Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 381Question →

A SysOps administrator is configuring an Amazon S3 Lifecycle policy to optimize storage costs for an organization's data. Which TWO storage class transitions are valid and supported by S3 Lifecycle rules?

Select all that apply

Show answer & explanation

Answer: S3 Standard to S3 Glacier Flexible Retrieval; S3 Standard-IA to S3 Intelligent-Tiering

Answer

Transitioning from S3 Standard to S3 Glacier Flexible Retrieval, and transitioning from S3 Standard-IA to S3 Intelligent-Tiering.
Amazon S3 Lifecycle transition rules support moving objects from warmer storage classes to colder, cheaper, or archive storage classes. Transitioning from S3 Standard to S3 Glacier Flexible Retrieval is a standard downward transition path. Transitioning from S3 Standard-IA to S3 Intelligent-Tiering is also supported, allowing AWS to manage access patterns automatically.

Step-by-Step Solution

1
Analyze S3 Lifecycle transition direction rules.
S3 Lifecycle rules support transitions from warmer (more active) storage classes to colder (less active/archive) storage classes.
This helps identify valid downward transitions and rule out invalid upward transitions.
2
Evaluate redundancy rules for S3 Lifecycle transitions.
Transitions from lower-redundancy storage classes (such as One Zone-IA) to higher-redundancy storage classes (such as Standard-IA) are not supported.
This eliminates options that attempt to increase storage redundancy through lifecycle policies.
3
Identify the two valid transitions from the options provided.
Transitioning S3 Standard to S3 Glacier Flexible Retrieval, and transitioning S3 Standard-IA to S3 Intelligent-Tiering are supported.
These match the allowed transition paths documented in the S3 Lifecycle transition matrix.

Key Concept

Amazon S3 Lifecycle transition rules and supported storage class paths.
Question 382Question →

A SysOps administrator needs to identify and safely decommission underutilized Application Load Balancers (ALBs) to optimize costs across a production AWS account. The administrator accesses the AWS Trusted Advisor Cost Optimization dashboard and notes several ALBs flagged as idle.

Which of the following describes the most accurate method to verify these load balancers are idle and the safest sequence to delete them?

Show answer & explanation

Answer: Query the CloudWatch RequestCount metric using the Sum statistic over the last 7 days. If the total requests are less than 100, update any Route 53 alias records pointing to the ALB to redirect traffic to a backup resource, wait for the DNS TTL to expire, and then delete the ALB.

Answer

Query the CloudWatch RequestCount metric using the Sum statistic over the last 7 days. If the total requests are less than 100, update any Route 53 alias records pointing to the ALB to redirect traffic to a backup resource, wait for the DNS TTL to expire, and then delete the ALB.
The correct option outlines the standard AWS Trusted Advisor threshold for identifying idle ALBs, which is having a RequestCount of less than 100 over a 7-day period. By using the Sum statistic, the administrator can confirm the total request volume. The decommissioning workflow is safe because it updates Route 53 records first and waits for the TTL to expire, preventing client connection failures before the resource is deleted.

Step-by-Step Solution

1
Verify ALB idle status via CloudWatch metrics.
Check the RequestCount metric with a Sum statistic over a 7-day period to ensure total requests are under 100.
This matches the criteria used by AWS Trusted Advisor for identifying underutilized Application Load Balancers and guarantees actual network idle status.
2
Perform pre-decommissioning DNS updates.
Update the Route 53 DNS records (such as Alias records pointing to the ALB) to route traffic to a static maintenance page or backup system.
Modifying DNS configuration prior to deletion prevents clients from experiencing connection errors once the load balancer is removed.
3
Wait for DNS TTL expiration and delete the resource.
Allow the TTL duration of the previous DNS record to elapse, then safely delete the ALB in the EC2 Console or via AWS CLI.
Waiting for the TTL to expire ensures all DNS resolvers and client caches have updated their records, preventing any remaining traffic from reaching the deleted ALB.

Key Concept

Safely identifying and decommissioning idle Application Load Balancers (ALBs) involves verifying usage using the RequestCount metric (Sum statistic over 7 days) and updating Route 53 DNS records before deleting the resource to avoid traffic blackholing.
Estimated Time:2m 0s
Question 383Question →

A company stores daily database backups in an Amazon S3 Standard bucket. A SysOps administrator is creating an Amazon S3 Lifecycle configuration to transition these backups to S3 Standard-Infrequent Access (S3 Standard-IA) to reduce storage costs. What is the minimum number of days the backups must remain in S3 Standard before they can be transitioned to S3 Standard-IA?

Show answer & explanation

Answer: 30 days

Answer

The backups must remain in S3 Standard for a minimum of 30 days before transitioning to S3 Standard-IA.
The correct answer is 30 days because Amazon S3 enforces a minimum constraint of 30 days before objects in S3 Standard can be transitioned to S3 Standard-IA or S3 One Zone-IA.

Step-by-Step Solution

1
Identify the target storage class for the lifecycle transition, which is S3 Standard-IA.
The target storage class is S3 Standard-IA.
S3 Lifecycle transition rules differ depending on the destination storage class.
2
Recall the Amazon S3 Lifecycle transition constraints for S3 Standard-IA.
Objects must be stored in S3 Standard for at least 30 days before transitioning to S3 Standard-IA.
This is a hard constraint enforced by the Amazon S3 service for cost-effective lifecycle transitions.
3
Select the option that represents this minimum constraint.
The minimum duration is 30 days.
Values lower than 30 days will cause a policy validation failure, while values higher than 30 days are not the minimum.

Key Concept

S3 Lifecycle transition constraints specify that objects must reside in S3 Standard for a minimum of 30 days before transitioning to S3 Standard-IA or S3 One Zone-IA.
Question 384Question →

A company runs a set of non-production workloads on Amazon EC2 instances that are automatically stopped outside of business hours to reduce expenses. Despite the instances being stopped, the company's monthly bill continues to show persistent hourly charges for public IPv4 addresses. A SysOps administrator needs to identify the source of these charges and prevent them in the future.

Which AWS Trusted Advisor Cost Optimization check should the administrator review to locate these specific resources, and what is the billing reason for the ongoing charges?

Show answer & explanation

Answer: Unassociated Elastic IP Addresses; AWS charges an hourly fee for Elastic IP addresses that are allocated to the account but are not associated with a running EC2 instance or an active network interface.

Answer

The Unassociated Elastic IP Addresses check in AWS Trusted Advisor should be reviewed. AWS charges an hourly fee for Elastic IP addresses that are allocated to the account but are not associated with a running EC2 instance or an active network interface.
The correct option correctly identifies the 'Unassociated Elastic IP Addresses' check in AWS Trusted Advisor and states the correct billing policy. When an EC2 instance is stopped, the associated Elastic IP address becomes unassociated. AWS charges an hourly fee for allocated Elastic IP addresses that are not associated with a running instance or an active network interface, aiming to optimize the usage of the public IPv4 address space.

Step-by-Step Solution

1
Analyze the scenario where stopped EC2 instances still result in hourly public IPv4 charges.
Identify that the charges are caused by Elastic IP (EIP) addresses remaining allocated to the account while the associated EC2 instances are stopped.
When an EC2 instance is stopped, any associated Elastic IP address is no longer associated with a running instance, triggering AWS's idle EIP billing policy.
2
Select the appropriate AWS Trusted Advisor Cost Optimization check designed to detect these resources.
Determine that the 'Unassociated Elastic IP Addresses' check flags allocated EIPs that are not linked to a running instance or active network interface.
This specific check is built to help administrators find and release unused Elastic IP addresses to eliminate unnecessary costs.
3
Verify the billing mechanics of Elastic IP addresses.
Confirm that AWS charges a small hourly fee for allocated but unassociated Elastic IP addresses to encourage efficient public IPv4 address utilization.
Understanding the billing rule explains why stopping the instance without releasing the EIP results in ongoing charges.

Key Concept

AWS Trusted Advisor Unassociated Elastic IP Addresses Cost Check
Estimated Time:1m 30s
Question 385Question →

A SysOps Administrator is troubleshooting a connectivity issue where external users cannot access a web application running on an Amazon EC2 instance. The instance is located in a subnet that is intended to be public. The administrator verifies that the web server is active and listening locally on TCP port 8080. However, when reviewing the VPC Flow Logs for the instance's elastic network interface (ENI), the administrator finds that there are no flow log records (either `ACCEPT` or `REJECT`) corresponding to external client IP addresses on port 8080.

What is the most likely cause of this issue?

Show answer & explanation

Answer: The subnet's route table does not contain a route pointing to the Internet Gateway.

Answer

The subnet's route table does not contain a route pointing to the Internet Gateway.
The correct answer is that the subnet's route table does not contain a route pointing to the Internet Gateway. VPC Flow Logs capture traffic at the network interface (ENI) level. If traffic from the internet cannot be routed to the subnet because of a missing route to the Internet Gateway, the packets never reach the ENI. Consequently, no flow log entries (neither ACCEPT nor REJECT) are generated for the client IPs. For a subnet to be public and accessible from the internet, its route table must have a route for 0.0.0.0/00.0.0.0/0 pointing to the Internet Gateway.

Step-by-Step Solution

1
Analyze the symptom of having no flow log records (neither ACCEPT nor REJECT) on port 8080 for external IP addresses.
The absence of any flow log records indicates that the packets are not reaching the Elastic Network Interface (ENI) at all.
VPC Flow Logs capture traffic at the network interface level. If a packet reaches the interface and is blocked by a security group or NACL, it generates a REJECT record.
2
Evaluate the role of the Internet Gateway (IGW) and the subnet's route table.
Without a route pointing to the Internet Gateway, external traffic cannot be routed to the subnet.
The default route (0.0.0.0/00.0.0.0/0) targeting the IGW is required for a subnet to be public and reachable from the internet.
3
Correlate the findings with the provided options.
The missing route to the Internet Gateway is the only configuration issue that prevents packets from reaching the subnet, explaining the complete lack of flow log records.
Other security controls like security groups and Network ACLs would drop the packet at the interface or subnet boundary, producing REJECT log entries.

Key Concept

VPC routing requirements for public subnets and the behavior of VPC Flow Logs at the ENI level.
Question 386Question →

A company has migrated its marketing website to Amazon S3 and configured the bucket for static website hosting. The SysOps administrator must configure Amazon Route 53 so that users can access the website using the apex domain (cooldomain.net). Which DNS record configuration must the administrator create in Route 53 to meet this requirement?

Show answer & explanation

Answer: An A record configured as an Alias record pointing to the S3 bucket website endpoint

Answer

An A record configured as an Alias record pointing to the S3 bucket website endpoint
The correct answer is the configuration that uses an A record configured as an Alias record pointing to the S3 bucket website endpoint. Route 53 Alias records are a Route 53-specific extension that allows mapping the zone apex (the root domain) directly to supported AWS resources, such as S3 buckets, Application Load Balancers, or CloudFront distributions. This satisfies the requirement without violating the DNS protocol restriction that prohibits CNAME records at the zone apex.

Step-by-Step Solution

1
Identify that the request is to route traffic from a zone apex (root domain, e.g., cooldomain.net) to an AWS resource (an Amazon S3 bucket configured for static hosting).
The target domain is the zone apex, which has strict DNS limitations regarding CNAME records.
DNS standards prohibit CNAME records at the root domain because the root domain must also contain NS and SOA records, and a CNAME cannot coexist with other records for the same name.
2
Determine the correct Route 53 record type to bypass this zone apex limitation for AWS resources.
Select an Alias record (specifically an A record type configured as an Alias).
Route 53 Alias records are query-time translations that allow mapping the zone apex directly to AWS resources (like S3 buckets) while conforming to DNS RFC specifications.
3
Point the Alias record to the specific S3 bucket website endpoint.
The DNS record resolves queries for the apex domain directly to the S3 bucket's IP addresses at runtime.
This enables seamless routing of the apex domain to the static website hosted on S3.

Key Concept

Amazon Route 53 Alias records bypass DNS RFC zone apex limitations for AWS resources.
Question 387Question →

A company has a VPC with private subnets containing Amazon EC2 instances that must securely write data to an Amazon Kinesis data stream. A SysOps Administrator deploys an Interface VPC Endpoint for Kinesis (com.amazonaws.us-east-1.kinesis-streams) within the private subnets. In addition, on-premises servers connected to the VPC via an AWS Direct Connect connection must also write data to the same Kinesis data stream privately. Which combination of actions must the SysOps Administrator take to ensure private connectivity for both the EC2 instances and the on-premises servers? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the security group associated with the Kinesis Interface VPC Endpoint to allow inbound HTTPS traffic (port 443) from both the VPC subnet CIDR block and the on-premises network CIDR block.; Set up a Route 53 Resolver inbound endpoint in the VPC, and configure the on-premises DNS servers to forward queries for the Kinesis service domain (kinesis.us-east-1.amazonaws.com) to the inbound endpoint's IP addresses.

Answer

Configure the security group associated with the Kinesis Interface VPC Endpoint to allow inbound HTTPS traffic from both the VPC subnet CIDR block and the on-premises network CIDR block, and set up a Route 53 Resolver inbound endpoint in the VPC to forward queries for the Kinesis service domain from the on-premises DNS servers.
To set up private access to Kinesis Data Streams for both VPC-based and on-premises resources: First, the security group of the Interface VPC Endpoint must allow inbound port 443 traffic from both sources because traffic to PrivateLink endpoints is controlled via standard security groups attached to their ENIs. Second, because on-premises servers cannot directly query the link-local Route 53 Resolver IP address (169.254.169.253), a Route 53 Resolver inbound endpoint must be configured in the VPC to accept forwarded queries from the on-premises DNS servers and resolve the Kinesis private DNS names to the endpoint's private IP addresses.

Step-by-Step Solution

1
Ensure the Interface VPC Endpoint's security group allows traffic.
The security group associated with the Interface VPC Endpoint is updated to allow inbound HTTPS (port 443) traffic from the VPC CIDR block and the on-premises CIDR block.
Interface VPC Endpoints use Elastic Network Interfaces (ENIs) with security groups that control inbound traffic. Both VPC resources and on-premises resources need permission to connect.
2
Establish name resolution for the on-premises servers.
A Route 53 Resolver inbound endpoint is deployed in the VPC, and the on-premises DNS server is configured with conditional forwarding rules for Kinesis pointing to the inbound endpoint's IP addresses.
On-premises servers cannot resolve VPC private DNS names directly or query the link-local Route 53 Resolver IP address. The inbound endpoint acts as a DNS proxy over Direct Connect.

Key Concept

Configuring Interface VPC Endpoints (AWS PrivateLink) for hybrid on-premises access using security groups and Route 53 Resolver inbound endpoints.
Estimated Time:2m 0s
Question 388Question →

A SysOps Administrator is setting up VPC Flow Logs to capture traffic from a public subnet and publish it to an Amazon CloudWatch Logs log group. The administrator creates a dedicated IAM service role for the flow logs, but when attempting to enable the flow log, they receive an "Access Denied" error. Additionally, the administrator wants to minimize long-term storage costs by ensuring that the collected flow log data is automatically deleted after 30 days. Which combination of actions must the administrator take to successfully activate the flow logs and meet the retention requirement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the administrator's IAM identity the iam:PassRole permission for the VPC Flow Logs service role.; Configure the retention settings of the CloudWatch Logs log group to expire events after 30 days.

Answer

To resolve the issue and meet the requirements, the administrator must grant their IAM identity the iam:PassRole permission for the VPC Flow Logs service role and configure the retention settings of the CloudWatch Logs log group to expire events after 30 days.
The correct options are the ones stating to grant the administrator's IAM identity the iam:PassRole permission for the VPC Flow Logs service role, and to configure the retention settings of the CloudWatch Logs log group to expire events after 30 days. The iam:PassRole permission is required whenever an administrator associates an IAM service role with a resource or service configuration. Setting the log group retention policy to 30 days ensures that CloudWatch automatically deletes older log events to prevent indefinite storage fees.

Step-by-Step Solution

1
Address the Access Denied error during flow log creation.
Identify that the administrator's IAM user or role lacks the iam:PassRole permission to associate the flow logs service role with the VPC flow log configuration.
AWS services require the iam:PassRole permission to verify that a user is authorized to pass a specific service role to an AWS service.
2
Resolve the permission issue by updating the administrator's IAM policy.
Add the iam:PassRole action targeting the Amazon Resource Name (ARN) of the VPC Flow Logs service role to the administrator's policy.
This allows the administrator to delegate the necessary permissions to the VPC Flow Logs service.
3
Configure data retention on the destination to control storage costs.
Update the retention period of the CloudWatch Logs log group from 'Never Expire' to '30 days'.
This ensures that old log data is automatically deleted after 30 days, avoiding indefinite storage charges.

Key Concept

VPC Flow Logs require an IAM role to publish to CloudWatch Logs. Creating this flow log configuration requires the creator to have the iam:PassRole permission. Furthermore, log retention settings must be configured at the CloudWatch Logs log group level to manage data storage costs, as logs do not traverse customer NACLs during out-of-band delivery.
Question 389Question →

A company is using an AWS Transit Gateway to connect three VPCs: VPC A, VPC B, and VPC C. The company also has an on-premises data center connected to the Transit Gateway via an AWS Site-to-Site VPN.

A SysOps Administrator must configure Transit Gateway routing to meet the following requirements:
1. Network traffic must flow freely between VPC A and VPC B.
2. VPC C must be able to communicate with the on-premises data center.
3. VPC C must be completely isolated from VPC A and VPC B.

Which two actions should the SysOps Administrator take to configure the Transit Gateway routing? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Transit Gateway route table for VPC C, associate it with the VPC C attachment, and propagate only the Site-to-Site VPN attachment route into this route table.; Create a Transit Gateway route table for the VPN, associate it with the Site-to-Site VPN attachment, and propagate the VPC A, VPC B, and VPC C attachment routes into this route table.

Answer

Create a Transit Gateway route table for VPC C, associate it with the VPC C attachment, and propagate only the Site-to-Site VPN attachment route into this route table; and create a Transit Gateway route table for the VPN, associate it with the Site-to-Site VPN attachment, and propagate the VPC A, VPC B, and VPC C attachment routes into this route table.
To achieve the desired routing and isolation, separate Transit Gateway (TGW) route tables must be created and associated with the respective attachments. By creating a dedicated TGW route table for VPC C, associating it with VPC C, and propagating only the VPN route, VPC C can communicate with on-premises but is isolated from VPC A and VPC B. Similarly, a dedicated TGW route table for the VPN attachment with propagations for all three VPCs ensures that return traffic from the on-premises network can reach any of the VPCs.

Step-by-Step Solution

1
Analyze the routing isolation requirements for VPC C, VPC A, VPC B, and the on-premises network connected via VPN.
VPC C needs to route traffic only to the VPN. VPC A and VPC B need to route traffic to each other and the VPN. The VPN needs to route traffic to VPC A, VPC B, and VPC C.
Understanding the required traffic paths is necessary to design the Transit Gateway route tables.
2
Configure the Transit Gateway route table for VPC C.
A separate Transit Gateway route table is created, associated with VPC C, and the VPN route is propagated into it. VPC A and VPC B routes are not propagated into this route table.
This isolates VPC C from VPC A and VPC B at the Transit Gateway level while permitting traffic to the VPN.
3
Configure the Transit Gateway route table for the Site-to-Site VPN attachment.
A Transit Gateway route table is created, associated with the VPN, and VPC A, VPC B, and VPC C routes are propagated into it.
This ensures that traffic originating from the on-premises network can find routes back to all three VPCs.

Key Concept

AWS Transit Gateway route table association and propagation rules for isolating VPC traffic.
Question 390Question →

A SysOps administrator needs to configure Amazon Route 53 to route traffic for a company's apex domain (example.com) to an Application Load Balancer (ALB). Which two configurations or actions should the administrator choose? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Alias A record for the apex domain pointing to the DNS name of the Application Load Balancer.; Use an Alias record instead of a standard CNAME record because DNS protocol specifications restrict CNAME records from being configured at the zone apex.

Answer

Create an Alias A record for the apex domain pointing to the DNS name of the Application Load Balancer, and use an Alias record instead of a standard CNAME record because DNS protocol specifications restrict CNAME records from being configured at the zone apex.
The correct options are to create an Alias A record pointing to the ALB DNS name and to use Alias records to avoid DNS spec limitations that prohibit standard CNAME records at the zone apex. Route 53 Alias records resolve to the resource IP addresses directly, which complies with standard DNS rules.

Step-by-Step Solution

1
Identify the target domain routing requirement
The target is the zone apex domain (example.com), which requires a record that resolves to the Application Load Balancer (ALB).
Traffic must be sent directly to the domain name without a 'www' prefix.
2
Determine the record type restrictions
Standard CNAME records cannot be placed at the zone apex due to DNS protocol limitations, and ALB IP addresses are dynamic.
Creating a CNAME at the apex conflicts with other required records like MX and NS, and manual A records cannot track dynamic ALB IP changes.
3
Apply Route 53 features to resolve the restriction
Create a Route 53 Alias A record pointing to the ALB.
Route 53 Alias records bypass the zone apex CNAME restriction by allowing an A record to reference an AWS resource directly.

Key Concept

Amazon Route 53 Alias records allow mapping zone apex domains to dynamic AWS resources like Application Load Balancers, satisfying DNS specs where standard CNAME records are forbidden.
Question 391Question →

A company runs a memory-intensive database application on a fleet of Amazon EC2 instances across multiple member accounts in an AWS Organizations organization. A SysOps administrator wants to use AWS Compute Optimizer to generate right-sizing recommendations for these instances. Currently, AWS Compute Optimizer generates recommendations based solely on CPU and network utilization metrics, ignoring the memory bottleneck. The Unified CloudWatch Agent is already installed and running on the EC2 instances. Which action must the administrator take to allow AWS Compute Optimizer to analyze memory utilization and include it in the right-sizing recommendations?

Show answer & explanation

Answer: Configure the Unified CloudWatch Agent to publish memory metrics using the default CWAgent namespace, and ensure the InstanceId dimension is included in the agent configuration.

Answer

Configure the Unified CloudWatch Agent to publish memory metrics using the default CWAgent namespace, and ensure the InstanceId dimension is included in the agent configuration.
The correct answer is to configure the Unified CloudWatch Agent to publish memory metrics using the default CWAgent namespace and include the InstanceId dimension. AWS Compute Optimizer automatically looks for memory metrics in the default CWAgent namespace. The InstanceId dimension is required for Compute Optimizer to correlate the memory metrics with the specific EC2 instance.

Step-by-Step Solution

1
Verify CloudWatch Agent configuration.
Confirm that the memory metrics collection (such as mem_used_percent) is enabled in the agent configuration file.
Before metrics can be sent, the agent must be configured to collect them from the operating system.
2
Set the default namespace to CWAgent and include the InstanceId dimension.
The metrics are published under the CWAgent namespace with the InstanceId dimension mapped.
AWS Compute Optimizer is hardcoded to look for memory metrics specifically in the default CWAgent namespace using the InstanceId dimension to associate the utilization data with the correct EC2 resource.
3
Validate the metric delivery in AWS Compute Optimizer.
AWS Compute Optimizer ingests the memory metrics and incorporates them into right-sizing recommendations within 24 hours.
This completes the ingestion pipeline required for memory-aware recommendations.

Key Concept

AWS Compute Optimizer utilizes memory metrics collected by the Unified CloudWatch Agent, provided they are published to the default CWAgent namespace with the InstanceId dimension.
Estimated Time:2m 0s
Question 392Question →

A company is releasing a new version of its web application. The SysOps administrator wants to perform a canary deployment by routing 90%90\% of user traffic to the current production Application Load Balancer (ALB) and 10%10\% of traffic to a new ALB. Which Route 53 configuration should the administrator implement to meet these requirements?

Show answer & explanation

Answer: Create two Alias A records for the subdomain, both configured with the Weighted routing policy, assigning a weight of 9090 to the production ALB record and 1010 to the new ALB record.

Answer

Create two Alias A records for the subdomain, both configured with the Weighted routing policy, assigning a weight of 9090 to the production ALB record and 1010 to the new ALB record.
The correct configuration uses the Weighted routing policy with two Alias A records. This allows the administrator to split DNS traffic in a 90:1090:10 proportion (by setting weights of 9090 and 1010). Using Alias records rather than CNAMEs is the recommended AWS best practice for mapping domains to load balancers, as they automatically update when the ALB IPs change and do not incur query charges.

Step-by-Step Solution

1
Determine the routing policy required to split traffic based on percentages (90%90\% and 10%10\%).
The Weighted routing policy is selected because it enables routing traffic to multiple resources in user-specified proportions.
Other routing policies like Simple or Failover do not support percentage-based distribution.
2
Select the appropriate record type for the Application Load Balancers.
Alias A records are chosen because they map directly to AWS resources (like ALBs) and are automatically updated when the ALB's underlying IP addresses change.
CNAME records incur standard Route 53 query charges and cannot be used at the zone apex.
3
Configure the weights for the two records.
Assign a weight of 9090 to the record pointing to the production ALB and a weight of 1010 to the record pointing to the new ALB.
This mathematically splits the traffic at a 9:19:1 ratio, corresponding to the required 90%90\% and 10%10\% distribution.

Key Concept

Weighted routing policy and Alias records in Route 53
Question 393Question →

A SysOps Administrator is configuring VPC Traffic Mirroring to capture a copy of inbound HTTPS traffic from a production application server's network interface (10.0.1.10) in a VPC. The mirrored traffic must be sent to an intrusion detection system (IDS) instance (10.0.2.20) in a different subnet of the same VPC. The administrator has successfully configured the Traffic Mirror Source, the Traffic Mirror Target, and a Traffic Mirror Filter to capture inbound TCP port 443 traffic. However, the IDS instance is not receiving any mirrored packets. Which configuration change should the administrator make to allow the mirrored traffic to reach the IDS instance?

Show answer & explanation

Answer: Add a rule to the security group of the IDS instance to allow inbound UDP traffic on port 4789 from the source network interface.

Answer

Add a rule to the security group of the IDS instance to allow inbound UDP traffic on port 4789 from the source network interface.
The correct answer is to allow inbound UDP traffic on port 4789 from the source network interface. VPC Traffic Mirroring encapsulates mirrored network packets in a VXLAN header, which uses UDP destination port 4789. Because security groups are stateful and block unsolicited traffic by default, the security group of the target IDS instance must be configured to allow this inbound UDP traffic to receive the mirrored packets.

Step-by-Step Solution

1
Analyze the encapsulation protocol used by AWS VPC Traffic Mirroring.
Identify that VPC Traffic Mirroring copies physical layer packets and encapsulates them into VXLAN packets using UDP port 4789.
This determines which port and protocol must be allowed through security controls to deliver the mirrored traffic.
2
Evaluate the target instance's security group configuration.
Realize that security groups are stateful, but because the VXLAN packet delivery is one-way from source to target, the target's security group must explicitly allow inbound UDP port 4789 from the source ENI.
If the security group does not allow UDP port 4789, it will block the incoming VXLAN packets at the hypervisor level.
3
Differentiate between VPC-internal local routing and external routing.
Confirm that since both subnets are in the same VPC, the system route table's local route automatically handles the traffic routing, meaning no additional routes or gateways are required.
This rules out any need for custom route table modifications targeting an Internet Gateway.

Key Concept

VPC Traffic Mirroring relies on VXLAN encapsulation (UDP port 4789) to copy and send packets to the target ENI, requiring target security groups to permit this inbound traffic.
Question 394Question →

A company is using AWS Organizations to manage multiple AWS accounts. A SysOps Administrator in the primary network management account creates an AWS Transit Gateway and shares it with a member account using AWS Resource Access Manager (RAM). A SysOps Administrator in the member account accepts the resource share and creates a Transit Gateway VPC attachment. However, traffic is not routing between the member VPC and other VPCs connected to the Transit Gateway. In the member account, the Transit Gateway attachment state is displayed as 'pendingAcceptance'. Which action is required to resolve this issue and enable network transit?

Show answer & explanation

Answer: The SysOps Administrator in the primary network management account must accept the shared attachment request.

Answer

The SysOps Administrator in the primary network management account must accept the shared attachment request.
The correct action is for the administrator in the primary network management account to accept the shared attachment request. When a Transit Gateway is shared with another AWS account via AWS Resource Access Manager (RAM), any VPC attachments created by the recipient account are placed in a 'pendingAcceptance' state. The owner of the Transit Gateway must explicitly accept the attachment request before the VPC can route traffic through the gateway, unless auto-acceptance of shared attachments has been pre-configured on the Transit Gateway.

Step-by-Step Solution

1
Identify the state of the Transit Gateway VPC attachment in the member account.
The attachment state is 'pendingAcceptance'.
This state indicates that the Transit Gateway owner must approve the shared resource attachment before traffic can flow.
2
Log in to the primary network management account (the owner of the Transit Gateway) and navigate to the AWS Transit Gateway console.
Locate the shared VPC attachment under 'Transit Gateway Attachments'.
Only the owning account has the authorization to accept attachments created by external or shared accounts.
3
Select the pending attachment and click 'Actions' -> 'Accept'.
The attachment state transitions to 'pending' and eventually to 'available'.
Accepting the attachment enables routing between the member account's VPC and the Transit Gateway.

Key Concept

Acceptance workflow for shared Transit Gateway attachments across AWS accounts
Question 395Question →

A company's staging environment has experienced escalating costs. A SysOps administrator is tasked with reviewing AWS Trusted Advisor Cost Optimization recommendations to quickly reduce expenses. The administrator wants to identify resources that are either completely unattached to active compute instances or database instances that have had no connections for an extended period.

Which AWS Trusted Advisor Cost Optimization checks should the administrator analyze to locate these resources? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon RDS Idle DB Instances; Unassociated Elastic IP Addresses

Answer

Amazon RDS Idle DB Instances and Unassociated Elastic IP Addresses are correct.
The correct options are the checks for Amazon RDS Idle DB Instances and Unassociated Elastic IP Addresses. Under AWS Trusted Advisor Cost Optimization, the Amazon RDS Idle DB Instances check evaluates database instances that have had no connections for 7 days. The Unassociated Elastic IP Addresses check identifies EIPs that are not associated with a running EC2 instance or ENI, which incurs an hourly idle charge.

Step-by-Step Solution

1
Analyze the requirements to identify unattached compute/network resources and idle database resources using AWS Trusted Advisor.
The requirements demand locating allocated but unassociated network resources (specifically Elastic IP addresses) and idle database instances (specifically Amazon RDS instances with no active connections).
This establishes the target resource types: Elastic IP addresses and RDS database instances.
2
Evaluate the AWS Trusted Advisor Cost Optimization checks related to these resource types.
The 'Unassociated Elastic IP Addresses' check identifies allocated EIPs that are not associated with running instances. The 'Amazon RDS Idle DB Instances' check identifies RDS instances with no active connections for the last 7 days.
Selecting these two checks directly addresses the requirement to locate unattached and idle resources.
3
Verify and exclude other cost optimization and billing options.
Cost allocation tags, S3 lifecycle transitions, and AWS Budgets are valid AWS cost management tools, but they are not checks under AWS Trusted Advisor's Cost Optimization checks that identify these specific resources.
This ensures the distractor options are ruled out based on service scope and functionality.

Key Concept

AWS Trusted Advisor Cost Optimization checks monitor AWS resources to identify cost-saving opportunities, such as unassociated Elastic IP addresses and idle RDS database instances.
Question 396Question →

A company is connecting its on-premises network to AWS using a 1 Gbps1\text{ Gbps} AWS Direct Connect connection via an AWS Transit Gateway and a Direct Connect Gateway. To ensure high availability, the company sets up an AWS Site-to-Site VPN connection to the same Transit Gateway as a backup path. The company wants to ensure that all traffic between the VPCs and the on-premises network automatically uses the Direct Connect connection under normal conditions, and only fails over to the VPN if the Direct Connect connection becomes unavailable. Which TWO configuration steps must the SysOps Administrator perform to achieve this routing behavior? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the on-premises router to advertise the same network prefixes to both the Direct Connect BGP session and the Site-to-Site VPN BGP session, prepending the AS path on the VPN advertisements.; In the VPC subnet route tables, add a route for the on-premises IP address range targeting the Transit Gateway.

Answer

To configure the failover routing, the SysOps Administrator must advertise the same on-premises prefixes over both paths while prepending the AS path on the VPN BGP advertisements so that AWS prefers the Direct Connect path. Additionally, they must add a route in the VPC subnet route tables pointing to the Transit Gateway for the on-premises IP range to ensure VPC resources can reach the on-premises network.
Prepend the AS path on the VPN BGP advertisements to ensure that AWS Transit Gateway views the VPN route as less desirable than the Direct Connect route. In addition, the VPC subnet route tables must be configured with a route pointing to the Transit Gateway so that traffic from the VPC can reach the Transit Gateway and be sent to the on-premises network.

Step-by-Step Solution

1
Configure dynamic BGP routing advertisements on-premises.
The on-premises router advertises identical CIDR blocks to both Direct Connect and VPN BGP sessions, but with the AS path prepended on the VPN advertisements.
This configuration forces the AWS Transit Gateway to prefer the shorter AS path of the Direct Connect connection for traffic heading from AWS to the on-premises data center.
2
Configure VPC subnet routing.
A route targeting the Transit Gateway for the on-premises IP address range is added to the VPC subnet route tables.
This ensures that instances inside the VPC subnets send their outbound hybrid traffic to the Transit Gateway, which then handles path selection.

Key Concept

AWS Transit Gateway BGP path selection and routing precedence for Direct Connect and Site-to-Site VPN failover.
Question 397Question →

A SysOps administrator wants to automate the remediation of underutilized Amazon EBS volumes flagged by AWS Trusted Advisor to optimize costs. The administrator wants to configure a rule that detects when the 'Underutilized Amazon EBS Volumes' check status changes to a warning or error state and automatically triggers a process to clean up these volumes. Which configuration will meet these requirements with the least administrative effort?

Show answer & explanation

Answer: Configure an Amazon EventBridge rule with the event source set to aws.trustedadvisor and the detail-type set to Trusted Advisor Check Item Refresh Notification. Create a pattern matching the Underutilized Amazon EBS Volumes check and a status of WARN or ERROR. Set the rule target to an AWS Systems Manager Automation document that deletes the flagged volumes.

Answer

Configure an Amazon EventBridge rule with the event source set to aws.trustedadvisor and the detail-type set to Trusted Advisor Check Item Refresh Notification. Create a pattern matching the Underutilized Amazon EBS Volumes check and a status of WARN or ERROR. Set the rule target to an AWS Systems Manager Automation document that deletes the flagged volumes.
The correct configuration uses Amazon EventBridge to natively match Trusted Advisor notifications. Trusted Advisor sends events under the source 'aws.trustedadvisor' with the detail-type 'Trusted Advisor Check Item Refresh Notification' when checks are refreshed or change status. An EventBridge rule can target an AWS Systems Manager Automation document to automatically delete the flagged volumes with minimal administrative effort.

Step-by-Step Solution

1
Identify the source of AWS Trusted Advisor cost optimization events.
Trusted Advisor natively sends 'Trusted Advisor Check Item Refresh Notification' events to Amazon EventBridge under the 'aws.trustedadvisor' source.
This establishes the entry point for automated event-driven remediation of cost optimization checks.
2
Configure the EventBridge event pattern matching the underutilization check.
Create a rule filtering for the 'Underutilized Amazon EBS Volumes' check name with a status of 'WARN' or 'ERROR'.
This ensures that only underutilized EBS volumes trigger the automation, preventing executions for healthy resources or other unrelated checks.
3
Set the target of the EventBridge rule to a remediation runner.
Target an AWS Systems Manager Automation document designed to delete underutilized or unattached EBS volumes.
Systems Manager Automation provides a low-overhead, managed way to execute corrective actions without managing custom code.

Key Concept

Automating AWS Trusted Advisor Cost Optimization checks via Amazon EventBridge and AWS Systems Manager
Question 398Question →

An application running on Amazon EC2 instances in a private subnet of a VPC needs to access a proprietary database service hosted by a partner company in another AWS account. The partner has shared the service via an AWS PrivateLink VPC Endpoint Service. The SysOps Administrator has created an Interface VPC Endpoint in the private subnet targeting the partner's service.

However, application logs show that connection attempts to the Interface VPC Endpoint's DNS name are failing due to connection timeouts.

Which TWO configurations must the SysOps Administrator verify or implement to resolve this connection issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Verify that the security group attached to the Interface VPC Endpoint has an inbound rule allowing traffic on the database port from the security group of the EC2 instances.; Verify that the VPC Endpoint connection status is Accepted, indicating that the service provider has approved the connection request.

Answer

Verify that the security group attached to the Interface VPC Endpoint allows inbound traffic on the database port from the EC2 instances' security group, and verify that the VPC Endpoint connection status is Accepted by the service provider.
The correct configurations involve ensuring the security group associated with the Interface VPC Endpoint permits inbound traffic on the database port from the EC2 instances, and verifying that the endpoint connection has been accepted by the service provider. Interface VPC Endpoints create network interfaces inside the VPC that act as targets for DNS queries, requiring appropriate security group rules to accept traffic. Additionally, connections to a PrivateLink service provider in another account remain in a pending state and drop traffic until explicitly accepted by the provider.

Step-by-Step Solution

1
Check the status of the VPC Endpoint in the Amazon VPC console.
Verify that the connection state is 'Available' rather than 'PendingAcceptance'.
Traffic cannot flow through a PrivateLink connection if the provider has not accepted the connection request.
2
Examine the security group rules associated with the Interface VPC Endpoint's network interfaces.
Ensure there is an inbound rule permitting TCP traffic on the database port from the security group of the source EC2 instances.
Interface Endpoints create Elastic Network Interfaces (ENIs) inside the VPC, which are protected by security groups. If the security group blocks inbound traffic on the service port, the connection will time out.
3
Verify that route tables do not need modifications.
Confirm that no routes pointing to the endpoint ID are added to the subnet route tables.
Interface VPC Endpoints rely on DNS resolution to direct traffic, not subnet routing table paths.

Key Concept

Troubleshooting AWS PrivateLink interface endpoints, ensuring connection acceptance by the service provider, and configuring security group rules for endpoint network interfaces.
Question 399Question →

A SysOps Administrator is configuring a secure, private connection to Amazon SNS (com.amazonaws.us-east-1.sns) for Amazon EC2 instances residing in a private subnet within a VPC. The VPC has no Internet Gateway or NAT Gateway. The EC2 instances are associated with a security group named EC2-SG. The Interface VPC Endpoint is associated with a security group named Endpoint-SG. The SysOps Administrator notices that the EC2 instances are timing out when attempting to publish messages to the SNS topic at sns.us-east-1.amazonaws.com.

Which two actions should the SysOps Administrator take to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Private DNS on the Amazon SNS Interface VPC Endpoint, and ensure that DNS resolution and DNS hostnames are enabled for the VPC.; Add an inbound rule to the Endpoint-SG security group that allows TCP port 443 traffic from the EC2-SG security group.

Answer

Enable Private DNS on the Amazon SNS Interface VPC Endpoint, and ensure that DNS resolution and DNS hostnames are enabled for the VPC. Additionally, add an inbound rule to the Endpoint-SG security group that allows TCP port 443 traffic from the EC2-SG security group.
The correct options are enabling Private DNS hostnames and configuring the Interface VPC Endpoint security group to allow inbound TCP port 443 traffic from the instances. Enabling Private DNS ensures that the standard service URL resolves to the private IP addresses of the endpoint's network interfaces. Allowing inbound HTTPS traffic on the endpoint's security group from the instances allows the connection to be established successfully.

Step-by-Step Solution

1
Configure DNS Settings
Ensure that the VPC has DNS resolution and DNS hostnames enabled. Then, enable Private DNS on the Interface VPC Endpoint.
This allows the public DNS hostname of the service (sns.us-east-1.amazonaws.com) to resolve directly to the private IP addresses of the endpoint network interfaces (ENIs) inside the VPC, avoiding public internet routing.
2
Configure Security Group Rules
Update the security group of the Interface VPC Endpoint (Endpoint-SG) to allow inbound TCP port 443 (HTTPS) traffic from the EC2 instances' security group (EC2-SG).
Interface VPC Endpoints receive inbound requests from client resources on port 443. Correctly permitting this traffic resolves the connection timeout issue.

Key Concept

Interface VPC Endpoints (AWS PrivateLink) require both DNS configuration (Private DNS) and proper Security Group rules to function, whereas Gateway VPC Endpoints require route table updates.
Question 400Question →

A company wants to implement automated cost monitoring for a new multi-tenant application deployed across multiple member accounts in AWS Organizations. The application uses a variety of services, and the SysOps team needs to detect unexpected cost spikes using machine learning. They also need to ensure that anomalies associated with the specific cost allocation tag 'TenantID' are detected and that a centralized record of all anomalies is logged to an Amazon SQS queue in the management account for auditing. Which combination of steps should the SysOps administrator perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a cost monitor in AWS Cost Anomaly Detection using the Cost Allocation Tag monitor type, specifying the 'TenantID' tag key. Create an anomaly subscription associated with this monitor that targets an Amazon SNS topic.; Create an Amazon EventBridge rule that filters for AWS Cost Anomaly Detection events and configure the rule to send these events to the centralized Amazon SQS queue.

Answer

To meet the requirements, the SysOps administrator should create a cost monitor in AWS Cost Anomaly Detection using the Cost Allocation Tag monitor type, specifying the 'TenantID' tag key, and target an Amazon SNS topic. Additionally, they should create an Amazon EventBridge rule that filters for AWS Cost Anomaly Detection events and routes them to the centralized Amazon SQS queue.
The correct steps involve creating a Cost Allocation Tag monitor in AWS Cost Anomaly Detection for the 'TenantID' tag and linking it to an anomaly subscription targeting Amazon SNS. Additionally, Amazon EventBridge natively captures AWS Cost Anomaly Detection events, allowing an EventBridge rule to route them directly to the centralized Amazon SQS queue for audit logging.

Step-by-Step Solution

1
Ensure the 'TenantID' tag is activated as a Cost Allocation Tag in the AWS Billing console.
The tag becomes available for AWS Cost Anomaly Detection and AWS Cost Explorer to track and group costs.
Tags must be activated before they can be evaluated by AWS Cost Anomaly Detection.
2
Create a Cost Allocation Tag monitor in AWS Cost Anomaly Detection targeting the 'TenantID' tag.
AWS Cost Anomaly Detection begins using machine learning to monitor costs matching the 'TenantID' tag and detect unusual spikes.
This establishes the detection mechanism tailored to the multi-tenant application.
3
Create an anomaly subscription for the monitor and point it to an Amazon SNS topic.
Anomaly alerts will be published to the SNS topic immediately upon detection.
An anomaly subscription is required to forward detection events to notification services.
4
Create an Amazon EventBridge rule filtering for Cost Anomaly Detection events, with the Amazon SQS queue in the management account as the target.
All cost anomaly events are automatically captured and sent to the centralized SQS queue.
EventBridge integrates natively with Cost Anomaly Detection, providing a clean, serverless way to log anomalies to SQS for auditing.

Key Concept

Using AWS Cost Anomaly Detection to monitor tag-based spending and routing alerts using Amazon EventBridge.
Estimated Time:3m 0s
PreviousPage 20 / 49Next
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin