchange processes.

A Compute Savings Plan automatically shifts its discount application as instances are terminated and Fargate tasks or

c6g

instances are launched.

Choosing the most flexible plan minimizes operational overhead and maximizes cost savings throughout the migration lifecycle.

Key Concept

Compute Savings Plans provide the greatest flexibility by automatically applying discounts across different EC2 instance families, regions, operating systems, tenancies, and compute services including AWS Fargate and AWS Lambda.

Estimated Time:1m 30s

Question 339Question →

A SysOps Administrator is investigating a connection timeout issue between an application server in subnet A ( $10.0.1.0/24$ ) and a database server in subnet B ( $10.0.2.0/24$ ). Both subnets are within the same VPC. Security groups have been verified as correct. The administrator reviews the following VPC Flow Log records for the network interface of the database server:

2 123456789012 eni-0123456789abcdef0 10.0.1.50 10.0.2.10 49152 3306 6 20 1040 1620123456 1620123516 ACCEPT OK
2 123456789012 eni-0123456789abcdef0 10.0.2.10 10.0.1.50 3306 49152 6 20 1040 1620123456 1620123516 REJECT OK

Which of the following actions must the administrator perform to resolve this connection issue? (Select TWO.)

Select all that apply

Add an outbound rule to the database subnet's Network ACL (NACL) to allow outbound TCP traffic on ports

1024-65535

to the application subnet CIDR block (

10.0.1.0/24

Add an inbound rule to the application subnet's Network ACL (NACL) to allow inbound TCP traffic on ports

1024-65535

from the database subnet CIDR block (

10.0.2.0/24

Add an outbound rule to the database server's Security Group to allow outbound TCP traffic on ports

1024-65535

to the application server (

10.0.1.50

Configure an IAM role with the `sts:AssumeRole` action for the VPC Flow Logs service and attach it to the database EC2 instance.

Add a route to the database subnet's route table that targets the Internet Gateway (IGW) for the destination

10.0.1.50

Show answer & explanation

Answer: Add an outbound rule to the database subnet's Network ACL (NACL) to allow outbound TCP traffic on ports $1024-65535$ to the application subnet CIDR block ( $10.0.1.0/24$ ).; Add an inbound rule to the application subnet's Network ACL (NACL) to allow inbound TCP traffic on ports $1024-65535$ from the database subnet CIDR block ( $10.0.2.0/24$ ).

Answer

To resolve the connection issue, the administrator must add an outbound rule to the database subnet's Network ACL (NACL) allowing outbound TCP traffic on ports

1024-65535

to the application subnet, and add an inbound rule to the application subnet's Network ACL (NACL) allowing inbound TCP traffic on ports

1024-65535

from the database subnet.

The VPC Flow Logs reveal that inbound traffic from the application server (source IP

10.0.1.50

on source port

49152

) to the database server (destination IP

10.0.2.10

on database port

3306

) is accepted. However, the outbound response from the database server (source IP

10.0.2.10

on source port

3306

) back to the application server (destination IP

10.0.1.50

on destination port

49152

) is rejected. Since Security Groups are stateful, any accepted inbound request will automatically allow the outbound response. The rejection must therefore be occurring at a stateless boundary, which is the Network ACL (NACL). To fix this, an outbound rule must be added to the database subnet's NACL to allow traffic to the ephemeral ports (

1024-65535

) of the application subnet. Additionally, since NACLs are stateless at both boundaries, the application subnet's NACL must also contain an inbound rule allowing the response traffic on the ephemeral port range from the database subnet.

Step-by-Step Solution

Analyze the VPC Flow Logs to determine the state of the network traffic.

The flow logs show that the inbound request from the application server (

10.0.1.50

port

49152

) to the database (

10.0.2.10

port

3306

) is accepted, but the outbound response (database source port

3306

to application destination port

49152

) is rejected.

This isolates the failure to the outbound path of the response traffic.

Identify which security control is causing the outbound rejection.

Since Security Groups are stateful, they automatically allow outbound response traffic for accepted inbound connections. Therefore, the rejection is caused by the stateless Network ACL (NACL) filtering.

This helps determine that the stateless NACL needs modification rather than the stateful Security Group.

Update the stateless Network ACLs to allow the response traffic on ephemeral ports.

The database subnet's NACL must allow outbound traffic on ephemeral ports (

1024-65535

) to the application subnet. Concurrently, the application subnet's NACL must allow inbound traffic on those same ephemeral ports from the database subnet.

NACLs are stateless and must be explicitly configured in both directions at both subnet boundaries to allow traffic to flow.

Key Concept

Stateless network access control list (NACL) evaluation versus stateful security group evaluation in Amazon VPC, and interpreting custom flow logs.

Estimated Time:3m 0s

Question 340Question →

A SysOps administrator is configuring an Amazon CloudFront distribution to serve static content from an Amazon S3 bucket. The company's security policy requires that all viewer traffic must access the bucket through CloudFront, and direct public access to the S3 bucket must be completely blocked. Additionally, the website must be accessible via the company's root domain (example.com). Which configuration steps should the administrator implement to meet these requirements?

Create an Origin Access Control (OAC) and associate it with the CloudFront distribution. Update the S3 bucket policy to allow the CloudFront OAC service principal access to perform the s3:GetObject action, and create an Alias record in Amazon Route 53 at the zone apex pointing to the CloudFront distribution.

Create an Origin Access Control (OAC) and associate it with the CloudFront distribution. Update the S3 bucket policy to allow the CloudFront OAC service principal access to perform the s3:GetObject action, and create a CNAME record in Amazon Route 53 at the zone apex pointing to the CloudFront distribution.

Configure an S3 Gateway Endpoint in the VPC, associate it with the subnet route tables, and restrict the S3 bucket policy to allow access only from the VPC endpoint. Create an Alias record in Amazon Route 53 at the zone apex pointing to the CloudFront distribution.

Create an Origin Access Control (OAC) and associate it with the CloudFront distribution. Grant the administrator's IAM role the iam:PassRole permission to pass the CloudFront service role to the S3 bucket, and create an Alias record in Amazon Route 53 at the zone apex pointing to the CloudFront distribution.

Show answer & explanation

Answer: Create an Origin Access Control (OAC) and associate it with the CloudFront distribution. Update the S3 bucket policy to allow the CloudFront OAC service principal access to perform the s3:GetObject action, and create an Alias record in Amazon Route 53 at the zone apex pointing to the CloudFront distribution.

Answer

Create an Origin Access Control (OAC) and associate it with the CloudFront distribution, update the S3 bucket policy to allow the CloudFront OAC service principal access to perform the s3:GetObject action, and create an Alias record in Route 53 at the zone apex pointing to the CloudFront distribution.

The correct configuration uses Origin Access Control (OAC) to secure the S3 origin, allowing only authenticated requests from the CloudFront distribution by updating the S3 bucket policy to authorize the CloudFront service principal. To resolve the root domain (zone apex) to the CloudFront distribution, a Route 53 Alias record is required because CNAME records are not allowed at the zone apex by standard DNS specifications.

Step-by-Step Solution

Secure the S3 origin with Origin Access Control.

CloudFront is configured to sign requests sent to the S3 origin using OAC.

This establishes a secure identity for the CloudFront distribution to authenticate with the S3 bucket.

Restrict the S3 bucket policy to CloudFront OAC.

The S3 bucket blocks direct public access and only permits s3:GetObject requests matching the CloudFront OAC service principal.

This ensures that users cannot bypass CloudFront to download assets directly from the bucket.

Configure DNS routing for the root domain in Route 53.

An Alias record is created at the zone apex (example.com) pointing to the CloudFront distribution's DNS name.

Standard DNS CNAME records cannot coexist with other record types at the zone apex, so a Route 53 Alias record must be used to route the root domain's traffic.

Key Concept

CloudFront Origin Access Control (OAC) and Route 53 Zone Apex Routing

PreviousPage 17 / 49Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept