Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 361Question →

A SysOps administrator has configured an Application Load Balancer (ALB) to route HTTP traffic to a fleet of Amazon EC2 instances. After deployment, all instances in the target group are reported as unhealthy with the status code 'HealthCheck.Failed'. The web application is configured to serve content on port 80.

Which two configurations should the administrator inspect to resolve the failing health checks? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The security group associated with the EC2 instances to ensure it allows inbound traffic on port 80 from the ALB security group.; The health check path in the target group settings to ensure it points to a valid file that returns a 200 OK status.

Answer

The correct configurations to verify are the security group associated with the EC2 instances to ensure it allows inbound traffic on port 80 from the ALB security group, and the health check path in the target group settings to ensure it points to a valid file that returns a 200 OK status.
For an Application Load Balancer health check to pass, the load balancer must be able to complete a TCP handshake and receive a successful HTTP response. Verifying the EC2 security group ensures the network path is open from the load balancer, and verifying the health check path ensures the application returns the expected success code (such as 200 OK).

Step-by-Step Solution

1
Check the security group rules applied to the EC2 instances.
Ensure there is an inbound rule permitting TCP traffic on port 80, with the source set to the security group of the Application Load Balancer.
If the security group blocks the load balancer's probes, the health check will fail with a connection timeout.
2
Check the health check path configuration in the target group and compare it to the web server logs.
Ensure the path (e.g., /index.html or /health) exists on the web server and returns a successful HTTP response code (typically 200 OK).
If the path returns a 404 Not Found, 403 Forbidden, or any code not configured as success in the target group, the instance is marked unhealthy.

Key Concept

Successful load balancer health checks require both network-level access (via security groups and network ACLs) and application-level response (via valid HTTP endpoints returning successful status codes).
Question 362Question →

A SysOps Administrator uses AWS CloudFormation StackSets to deploy infrastructure templates containing a resource-level tag with the key `BillingDept` across multiple target AWS accounts in AWS Organizations. The administrator verifies that the tags are successfully applied to all deployed resources. However, when opening AWS Cost Explorer in the organization's management account, the `BillingDept` tag is not available to filter or group the cost data.

Which action must the administrator take to resolve this issue?

Show answer & explanation

Answer: Access the AWS Billing and Cost Management console from the organization's management account, and activate the `BillingDept` tag as a cost allocation tag.

Answer

Access the AWS Billing and Cost Management console from the organization's management account, and activate the BillingDept tag as a cost allocation tag.
Activating the tag in the management account's Billing and Cost Management console is required because user-defined cost allocation tags do not automatically become active for billing reports upon creation. They must be explicitly activated by the management account of the organization to start appearing in AWS Cost Explorer.

Step-by-Step Solution

1
Identify where the cost allocation tags are centrally managed in a multi-account organization.
The management account is determined to be the central point of configuration for consolidated billing and Cost Explorer settings.
Cost Explorer filters and billing reports for the entire organization are run from the management account.
2
Determine the activation status of the new custom tag.
Realize that custom tags are not active for cost allocation automatically upon resource tagging or template deployment.
AWS requires explicit opt-in activation for user-defined tags to be processed by the billing engine.
3
Perform the activation of the tag in the Billing console of the management account.
The tag is marked as active under the Cost Allocation Tags section.
Once activated, AWS starts tracking costs associated with this tag, and the tag becomes available in Cost Explorer within 24 hours.

Key Concept

User-defined cost allocation tags must be manually activated in the management account of an AWS Organization to be visible in Cost Explorer.
Question 363Question →

A company's primary web application is served through an Amazon CloudFront distribution with an Application Load Balancer (ALB) as the custom origin. During peak traffic events, the ALB occasionally returns HTTP 502 (Bad Gateway) errors. To maintain a good user experience, the SysOps administrator wants to configure CloudFront to serve a static maintenance page hosted in an Amazon S3 bucket when these errors occur. How should the administrator configure the CloudFront distribution to meet these requirements?

Show answer & explanation

Answer: Create an origin group containing the ALB as the primary origin and the S3 bucket as the secondary origin, then configure failover criteria to include the 502 status code.

Answer

Create an origin group containing the ALB as the primary origin and the S3 bucket as the secondary origin, then configure failover criteria to include the 502 status code.
Creating a CloudFront origin group with the ALB as the primary origin and the S3 bucket as the secondary origin allows CloudFront to fail over automatically. When the primary origin returns an HTTP 502 status code, CloudFront requests the content from the secondary origin (S3 bucket), ensuring that the maintenance page is served to the viewer.

Step-by-Step Solution

1
Identify that the primary origin (ALB) returns transient HTTP 502 errors and that failover needs to happen dynamically at the CloudFront edge.
Realize that DNS-level failover is inappropriate because it cannot inspect HTTP response codes on a per-request basis.
Choosing the correct layer for failover ensures minimal downtime and correct handling of status codes.
2
Configure an origin group within the CloudFront distribution.
Add the ALB as the primary origin and the S3 bucket containing the maintenance page as the secondary origin.
This establishes the backup path for content delivery.
3
Select the HTTP 502 status code in the origin group's failover criteria configuration.
CloudFront will intercept 502 errors from the ALB and fetch the requested resource (or maintenance page) from the S3 bucket instead.
Specifying the status code triggers the automated redirect behavior at the edge.

Key Concept

CloudFront Origin Groups and High Availability
Question 364Question →

A company manages its multi-account environment using AWS Organizations. A SysOps administrator must establish a cost control policy for development sandbox accounts to prevent monthly spending from exceeding a fixed limit of $1,000\$1,000 per account. The solution must satisfy the following criteria:

1. If a sandbox account's actual monthly spend reaches 100%100\% of the budget, the account must be immediately barred from provisioning new resources.
2. A notification must be sent automatically to the SysOps team's Slack channel.

Which combination of actions should the SysOps administrator perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the cost budget in the AWS Organizations management account, and define a budget action that applies a restrictive Service Control Policy (SCP) to the target member account. Ensure the IAM identity configuring the budget has iam:PassRole permissions for the role that AWS Budgets assumes.; Create an Amazon Simple Notification Service (Amazon SNS) topic, configure AWS Chatbot to integrate the SNS topic with the Slack channel, and configure the budget to send an alert to the SNS topic when the limit is reached.

Answer

Configure the cost budget in the AWS Organizations management account, defining a budget action to apply a restrictive Service Control Policy (SCP) to the target member account while ensuring the configuring IAM identity has iam:PassRole permissions; and create an Amazon SNS topic integrated with AWS Chatbot and the Slack channel to send alerts when the limit is reached.
The correct combination of actions uses AWS Budgets created in the AWS Organizations management account to trigger a native budget action. Since member accounts cannot apply SCPs to themselves, this must be done at the Organization level, requiring the administrator to have iam:PassRole permissions for the role that AWS Budgets assumes. Additionally, sending notifications to Slack is achieved by publishing alerts from AWS Budgets to an Amazon SNS topic, which triggers AWS Chatbot to deliver the message to Slack.

Step-by-Step Solution

1
Determine the budget scope and placement.
Identify that because the cost controls require applying a Service Control Policy (SCP) to block resource creation in sandbox member accounts, the budget and its action must be created in the AWS Organizations management account (or a delegated administrator account).
Member accounts do not have the permission or capability to attach SCPs to themselves.
2
Configure the Budget Action and required permissions.
Define an AWS Budgets action targeting the member account with the restrictive SCP. Attach an IAM role to the action that grants AWS Budgets permission to apply the SCP. Ensure the administrator configuring the budget has iam:PassRole permission to pass the role.
AWS Budgets must assume the specified IAM role to execute the action, and the user must be permitted to pass that role to the service.
3
Configure Slack notification integration.
Create an Amazon SNS topic and subscribe AWS Chatbot to it, mapping the subscription to the SysOps Slack channel. Set the AWS Budget alert threshold at 100%100\% of the monthly limit to publish to this SNS topic.
AWS Budgets does not support sending direct webhooks to Slack, so Amazon SNS and AWS Chatbot are required to deliver the message.

Key Concept

AWS Budgets Actions allow organization-wide enforcement (such as applying Service Control Policies) and integration with alerting mechanisms like Amazon SNS and AWS Chatbot for automated notifications.
Question 365Question →

A SysOps Administrator is reviewing AWS Compute Optimizer recommendations for an Amazon EC2 instance. The administrator notices that the recommendations do not include memory utilization metrics, which are critical for right-sizing the workload.

What must the administrator do to enable memory utilization analysis in AWS Compute Optimizer for this EC2 instance?

Show answer & explanation

Answer: Install and configure the unified CloudWatch agent on the EC2 instance to collect and send memory metrics.

Answer

Install and configure the unified CloudWatch agent on the EC2 instance to collect and send memory metrics.
The correct option is to install and configure the unified CloudWatch agent. AWS Compute Optimizer cannot analyze memory utilization of EC2 instances out of the box because memory is a guest operating system-level metric. Installing the unified CloudWatch agent allows the collection of memory metrics, which are then sent to Amazon CloudWatch and automatically ingested by AWS Compute Optimizer.

Step-by-Step Solution

1
Identify the missing metric type in the AWS Compute Optimizer console.
Confirm that OS-level memory metrics are not being collected because AWS Compute Optimizer only receives hypervisor-level metrics (CPU, disk, network) by default.
By default, Amazon EC2 only reports hypervisor-visible metrics to CloudWatch. Memory utilization is an operating system-level metric.
2
Deploy and configure the unified CloudWatch agent on the target EC2 instance.
The agent collects memory utilization metrics from the guest operating system and publishes them to Amazon CloudWatch.
AWS Compute Optimizer automatically detects and analyzes memory metrics published by the unified CloudWatch agent once they are available in CloudWatch.

Key Concept

Memory metric collection for AWS Compute Optimizer using the unified CloudWatch agent
Question 366Question →

A SysOps administrator is managing a high-throughput TCP service deployed on Amazon EC2 instances. The instances are registered by instance ID to a target group associated with a Network Load Balancer (NLB) in the `eu-west-1` region. To comply with strict security standards, the target security group is configured to only allow inbound TCP port 90009000 traffic from a specific customer on-premises CIDR block (198.51.100.0/22198.51.100.0/22). While the customer can establish direct connections to individual instances during maintenance windows, all attempts to connect through the NLB fail, and the NLB target group reports the instances as unhealthy. What action must the administrator take to resolve the health check failure and restore connectivity through the NLB?

Show answer & explanation

Answer: Add an inbound rule to the target instances' security group that allows TCP port 90009000 traffic from the VPC subnets where the Network Load Balancer (NLB) is deployed.

Answer

Add an inbound rule to the target instances' security group that allows TCP port 90009000 traffic from the VPC subnets where the Network Load Balancer (NLB) is deployed.
The correct answer is to allow inbound TCP traffic on port 90009000 from the subnets where the Network Load Balancer (NLB) is deployed. When targets are registered by instance ID, the NLB preserves the client source IP for routing actual traffic, meaning the EC2 instances see the client's IP (198.51.100.0/22198.51.100.0/22) as the source. However, health check requests from the NLB always originate from the private IP addresses of the NLB nodes themselves. If the target security group only permits traffic from the client CIDR, the NLB's health checks will be blocked, causing the target group to mark them as unhealthy. Allowing traffic from the NLB's subnets resolves this issue.

Step-by-Step Solution

1
Analyze the load balancer type and target registration method.
Identify that a Network Load Balancer (NLB) with targets registered by instance ID preserves the client's source IP address for application traffic, but health checks originate from the NLB's private IP addresses.
To determine the network path and source IP addresses for both application traffic and health checks.
2
Examine the security group configuration of the EC2 instances.
Verify that the security group only allows inbound traffic from the customer's on-premises IP range (198.51.100.0/22198.51.100.0/22), thereby blocking the NLB's internal health check requests.
To identify why the health checks are failing despite direct client connectivity being possible during maintenance.
3
Add a rule to allow health checks.
Configure the security group of the EC2 instances to allow inbound TCP traffic on port 90009000 from the subnets where the NLB is deployed.
To permit the NLB nodes to successfully complete health checks on the registered instances.

Key Concept

NLB target security group and health check source IP behavior under client IP preservation.
Estimated Time:3m 0s
Question 367Question →

A SysOps Administrator is configuring IPv6 connectivity for a web application tier located in a private subnet. The instances must be able to initiate outbound connections to external IPv6 services for software updates, but external hosts must not be allowed to initiate connections to the instances. The administrator has created and attached an egress-only internet gateway to the VPC. Which of the following actions must the administrator perform to allow the instances to successfully establish these connections? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add a route to the private subnet's route table with a destination of `::/0` pointing to the egress-only internet gateway.; Configure the private subnet's Network ACL to allow outbound IPv6 traffic to `::/0` and allow inbound IPv6 traffic from `::/0` on TCP ports 10241024-6553565535.

Answer

To allow private subnet instances to make outbound IPv6 connections, you must add a route in the subnet's route table for `::/0` targeting the egress-only internet gateway, and configure the stateless Network ACL to allow outbound IPv6 traffic and inbound response traffic on ephemeral ports (10241024-6553565535).
The correct solution involves configuring routing and network ACLs. First, adding a route for `::/0` targeting the egress-only internet gateway in the subnet's route table ensures that outbound IPv6 traffic is correctly forwarded. Second, because Network ACLs are stateless, they do not track connection states. Therefore, an inbound rule must be configured to allow the return traffic from the external servers on ephemeral ports (TCP 10241024-6553565535).

Step-by-Step Solution

1
Configure the routing path for IPv6 traffic.
Add a route for `::/0` targeting the egress-only internet gateway in the route table of the private subnet.
This tells the VPC router where to direct outbound IPv6 traffic originating from the subnet.
2
Ensure stateless network firewalls permit the bi-directional traffic flow.
Update the subnet's Network ACL (NACL) to allow outbound IPv6 traffic to `::/0` and allow inbound response traffic from `::/0` on ephemeral ports (10241024-6553565535).
Because NACLs are stateless, they evaluate ingress and egress traffic independently. The return packets of outbound connections will be dropped unless ephemeral ports are allowed inbound.
3
Verify stateful security group rules.
The instance security group must allow outbound traffic, but no inbound rules for ephemeral ports are needed.
Security groups are stateful and automatically permit return traffic for established outbound connections.

Key Concept

Egress-Only Internet Gateway routing and stateless Network ACL rules for IPv6 traffic
Question 368Question →

A target group for an Application Load Balancer (ALB) contains EC2 instances that are all marked as unhealthy. Although the web application is running properly and listening on port 80 on all instances, the target group's health check is configured to query port 8080. Which configuration change will resolve this issue?

Show answer & explanation

Answer: Modify the target group's health check settings to use port 80 or the traffic port.

Answer

Modify the target group's health check settings to use port 80 or the traffic port.
Modifying the target group's health check settings to use port 80 (or the traffic port) allows the load balancer to query the port where the web application is actually listening. Since the application is running properly on port 80, this change will allow the health checks to succeed, marking the instances as healthy.

Step-by-Step Solution

1
Identify the port on which the web application is listening on the EC2 instances.
The application is listening on port 80.
Health check requests must be sent to the port where the application is listening to receive a valid response.
2
Identify the port that the Application Load Balancer target group is currently querying for health checks.
The target group is querying port 8080.
Since the application is not listening on port 8080, health checks will fail.
3
Update the health check port in the target group configuration to match the application port.
The health check port is changed to port 80 (or 'traffic port').
This aligns the health check destination with the listening application service, allowing the health checks to succeed.

Key Concept

Target Group Health Check Configuration
Question 369Question →

A SysOps administrator wants to configure automated cost controls for an AWS account used for experimental testing. The administrator needs to prevent developers from launching any new resources as soon as the forecasted monthly spend for the account exceeds $1500. The administrator decides to use AWS Budgets Actions to attach a restrictive IAM policy to the developers' IAM group. Which set of actions is required to successfully implement this configuration?

Show answer & explanation

Answer: Create a budget in AWS Budgets with a forecasted spend threshold of $1500. Create an IAM role with a trust policy allowing budgets.amazonaws.com to assume the role, and grant the role permissions to attach IAM policies. Grant the administrator's IAM identity iam:PassRole permissions for the role, and configure the budget action using this role to apply the restrictive IAM policy to the developers' group.

Answer

Create a budget in AWS Budgets with a forecasted spend threshold of $1500. Create an IAM role with a trust policy allowing budgets.amazonaws.com to assume the role, and grant the role permissions to attach IAM policies. Grant the administrator's IAM identity iam:PassRole permissions for the role, and configure the budget action using this role to apply the restrictive IAM policy to the developers' group.
The correct configuration uses AWS Budgets Actions to natively attach an IAM policy to the developers' group. This requires an execution role trusted by budgets.amazonaws.com with permissions to manage IAM policies. Crucially, the administrator setting up the budget action must possess the iam:PassRole permission on the execution role, ensuring secure delegation of authority.

Step-by-Step Solution

1
Create the execution IAM role for AWS Budgets.
An IAM role is created with a trust policy allowing the service principal budgets.amazonaws.com to assume it, along with a permissions policy allowing iam:AttachGroupPolicy.
AWS Budgets needs to assume this role to perform the action of attaching the policy to the developers' group.
2
Grant the administrator the iam:PassRole permission.
The administrator's IAM policy is updated to allow passing the newly created execution role to the AWS Budgets service.
Without iam:PassRole on the administrator's identity, AWS Budgets will fail to register the action because it cannot verify authorization to delegate the role.
3
Configure the budget and the forecasted cost threshold action.
A budget is established with a $1500 limit, and a budget action is set to trigger when forecasted costs reach 100% of the budget.
This establishes the trigger point for the automated enforcement policy using native AWS Budgets functionality.

Key Concept

Configuring AWS Budgets Actions with the appropriate IAM trust policies and PassRole permissions.
Question 370Question →

An enterprise runs workloads across multiple AWS accounts linked via consolidated billing. To monitor project expenditures, a SysOps Administrator tags resources with the keys 'ProjectCode' and 'Owner'. Despite successfully applying these tags to Amazon EC2 instances and Amazon S3 buckets in the member accounts, the administrator cannot find them when attempting to filter or group costs in AWS Cost Explorer. Which two actions must the SysOps Administrator perform to resolve this issue? (Select two.)

Select all that apply

Show answer & explanation

Answer: Activate the 'ProjectCode' and 'Owner' tags as cost allocation tags in the Billing and Cost Management console of the management account.; Allow up to 2424 hours after tag activation for the data to populate and become available in AWS Cost Explorer.

Answer

Activate the tags in the Billing and Cost Management console of the organization's management account, and allow up to 2424 hours for them to appear in AWS Cost Explorer.
For tags to be used for cost tracking in a consolidated billing environment, they must be manually activated as cost allocation tags in the Billing and Cost Management console of the organization's management account. Once activated, there is a propagation delay of up to 2424 hours before they populate and become usable in AWS Cost Explorer.

Step-by-Step Solution

1
Determine where cost allocation tags must be activated in a consolidated billing setup.
Identify that the organization's management (payer) account holds the authority to manage cost allocation tags for all member accounts.
Individual member accounts cannot activate cost allocation tags for the consolidated bill.
2
Perform tag activation in the appropriate console.
Sign in to the management account, open the Billing and Cost Management console, and select and activate the 'ProjectCode' and 'Owner' tags.
Resource tags are not active for cost allocation automatically and must be explicitly enabled.
3
Account for propagation time.
Wait up to 2424 hours for the tag activation to reflect in AWS Cost Explorer.
Cost Explorer requires time to process historical and incoming billing data with the newly activated tags.

Key Concept

In a consolidated billing environment under AWS Organizations, custom resource tags must be manually activated as cost allocation tags in the Billing and Cost Management console of the management account, taking up to 2424 hours to propagate to AWS Cost Explorer.
Question 371Question →

A SysOps administrator must configure DNS for a global web application hosted at the zone apex domain (example.com). The application is deployed across two AWS Regions: a primary active stack in us-east-1 fronted by an Application Load Balancer (ALB), and a passive disaster recovery (DR) stack in us-west-2 fronted by another ALB. The administrator must implement an active-passive failover configuration that automatically redirects all traffic to the DR stack if the primary ALB or its backend targets become unhealthy. Which two Route 53 configuration steps should the administrator implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Alias record at the zone apex (example.com) pointing to the ALB in us-east-1 with a Failover routing policy, set the Failover Record Type to Primary, and enable Evaluate Target Health.; Create an Alias record at the zone apex (example.com) pointing to the ALB in us-west-2 with a Failover routing policy, set the Failover Record Type to Secondary, and enable Evaluate Target Health.

Answer

Create an Alias record at the zone apex pointing to the primary ALB in us-east-1 using a Failover routing policy (Primary) and enable Evaluate Target Health, and create a corresponding Alias record pointing to the secondary ALB in us-west-2 (Secondary) with Evaluate Target Health enabled.
The correct configuration requires creating two Failover routing policy Alias records at the zone apex pointing to the respective Application Load Balancers. The record pointing to the primary ALB in us-east-1 must be set as Primary, while the record pointing to the DR ALB in us-west-2 must be set as Secondary. In both records, 'Evaluate Target Health' must be set to Yes so Route 53 can dynamically monitor the health of the backend targets and automatically shift traffic if the primary region fails.

Step-by-Step Solution

1
Select the zone apex domain within the Route 53 hosted zone and choose to create a new record.
Initiates the DNS record creation process for the base domain without subdomains.
The requirement specifically specifies hosting at the zone apex (example.com).
2
Configure an Alias record pointing to the Application Load Balancer in the primary region (us-east-1).
Routes zone apex traffic directly to the AWS ALB resource without incurring standard DNS query costs or violating DNS specs.
Zone apex domains cannot use CNAME records; Route 53 Alias records must be used.
3
Set the routing policy to Failover, configure the us-east-1 record as Primary, and set Evaluate Target Health to Yes.
Enables Route 53 to automatically monitor the health of the ALB's target groups and designate this as the default path.
Allows Route 53 to detect target failures and trigger failover to the standby region.
4
Create a second Alias record at the zone apex pointing to the ALB in us-west-2, configure the routing policy to Failover, set it as Secondary, and set Evaluate Target Health to Yes.
Establishes the passive failover destination that receives traffic only when the primary region is unhealthy.
Completes the active-passive failover configuration.

Key Concept

Route 53 Failover Routing with Alias Records at the Zone Apex
Question 372Question →

A SysOps administrator has established hybrid connectivity by connecting an on-premises network to a multi-VPC environment using an AWS Transit Gateway. The administrator configures an AWS Site-to-Site VPN attachment on the Transit Gateway, and both IPsec tunnels are UP with the BGP session active. The Transit Gateway route table has successfully propagated the routes from the on-premises network. However, EC2 instances in a private subnet of one of the VPCs still cannot communicate with the on-premises servers. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The route table associated with the private VPC subnet does not contain a route directing traffic destined for the on-premises network to the Transit Gateway.

Answer

The route table associated with the private VPC subnet does not contain a route directing traffic destined for the on-premises network to the Transit Gateway.
The correct answer is the option stating that the route table associated with the private VPC subnet does not contain a route directing traffic destined for the on-premises network to the Transit Gateway. For traffic to flow from a VPC subnet to an on-premises network via a Transit Gateway, two routing configurations must be in place: the Transit Gateway route table must know how to reach the on-premises CIDR (which was achieved via BGP propagation), and the VPC subnet's route table must have a route pointing the on-premises CIDR to the Transit Gateway attachment. Without the subnet route table entry, traffic will never leave the VPC subnet.

Step-by-Step Solution

1
Analyze the packet path from the EC2 instance to the on-premises network.
The packet starts at the EC2 instance in the private subnet and evaluates the subnet's local route table.
Before a packet can reach the Transit Gateway, the subnet route table must define a route that targets the Transit Gateway for the destination IP prefix.
2
Verify the role of Transit Gateway route table propagation.
Propagation updates the Transit Gateway's internal route table so it knows how to route packets once they arrive at the Transit Gateway.
TGW propagation does not automatically update VPC subnet route tables; those must be managed separately.
3
Identify the missing link in the configuration.
The subnet route table lacks a route pointing the on-premises CIDR block to the Transit Gateway attachment (`tgw-xxxx`).
Adding this route ensures that traffic destined for on-premises is successfully forwarded from the VPC subnet to the Transit Gateway.

Key Concept

VPC Subnet Routing to Transit Gateway
Estimated Time:1m 30s
Question 373Question →

A SysOps administrator is configuring an Amazon S3 Lifecycle policy for transaction logs that are uploaded daily. The logs must be retained for 3 years (1095 days) to meet compliance requirements. The access patterns and requirements for these logs are as follows:

* Days 0–15: Frequently accessed, requiring millisecond retrieval latency.
* Days 16–90: Infrequently accessed. However, if a retrieval request is made, the logs must be available within 5 minutes.
* Days 91–1095: Rarely accessed for annual audit compliance, where a retrieval latency of up to 12 hours is acceptable.

To minimize storage and retrieval costs, which TWO lifecycle policy configurations should the administrator implement to meet these requirements without incurring validation errors or early transition charges? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Transition objects from S3 Standard to S3 Glacier Flexible Retrieval after 30 days; Transition objects from S3 Glacier Flexible Retrieval to S3 Glacier Deep Archive after 120 days

Answer

Transitioning objects from S3 Standard to S3 Glacier Flexible Retrieval after 30 days, and transitioning objects from S3 Glacier Flexible Retrieval to S3 Glacier Deep Archive after 120 days.
Transitioning objects from S3 Standard to S3 Glacier Flexible Retrieval after 30 days avoids the S3 Standard-IA transition constraint of 30 days. S3 Glacier Flexible Retrieval supports Expedited Retrievals (1–5 minutes), meeting the retrieval time target. Transitioning from Glacier Flexible Retrieval to Glacier Deep Archive after 120 days ensures that the objects spend exactly 90 days (from day 30 to day 120) in Glacier Flexible Retrieval, avoiding early transition fees while utilizing S3 Glacier Deep Archive for the lowest long-term storage cost.

Step-by-Step Solution

1
Analyze retrieval latency and storage class alignment.
The requirements dictate: Days 0–15 need millisecond retrieval (S3 Standard or Standard-IA). Days 16–90 need under 5 minutes (Glacier Flexible Retrieval with Expedited Retrieval). Days 91–1095 need under 12 hours (Glacier Deep Archive).
This establishes which storage classes are capable of satisfying each phase's recovery time objectives.
2
Evaluate S3 Lifecycle rules for transitioning to S3 Standard-IA.
Transitioning to S3 Standard-IA at day 15 fails because S3 Lifecycle requires objects to remain in S3 Standard for at least 30 days before transitioning to S3 Standard-IA.
This eliminates configurations that attempt to transition to Standard-IA too early, which would cause policy validation errors.
3
Evaluate early transition fees and minimum storage durations.
Transitioning to Glacier Flexible Retrieval at day 15 and then to Glacier Deep Archive at day 90 means objects spend only 75 days in Glacier Flexible Retrieval. Because Glacier Flexible Retrieval has a 90-day minimum storage requirement, this incurs a prorated fee for 15 days.
This eliminates configurations that result in unnecessary early transition charges.
4
Determine the optimal transition schedule.
Transitioning to S3 Glacier Flexible Retrieval at day 30 meets the 30-day minimum standard. Keeping objects in Glacier Flexible Retrieval for 90 days (until day 120) satisfies the 90-day minimum storage period before transitioning to Glacier Deep Archive, avoiding early transition fees.
This confirms the correct two lifecycle actions.

Key Concept

S3 Lifecycle transition rules require objects to stay in S3 Standard for at least 30 days before moving to Standard-IA/One Zone-IA, and storage classes like Glacier Flexible Retrieval have a 90-day minimum storage duration that must be met to avoid early transition fees.
Question 374Question →

A company uses Amazon EBS gp2 volumes for storage on their EC2 instances. The storage workloads have increased, leading to performance bottlenecks due to IOPS limits. A SysOps Administrator wants to use AWS Compute Optimizer to analyze these volumes and transition them to gp3 to optimize performance and reduce cost. Which of the following actions should the administrator take to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Opt in to AWS Compute Optimizer at the account or Organization level to analyze EBS volume performance and generate recommendations.; Use the Amazon EC2 console or AWS CLI to modify the volume type from gp2 to gp3 while the volume remains attached and online.

Answer

To analyze the volumes and perform the migration, the administrator must opt in to AWS Compute Optimizer to generate optimization recommendations and then use the EBS Elastic Volumes feature to modify the volume type from gp2 to gp3 while the volumes remain attached and online.
To obtain EBS volume recommendations, the account must be opted in to AWS Compute Optimizer, which automatically evaluates volume utilization metrics. Once recommendations are generated, gp2 volumes can be modified to gp3 online without downtime or detaching the volume using the EBS Elastic Volumes feature.

Step-by-Step Solution

1
Opt in to AWS Compute Optimizer at the AWS account or AWS Organizations level.
AWS Compute Optimizer starts analyzing resource configuration and utilization metrics to generate recommendations for EBS volumes.
Opting in is required to activate the service and enable it to analyze gp2 volumes.
2
Review the recommendations in the AWS Compute Optimizer console to identify gp2 volumes that can be right-sized or migrated to gp3.
The administrator finds recommendations advising migrating specific gp2 volumes to gp3 for cost savings and performance improvements.
This step identifies the exact target volumes and potential performance gains.
3
Use the EC2 Modify Volume action to change the volume type from gp2 to gp3 online.
The EBS volume is modified to gp3 without downtime or detaching it from the instance.
EBS Elastic Volumes allows modification of volume types on-the-fly.

Key Concept

EBS volume optimization using AWS Compute Optimizer and EBS Elastic Volumes online modification.
Question 375Question →

A company is setting up a hybrid network environment to connect three VPCs with their on-premises network using an AWS Transit Gateway. A SysOps Administrator has created the Transit Gateway and established an AWS Site-to-Site VPN connection with dynamic routing (BGP) to the Transit Gateway. The administrator needs to configure routing so that instances in the private subnets of all three VPCs can communicate with the on-premises network.

Which steps must the administrator take to configure the routing? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable route propagation for the Site-to-Site VPN attachment in the Transit Gateway route table.; In the VPC subnet route tables, add a route for the on-premises network range pointing to the Transit Gateway attachment as the target.

Answer

Enable route propagation for the Site-to-Site VPN attachment in the Transit Gateway route table, and add a route in the VPC subnet route tables pointing to the Transit Gateway attachment.
To enable hybrid connectivity via an AWS Transit Gateway, two main routing tables must be configured: the VPC subnet route tables and the Transit Gateway route table. First, traffic from the VPC subnets must know how to reach the on-premises network. This is achieved by adding a route in the VPC subnet route tables targeting the Transit Gateway. Second, the Transit Gateway must know how to route packets to the on-premises network via the VPN. By enabling route propagation on the Site-to-Site VPN attachment, the Transit Gateway dynamically learns the on-premises BGP-advertised routes.

Step-by-Step Solution

1
Configure the VPC routing to point to the Transit Gateway.
A route is added in the VPC subnet route tables for the on-premises destination CIDR pointing to the Transit Gateway attachment.
This allows outbound traffic from the instances to be directed to the Transit Gateway.
2
Configure the Transit Gateway routing to learn the on-premises routes.
Route propagation is enabled for the VPN attachment in the Transit Gateway route table.
This allows the Transit Gateway to dynamically receive BGP route advertisements from the customer gateway, populating the Transit Gateway route table with the on-premises destination ranges.

Key Concept

Routing configuration for AWS Transit Gateway and Site-to-Site VPN hybrid connections.
Estimated Time:2m 0s
Question 376Question →

A SysOps administrator is configuring an Amazon S3 Lifecycle policy to optimize storage costs for application logs. The logs are initially stored in the S3 Standard storage class. The administrator wants to transition these logs to S3 Standard-Infrequent Access (Standard-IA) after 3030 days, and then to S3 Intelligent-Tiering after 6060 days.

Which of the following describes why this lifecycle configuration is invalid?

Show answer & explanation

Answer: Amazon S3 Lifecycle rules do not support transitioning objects from S3 Standard-IA to S3 Intelligent-Tiering.

Answer

Amazon S3 Lifecycle rules do not support transitioning objects from S3 Standard-IA to S3 Intelligent-Tiering.
Amazon S3 Lifecycle policies support transitions from warmer storage classes to colder storage classes. In the S3 Lifecycle transition matrix, you can transition from S3 Standard to S3 Standard-IA or S3 Intelligent-Tiering. However, you cannot transition from S3 Standard-IA to S3 Intelligent-Tiering, as S3 Intelligent-Tiering is not considered a colder storage class than S3 Standard-IA.

Step-by-Step Solution

1
Analyze the proposed lifecycle transition path: S3 Standard -> S3 Standard-IA -> S3 Intelligent-Tiering.
The first step (S3 Standard to S3 Standard-IA) is a valid downward transition. The second step (S3 Standard-IA to S3 Intelligent-Tiering) is not a supported transition path.
Amazon S3 Lifecycle rules only allow transitions from warmer to colder storage classes. S3 Intelligent-Tiering is not considered colder than S3 Standard-IA in the transition hierarchy.

Key Concept

Amazon S3 Lifecycle transition matrix limitations and supported storage class paths
Question 377Question →

An organization runs an application on Amazon EC2 instances in a private subnet within a VPC. The subnet does not have a route to an Internet Gateway or a NAT Gateway. The application must write messages to an Amazon SQS queue in the same AWS Region. A SysOps Administrator deploys an Interface VPC Endpoint for SQS (com.amazonaws.us-east-1.sqs) associated with the private subnet. However, the application logs show that connection attempts to sqs.us-east-1.amazonaws.com continue to time out. Which combination of actions should the SysOps Administrator take to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Private DNS hostnames for the Interface VPC Endpoint.; Configure the security group attached to the Interface VPC Endpoint to allow inbound HTTPS (TCP port 443) traffic from the security group of the EC2 instances.

Answer

Enable Private DNS hostnames for the Interface VPC Endpoint, and configure the security group attached to the Interface VPC Endpoint to allow inbound HTTPS (TCP port 443) traffic from the security group of the EC2 instances.
To resolve the timeout issue, Private DNS hostnames must be enabled on the Interface VPC Endpoint so that the application's calls to the public SQS URL resolve to the endpoint's private IP addresses. Additionally, the security group attached to the Interface VPC Endpoint's network interfaces must permit inbound HTTPS (TCP port 443) traffic from the EC2 instances' security group.

Step-by-Step Solution

1
Analyze the connection timeout log to identify the network path and DNS resolution behavior.
The application attempts to connect to the public endpoint (sqs.us-east-1.amazonaws.com) but times out because the subnet has no route to the internet, and DNS is either not resolving to the endpoint's private IPs or the network path to the endpoint's network interfaces is blocked.
Understanding why the connection times out helps isolate whether the issue is DNS resolution or security group blocking.
2
Configure DNS resolution for the Interface VPC Endpoint.
Enabling Private DNS hostnames ensures that requests to the public SQS endpoint are transparently routed to the Interface VPC Endpoint's private IP addresses.
This allows the application to utilize the private network path without modifying the endpoint URI in code.
3
Configure security group rules to allow network traffic to pass through the endpoint's interface.
The security group associated with the Interface VPC Endpoint's network interfaces is updated to allow inbound TCP port 443 traffic from the security group of the EC2 instances.
Interface VPC Endpoints use Elastic Network Interfaces (ENIs) which require explicit inbound security group rules to permit traffic from clients.

Key Concept

Interface VPC Endpoints rely on Private DNS hostnames for transparent routing and Security Groups on their Elastic Network Interfaces for traffic control. Unlike Gateway Endpoints, they do not use subnet route tables.
Estimated Time:2m 0s
Question 378Question →

An organization is designing a high-availability architecture for its web application hosted at the zone apex (`example.com`). The application is deployed across `us-east-1` and `eu-west-1` behind regional Application Load Balancers (ALBs). The architecture requires low-latency routing for global users under normal operations, dynamic failover between regions if one region becomes unavailable, and fallback to an Amazon S3 static website hosting a maintenance page in `us-west-2` only if both primary regions are completely offline. Which Route 53 record configuration must be implemented to satisfy these requirements with the lowest management complexity?

Show answer & explanation

Answer: Create latency-based Alias records for `latency.example.com` pointing to the regional ALBs, with health checks enabled for each. Create a primary Failover Alias record for the zone apex (`example.com`) pointing to `latency.example.com` with Evaluate Target Health set to Yes. Create a secondary Failover Alias record for `example.com` pointing to the Amazon S3 static website endpoint.

Answer

Create latency-based Alias records for a subdomain, and point a primary Failover Alias record at the zone apex to that subdomain with Evaluate Target Health enabled, while pointing the secondary Failover Alias record to the S3 static website endpoint.
To achieve active-active-passive failover for a zone apex domain, you must use nested Route 53 records. Since the zone apex domain (`example.com`) cannot use CNAME records due to DNS limitations, Alias records must be used. First, latency-based Alias records are created for a subdomain (`latency.example.com`) pointing to the regional Application Load Balancers (ALBs) with health checks enabled. Next, a primary Failover Alias record is created for `example.com` pointing to `latency.example.com` with 'Evaluate Target Health' enabled. This configuration ensures that if at least one regional ALB is healthy, Route 53 evaluates the target (`latency.example.com`) as healthy and routes traffic to the latency-based records. If both regional ALBs fail their health checks, Route 53 evaluates the target as unhealthy and fails over to the secondary Failover Alias record pointing to the S3 bucket website endpoint.

Step-by-Step Solution

1
Define the latency-based Alias records for a nested routing target.
Create latency-based Alias records under a subdomain, such as `latency.example.com`, that point to the regional ALBs in `us-east-1` and `eu-west-1` with health checks enabled.
This groups the active-active regional endpoints under a single DNS name, allowing Route 53 to evaluate their health collectively.
2
Configure the primary DNS entry at the zone apex.
Create a primary Failover Alias record for `example.com` pointing to the nested subdomain `latency.example.com` and set 'Evaluate Target Health' to Yes.
Setting 'Evaluate Target Health' to Yes forces Route 53 to check the health of the records under the target subdomain. If either region is healthy, the primary record is considered healthy.
3
Configure the backup failover path for the zone apex.
Create a secondary Failover Alias record for `example.com` pointing to the S3 static website hosting endpoint in `us-west-2`.
If all endpoints under `latency.example.com` fail health checks, Route 53 will direct traffic to the secondary failover target.

Key Concept

Active-Active-Passive DNS Failover using Nested Route 53 Alias Records
Question 379Question →

An application team deploys a new service on Amazon EC2 instances. The instances are registered to a target group associated with an Application Load Balancer. The load balancer's health checks are currently failing, showing the targets as unhealthy. The application logs indicate that the HTTP requests to the root path return a 403 Forbidden status because this endpoint is protected. A public, unauthenticated health status page is available at the '/ping' path. Additionally, the firewall rules on the EC2 instances do not permit any HTTP traffic from the load balancer.

To fix these failing health checks, which two configuration steps should be performed? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the health check settings in the target group to request the '/ping' path.; Adjust the instance security group rules to allow inbound HTTP traffic from the load balancer's security group.

Answer

Update the health check settings in the target group to request the '/ping' path, and adjust the instance security group rules to allow inbound HTTP traffic from the load balancer's security group.
The correct response components are: updating the health check path to the unauthenticated '/ping' path to resolve the 403 Forbidden error, and adjusting the instance security group rules to allow incoming HTTP traffic from the load balancer. These steps address both the network connectivity layer and the application response layer.

Step-by-Step Solution

1
Identify the cause of the health check failure from the application side.
The application returns a 403 Forbidden status code for the default root path because it requires authentication, whereas the '/ping' path is public and unauthenticated.
The Application Load Balancer health check expects a 200 OK response by default, so pointing it to the unauthenticated '/ping' path solves the HTTP status code failure.
2
Identify the cause of the network block between the load balancer and the targets.
The security group associated with the EC2 instances does not allow inbound HTTP traffic from the load balancer.
The security group must be updated to allow inbound HTTP traffic from the load balancer's security group so health check probes can reach the application.

Key Concept

Target Group Health Checks and Security Group Rules
Question 380Question →

A SysOps administrator needs to implement a cost-monitoring solution for a multi-account organization. The company recently adopted a tagging policy requiring all project resources to carry a Project tag. The administrator has the following requirements:
1. Detect anomalous spend associated with individual projects using machine learning and send alerts to an existing Amazon SNS topic.
2. Analyze daily cost trends and forecast future spending for the next 3 months grouped by the Project tag using AWS Cost Explorer.

Which combination of actions must the administrator take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Activate the Project tag as a cost allocation tag in the AWS Billing and Cost Management console.; Create a cost monitor in AWS Cost Anomaly Detection using the Resource tags monitor type with the Project tag key, and create an alert subscription pointing to the Amazon SNS topic.

Answer

Activate the Project tag as a cost allocation tag in the Billing console, and create a Resource tags cost monitor in AWS Cost Anomaly Detection with an alert subscription pointing to the Amazon SNS topic.
To monitor and forecast costs based on a specific tag, the tag must first be activated as a cost allocation tag in the AWS Billing and Cost Management console. Once activated, the tag key becomes available as a dimension in AWS Cost Explorer and AWS Cost Anomaly Detection. To detect anomalous spend on tagged resources using machine learning, a Resource tags monitor must be created in AWS Cost Anomaly Detection with the specified tag key. An alert subscription linked to this monitor is then used to send notifications to the target Amazon SNS topic.

Step-by-Step Solution

1
Activate the cost allocation tag.
The Project tag becomes available as a dimension in AWS Cost Explorer and AWS Cost Anomaly Detection.
Before user-defined tags can be used in billing tools, they must be explicitly activated in the AWS Billing and Cost Management console.
2
Create the Cost Anomaly Detection monitor.
A monitor is created using the Resource tags monitor type, configured with the Project tag key.
This tells AWS Cost Anomaly Detection to apply machine learning models to track cost anomalies segmented by the different values of the Project tag.
3
Configure the alert subscription.
An alert subscription is linked to the tag monitor, specifying the target Amazon SNS topic ARN.
This establishes the delivery pathway so that any detected anomaly automatically generates a notification to the automation system.
4
Run daily forecasting in Cost Explorer.
Historical daily trends are analyzed and future spending is forecasted for up to 3 months using the activated tag filter.
Cost Explorer supports daily granularity forecasting for up to 3 months when filtering by active cost allocation tags.

Key Concept

AWS Cost Anomaly Detection monitor types and cost allocation tag activation prerequisites.
PreviousPage 19 / 49Next
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin