Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 341Question →

An organization runs EC2 instances in a private VPC subnet that must access AWS Secrets Manager. A SysOps Administrator deploys an Interface VPC Endpoint for Secrets Manager inside the subnet to keep the traffic private. However, the EC2 instances are unable to connect to Secrets Manager. Which of the following actions will resolve this connectivity issue?

Show answer & explanation

Answer: Configure the security group attached to the Interface VPC Endpoint to allow inbound HTTPS traffic from the EC2 instances.

Answer

Configure the security group attached to the Interface VPC Endpoint to allow inbound HTTPS traffic from the EC2 instances.
The correct action is to configure the security group attached to the Interface VPC Endpoint to allow inbound HTTPS traffic from the EC2 instances. Interface VPC Endpoints create Elastic Network Interfaces (ENIs) in the subnet, which are protected by security groups. By default, these security groups may block inbound traffic, so they must be updated to allow traffic on port 443 from the EC2 instances.

Step-by-Step Solution

1
Identify the type of VPC endpoint deployed.
The deployed endpoint is an Interface VPC Endpoint (AWS PrivateLink), which provisions Elastic Network Interfaces (ENIs) inside the subnet.
Understanding the type of endpoint helps determine whether route tables or security groups control traffic access.
2
Evaluate the routing and security group requirements for Interface VPC Endpoints.
Interface VPC Endpoints do not use route table entries. Instead, they rely on security groups to control inbound traffic to the endpoint's ENIs.
Since the endpoint behaves like a network interface inside the VPC, it must allow traffic from the source EC2 instances.
3
Verify and update the security group associated with the Interface VPC Endpoint.
Ensure the inbound rules of the endpoint's security group allow HTTPS (port 443) traffic from the EC2 instances' security group or private IP range.
This allows the EC2 instances to establish the SSL/TLS handshake with the AWS service endpoint via PrivateLink.

Key Concept

Interface VPC Endpoints (AWS PrivateLink) require security group configurations to allow inbound traffic from clients, unlike Gateway Endpoints which rely on subnet route table routes.
Estimated Time:1m 0s
Question 342Question →

An organization hosts a proprietary API service in VPC-B behind an Amazon VPC Network Load Balancer (NLB). A SysOps Administrator in a separate AWS account configures an Interface VPC Endpoint in a private subnet of VPC-A to securely access this API service using AWS PrivateLink. The administrator enables Private DNS on the Interface VPC Endpoint. However, when an application running on Amazon EC2 instances in VPC-A attempts to invoke the API service, the connections consistently fail with a network timeout error. Which TWO configuration steps should the SysOps Administrator perform to troubleshoot and resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Verify that the security group associated with the Interface VPC Endpoint allows inbound TCP traffic on the service port from the security group of the EC2 instances in VPC-A.; Verify that the security group associated with the EC2 instances in VPC-A allows outbound TCP traffic on the service port to the IP addresses or security group of the Interface VPC Endpoint.

Answer

Verify that the security group associated with the Interface VPC Endpoint allows inbound TCP traffic from the EC2 instances, and verify that the security group associated with the EC2 instances allows outbound TCP traffic to the Interface VPC Endpoint.
For Interface VPC Endpoints, traffic is directed via DNS to the private IP addresses of the Elastic Network Interfaces (ENIs) deployed in the subnet. Therefore, security groups on both the endpoint network interfaces and the client EC2 instances must explicitly permit the traffic. The security group of the Interface VPC Endpoint must allow inbound traffic from the EC2 instances, and the security group of the EC2 instances must allow outbound traffic to the Interface VPC Endpoint.

Step-by-Step Solution

1
Analyze the endpoint type and routing mechanism.
Identify that the endpoint is an Interface VPC Endpoint utilizing AWS PrivateLink, which places ENIs directly inside the VPC and uses DNS rather than route table rules.
This rules out adding routes or associating route tables for this endpoint type.
2
Review security group rules for the endpoint network interfaces.
Ensure that the security group attached to the Interface VPC Endpoint allows inbound traffic on the service's port from the client EC2 instances.
Interface endpoints behave like standard network interfaces and are subject to security group evaluation.
3
Review security group rules for the client EC2 instances.
Ensure that the security group attached to the EC2 instances allows outbound traffic on the service's port to the private IP addresses of the endpoint interfaces.
Stateful security groups must permit the initial outbound connection from the client to the endpoint.

Key Concept

AWS PrivateLink Interface Endpoints require proper security group configurations for inbound and outbound traffic, and do not use route table entries.
Question 343Question →

A company has established hybrid connectivity using an AWS Transit Gateway. The Transit Gateway is attached to three VPCs. To connect to the on-premises network (CIDR 172.31.0.0/16172.31.0.0/16), the company uses a primary 10 Gbps10\text{ Gbps} AWS Direct Connect connection with a Transit Virtual Interface (Transit VIF) terminated on a Direct Connect Gateway. As a backup, they have configured an AWS Site-to-Site VPN connection attached directly to the Transit Gateway. Both connections are advertising the 172.31.0.0/16172.31.0.0/16 prefix via dynamic BGP, and both attachments have route propagation enabled in the Transit Gateway route table. During a maintenance window, a SysOps administrator needs to temporarily force all outbound traffic destined for the on-premises network to use the Site-to-Site VPN backup path. Which action will achieve this goal with the least administrative effort?

Show answer & explanation

Answer: Add a static route for 172.31.0.0/16172.31.0.0/16 pointing to the Site-to-Site VPN attachment in the Transit Gateway route table.

Answer

Add a static route for the on-premises network prefix (172.31.0.0/16172.31.0.0/16) pointing to the Site-to-Site VPN attachment in the Transit Gateway route table.
The correct answer is to add a static route in the Transit Gateway route table pointing to the VPN attachment. In AWS Transit Gateway routing logic, static routes always take precedence over propagated routes. Since both the Direct Connect Gateway and Site-to-Site VPN connections propagate the same prefix dynamically, the Transit Gateway naturally prefers the Direct Connect Gateway attachment. Adding a static route overrides this default preference and immediately forces traffic to the VPN attachment.

Step-by-Step Solution

1
Analyze the current route propagation and selection behavior in the AWS Transit Gateway route table.
The Transit Gateway receives the 172.31.0.0/16172.31.0.0/16 prefix via dynamic BGP from both the Direct Connect Gateway and the Site-to-Site VPN. By default, Transit Gateway route tables prefer Direct Connect Gateway attachments over VPN attachments for identical prefixes.
This establishes why traffic is currently routing over the Direct Connect connection and why standard propagation favors this path.
2
Evaluate the viability of manipulating BGP attributes (AS Path prepending and MED) on the on-premises router.
BGP path selection attributes are only compared among routes of the same attachment type (e.g., between two VPN connections). They cannot override the Transit Gateway's built-in preference of Direct Connect over VPN.
This rules out BGP attribute tuning as a solution for different attachment types.
3
Apply the route precedence rules for Transit Gateway route tables.
In a Transit Gateway route table, static routes always take precedence over propagated routes. Adding a static route for 172.31.0.0/16172.31.0.0/16 pointing to the VPN attachment will immediately override the propagated Direct Connect route.
This is the most effective and lowest-effort way to temporarily redirect the traffic.

Key Concept

AWS Transit Gateway route evaluation order and precedence rules, where static routes override propagated routes, and Direct Connect Gateway propagated routes are preferred over VPN propagated routes.
Question 344Question →

A company is reviewing its AWS Trusted Advisor Cost Optimization recommendations to reduce monthly expenditures. The SysOps administrator identifies multiple findings in the dashboard:

- Several Amazon Elastic Block Store (Amazon EBS) volumes are flagged under the `Underutilized Amazon EBS Volumes` check because they have been unattached for more than 1414 days.
- Multiple Amazon Relational Database Service (Amazon RDS) DB instances are flagged under the `Amazon RDS Idle DB Instances` check because they have had 00 active database connections for the last 77 days.

The administrator wants to configure an automated solution to remediate these specific findings with minimal administrative effort.

Which of the following remediation workflows should the administrator implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon EventBridge rule that filters for `aws.trustedadvisor` events with the check name `Underutilized Amazon EBS Volumes` and status `WARN` or `ERROR`, and target an AWS Systems Manager (SSM) Automation document to snapshot and delete the flagged volumes.; Configure an Amazon EventBridge rule that filters for `aws.trustedadvisor` events with the check name `Amazon RDS Idle DB Instances` and status `WARN` or `ERROR`, and target an AWS Systems Manager (SSM) Automation document to stop the flagged DB instances.

Answer

Configure an Amazon EventBridge rule targeting an AWS Systems Manager (SSM) Automation document to snapshot and delete the flagged underutilized EBS volumes, and configure an EventBridge rule targeting an SSM Automation document to stop the flagged idle RDS DB instances.
Remediation of underutilized EBS volumes and idle RDS instances can be automated by creating Amazon EventBridge rules filtering for AWS Trusted Advisor findings and triggering targeted AWS Systems Manager (SSM) Automation documents. The rule for underutilized EBS volumes correctly targets an SSM document to snapshot and delete the unattached volumes to stop storage costs. The rule for idle RDS DB instances targets an SSM document to stop the database instances, saving compute costs.

Step-by-Step Solution

1
Analyze the event source for Trusted Advisor findings.
Identify that AWS Trusted Advisor publishes event notifications to Amazon EventBridge under the source `aws.trustedadvisor` with specific check names in the event details.
Establishing the source of the automation trigger is necessary to filter for cost optimization alerts.
2
Select the correct remediation target and action for unattached EBS volumes.
Use an Amazon EventBridge rule matching `Underutilized Amazon EBS Volumes` to trigger an AWS Systems Manager (SSM) Automation document that takes a snapshot and deletes the volumes.
This removes the unattached volumes, stopping storage costs while preserving data if needed.
3
Select the correct remediation target and action for idle RDS DB instances.
Use an Amazon EventBridge rule matching `Amazon RDS Idle DB Instances` to trigger an SSM Automation document that stops the RDS instances.
Stopping the database instances halts the compute charges immediately while keeping the data intact.

Key Concept

AWS Trusted Advisor integrates with Amazon EventBridge to publish check status notifications. You can build automated, event-driven remediation workflows by routing these events to AWS Systems Manager Automation documents or AWS Lambda functions.
Question 345Question →

A company hosts a web application behind an Application Load Balancer (ALB) that serves as the custom origin for an Amazon CloudFront distribution. A SysOps administrator must secure the architecture to ensure that the ALB only processes traffic originating directly from CloudFront. Additionally, during promotional events, the administrator must protect the origin backend from being overwhelmed by duplicate requests originating from different regional cache locations. Which combination of configurations will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure CloudFront to add a custom HTTP header to origin requests, and configure the ALB listener rules to forward requests to the target group only if this header is present with the correct secret value.; Enable CloudFront Origin Shield in the distribution's origin settings, selecting the optimal AWS Region close to the origin backend.

Answer

The correct configurations are to inject a custom HTTP header from CloudFront and verify it in the Application Load Balancer listener rules, and to enable CloudFront Origin Shield in the distribution's origin settings.
To secure the custom origin, configuring CloudFront to add a custom HTTP header with a secret value and configuring the Application Load Balancer (ALB) listener rules to only forward requests containing that custom header ensures that direct access to the ALB is blocked. To protect the origin from being overwhelmed by duplicate requests, enabling CloudFront Origin Shield creates a centralized caching layer that reduces origin requests during traffic spikes.

Step-by-Step Solution

1
Configure a custom header in the CloudFront distribution settings for the custom origin.
CloudFront automatically appends this custom header to every request it forwards to the Application Load Balancer.
This establishes a shared secret that can be used by the backend to identify valid CloudFront requests.
2
Modify the Application Load Balancer listener rules to forward requests to the target group only when the HTTP header matches the custom header and secret value.
Requests without the header or with incorrect values are rejected at the ALB level.
This prevents direct HTTP/HTTPS access to the ALB, ensuring only CloudFront-forwarded traffic is accepted.
3
Enable Origin Shield within the CloudFront origin configuration and select a regional edge cache close to the origin.
An extra caching layer is created between the regional edge caches and the custom origin.
This consolidates cache misses from multiple regional edge caches into a single request to the origin, preventing origin overload.

Key Concept

Securing custom origins with CloudFront custom headers and optimizing cache hit ratios with Origin Shield.
Question 346Question →

A SysOps administrator is setting up a monthly cost budget in AWS Budgets. The administrator wants to use AWS Budgets Actions to automatically apply a restrictive IAM policy to a developer group if the actual monthly spend exceeds a specific threshold.

Which of the following are required to successfully configure and run this budget action? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An IAM role that grants the AWS Budgets service principal permission to run the action and apply the policy; A budget action configured in AWS Budgets that specifies the action threshold, the target group, and the IAM policy to apply

Answer

To configure the AWS Budgets Action, the administrator must create an IAM role that trusts the AWS Budgets service principal and has permissions to apply the policy, and configure the budget action within AWS Budgets to define the threshold, target group, and policy.
The correct requirements are creating an IAM role that trusts the AWS Budgets service principal and configuring the budget action directly inside AWS Budgets. This allows the AWS Budgets service to securely assume the role and apply the restrictive policy to the developer group when the cost threshold is crossed.

Step-by-Step Solution

1
Identify the service executing the action.
AWS Budgets executes the policy application directly.
Since the action is run by the AWS Budgets service, it requires permissions to modify IAM resources.
2
Determine the required IAM configuration.
Create an IAM role that has a trust policy allowing 'budgets.amazonaws.com' to assume it, along with permissions like attaching group policies.
AWS Budgets must assume this role to modify the target developer group's permissions.
3
Determine the required budget configuration.
Define the budget action and its threshold directly in the AWS Budgets console or API.
The action must be linked to the budget threshold so that it triggers automatically when the cost is exceeded.

Key Concept

AWS Budgets Actions allow SysOps administrators to configure automated responses (such as applying IAM policies, Service Control Policies, or stopping EC2/RDS instances) when a cost or usage budget threshold is met. This requires configuring the action in AWS Budgets and providing an IAM role that the AWS Budgets service principal can assume to execute the action.
Question 347Question →

A SysOps Administrator is configuring an Interface VPC Endpoint for Amazon Systems Manager (SSM) to allow Amazon EC2 instances in a private subnet to securely communicate with the SSM API. The network traffic must remain entirely within the AWS network and not traverse the public internet. Which TWO configurations are required to establish this connectivity? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Private DNS for the Interface VPC Endpoint.; Associate a security group with the Interface VPC Endpoint that allows inbound HTTPS (port 443) traffic from the EC2 instances' private subnet.

Answer

To configure an Interface VPC Endpoint, the SysOps Administrator must enable Private DNS on the endpoint and associate a security group with the endpoint that allows inbound HTTPS (port 443) traffic from the private subnet's EC2 instances.
For Interface VPC Endpoints, private connectivity is established via Elastic Network Interfaces (ENIs) and DNS. The correct actions are to enable Private DNS (which maps standard AWS service DNS hostnames to the private IP addresses of the endpoint) and to associate a security group with the endpoint that permits inbound HTTPS traffic from the resources in the private subnet.

Step-by-Step Solution

1
Configure DNS resolution for the endpoint.
Private DNS is enabled on the Interface VPC Endpoint.
This allows applications and instances to use the standard AWS service endpoint URLs to resolve to the private IP addresses of the endpoint's network interfaces.
2
Configure the security group for the endpoint.
A security group is associated with the endpoint that permits inbound HTTPS (port 443) traffic from the source EC2 instances.
Interface VPC Endpoints use Elastic Network Interfaces (ENIs) inside the VPC, which are secured by security groups. These security groups must permit inbound traffic from the clients.

Key Concept

Interface VPC Endpoints (AWS PrivateLink) require enabling Private DNS for seamless endpoint resolution and using security groups to control inbound network traffic to the endpoint network interfaces.
Question 348Question →

A SysOps administrator needs to implement a cost-monitoring solution for an AWS account where developers frequently deploy untagged experimental workloads. The solution must use machine learning to automatically detect unexpected spend spikes on resources that lack the Environment tag and send immediate alerts to an existing Amazon SNS topic. Furthermore, the administrator must be able to perform root-cause analysis in AWS Cost Explorer to identify the specific EC2 instance IDs responsible for any detected anomalies.

Which combination of steps should the administrator perform to meet these requirements?

Show answer & explanation

Answer: Activate the Environment tag as a cost allocation tag in the Billing console. Enable hourly and resource-level granularity in AWS Cost Explorer. In AWS Cost Anomaly Detection, create a Cost Allocation Tag monitor for the Environment tag, create an alert subscription linked to the SNS topic, and ensure the SNS topic's access policy permits the anomaly-detection.amazonaws.com service principal to publish to it.

Answer

Activate the Environment tag as a cost allocation tag in the Billing console, enable hourly and resource-level granularity in AWS Cost Explorer, create a Cost Allocation Tag monitor for the Environment tag in AWS Cost Anomaly Detection, link it to an SNS subscription, and allow the anomaly-detection.amazonaws.com service principal to publish to the SNS topic.
The correct option outlines the comprehensive set of actions required to monitor untagged resources and analyze them. Activating the Environment tag as a cost allocation tag ensures AWS tracks cost data associated with this key. Enabling hourly and resource-level granularity in AWS Cost Explorer is necessary to identify individual EC2 instance IDs. Creating a Cost Allocation Tag monitor in AWS Cost Anomaly Detection allows the machine learning model to evaluate cost anomalies associated with tag values (including resources with no tag value). Modifying the SNS topic access policy to allow the anomaly-detection.amazonaws.com service principal to publish ensures alerts are successfully delivered.

Step-by-Step Solution

1
Activate the tag key in the Billing console.
The Environment tag is registered as a Cost Allocation Tag, allowing AWS to start tracking and aggregating cost data by this tag value.
Cost Anomaly Detection and Cost Explorer cannot filter or monitor based on tags unless they are explicitly activated as cost allocation tags.
2
Enable hourly and resource-level granularity in Cost Explorer.
AWS Cost Explorer is configured to store detailed resource-level and hourly data.
By default, Cost Explorer aggregates cost data daily at the service/member account level. Viewing individual EC2 instance IDs requires enabling resource-level granularity.
3
Create a Cost Allocation Tag monitor and associate it with an alert subscription targeting the SNS topic.
AWS Cost Anomaly Detection will evaluate costs grouped by the Environment tag (including untagged resources marked as 'No Tag Value') and send notifications to the SNS topic.
This establishes the machine-learning-driven monitoring for anomalous spend on the target tag key.
4
Update the SNS topic access policy to grant publish permissions to the Cost Anomaly Detection service principal.
The anomaly-detection.amazonaws.com service principal is authorized to call the Publish API on the SNS topic.
Without this policy modification, the SNS topic will reject the publish requests from AWS Cost Anomaly Detection, preventing alerts from being delivered.

Key Concept

AWS Cost Anomaly Detection utilizes machine learning to identify unexpected cost spikes, but depends on Cost Allocation Tags to monitor tagged/untagged resources, and requires SNS policy permissions to deliver alerts, while Cost Explorer requires explicit enablement of resource-level granularity for instance-level root-cause analysis.
Question 349Question →

A SysOps Administrator is troubleshooting a configuration issue in a VPC. EC2 instances in a private subnet must access an Amazon S3 bucket to retrieve datasets. To comply with security policies and avoid data transfer processing costs, the administrator created an Amazon S3 Gateway VPC Endpoint. However, during a traffic analysis, the administrator observes that data transfer charges for the NAT Gateway are still increasing.

An inspection of the VPC Flow Logs for the EC2 instance's elastic network interface (ENI) reveals the following entry:

2 123456789012 eni-08a7b6c5d4e3f2g10 10.0.2.14 52.216.184.147 49320 443 6 40 2400 1781308800 1781308860 ACCEPT OK

Which action must the administrator take to ensure S3 traffic is routed through the S3 Gateway VPC Endpoint?

Show answer & explanation

Answer: Update the route table associated with the private subnet by adding a route that targets the S3 Gateway VPC Endpoint (vpce-xxxxxxxx) for the Amazon S3 prefix list destination (pl-xxxxxxxx).

Answer

Update the route table associated with the private subnet by adding a route that targets the S3 Gateway VPC Endpoint (vpce-xxxxxxxx) for the Amazon S3 prefix list destination (pl-xxxxxxxx).
The correct action is to update the route table associated with the private subnet by adding a route that targets the S3 Gateway VPC Endpoint for the Amazon S3 prefix list. Gateway VPC Endpoints function by intercepting traffic destined for a specific AWS service (in this case, S3) using prefix list routes. If the route table is not updated to point the prefix list destination to the endpoint, the traffic will fallback to the default route (0.0.0.0/0) through the NAT Gateway, incurring data transfer processing fees.

Step-by-Step Solution

1
Analyze the VPC Flow Log entry.
The flow log entry shows an accepted connection (ACCEPT OK) from the EC2 private IP (10.0.2.14) to a public IP destination (52.216.184.147) on port 443. The destination IP belongs to the public S3 service range.
Before making changes, the administrator must confirm that traffic is still being directed to S3's public IP range and is traversing the NAT Gateway via the default route.
2
Check the route table of the private subnet.
The route table has a default route (0.0.0.0/0) pointing to the NAT Gateway, but lacks a route for the S3 prefix list (pl-xxxxxxxx) targeting the S3 Gateway VPC Endpoint (vpce-xxxxxxxx).
Gateway VPC Endpoints require explicit route table entries to redirect traffic from the default route to the private VPC endpoint route.
3
Add the S3 prefix list route to the private subnet's route table.
A new route is added with the destination 'pl-xxxxxxxx' (representing all S3 IP prefixes in the region) and the target 'vpce-xxxxxxxx'.
This configuration ensures that traffic destined for S3 bypasses the NAT Gateway and goes directly to S3 via the VPC local backbone, avoiding NAT Gateway processing charges.

Key Concept

Gateway VPC Endpoints use prefix list routing in subnet route tables to route traffic privately and cost-effectively to S3 and DynamoDB without traversing NAT Gateways.
Question 350Question →

A SysOps administrator needs to configure a system to monitor AWS account spending and send alerts whenever there is a sudden, unexpected spike in cost. The spending patterns are variable and unpredictable, making static thresholds ineffective. The administrator wants a solution that uses machine learning to dynamically detect these cost anomalies. Which AWS feature should the administrator use to achieve this goal?

Show answer & explanation

Answer: AWS Cost Anomaly Detection

Answer

AWS Cost Anomaly Detection
AWS Cost Anomaly Detection is the only listed feature that uses machine learning to analyze spending data, identify abnormal spikes, and alert administrators without requiring the manual configuration of static thresholds.

Step-by-Step Solution

1
Analyze the requirements to find a tool that detects sudden cost spikes in variable and unpredictable spend patterns.
Determined that static limits will not work, meaning a machine learning-driven dynamic threshold is needed.
Variable and unpredictable spending patterns make manual thresholds prone to false positives or false negatives.
2
Evaluate the capabilities of the correct service, AWS Cost Anomaly Detection.
AWS Cost Anomaly Detection matches the requirement by dynamically baseline-learning spending patterns using machine learning models.
It detects anomalies and alerts administrators dynamically, satisfying the specific project request.
3
Contrast AWS Cost Anomaly Detection with static budgeting and configuration features.
AWS Budgets requires static limits, EventBridge routes events, and Cost Allocation Tags categorize costs.
This rules out the incorrect options.

Key Concept

AWS Cost Anomaly Detection utilizes machine learning models to establish dynamic baselines and alert on unexpected cost spikes, making it ideal for variable spending patterns where static budgets are ineffective.
Question 351Question →

A company runs a microservices-based application across multiple member accounts in an AWS Organizations structure. A SysOps Administrator is reviewing AWS Compute Optimizer recommendations in the delegated administrator account. The administrator notices that although the tool provides recommendations for EC2 instances, it flags memory utilization metrics as "Unavailable" for all instances, meaning it cannot verify if an instance is memory-bottlenecked before recommending a smaller instance size. Which TWO configurations or actions must the administrator implement to ensure AWS Compute Optimizer receives and analyzes memory metrics to provide accurate, memory-aware right-sizing recommendations across all accounts? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy and configure the Unified CloudWatch Agent on the EC2 instances to publish memory utilization metrics to the default CWAgent namespace.; Opt-in to AWS Compute Optimizer from the AWS Organizations management account or delegated administrator account for all member accounts.

Answer

Deploying the Unified CloudWatch Agent on EC2 instances to send memory metrics to the default CWAgent namespace, and opting in to AWS Compute Optimizer at the organization level.
To provide memory-aware recommendations, AWS Compute Optimizer must be able to analyze memory utilization metrics. Since memory is an OS-level metric, the Unified CloudWatch Agent must be installed on the EC2 instances to collect and publish these metrics to CloudWatch under the default CWAgent namespace. Additionally, because the workloads are distributed across multiple member accounts in an organization, Compute Optimizer must be enabled at the Organization level from the management account or a delegated administrator account to collect and display consolidated recommendations.

Step-by-Step Solution

1
Configure the Unified CloudWatch Agent on the target EC2 instances to collect memory utilization metrics.
Memory metrics (such as mem_used_percent) are published to the default CWAgent namespace in Amazon CloudWatch.
Compute Optimizer cannot read OS-level memory metrics from the hypervisor; it requires the CloudWatch Agent to feed this data to CloudWatch.
2
Ensure the EC2 instances are associated with an IAM instance profile containing permissions to write to CloudWatch.
The CloudWatch Agent successfully authenticates and pushes the memory metrics.
Without IAM permissions, the CloudWatch Agent cannot publish the collected memory metrics to CloudWatch.
3
Opt-in to AWS Compute Optimizer at the AWS Organizations organization level.
Compute Optimizer is enabled for all member accounts, allowing it to aggregate metrics and analyze resources organization-wide.
Multi-account environments require organization-level opt-in or delegated administrator configuration to generate consolidated recommendations.

Key Concept

Configuring OS-level memory metric collection via the CloudWatch Agent and enabling organization-wide Compute Optimizer opt-in for rightsizing.
Estimated Time:3m 0s
Question 352Question →

An organization utilizes consolidated billing in AWS Organizations. A SysOps Administrator has deployed an organization-wide Tag Policy to enforce the tag key `BillingID` on all newly created Amazon EC2 instances across all member accounts. The policy is successfully validated, and resources are being launched with the correct tag. However, when the administrator attempts to create a custom cost filter in AWS Cost Explorer to track spending for these instances, the `BillingID` tag key is unavailable. Which action must be taken to resolve this issue?

Show answer & explanation

Answer: Access the Billing console using the organization's management account, open the Cost Allocation Tags page, and select the tag key to activate it.

Answer

Access the Billing console using the organization's management account, open the Cost Allocation Tags page, and select the tag key to activate it.
In AWS Organizations, user-defined cost allocation tags must be activated manually from the management (payer) account via the Billing console before they can be used to filter or group costs in tools like AWS Cost Explorer or AWS Budgets. Enforcing tag keys via Tag Policies ensures resource compliance but does not bypass the requirement for billing activation.

Step-by-Step Solution

1
Identify the account type required for managing billing configuration.
Confirm that only the management (payer) account of the AWS Organization can administer cost allocation tags.
Member accounts do not have permission to activate cost allocation tags for consolidated billing.
2
Locate the cost allocation settings in the AWS Billing console.
Access the Cost Allocation Tags dashboard in the management account.
This is the centralized console where user-defined and AWS-generated tags must be activated for billing tracking.
3
Activate the specific tag key.
Find the `BillingID` tag key under the user-defined cost allocation tags list and select 'Activate'.
Activating the tag key prompts AWS to begin tracking and organizing cost data by this tag, making it available in Cost Explorer and Budgets.

Key Concept

Activation of Cost Allocation Tags
Estimated Time:1m 30s
Question 353Question →

A SysOps Administrator has deployed an Interface VPC Endpoint for AWS Key Management Service (AWS KMS) to allow Amazon EC2 instances in a private VPC subnet to securely access KMS. The applications on the EC2 instances are configured to use the default service endpoint kms.us-east-1.amazonaws.com. However, they are unable to resolve the hostname to the private IP addresses of the endpoint. Which action will resolve this DNS resolution issue?

Show answer & explanation

Answer: Enable private DNS hostnames for the Interface VPC Endpoint.

Answer

Enable private DNS hostnames for the Interface VPC Endpoint.
Enabling private DNS hostnames creates a Route 53 private hosted zone associated with the VPC. This resolves the public service endpoint hostname to the private IP addresses of the Interface VPC Endpoint's network interfaces, allowing applications to function without changing their destination endpoint URLs.

Step-by-Step Solution

1
Identify the type of VPC endpoint being configured.
The scenario specifies an Interface VPC Endpoint (AWS PrivateLink), which provisions Elastic Network Interfaces (ENIs) within the subnets.
This establishes that communication relies on direct network interface targeting and DNS name resolution, rather than route table rules.
2
Evaluate the application configuration requirements.
Applications are configured to send requests to the default public endpoint URL (kms.us-east-1.amazonaws.com) rather than a custom endpoint DNS name.
This indicates that public DNS resolution must be overridden locally within the VPC to point to the private IP addresses of the interface endpoint.
3
Enable the private DNS hostnames feature on the Interface VPC Endpoint.
AWS associates a private Route 53 hosted zone with the VPC, mapping the public hostname kms.us-east-1.amazonaws.com to the private IPs of the endpoint's ENIs.
This allows applications to use the standard default endpoint name and have their traffic routed privately to AWS KMS without code or configuration changes.

Key Concept

Interface VPC Endpoints require Private DNS to be enabled so that standard public endpoint hostnames resolve directly to the private IP addresses of the endpoint's network interfaces.
Estimated Time:1m 0s
Question 354Question →

An Application Load Balancer (ALB) is configured to distribute traffic to a fleet of Amazon EC2 instances in private subnets. The EC2 instances run a web application that listens on TCP port 8443 (HTTPS) for client traffic. The Target Group configuration specifies a custom health check on TCP port 8080 (HTTP) with the path `/healthz`. Recently, the SysOps Administrator observed that all EC2 instances in the Target Group are marked as unhealthy, with the health status detail displaying: 'Health check failed with HTTP code 401: Unauthorized'. In addition, a recent security group cleanup has caused connection timeouts on port 8080 during target registration. Which of the following actions should the SysOps Administrator take to resolve these issues and restore the target health status to healthy? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Modify the application configuration on the EC2 instances to permit unauthenticated access to the `/healthz` path; Update the security group associated with the EC2 instances to allow inbound TCP traffic on port 8080 from the Application Load Balancer's security group

Answer

Modify the application configuration on the EC2 instances to permit unauthenticated access to the `/healthz` path, and update the security group associated with the EC2 instances to allow inbound TCP traffic on port 8080 from the Application Load Balancer's security group.
The target instances are returning HTTP 401 (Unauthorized) because the `/healthz` health check endpoint requires authentication. Modifying the application configuration to allow unauthenticated access to this path resolves this error. Additionally, because the health checks are configured to run on port 8080 rather than the default traffic port (8443), the instance security group must explicitly permit inbound TCP traffic on port 8080 from the Application Load Balancer's security group to prevent connection timeouts.

Step-by-Step Solution

1
Analyze the health check failure status code 401 Unauthorized.
Determine that the `/healthz` path on the EC2 instances requires authentication, which prevents the Application Load Balancer from receiving a success status code (typically 200 OK).
An ELB health check requires a successful HTTP response code (configured in the target group, default is 200) to mark a target as healthy.
2
Analyze the connection timeout issue on port 8080.
Determine that security group rules on the EC2 instances do not allow inbound traffic from the load balancer on TCP port 8080.
Because the health check is configured on port 8080 instead of the standard application port 8443, the security group must be explicitly configured to allow the load balancer to connect to port 8080.
3
Formulate the resolutions.
Configure the application to allow unauthenticated access to the `/healthz` path, and update the security group rules to permit inbound traffic on port 8080 from the ALB security group.
These actions directly resolve both the HTTP 401 Unauthorized status code and the connection timeout symptoms.

Key Concept

Elastic Load Balancing Health Checks and Security Group Configuration
Question 355Question →

A SysOps Administrator is investigating malicious outbound HTTP traffic originating from a VPC. Multiple Amazon EC2 instances reside in private subnets and route their outbound traffic to the internet through a NAT Gateway. The administrator has enabled VPC Flow Logs on the public subnet's network interface where the NAT Gateway resides. However, in the default flow logs, the `srcaddr` field for all outbound packets shows the NAT Gateway's private IP address, making it impossible to identify which specific EC2 instance is generating the malicious traffic.

The administrator wants to resolve this issue and successfully configure the logs to be published to a CloudWatch Logs log group.

Which of the following actions should the administrator take to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a new VPC Flow Log with a custom format that includes the `pkt-srcaddr` field to capture the original packet-level source IP address of the traffic passing through the NAT Gateway.; Create a new VPC Flow Log targeting the private subnets where the EC2 instances reside to capture the traffic at the instance network interfaces before NAT translation.

Answer

Create a new VPC Flow Log with a custom format that includes the `pkt-srcaddr` field, and create a new VPC Flow Log targeting the private subnets where the EC2 instances reside.
The option to use a custom flow log format with the `pkt-srcaddr` field is correct because this field captures the original source IP address before NAT translation. The option to enable flow logs on the private subnets is correct because it captures the traffic before it reaches the NAT Gateway, meaning the source IP in the logs will be the actual private IP of the EC2 instance.

Step-by-Step Solution

1
Analyze the limitation of default VPC Flow Logs on the NAT Gateway interface.
The default format only captures `srcaddr`, which shows the intermediate interface's IP (NAT Gateway private IP) after source NAT has occurred.
To pinpoint the original source EC2 instance, the packet-level source IP before translation must be captured, or the logs must be gathered before the packet reaches the NAT Gateway.
2
Identify the mechanisms to capture the original source IP.
Two mechanisms are available: use a custom flow log format with the `pkt-srcaddr` field on the public interface, or capture flow logs directly on the private subnet or private ENIs before translation.
The custom field `pkt-srcaddr` logs the original packet-level source IP. Alternatively, subnet-level logs capture the traffic at the ENIs of the instances, where the source IP is still the private IP of the instance.
3
Verify creation prerequisites and operational best practices.
The IAM policy of the administrator creating the flow logs must contain the `iam:PassRole` permission to pass the delivery role to the flow logs service. S3 gateway endpoints should not be deleted as they bypass the NAT Gateway to reduce cost, and log group retention should be managed to avoid cost spikes.
This ensures the logging solution can be successfully created and managed without security issues or unnecessary data transfer and storage costs.

Key Concept

VPC Flow Logs customization and network address translation visibility limitations.
Question 356Question →

An administrator has deployed a web application on several Amazon EC2 instances behind an Application Load Balancer (ALB). After registering the instances with the target group, the administrator notices that all instances are reported as unhealthy by the load balancer. The application is configured to run on port 80. Which two configurations should the administrator verify to troubleshoot the failing health checks? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The target group's health check port and path match the port and path where the web application is listening on the instances.; The security group associated with the EC2 instances allows inbound traffic on port 80 from the security group of the Application Load Balancer.

Answer

Verify that the target group's health check port and path match the application's configuration, and ensure that the security group of the EC2 instances allows inbound traffic on port 80 from the Application Load Balancer's security group.
For an Application Load Balancer to report instances as healthy, the security group on the EC2 instances must allow inbound traffic from the load balancer on the health check port. Additionally, the target group's health check configuration must specify a port and path that match the running web application so it receives a successful HTTP response (such as 200 OK).

Step-by-Step Solution

1
Check the security group rules of the EC2 instances.
Ensure there is a rule allowing inbound traffic from the security group of the Application Load Balancer (ALB) on port 80.
This confirms the load balancer can physically reach the instances to perform the health check.
2
Review the health check configuration in the target group.
Confirm that the health check port matches the application port (80) and that the path (e.g., '/') points to a valid, unauthenticated resource.
This ensures the load balancer is querying a valid URL endpoint on the web server that returns a 200 OK status.

Key Concept

Application Load Balancer health checks require proper network connectivity (security groups) and correct application configuration (port and path) to successfully report targets as healthy.
Question 357Question →

A SysOps Administrator is troubleshooting a connectivity issue between an Application Load Balancer (ALB) in a public subnet (10.0.1.0/2410.0.1.0/24) and a fleet of web servers running on Amazon EC2 instances in a private subnet (10.0.2.0/2410.0.2.0/24). Users are reporting HTTP 504504 Gateway Timeout errors when attempting to access the application.

The Administrator reviews the VPC Flow Logs for the web servers' subnet and observes the following entries:

versionsrcaddrdstaddrsrcportdstportprotocolpacketsbytesactionlog-status
210.0.1.5010.0.2.1051243806140ACCEPTOK
210.0.2.1010.0.1.5080512436140REJECTOK

What configuration change is required to resolve this connectivity issue?

Show answer & explanation

Answer: Add an outbound rule to the Network ACL associated with the private subnet to allow outbound traffic to the public subnet (10.0.1.0/2410.0.1.0/24) on ephemeral ports (1024−655351024-65535).

Answer

Add an outbound rule to the Network ACL associated with the private subnet to allow outbound traffic to the public subnet (10.0.1.0/2410.0.1.0/24) on ephemeral ports (1024−655351024-65535).
The VPC Flow Logs reveal that inbound traffic from the ALB (10.0.1.5010.0.1.50) to the web server (10.0.2.1010.0.2.10) is accepted, but the outbound response is rejected. Because Security Groups are stateful, they automatically allow response traffic for any permitted inbound connection. However, Network ACLs are stateless and require explicit rules in both directions. The rejection of the outbound response indicates that the private subnet's Network ACL is missing an outbound rule. The rule must permit outbound traffic to the ephemeral ports (1024−655351024-65535) used by the ALB to receive the response.

Step-by-Step Solution

1
Analyze the VPC Flow Logs to determine the status of the connection.
The log shows that the inbound HTTP request (destination port 8080, source port 5124351243) from the ALB (10.0.1.5010.0.1.50) to the web server (10.0.2.1010.0.2.10) is accepted, but the outbound response (source port 8080, destination port 5124351243) is rejected.
Identifying that the request is accepted but the response is rejected helps isolate the issue to a stateless security control.
2
Evaluate the stateful/stateless nature of the security controls.
Security groups are stateful and automatically allow response traffic, meaning they are not causing the outbound rejection. Network ACLs are stateless and require explicit rules in both directions.
Since the inbound request was accepted, a stateless control like a Network ACL must be blocking the return traffic due to a missing outbound rule.
3
Determine the necessary configuration change.
Add an outbound rule to the private subnet's Network ACL to allow traffic to the public subnet (10.0.1.0/2410.0.1.0/24) on ephemeral ports (1024−655351024-65535).
The client connection uses ephemeral ports for response traffic. Explicitly allowing outbound traffic on ephemeral ports completes the response loop.

Key Concept

VPC Network ACLs are stateless security controls that evaluate inbound and outbound traffic independently. Allowed inbound connections require matching outbound rules for the ephemeral port range (1024−655351024-65535) to successfully return response traffic.
Question 358Question →

A batch processing workload runs on Amazon ECS tasks using AWS Fargate. The tasks are distributed across two private subnets in Availability Zones us−west−2aus-west-2a and us−west−2bus-west-2b within a single VPC. Every month, these tasks pull approximately 15 TB15\text{ TB} of container image layers from Amazon ECR and send 10 TB10\text{ TB} of log data to Amazon CloudWatch Logs. Currently, a single NAT Gateway located in us−west−2aus-west-2a is used for all outbound traffic from both private subnets. The monthly AWS bill shows high costs for NAT Gateway data processing and cross-AZ data transfer.

Which two actions should a SysOps administrator take to minimize these data transfer costs while maintaining secure, private connectivity to ECR and CloudWatch Logs? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.; Deploy Interface VPC Endpoints for ECR and CloudWatch Logs in both Availability Zones, and enable Private DNS.

Answer

To minimize data transfer costs, the SysOps administrator should create a Gateway VPC Endpoint for Amazon S3 and associate it with the private subnet route tables, and deploy Interface VPC Endpoints for ECR and CloudWatch Logs in both Availability Zones with Private DNS enabled.
The correct actions are to create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables, and deploy Interface VPC Endpoints for ECR and CloudWatch Logs in both Availability Zones. ECR stores container image layers in Amazon S3. By using a Gateway VPC Endpoint for S3, all layer downloads are routed privately and for free, bypassing the NAT Gateway. Deploying Interface VPC Endpoints for ECR and CloudWatch Logs in both Availability Zones ensures logs and ECR API calls are processed locally within each zone, replacing the 0.045perGBNATGatewaychargewiththelower0.045 per GB NAT Gateway charge with the lower 0.01 per GB Interface Endpoint charge, and avoiding cross-AZ data transfer fees.

Step-by-Step Solution

1
Analyze the traffic destination and volume.
The ECS Fargate tasks pull 15 TB15\text{ TB} of container image layers (stored in S3) from ECR and push 10 TB10\text{ TB} of logs to CloudWatch Logs monthly.
Understanding the destinations allows selecting the correct endpoint type.
2
Evaluate NAT Gateway costs.
The current architecture routes all this traffic through a single NAT Gateway, incurring data processing fees of 0.045 USD/GB0.045\text{ USD/GB} for both pulling images and pushing logs, along with cross-AZ fees (0.01 USD/GB0.01\text{ USD/GB}) for tasks in us−west−2bus-west-2b.
Identifying the current cost drivers helps determine the target areas for optimization.
3
Select the most cost-effective VPC endpoints.
S3 Gateway Endpoints are free and route S3 layer downloads. Interface VPC Endpoints for ECR and CloudWatch Logs charge 0.01 USD/GB0.01\text{ USD/GB} for data processing, which is significantly cheaper than NAT Gateway.
Replacing NAT Gateway routing with VPC endpoints minimizes data processing costs.
4
Address cross-AZ traffic.
By deploying the Interface Endpoints in both active Availability Zones and enabling Private DNS, Fargate tasks in each AZ connect to local endpoints, avoiding the 0.01 USD/GB0.01\text{ USD/GB} cross-AZ data transfer fee.
Local endpoints prevent traffic from crossing Availability Zone boundaries.

Key Concept

VPC Endpoint optimization and minimizing NAT Gateway data processing fees for AWS service traffic.
Estimated Time:2m 30s
Question 359Question →

A company hosts a static website on Amazon S3. The website's assets are encrypted using server-side encryption with AWS KMS customer managed keys (SSE-KMS). A SysOps administrator is configuring an Amazon CloudFront distribution to serve these assets securely using Origin Access Control (OAC). Which TWO actions must the administrator take to allow CloudFront to retrieve and serve the encrypted assets? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the Amazon S3 bucket policy to grant the s3:GetObject permission to the CloudFront service principal, specifying the distribution ARN in the aws:SourceArn condition.; Update the AWS KMS key policy of the customer managed key to grant the kms:Decrypt permission to the CloudFront service principal, specifying the distribution ARN in the aws:SourceArn condition.

Answer

To allow CloudFront to serve KMS-encrypted S3 assets using Origin Access Control (OAC), the SysOps administrator must update the S3 bucket policy to grant s3:GetObject permissions to the CloudFront service principal, and update the KMS key policy of the customer managed key to grant kms:Decrypt permissions to the CloudFront service principal, both restricted by the distribution's ARN using the aws:SourceArn condition.
The correct options involve configuring the Amazon S3 bucket policy to grant the s3:GetObject permission and configuring the AWS KMS key policy of the customer managed key to grant the kms:Decrypt permission. Both permissions must be granted to the CloudFront service principal (cloudfront.amazonaws.com) and scoped to the specific distribution ARN using the aws:SourceArn condition.

Step-by-Step Solution

1
Configure the S3 bucket policy to trust the CloudFront service principal.
The bucket policy allows the s3:GetObject action when the requester is the CloudFront service principal and matches the specific distribution ARN.
This establishes standard Origin Access Control (OAC) authorization at the S3 bucket layer.
2
Configure the KMS key policy of the customer managed key.
The key policy allows the kms:Decrypt action to the CloudFront service principal with a condition verifying the distribution's ARN.
Since the objects are encrypted using SSE-KMS, the caller (CloudFront) needs explicit permission to decrypt the objects using the KMS key.

Key Concept

Using Origin Access Control (OAC) with SSE-KMS encrypted S3 origins in CloudFront.
Question 360Question →

A SysOps administrator wants to monitor AWS accounts for unexpected cost spikes using machine learning. The administrator also wants to receive alerts in a Slack channel when an anomaly is detected. Which actions should the administrator take to configure this solution? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create a cost monitor in AWS Cost Anomaly Detection.; Create an alert subscription in AWS Cost Anomaly Detection using AWS Chatbot to send notifications to the Slack channel.

Answer

To monitor for machine learning-based cost anomalies and receive alerts in Slack, create a cost monitor in AWS Cost Anomaly Detection and configure an alert subscription that uses AWS Chatbot to send notifications to the Slack channel.
To establish cost anomaly monitoring and alerting, the SysOps administrator must create a cost monitor to analyze spending using machine learning models, and configure an alert subscription pointing to the Slack channel via AWS Chatbot.

Step-by-Step Solution

1
Create a cost monitor in AWS Cost Anomaly Detection.
Configures the machine learning system to evaluate costs based on AWS services, cost allocation tags, cost categories, or linked accounts.
This establishes the scope of spend that needs to be analyzed for anomalies.
2
Configure a subscription for alerting.
Defines the integration with AWS Chatbot and specifies the Slack channel as the destination.
This links the detected cost anomalies to the administrator's Slack channel for real-time alerting.

Key Concept

AWS Cost Anomaly Detection uses machine learning to identify anomalous spend and supports alerting via SNS or AWS Chatbot to messaging platforms like Slack.
PreviousPage 18 / 49Next
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin