Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 21Question →

A company hosts a web application behind an Application Load Balancer (ALB) in the us-west-2 Region. The company uses Amazon Route 53 with active-passive failover routing to redirect traffic to a backup static website in Amazon S3 if the primary application goes down. The SysOps Administrator configures a Route 53 health check to monitor a CloudWatch alarm. The alarm is based on the UnHealthyHostCount metric for the ALB's target group in us-west-2. During an application outage where all backend instances become unresponsive and stop reporting metrics, the Route 53 health check status remains 'Healthy' and failover does not occur. Which of the following configuration changes are required to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Recreate the CloudWatch alarm in the us-east-1 Region, referencing the ALB metrics from the us-west-2 Region.; Configure the Route 53 health check to treat insufficient data (INSUFFICIENT_DATA state) as unhealthy.

Answer

Recreating the CloudWatch alarm in the us-east-1 Region (referencing the us-west-2 ALB metrics) and configuring the Route 53 health check to treat insufficient data (INSUFFICIENT_DATA state) as unhealthy.
The correct configurations involve recreating the CloudWatch alarm in us-east-1 because Route 53 health checks can only monitor alarms in that specific Region, and configuring the health check to treat the INSUFFICIENT_DATA state as unhealthy to trigger failover when metrics stop reporting.

Step-by-Step Solution

1
Identify the regional requirements for Route 53 health checks monitoring CloudWatch alarms.
Confirm that Route 53 can only integrate with CloudWatch alarms created in the us-east-1 Region, regardless of the target resource's Region.
Route 53's integration with CloudWatch is globally anchored in the N. Virginia Region.
2
Analyze the behavior of the CloudWatch alarm when metrics are missing.
Recognize that when all backend instances go down and stop reporting metrics, the alarm status changes to INSUFFICIENT_DATA.
Without active reporting from targets, no metric values are sent, resulting in missing data points.
3
Adjust the health check state configuration for missing data.
Configure the Route 53 health check to treat the INSUFFICIENT_DATA state as unhealthy so that the primary record is marked unhealthy and traffic fails over.
By default, Route 53 may not treat insufficient data as a failure state, which prevents failover.

Key Concept

Route 53 DNS Failover using CloudWatch Alarms
Question 22Question →

A SysOps administrator uses AWS CloudFormation to manage a production stack that includes an Amazon EC2 Auto Scaling group (ASG) behind an Application Load Balancer. The administrator attempts to update the application by modifying the CloudFormation template to use a new launch template. The new launch template specifies a new IAM instance profile with a new IAM role. The CloudFormation stack update is initiated using a dedicated IAM execution role.

During the deployment, the update fails on the ASG resource, causing CloudFormation to transition the stack to the UPDATE_ROLLBACK_IN_PROGRESS state. Shortly after, the stack status changes to UPDATE_ROLLBACK_FAILED. The CloudFormation event log shows an access denied error stating that CloudFormation is not authorized to associate the old IAM instance profile's role with the ASG's launch template.

How should the administrator resolve this issue to allow the rollback to complete successfully?

Show answer & explanation

Answer: Update the IAM policy attached to the CloudFormation execution role to include the iam:PassRole permission for the original IAM role used in the previous launch template, and then execute the ContinueUpdateRollback action on the stack.

Answer

Update the IAM policy attached to the CloudFormation execution role to include the iam:PassRole permission for the original IAM role used in the previous launch template, and then execute the ContinueUpdateRollback action on the stack.
The correct solution is to update the CloudFormation execution role's IAM policy to grant the iam:PassRole permission for the original role, and then run ContinueUpdateRollback. This is because CloudFormation needs explicit permission to pass the original role to the Auto Scaling group when rolling back the launch template. When a stack is in the UPDATE_ROLLBACK_FAILED state, the ContinueUpdateRollback action is the standard AWS mechanism to resume the rollback process after the block is resolved.

Step-by-Step Solution

1
Analyze the CloudFormation event log error details.
Identify that the failure is due to an Access Denied error when CloudFormation attempts to associate the previous launch template's IAM role with the Auto Scaling Group.
To determine the exact permission or resource constraint causing the rollback failure.
2
Identify the missing IAM permission required for the rollback.
Determine that the CloudFormation execution role requires the iam:PassRole permission for the original IAM role, because CloudFormation is passing that role back to the Auto Scaling Group.
When reverting a resource that uses an IAM role to its previous state, the execution entity must be authorized to pass the original role, not just the newly proposed role.
3
Update the IAM policy of the CloudFormation execution role.
Add the iam:PassRole permission for the Amazon Resource Name (ARN) of the original IAM role.
To authorize CloudFormation to perform the role assignment required for the rollback.
4
Execute the ContinueUpdateRollback command on the CloudFormation stack.
CloudFormation resumes the rollback process, successfully configures the ASG back to the previous launch template, and transitions the stack to UPDATE_ROLLBACK_COMPLETE.
A stack in the UPDATE_ROLLBACK_FAILED state must be explicitly instructed to resume rolling back using the ContinueUpdateRollback operation once the blocking issue is resolved.

Key Concept

Troubleshooting CloudFormation stack updates and rollbacks involving IAM PassRole permissions
Question 23Question →

A SysOps Administrator is managing cross-Region disaster recovery using AWS Elastic Disaster Recovery (AWS DRS) to protect a critical business application. The application's EC2 instances in us-east-1 are replicated to a staging area in us-west-2. The instances are configured with an IAM instance profile associated with a role named ApplicationStorageAccessRole that permits access to Amazon S3. During a disaster recovery drill in us-west-2, the administrator attempts to launch recovery instances, but the launch fails. The EC2 launch history shows an authorization error indicating that the administrator is not authorized to perform the action on the resource. Which action must the administrator take to successfully launch the recovery instances during the drill?

Show answer & explanation

Answer: Add the iam:PassRole permission for the ApplicationStorageAccessRole to the IAM identity of the administrator initiating the drill.

Answer

Add the iam:PassRole permission for the ApplicationStorageAccessRole to the IAM identity of the administrator initiating the drill.
To launch recovery instances with an IAM instance profile, the IAM identity initiating the drill or failover (the SysOps Administrator) must have the iam:PassRole permission for the IAM role associated with the instance profile. This allows the administrator to pass the role to the EC2 service when the instances are created in the target Region.

Step-by-Step Solution

1
Identify the IAM role specified in the EC2 Launch Template of the source instances, which is ApplicationStorageAccessRole.
Confirming the target role that must be associated with the recovery instances.
AWS Elastic Disaster Recovery uses EC2 Launch Templates to launch target recovery instances with their original configurations, including IAM roles.
2
Evaluate the IAM permissions of the administrator initiating the disaster recovery drill.
Recognize that the administrator lacks the iam:PassRole permission for the ApplicationStorageAccessRole.
To prevent privilege escalation, AWS requires users who launch EC2 instances with an IAM role to possess the iam:PassRole permission for that specific role.
3
Add an IAM policy granting the iam:PassRole permission for the ApplicationStorageAccessRole to the administrator's IAM user or role.
The administrator is now authorized to initiate the drill launch with the instance profile.
This permission allows the administrator to pass the role to the EC2 service, enabling the launch of the recovery instances with the required role.

Key Concept

AWS Elastic Disaster Recovery (AWS DRS) utilizes EC2 Launch Templates to deploy target recovery instances. When these instances require an IAM role via an instance profile, the user initiating the recovery or drill must have the iam:PassRole permission for that role to successfully complete the launch.
Question 24Question →

A SysOps Administrator is configuring an AWS Lambda function in AWS Account 555555555555555555555555 to decrypt sensitive application configuration files. The configuration files are encrypted using a customer managed KMS key. The Administrator has attached an IAM policy to the Lambda function's execution role that grants permission for the `kms:Decrypt` action on the KMS key. However, when executing, the Lambda function fails with an AccessDeniedException during the decryption step.

Upon inspecting the KMS key policy, the Administrator finds only the following statement:

{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::555555555555:role/SysOpsAdminRole"
},
"Action": "kms:*",
"Resource": "*"
}

Which modification to the KMS key policy will resolve this issue by allowing the Lambda function's IAM policy to take effect?

Show answer & explanation

Answer: Add a statement to the KMS key policy that grants the root user of account 555555555555555555555555 (`arn:aws:iam::555555555555:root`) permissions for all KMS actions (`kms:*`).

Answer

Add a statement to the KMS key policy that grants the root user of the account (`arn:aws:iam::555555555555:root`) permissions for all KMS actions (`kms:*`).
In AWS KMS, for IAM policies to grant access to a customer managed key, the key policy must contain a statement that delegates authority to the AWS account. This is typically done by granting the root user principal (`arn:aws:iam::account-id:root`) permission to perform actions on the key. Once this statement is present, AWS evaluates both the key policy and the IAM policies. Since the Lambda execution role already has an IAM policy allowing `kms:Decrypt`, adding the account root principal statement to the key policy resolves the AccessDeniedException.

Step-by-Step Solution

1
Analyze the existing configurations of the Lambda execution role and the KMS key policy.
The Lambda role contains a policy granting `kms:Decrypt`. However, the KMS key policy only lists a specific administrator role (`SysOpsAdminRole`) and does not grant the account root principal permission to manage permissions via IAM.
By default, KMS key policies must explicitly delegate permission authority to the AWS account for any IAM policies within that account to have effect on the key.
2
Identify the standard delegation statement required in KMS key policies.
The statement must target the AWS account root principal (`arn:aws:iam::555555555555:root`) and grant `kms:*` permissions.
This configuration establishes the link between the key policy and IAM policies, allowing AWS to evaluate IAM policies for roles or users attempting to access the key.
3
Select the option that implements this configuration.
Adding a statement to the key policy that permits the account root user enables evaluation of the Lambda function's execution role policy, resolving the AccessDeniedException.
Once the root user is added to the key policy, the Lambda execution role's policy is successfully evaluated, granting the necessary decryption permissions.

Key Concept

AWS KMS Key Policy Delegation to IAM
Question 25Question →

An organization has a fleet of Ubuntu Amazon EC2 instances. A SysOps Administrator creates a custom patch baseline in AWS Systems Manager Patch Manager to control which security updates are installed. The administrator registers a patch group named 'ubuntu-prod' with this custom baseline. During a scheduled maintenance window, the administrator observes that the instances are being patched, but they are receiving updates from the default AWS-provided patch baseline rather than the custom baseline.

Which of the following is the most likely cause of this behavior?

Show answer & explanation

Answer: The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.

Answer

The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.
For AWS Systems Manager Patch Manager to associate an instance with a patch group, the instance must have a tag with the exact case-sensitive key 'Patch Group' (with a space). If the tag key is 'PatchGroup' (without a space), Systems Manager fails to map the instance to the 'ubuntu-prod' patch group, causing Patch Manager to apply the default AWS-provided patch baseline instead.

Step-by-Step Solution

1
Analyze the observed behavior where instances are successfully patched but are using the default baseline instead of the custom baseline.
This indicates that the Systems Manager agent is functioning and the maintenance window is executing, but the instances are not being associated with the registered patch group 'ubuntu-prod'.
When an instance is not successfully matched to a patch group, Systems Manager Patch Manager falls back to the default baseline for that operating system.
2
Verify the requirements for defining and matching patch groups on EC2 instances.
AWS Systems Manager requires managed nodes to be tagged with the exact case-sensitive key 'Patch Group' (with a space) and the value matching the registered patch group name.
Any deviation in the tag key, such as using 'PatchGroup' or 'patch_group', will cause the baseline mapping to fail.

Key Concept

AWS Systems Manager Patch Group Tagging Requirements
Question 26Question →

An organization's Amazon EC2 instances located in a private subnet are experiencing connection timeouts when trying to access Amazon S3. A Gateway VPC Endpoint for Amazon S3 has been deployed and linked to the private subnet's route table. The instances use a security group that permits all egress traffic. The subnet's custom Network ACL has an egress rule allowing port 443443 traffic to the S3 prefix list, but all custom ingress rules have been removed, leaving only the default deny rule. What configuration change is necessary to restore access to Amazon S3?

Show answer & explanation

Answer: Configure an inbound rule in the custom Network ACL to allow traffic from the Amazon S3 prefix list on ephemeral ports 10241024-6553565535.

Answer

Configure an inbound rule in the custom Network ACL to allow traffic from the Amazon S3 prefix list on ephemeral ports 10241024-6553565535.
Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly permitted. While the security group automatically tracks states, the custom Network ACL requires a return rule. S3 response traffic uses ephemeral ports 10241024-6553565535, so adding an inbound rule in the Network ACL for this range resolves the connection timeout.

Step-by-Step Solution

1
Analyze the network route configuration for S3 traffic.
The route table is already associated with the S3 Gateway VPC Endpoint, indicating that the routing layer is correctly configured to redirect S3 traffic through the gateway endpoint.
Before troubleshooting security controls, verifying that a route to the target destination exists ensures routing is correct.
2
Examine the stateful and stateless security configurations.
The security group is stateful and permits outbound traffic, which automatically allows return traffic. The custom Network ACL is stateless and only contains an outbound rule for port 443443, meaning inbound response traffic is blocked by the default deny rule.
Since Network ACLs are stateless, they evaluate inbound and outbound traffic independently. Ephemeral ports must be opened for return traffic.
3
Identify the appropriate source and port range for the inbound rule.
Configure the inbound rule with the source as the S3 prefix list and the port range as ephemeral ports 10241024-6553565535.
S3 initiates connections back to the client using ephemeral ports, so the stateless return path must permit this range.

Key Concept

Stateless nature of Network Access Control Lists (NACLs) and ephemeral port requirements for return traffic
Estimated Time:2m 30s
Question 27Question →

A SysOps Administrator is configuring Amazon EC2 instances in a private subnet with no internet access to invoke AWS Lambda functions. The VPC has no Internet Gateway or NAT Gateway attached. The administrator creates an Interface VPC Endpoint for AWS Lambda (com.amazonaws.us-east-1.lambda) in the VPC and associates it with the private subnet. However, application scripts on the EC2 instances continue to receive connection timeouts when trying to invoke Lambda functions using the default AWS SDK endpoint (lambda.us-east-1.amazonaws.com).

Which of the following configuration changes should the SysOps Administrator make to resolve this connectivity issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable private DNS hostnames for the Interface VPC Endpoint.; Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443 from the security group of the EC2 instances.

Answer

Enabling private DNS hostnames for the Interface VPC Endpoint and allowing inbound HTTPS traffic on port 443 from the EC2 instances' security group in the endpoint's security group will resolve the connection timeouts.
To resolve the timeout issue, private DNS hostnames must be enabled on the Interface VPC Endpoint so that the AWS SDK's default domain name resolves to the endpoint's private IP addresses. Additionally, the security group of the Interface VPC Endpoint must allow inbound HTTPS traffic on port 443 from the EC2 instances' security group.

Step-by-Step Solution

1
Enable private DNS hostnames on the Interface VPC Endpoint configuration.
DNS queries from the EC2 instances for lambda.us-east-1.amazonaws.com resolve to the private IP addresses of the endpoint network interfaces.
This ensures the standard SDK client requests are automatically routed internally to the private endpoint instead of resolving to public IP addresses.
2
Update the security group of the Interface VPC Endpoint to permit inbound HTTPS (port 443) traffic from the security group associated with the EC2 instances.
The network interfaces of the VPC endpoint accept incoming TCP connection requests on port 443 from the EC2 instances.
Security groups on Interface VPC Endpoints are stateful and must explicitly allow inbound traffic from clients accessing the service.

Key Concept

Interface VPC Endpoints require both Private DNS to resolve standard service endpoints internally and appropriate inbound security group rules to allow client traffic.
Question 28Question →

A SysOps Administrator is reviewing optimization opportunities for a memory-bound Lambda function that processes incoming file uploads. The administrator wants to use AWS Compute Optimizer to determine the most cost-effective memory configuration for the function without sacrificing performance. Currently, the Compute Optimizer console shows no recommendations for this Lambda function. Which of the following requirements must be met before AWS Compute Optimizer can generate memory size recommendations for the Lambda function?

Show answer & explanation

Answer: The Lambda function must have been invoked at least 50 times over the past 14 days.

Answer

The Lambda function must have been invoked at least 50 times over the past 14 days.
AWS Compute Optimizer natively analyzes the execution history of Lambda functions from CloudWatch Logs. To generate accurate memory recommendations, the service requires a minimum invocation history of at least 50 invocations over a 14-day lookback period.

Step-by-Step Solution

1
Identify the target resource and metric source for optimization.
The target is an AWS Lambda function, and Compute Optimizer analyzes its memory allocation natively using CloudWatch Logs metadata (such as memory used vs. memory configured in the REPORT lines).
Understanding where Compute Optimizer gathers metrics helps rule out options requiring additional agents or configuration.
2
Recall the minimum baseline data requirements for AWS Compute Optimizer.
Compute Optimizer needs a minimum history of 50 invocations over the last 14 days to build a baseline for recommending memory adjustments.
A minimum threshold ensures recommendations are statistically valid and accurate.

Key Concept

AWS Compute Optimizer requirements for AWS Lambda memory optimization
Question 29Question →

An administrator wants to implement automatic remediation for non-compliant resources detected by an AWS Config rule. The rule identifies Amazon S3 buckets that allow public read access. The administrator plans to use the `AWS-DisableS3BucketPublicReadWrite` Systems Manager (SSM) Automation document as the remediation action. During configuration, the administrator encounters permission errors and the remediation fails to run.

Which actions must the administrator take to successfully resolve the permission issues and enable the automated remediation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an IAM execution role with a trust policy that allows the ssm.amazonaws.com service principal to assume it, and attach policies granting permissions to modify S3 bucket settings.; Grant iam:PassRole permissions for the Systems Manager execution role to the IAM identity configuring the AWS Config remediation action.

Answer

The administrator must configure an IAM execution role with a trust policy that allows the ssm.amazonaws.com service principal to assume it (with permissions to modify S3 settings), and grant the iam:PassRole permission for the execution role to the IAM identity configuring the remediation.
To remediate non-compliant resources automatically via AWS Config and Systems Manager Automation, two requirements must be satisfied. First, a role assumed by Systems Manager (ssm.amazonaws.com) must exist and have permissions to perform the corrective actions on S3. Second, the user or service principal initiating the automation setup must possess the iam:PassRole permission to pass this execution role to Systems Manager.

Step-by-Step Solution

1
Create an IAM role for Systems Manager execution.
An IAM role is created with a trust relationship for ssm.amazonaws.com and a policy allowing the required S3 bucket configuration changes.
Systems Manager needs permissions to perform the actual remediation steps on S3 buckets.
2
Assign the PassRole permission to the configuring administrator.
The administrator has iam:PassRole permission explicitly defined for the target execution role ARN in their IAM policy.
This permission allows the administrator to pass the Systems Manager execution role to the service for performing remediation actions.

Key Concept

AWS Config automated remediation using Systems Manager Automation documents requires configuring service trust relationships and granting the administrator iam:PassRole permissions to delegate roles to the service.
Question 30Question →

A SysOps Administrator is securing a customer managed KMS key in the us-west-2 Region that is used to encrypt Amazon Elastic Block Store (EBS) volumes. The administrator wants to enforce the following security requirements:
- Users in the AWS account must be able to administer the key (such as enabling rotation or updating policies) using IAM policies.
- The key must only be allowed to encrypt and decrypt EBS volumes when the request is made by Amazon EC2 on behalf of a user, preventing direct API calls using the AWS CLI or SDKs.

Which two actions must the administrator take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Include a statement in the KMS key policy that grants `kms:*` permissions to the account's root principal (`arn:aws:iam::111122223333:root`).; Add a condition to the KMS key policy's cryptographic operations statement that specifies `"StringEquals": { "kms:ViaService": "ec2.us-west-2.amazonaws.com" }`.

Answer

The administrator must add a statement to the KMS key policy that grants `kms:*` permissions to the account's root principal (`arn:aws:iam::111122223333:root`) and add a condition to the KMS key policy's cryptographic operations statement specifying `"kms:ViaService": "ec2.us-west-2.amazonaws.com"`.
To allow IAM policies to manage the key, the KMS key policy must delegate administrative permissions to the root principal of the AWS account. Additionally, to restrict key usage to EBS volume operations while blocking direct API calls, the key policy must include a condition restricting requests to the EC2 service in the appropriate Region using the `kms:ViaService` condition key set to `ec2.us-west-2.amazonaws.com`.

Step-by-Step Solution

1
Enable IAM policy delegation in the KMS key policy.
Allows IAM policies attached to users and roles within the account to control access permissions for the KMS key.
By default, a KMS key is only manageable via its key policy unless it explicitly grants permissions to the account root principal.
2
Add the `kms:ViaService` condition to the key policy for cryptographic operations.
Restricts key usage to requests made by specified AWS services on behalf of the user.
This prevents users from performing direct decrypt/encrypt actions via the CLI/SDK, forcing the requests to go through EC2 when attaching the EBS volume.
3
Set the service principal to `ec2.us-west-2.amazonaws.com`.
Ensures the restriction correctly matches EBS operations in the us-west-2 Region.
EBS uses the EC2 service endpoint under the hood for volume attachment and encryption.

Key Concept

KMS key policies control authorization, and IAM policies can only manage a KMS key if the key policy explicitly delegates authority to the account root principal. The `kms:ViaService` condition key restricts KMS key usage to requests coming from specific AWS services.
Question 31Question →

A SysOps Administrator is optimizing the performance and cost of a transactional database hosted on an Amazon EC2 instance. The database is currently backed by a 1 TiB1\text{ TiB} Amazon EBS io2\text{io2} volume configured with 10,00010,000 Provisioned IOPS. Over the past 1414 days, Amazon CloudWatch metrics indicate that the volume's IOPS utilization consistently peaks at 2,2002,200 IOPS, and throughput peaks at 150 MiB/s150\text{ MiB/s}. AWS Compute Optimizer flags this volume as 'Overprovisioned'.

Which action should the administrator take to implement Compute Optimizer's recommendation and optimize costs without impacting application performance?

Show answer & explanation

Answer: Modify the EBS volume in-place to change the volume type to gp3, configuring the volume with 3,000 IOPS and 150 MiB/s throughput.

Answer

Modify the EBS volume in-place to change the volume type to gp3, configuring the volume with 3,000 IOPS and 150 MiB/s throughput.
Modifying the EBS volume in-place to change the volume type to gp3 with 3,000 IOPS and 150 MiB/s throughput is correct because it aligns with Compute Optimizer's recommendation. A gp3 volume offers 3,000 baseline IOPS and 125 MiB/s throughput for free. Increasing the throughput to 150 MiB/s satisfies the database's peak performance demands (2,200 IOPS and 150 MiB/s) while significantly reducing provisioned costs compared to the expensive io2 volume.

Step-by-Step Solution

1
Analyze the peak workload metrics from the past 1414 days, identifying that the database requires a maximum of 2,2002,200 IOPS and 150 MiB/s150\text{ MiB/s} throughput.
The requirements are within the capabilities of a gp3 volume, which offers 3,0003,000 baseline IOPS and customizable throughput.
This establishes the minimum performance target needed to maintain database performance without overprovisioning.
2
Determine the optimal configuration for a gp3 volume to meet these metrics.
A gp3 volume configured with 3,0003,000 baseline IOPS (included) and 150 MiB/s150\text{ MiB/s} throughput (25 MiB/s25\text{ MiB/s} provisioned above the baseline 125 MiB/s125\text{ MiB/s}).
This configuration satisfies both the peak IOPS and peak throughput requirements while avoiding excess provisioned resources.
3
Perform an in-place EBS volume modification to change the volume type from io2 to gp3 with the determined settings.
The volume type is modified online without performance degradation or downtime.
EBS elastic volumes allow live modification of volume types, size, IOPS, and throughput.

Key Concept

AWS Compute Optimizer helps right-size EBS volumes by analyzing performance metrics and suggesting cost-effective alternatives like gp3 for overprovisioned io1/io2 volumes.
Question 32Question →

A company runs a memory-bound microservices application on Amazon EC2 instances. A SysOps Administrator notices that AWS Compute Optimizer is generating resource recommendations based only on CPU and network metrics, without factoring in memory utilization. Which of the following actions must the administrator take to ensure AWS Compute Optimizer includes memory metrics in its recommendations? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the unified CloudWatch agent on the EC2 instances to publish memory utilization metrics to the default CWAgent namespace.; Attach an IAM role to the EC2 instances that includes the CloudWatchAgentServerPolicy managed policy.

Answer

Configure the unified CloudWatch agent on the EC2 instances to publish memory utilization metrics to the default CWAgent namespace, and attach an IAM role to the EC2 instances that includes the CloudWatchAgentServerPolicy managed policy.
To include memory metrics in AWS Compute Optimizer recommendations, the unified CloudWatch agent must be installed on the EC2 instances to capture OS-level memory utilization and publish it to the CWAgent namespace. Additionally, the EC2 instances must be authorized to write these metrics to CloudWatch, which requires attaching an IAM role with the CloudWatchAgentServerPolicy policy.

Step-by-Step Solution

1
Configure metric collection at the OS level.
The unified CloudWatch agent is installed and configured to send OS-level memory metrics (such as mem_used_percent) to the CWAgent namespace in CloudWatch.
By default, EC2 only reports hypervisor-level metrics like CPU and disk I/O. Memory is an OS-level metric that requires an agent to collect.
2
Grant the instances permission to write metrics.
An IAM role containing the CloudWatchAgentServerPolicy managed policy is attached to the EC2 instances.
The CloudWatch agent requires permissions to call the PutMetricData API to send metrics to CloudWatch.
3
Ensure Compute Optimizer reads the metrics.
Compute Optimizer detects the memory metrics under the CWAgent namespace and begins factoring them into recommendations.
Compute Optimizer is pre-configured to look for memory metrics specifically under the CWAgent namespace.

Key Concept

AWS Compute Optimizer memory metric requirements
Question 33Question →

An application running on an Amazon EC2 instance in Account B (444455556666) needs to decrypt sensitive files stored in an Amazon S3 bucket in Account A (111122223333). The files in the S3 bucket are encrypted using Server-Side Encryption with AWS KMS (SSE-KMS) and a customer managed KMS key in Account A. The KMS key currently has the following key policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

An IAM role named AppRole is attached as the instance profile for the EC2 instance in Account B. Which TWO configurations are required to allow AppRole in Account B to decrypt the objects in the S3 bucket? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the KMS key policy in Account A to allow the IAM role AppRole in Account B to perform the kms:Decrypt action.; Attach an IAM policy to the IAM role AppRole in Account B that allows the kms:Decrypt action on the KMS key ARN in Account A.

Answer

To configure cross-account decryption, update the KMS key policy in Account A to grant permission to the external role, and attach an IAM policy to the role in Account B allowing decryption on the key ARN.
To establish cross-account access to a customer managed KMS key, permissions must be granted on both sides. The key policy of the KMS key in Account A must be configured to trust the external role (or Account B's root principal), and the IAM policy attached to the EC2 instance role in Account B must allow the kms:Decrypt action on the ARN of the KMS key in Account A. Together, these two configurations authorize the cross-account decryption request.

Step-by-Step Solution

1
Review the requirements for cross-account AWS KMS key access.
Identify that cross-account access requires permissions to be granted in both the KMS key policy of the owning account and the IAM policy of the calling account.
AWS KMS requires explicit authorization from both the key owner and the caller's account when requests cross AWS accounts.
2
Update the KMS key policy in Account A (the key owner).
Add a statement to the key policy that permits the external IAM role (arn:aws:iam::444455556666:role/AppRole) to perform the kms:Decrypt action.
The customer managed key policy must trust the external identity before Account B can delegate or use the key.
3
Attach an IAM policy to the EC2 instance role in Account B (the caller).
Add a policy allowing the kms:Decrypt action on the target key's ARN in Account A.
The caller's identity must be explicitly permitted by its own account's IAM policy to access the external key resource.

Key Concept

Cross-account AWS KMS access requires configuring both the KMS key policy in the source account to trust the destination principal, and an IAM policy in the destination account to permit the caller to use the external KMS key.
Question 34Question →

A SysOps Administrator is configuring an AWS Config rule to monitor whether Amazon EC2 instances have public IP addresses. The administrator sets up automatic remediation using the AWS-StopEC2Instance Systems Manager (SSM) Automation document. The administrator creates an IAM role named ConfigRemediationRole that has a trust relationship with ssm.amazonaws.com and has the necessary permissions to stop EC2 instances. When the administrator attempts to associate this role with the AWS Config remediation configuration, the AWS Config console displays an error: 'Insufficient permissions to pass the remediation role.' Which action will resolve this issue?

Show answer & explanation

Answer: Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the ConfigRemediationRole resource.

Answer

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the ConfigRemediationRole resource.
The correct answer is to grant the administrator the iam:PassRole permission. When configuring AWS services to act on your behalf using an IAM role, your IAM identity (user or role) must be authorized to pass that role. Without this permission, the AWS Config console and API prevent you from completing the configuration to protect against unauthorized privilege escalation.

Step-by-Step Solution

1
Identify the role delegation flow in AWS Config automated remediation.
AWS Config uses AWS Systems Manager (SSM) Automation to execute remediation. The user configuring this setup must pass an IAM execution role to the SSM service.
Understanding the service interaction helps pinpoint which permissions are required for the configuration step.
2
Analyze the error message 'Insufficient permissions to pass the remediation role'.
The error explicitly indicates a failure in the iam:PassRole authorization check for the administrator's identity.
When an AWS service or user associates an IAM role with a service, the user's IAM identity must be explicitly authorized to pass that role.
3
Determine the correct policy configuration to authorize role passage.
Attach a policy with iam:PassRole to the administrator's IAM user or role, targeting the ARN of ConfigRemediationRole.
This grants the administrator the necessary privilege to complete the configuration of the automated remediation.

Key Concept

AWS Config automated remediation and IAM role delegation (iam:PassRole requirements)
Question 35Question →

A SysOps Administrator is managing resource optimization across a multi-account organization using AWS Organizations. The administrator notices that AWS Compute Optimizer is generating EC2 rightsizing recommendations based only on CPU and network metrics, failing to analyze memory utilization. Additionally, several member accounts are running gp2 EBS volumes that are overprovisioned for size just to achieve higher throughput. Which TWO actions should the SysOps Administrator take to resolve these issues?

Select all that apply

Show answer & explanation

Answer: Deploy the Amazon CloudWatch agent to the EC2 instances in the member accounts to collect and report memory utilization metrics.; Modify the EBS volumes from gp2 to gp3 to allow independent scaling of throughput and size while reducing storage costs.

Answer

Deploy the Amazon CloudWatch agent to the EC2 instances in the member accounts to collect and report memory utilization metrics, and modify the EBS volumes from gp2 to gp3 to allow independent scaling of throughput and size while reducing storage costs.
Deploying the Amazon CloudWatch agent is correct because memory is an operating system-level metric that is not visible to the hypervisor. AWS Compute Optimizer requires the agent to be configured to receive these metrics. Modifying gp2 volumes to gp3 is correct because gp3 volumes decouple throughput and IOPS from storage capacity, enabling cost savings and rightsizing without overprovisioning storage size.

Step-by-Step Solution

1
Identify the cause of missing memory metrics in AWS Compute Optimizer.
Realize that memory metrics are OS-level metrics and require the Amazon CloudWatch agent to be installed on the EC2 instances.
AWS Compute Optimizer cannot access memory utilization metrics by default because they are not monitored at the hypervisor level.
2
Identify the optimization strategy for gp2 volumes overprovisioned for throughput.
Choose gp3 volumes as the target class, which allows independent provisioning of IOPS and throughput without scaling volume size.
Migrating to gp3 directly solves the issue of overprovisioning storage size solely to get higher throughput.

Key Concept

AWS Compute Optimizer rightsizing requirements and EBS volume performance optimization.
Question 36Question →

A SysOps administrator has configured a Network Load Balancer (NLB) to route custom TCP traffic on port 9000 to a target group of Amazon EC2 instances located in private subnets. The targets are registered by instance ID. Although the application is running on all instances and successfully listening on port 9000, the target group shows all EC2 instances as unhealthy. Which of the following configuration issues could be the cause of the failing health checks? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The security group of the EC2 instances does not permit inbound traffic from the private IP addresses of the NLB nodes on port 9000.; The target group health check protocol is set to HTTP, but the application running on the instances only supports raw TCP connections.

Answer

The target group health checks are failing because the EC2 instances' security groups do not allow inbound traffic from the private IP addresses of the Network Load Balancer nodes, and the target group is misconfigured to use HTTP health checks for an application that only supports raw TCP traffic.
The correct options identify the security group and protocol mismatch issues. When registering targets by instance ID, the NLB sends health checks from its private IP addresses. The target security groups must explicitly allow this inbound traffic. Additionally, an HTTP health check configuration expects an HTTP response code, which a raw TCP service cannot provide.

Step-by-Step Solution

1
Analyze the network path for health checks between the Network Load Balancer (NLB) and the targets in the private subnets.
Since targets are registered by instance ID, the health checks originate from the NLB's private IP addresses, meaning the backend security groups must permit this inbound traffic.
Security groups on EC2 instances must allow inbound traffic from the load balancer on the health check port to allow health probes to succeed.
2
Examine the health check protocol configuration of the target group.
If the target group uses HTTP health checks but the application listens for raw TCP traffic, the health checks will fail due to protocol mismatch.
An HTTP health check requires a valid HTTP status code response (e.g., 200 OK), which a raw TCP application cannot provide.

Key Concept

Network Load Balancer health checks require proper security group configuration to allow private IP traffic from NLB nodes, and the health check protocol must match the backend application's capabilities.
Question 37Question →

A SysOps administrator has configured an Application Load Balancer (ALB) to route HTTP traffic to a target group of Amazon EC2 instances. The application runs on port 5000, and the target group is configured to use port 5000 with a health check path of `/healthz`. The EC2 instances are located in a private subnet, while the ALB is in a public subnet. All instances in the target group are showing as unhealthy, and users receive an HTTP 503 Service Unavailable error when attempting to connect to the application. Which of the following could be causing this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The stateless Network Access Control List (NACL) associated with the private subnet does not have an outbound rule allowing ephemeral port traffic (1024-65535) back to the ALB subnets.; The application's `/healthz` endpoint requires user authentication and returns an HTTP 401 response code instead of the default healthy HTTP status codes.

Answer

The stateless Network Access Control List (NACL) associated with the private subnet lacks an outbound rule to allow ephemeral port traffic (1024-65535) back to the ALB subnets, and the application's `/healthz` endpoint requires user authentication and returns an HTTP 401 response code.
The stateless Network Access Control List (NACL) associated with the private subnet must permit outbound ephemeral port traffic back to the ALB subnets to allow return health check response packets. Additionally, target group health checks expect an HTTP 200-299 response by default. If the `/healthz` endpoint requires authentication and returns an HTTP 401 status code, the ALB will mark the instances as unhealthy.

Step-by-Step Solution

1
Analyze how ALB health check probes function and evaluate status codes.
Determine that the ALB expects a status code between 200-299. If the endpoint requires authentication, it returns a 401 code, causing the health check to fail.
This checks the validity of the application response format against ELB standards.
2
Evaluate the stateful vs. stateless traffic characteristics of security groups and NACLs.
Verify that while security groups automatically handle return traffic, stateless NACLs require an explicit outbound rule for ephemeral ports (1024-65535) to allow return packets back to the ALB.
This ensures network-level traffic is allowed to return to the source of the probe.
3
Examine the scope of external routing components like Route 53 and Internet Gateways.
Recognize that Route 53 and Internet Gateways affect public ingress but do not interfere with internal VPC routing between the ALB and private instances.
This rules out external DNS and gateway configurations as potential causes.

Key Concept

ALB Target Group Health Check and VPC Network Troubleshooting
Question 38Question →

A SysOps Administrator is managing a web application that uses Amazon Route 53 for DNS resolution. The administrator configures Geolocation routing for `app.example.com` to route users in Europe to an Application Load Balancer (ALB) in `eu-west-1` and users in Asia to an ALB in `ap-southeast-1`. Shortly after deployment, users in North America report that they receive DNS resolution errors when trying to access the application. Which configuration change should the administrator implement to resolve the DNS resolution errors for North American users?

Show answer & explanation

Answer: Create a third geolocation routing record for `app.example.com` with the location set to 'Default' and point it to one of the active ALBs.

Answer

Create a third geolocation routing record for the subdomain with the location set to 'Default' pointing to one of the active Application Load Balancers.
The correct answer is to create a third geolocation routing record with the location set to 'Default' and point it to an active ALB. In Amazon Route 53, if geolocation routing is configured but a query originates from a region not explicitly mapped in any of the records, Route 53 returns a 'no answer' response (NXDOMAIN). Configuring a default record handles queries from all locations that are not explicitly mapped.

Step-by-Step Solution

1
Analyze the DNS routing configuration and the failure scenario.
Identify that the current Geolocation routing policy only covers Europe and Asia, leaving other regions (like North America) without a matching route rule.
When Route 53 receives a DNS query from a location that does not match any existing geolocation record, it will return a DNS resolution error if no default fallback is configured.
2
Determine the appropriate Route 53 configuration to handle unmapped locations.
A geolocation record with the location set to 'Default' must be added to route unmatched queries.
The 'Default' location record matches all queries from locations that are not explicitly covered by another geolocation record in the set.
3
Map the 'Default' record to an active application endpoint.
Create the record pointing to one of the existing Application Load Balancers to serve traffic for users in North America and other unmapped regions.
This ensures high availability and continuous DNS resolution globally.

Key Concept

Route 53 Geolocation Routing Default Fallback Configuration
Estimated Time:1m 30s
Question 39Question →

A SysOps Administrator is hosting a public website on an Amazon EC2 instance within a VPC. The instance is in a subnet with an associated route table that has a default route (0.0.0.0/00.0.0.0/0) pointing to an Internet Gateway. The Security Group attached to the instance allows inbound TCP port 8080 traffic from all sources (0.0.0.0/00.0.0.0/0) and allows all outbound traffic. The Administrator associates a custom Network Access Control List (NACL) with the subnet. The NACL allows inbound TCP port 8080 traffic from all sources (0.0.0.0/00.0.0.0/0) and outbound TCP port 8080 traffic to all destinations (0.0.0.0/00.0.0.0/0). Users report that they cannot connect to the website. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The custom NACL outbound rules do not allow return traffic to the ephemeral port range (10241024-6553565535) of the clients.

Answer

The custom NACL outbound rules do not allow return traffic to the ephemeral port range (10241024-6553565535) of the clients.
The correct answer is correct because Network Access Control Lists (NACLs) are stateless. When a client initiates a connection to a web server, the source port on the client is an ephemeral port (typically 10241024-6553565535). Although the NACL allows inbound traffic on port 8080 and outbound traffic on port 8080, the outbound response from the server is sent to the client's ephemeral port. Because the custom NACL does not have an outbound rule allowing traffic to the ephemeral port range, the return traffic is dropped.

Step-by-Step Solution

1
Identify the statefulness of the firewalls involved.
Security Groups are stateful, meaning return traffic is automatically allowed. Network Access Control Lists (NACLs) are stateless, requiring explicit inbound and outbound rules for traffic flow.
To determine where the return traffic is being blocked in the network path.
2
Analyze the port requirements for the return traffic.
The client connects to port 8080 (destination) from a random source port in the ephemeral range (10241024-6553565535). The return traffic from the server will have a source port of 8080 and a destination port in the ephemeral range (10241024-6553565535).
To determine which port rules must be configured in the stateless NACL to allow return traffic.
3
Evaluate the custom NACL configuration against the port requirements.
The custom NACL only allows outbound traffic on TCP port 8080, which blocks the return traffic destined for the client's ephemeral ports.
To identify the root cause of the connection failure.

Key Concept

Stateless firewalls (NACLs) require explicit outbound rules for ephemeral ports to allow return traffic, whereas stateful firewalls (Security Groups) track connection states automatically.
Estimated Time:1m 30s
Question 40Question →

A SysOps Administrator is configuring a monitoring solution for a dynamic fleet of Amazon EC2 instances. The instances run a custom application that reports a custom metric named ActiveSessionsActiveSessions to Amazon CloudWatch. To monitor the overall session load, the administrator attempts to create a CloudWatch alarm based on a metric math expression that uses the SEARCHSEARCH function to dynamically locate and sum the ActiveSessionsActiveSessions metric across all instances in the Auto Scaling group. However, the administrator is unable to save the alarm due to a validation error.

Which of the following explains why this configuration failed?

Show answer & explanation

Answer: Amazon CloudWatch alarms do not support metric math expressions that contain a SEARCHSEARCH function.

Answer

Amazon CloudWatch alarms do not support metric math expressions that contain a SEARCH function because the search query returns a dynamic number of time series that cannot be mapped to a static alarm configuration.
The correct answer states that Amazon CloudWatch alarms do not support metric math expressions containing a SEARCH function. While CloudWatch supports metric math for alarms (e.g., SUM, AVG), any expression containing a SEARCH function cannot be used to create an alarm. This is because search expressions return a dynamic number of time series (which can change as EC2 instances launch or terminate), whereas a CloudWatch alarm requires a stable number of time series to evaluate against a threshold.

Step-by-Step Solution

1
Identify the configuration details of the CloudWatch alarm.
The alarm uses a metric math expression containing a SEARCHSEARCH function to aggregate a custom metric (ActiveSessionsActiveSessions) dynamically.
To understand the context of the validation failure when saving the alarm.
2
Analyze the limitations of CloudWatch alarms with respect to metric math and search functions.
Amazon CloudWatch allows metric math for alarms but explicitly prohibits using the SEARCHSEARCH function in an alarm's expression because the query's output can vary dynamically as instances scale in or out.
To pinpoint the exact reason for the validation error.
3
Evaluate alternative solutions to achieve the desired monitoring setup.
To aggregate custom metrics across a dynamic fleet, the administrator should publish pre-aggregated metrics at the application level or use CloudWatch Metric Streams / Contributor Insights rather than a dynamic search alarm.
To resolve the monitoring requirement within CloudWatch limits.

Key Concept

CloudWatch Alarm limitations with Metric Math and SEARCH expressions
PreviousPage 2 / 49Next
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin