Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 441Question →

A company uses Amazon EKS on Amazon EC2 worker nodes to run its microservices. A SysOps Administrator enables Amazon CloudWatch Container Insights on the cluster to monitor performance. After a month, the Administrator notices a significant increase in the AWS bill due to CloudWatch Logs storage costs. The logs are stored in the /aws/containerinsights/{cluster-name}/performance log group with the default retention setting. The Administrator needs to ensure that these logs are retained for only 14 days to reduce ongoing costs. What is the most administratively efficient way to implement this change?

Show answer & explanation

Answer: Modify the retention setting of the /aws/containerinsights/{cluster-name}/performance log group directly in the CloudWatch Logs console or via the AWS CLI to 14 days.

Answer

Modify the retention setting of the /aws/containerinsights/{cluster-name}/performance log group directly in the CloudWatch Logs console or via the AWS CLI to 14 days.
Performance logs for Container Insights on Amazon EKS are stored in CloudWatch Logs in a log group named /aws/containerinsights/{cluster-name}/performance. Modifying the retention period of the log group itself is the most direct and efficient method to automatically expire older logs.

Step-by-Step Solution

1
Locate the performance log group generated by Container Insights in the Amazon CloudWatch console.
The log group is identified as /aws/containerinsights/{cluster-name}/performance.
Container Insights stores EKS performance telemetry in this specific log group.
2
Modify the retention setting of the identified log group.
The retention period is changed from the default 'Never expire' to '14 days'.
This updates the log group metadata in CloudWatch Logs to automatically prune log events older than 14 days, minimizing storage costs.

Key Concept

Configuring log group retention settings to manage CloudWatch Logs storage costs for Container Insights performance logs.
Question 442Question →

A company hosts a high-traffic inventory management system on Amazon RDS for PostgreSQL. During peak operational hours, database performance degrades due to a high volume of read-only queries from a business intelligence tool. Additionally, the company requires a recovery time objective (RTO) of under 10 minutes for any database infrastructure failure. Which configuration should the SysOps Administrator implement to satisfy these requirements?

Show answer & explanation

Answer: Configure the Amazon RDS DB instance for Multi-AZ deployment, and create a separate RDS Read Replica. Point the main application to the primary DB instance endpoint and the business intelligence tool to the read replica endpoint.

Answer

Configure the Amazon RDS DB instance for Multi-AZ deployment, and create a separate RDS Read Replica. Point the main application to the primary DB instance endpoint and the business intelligence tool to the read replica endpoint.
An Amazon RDS Multi-AZ deployment provides automatic synchronous replication and failover to a standby DB instance in a different Availability Zone if the primary instance fails, satisfying the low RTO requirement. To offload read operations from the business intelligence tool, an RDS Read Replica should be deployed, as it provides a dedicated endpoint for read-only queries.

Step-by-Step Solution

1
Evaluate the database high availability and failover mechanism.
Determine that Amazon RDS Multi-AZ provides automatic, synchronous failover to a standby instance in another Availability Zone, fulfilling the under 10-minute RTO requirement.
Single-AZ instances do not support automatic failover, and custom failover scripts introduce recovery delays.
2
Address the read-scaling requirement for the business intelligence tool.
Identify that a separate RDS Read Replica is required to offload reporting queries.
Standard Multi-AZ standby instances are passive and cannot serve read traffic.
3
Select the unified architecture.
Combine RDS Multi-AZ for failover with an RDS Read Replica for read offloading, routing application writes to the primary DB endpoint and BI queries to the replica endpoint.
This configuration satisfies both RTO and performance requirements with minimal administrative effort.

Key Concept

Distinguishing between RDS Multi-AZ deployments (used for synchronous high availability and automatic failover) and RDS Read Replicas (used for asynchronous horizontal scaling of read traffic).
Estimated Time:1m 30s
Question 443Question →

A SysOps administrator wants to automate the remediation of non-compliant resources. AWS Config is configured with the `vpc-flow-logs-enabled` rule to monitor compliance. The administrator wants to use Amazon EventBridge and an AWS Systems Manager (SSM) Automation runbook to automatically enable VPC Flow Logs whenever a VPC is flagged as non-compliant. Which two configuration actions must the administrator perform to set up this remediation pipeline?

Select all that apply

Show answer & explanation

Answer: Create an Amazon EventBridge rule with an event pattern that filters for AWS Config compliance change events where the compliance type is 'NON_COMPLIANT' for the `vpc-flow-logs-enabled` rule, and specify the Systems Manager Automation runbook as the target.; Attach an IAM policy to the EventBridge rule's IAM role that grants the `ssm:StartAutomationExecution` permission for the target Systems Manager Automation runbook.

Answer

The correct configuration actions are creating an Amazon EventBridge rule that filters for AWS Config compliance change events and targets the runbook, and granting the `ssm:StartAutomationExecution` permission to the EventBridge rule's IAM role.
The correct setup involves configuring an Amazon EventBridge rule that filters for AWS Config compliance change events (specifically for the rule checking VPC flow logs) and targets the Systems Manager Automation runbook. To execute the runbook, the EventBridge rule's IAM role must be granted the `ssm:StartAutomationExecution` permission.

Step-by-Step Solution

1
Configure the trigger source using AWS Config and EventBridge.
An EventBridge rule matches AWS Config events when the compliance status of the `vpc-flow-logs-enabled` rule transitions to 'NON_COMPLIANT'.
This establishes the event-driven mechanism to detect non-compliance immediately.
2
Configure the target and execution permissions for EventBridge.
The EventBridge rule is configured to target the Systems Manager Automation runbook, and its execution role is granted the `ssm:StartAutomationExecution` permission.
This allows EventBridge to authorize the invocation of the Systems Manager runbook.
3
Configure Systems Manager Automation role permissions.
Ensure the Systems Manager Automation execution role has permissions to execute the runbook commands (such as `ec2:CreateFlowLogs`) and the necessary `iam:PassRole` permission to delegate permissions.
This guarantees that the runbook can perform the actual remediation steps on the target VPC.

Key Concept

EventBridge rules can target AWS Systems Manager Automation runbooks to perform automated remediation when AWS Config detects compliance status changes.
Question 444Question →

A company hosts a web application on AWS Elastic Beanstalk. The application runs in a production environment with an Auto Scaling group of 8 Amazon EC2 instances. The company’s deployment policy requires that the application maintains full capacity to handle incoming traffic at all times during updates. To control costs, the company cannot allow a temporary doubling of the environment's compute resources, which rules out immutable deployments. Which deployment policy should the SysOps Administrator select to meet these requirements with the least financial impact?

Show answer & explanation

Answer: Rolling with an additional batch

Answer

Rolling with an additional batch
The rolling with an additional batch deployment policy launches a new batch of instances to maintain full capacity while the existing instances are updated in batches. This avoids taking any capacity offline and only increases resources by a single batch size, rather than doubling the entire environment.

Step-by-Step Solution

1
Analyze the capacity requirement during deployment.
The application must maintain 100% capacity (8 instances) during the deployment process.
To prevent performance degradation or downtime under production traffic.
2
Analyze the budget and resource constraints.
The system cannot temporarily double the running compute resources, ruling out immutable or full environment-copy deployments.
To control costs and avoid launching a duplicate Auto Scaling group of 8 instances.
3
Evaluate the Elastic Beanstalk deployment options against both constraints.
Rolling with an additional batch is selected because it launches only one extra batch of instances to offset capacity loss during the rolling update, keeping additional costs to a minimum.
It fulfills the capacity requirement without needing a parallel environment of equal size.

Key Concept

Selecting Elastic Beanstalk deployment strategies to balance application capacity and cost constraints.
Question 445Question →

A SysOps Administrator is tasked with enabling Amazon CloudWatch Container Insights for an existing Amazon ECS cluster where all tasks run on AWS Fargate. Additionally, the administrator must create a CloudWatch dashboard to monitor the CPU and memory utilization of the cluster and its tasks. Which combination of actions should the SysOps Administrator take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Container Insights for the cluster by updating the cluster settings using the AWS CLI command: aws ecs update-cluster-settings --cluster <cluster-name> --settings name=containerInsights,value=enabled; Create a CloudWatch dashboard and add widgets that reference the metrics under the ECS/ContainerInsights namespace.

Answer

Enable Container Insights on the cluster using the AWS CLI update-cluster-settings command, and then create a CloudWatch dashboard with widgets displaying metrics from the ECS/ContainerInsights namespace.
For an Amazon ECS cluster running on AWS Fargate, the SysOps Administrator must enable Container Insights by updating the cluster settings. The AWS CLI command update-cluster-settings achieves this. Once enabled, ECS publishes metrics to the ECS/ContainerInsights namespace. The administrator can create a CloudWatch dashboard and add widgets referencing this namespace to display the utilization metrics.

Step-by-Step Solution

1
Enable Container Insights at the ECS cluster level
The AWS Fargate container infrastructure begins publishing CPU, memory, storage, and network utilization metrics.
Fargate tasks do not support running the CloudWatch agent daemon directly as a daemonset, so Container Insights must be enabled via the cluster settings.
2
Build a CloudWatch dashboard pointing to the metric namespace
A centralized dashboard displays the metrics in real-time.
ECS Container Insights metrics are pushed to the ECS/ContainerInsights namespace, which can be visualized by adding standard metric widgets to the dashboard.

Key Concept

For Amazon ECS clusters running on AWS Fargate, Container Insights is enabled via cluster settings, and the infrastructure automatically pushes performance metrics to the ECS/ContainerInsights namespace without the need for manual agent configuration.
Question 446Question →

A SysOps administrator wants to automate the remediation of unencrypted Amazon EBS volumes. The administrator creates an Amazon EventBridge rule that triggers when an EBS volume is created. The target of the rule is the Systems Manager Automation document `AWS-DeleteVolume` to remove the unencrypted volume. The automation document requires an IAM service role to execute the deletion.

Which configuration and IAM permissions are required for the EventBridge rule to successfully trigger the remediation?

Show answer & explanation

Answer: Associate an IAM role with the EventBridge rule target that trusts `events.amazonaws.com`. Attach a policy to this role that grants `ssm:StartAutomationExecution` for the Systems Manager document and `iam:PassRole` for the Systems Manager service role.

Answer

Associate an IAM role with the EventBridge rule target that trusts `events.amazonaws.com`. Attach a policy to this role that grants `ssm:StartAutomationExecution` for the Systems Manager document and `iam:PassRole` for the Systems Manager service role.
The correct configuration requires associating an IAM role with the EventBridge rule target that trusts the EventBridge service principal (`events.amazonaws.com`). This role must have a policy attached that allows `ssm:StartAutomationExecution` to run the remediation document and `iam:PassRole` to pass the service role that Systems Manager will assume to perform the deletion.

Step-by-Step Solution

1
Configure the trust relationship for the EventBridge execution role.
The role's trust policy is configured to trust the `events.amazonaws.com` service principal.
This authorization permits the EventBridge service to assume the execution role when the rule is triggered.
2
Grant the execution role permission to start the automation.
An identity-based policy is attached to the EventBridge role permitting `ssm:StartAutomationExecution` on the `AWS-DeleteVolume` document.
This permission allows EventBridge to initiate the Systems Manager Automation execution.
3
Grant the execution role permission to pass the Systems Manager service role.
The identity-based policy includes `iam:PassRole` permission targeting the specific Systems Manager service role.
Because the Automation document requires a service role to perform the deletion, EventBridge must be allowed to pass that service role to the Systems Manager service.

Key Concept

To execute Systems Manager Automation from an EventBridge rule target, EventBridge requires an IAM execution role that trusts the `events.amazonaws.com` service principal. This role must have identity-based permissions allowing `ssm:StartAutomationExecution`. If the automation runbook specifies an IAM service role to execute its API calls, the EventBridge execution role must also have `iam:PassRole` permissions for that service role.
Estimated Time:1m 30s
Question 447Question →

A SysOps administrator manages a multi-account AWS environment and uses AWS Service Catalog in a hub account to share a portfolio with several spoke accounts within an AWS Organization. To enforce security compliance, the administrator wants all resources provisioned from this portfolio in the spoke accounts to be created using a dedicated IAM role named SCLaunchExecutionRole in each spoke account. The administrator creates the SCLaunchExecutionRole in the spoke accounts, attaches policies containing the required resource provisioning permissions, and configures the trust policy to allow the cloudformation.amazonaws.com service principal to assume the role. The administrator then configures a launch constraint on the shared portfolio in the spoke accounts, specifying SCLaunchExecutionRole as the launch role. However, when developers in the spoke accounts attempt to provision the product, the deployment fails with a status of tainted, and the event logs state that the execution role cannot be assumed. How should the administrator resolve this deployment failure?

Show answer & explanation

Answer: Update the trust policy of the SCLaunchExecutionRole in the spoke accounts to trust the servicecatalog.amazonaws.com service principal.

Answer

Update the trust policy of the SCLaunchExecutionRole in the spoke accounts to trust the servicecatalog.amazonaws.com service principal.
The correct answer is to update the trust policy of the execution role to trust the AWS Service Catalog service principal. When a launch constraint is applied to a product in a portfolio, the AWS Service Catalog service must assume the specified IAM role to perform provisioning actions. Because the original role was only configured to trust AWS CloudFormation, AWS Service Catalog was blocked from assuming the role, resulting in the deployment failure.

Step-by-Step Solution

1
Analyze the error message indicating that the launch constraint role cannot be assumed.
Identified that the service attempting to assume the role lacks the required trust relationship authorization.
Before AWS Service Catalog can deploy resources, it must be allowed to assume the specified launch constraint role.
2
Examine the trust policy of the SCLaunchExecutionRole.
Observed that the trust policy currently only allows cloudformation.amazonaws.com to assume the role.
Although CloudFormation does the physical deployment, AWS Service Catalog is the service that initiates the assumption of the launch constraint role.
3
Modify the trust policy of the SCLaunchExecutionRole in the spoke accounts.
Added servicecatalog.amazonaws.com to the Trust Relationship statement's Principal block.
This grants the AWS Service Catalog service the authorization to assume the role and perform provisioning tasks on behalf of the end user.

Key Concept

AWS Service Catalog Launch Constraints and Multi-Account IAM Roles
Question 448Question →

A SysOps administrator needs to perform a major platform version upgrade for a production web application hosted on AWS Elastic Beanstalk. The application's Amazon RDS DB instance is currently coupled to the Elastic Beanstalk environment. The upgrade must be performed with zero downtime, and the database data must be preserved.

Which combination of actions should the administrator take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a DB snapshot of the coupled RDS DB instance, restore it to a standalone RDS DB instance, and configure the existing Elastic Beanstalk environment to use the connection details of the standalone instance.; Launch a new Elastic Beanstalk environment without a coupled database, configure it to use the connection details of the standalone RDS DB instance, swap the environment CNAMEs, and terminate the old environment.

Answer

Create a DB snapshot of the coupled RDS DB instance, restore it to a standalone RDS DB instance, and configure the existing Elastic Beanstalk environment to use the connection details of the standalone instance; then launch a new Elastic Beanstalk environment without a coupled database, configure it to use the connection details of the standalone RDS DB instance, swap the environment CNAMEs, and terminate the old environment.
To perform a zero-downtime upgrade when a database is coupled to an Elastic Beanstalk environment, the database must first be decoupled. The correct sequence involves taking an RDS snapshot of the coupled DB, launching a standalone RDS instance from that snapshot, and configuring the active environment to use the new standalone instance. Once the active environment is successfully running on the decoupled database, a new environment running the upgraded platform version is launched (pointing to the same standalone database). A CNAME swap redirects traffic to the new environment without downtime, and the old environment can be safely terminated without deleting the database.

Step-by-Step Solution

1
Take an Amazon RDS snapshot of the coupled database.
A point-in-time snapshot of the database is created.
This captures the current application data state before decoupling.
2
Restore the snapshot to a new standalone RDS instance, and update the connection details in the existing Elastic Beanstalk environment to point to this standalone database.
The existing environment runs against the new standalone RDS instance.
This decouples the database from the life cycle of the Elastic Beanstalk environment.
3
Launch a new Elastic Beanstalk environment with the upgraded platform version, pointing to the standalone database, perform a CNAME swap, and terminate the old environment.
The application traffic is cut over to the new environment with zero downtime, and the old environment is safely deleted without deleting the database.
This completes the Blue/Green deployment strategy and cleans up the obsolete resources.

Key Concept

Decoupling databases in Elastic Beanstalk for Blue/Green deployments
Question 449Question →

An administrator is managing an infrastructure stack using AWS CloudFormation. The stack includes an AWS IAM role used for an application's execution and an Amazon S3 bucket. An operator accidentally deleted the IAM role manually from the IAM Console. Shortly after, a scheduled automated stack update is triggered, but it fails due to an unrelated configuration error in another resource. The stack attempts to roll back, but the rollback fails, placing the stack in the UPDATE_ROLLBACK_FAILED state because the IAM role cannot be found. Which of the following actions can the SysOps Administrator take to successfully resolve the UPDATE_ROLLBACK_FAILED state and return the stack to a stable configuration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Manually recreate the IAM role with the exact same name as defined in the CloudFormation stack template, then initiate the Continue Update Rollback operation.; Initiate the Continue Update Rollback operation and specify the logical ID of the deleted IAM role in the list of resources to skip.

Answer

To resolve the UPDATE_ROLLBACK_FAILED state, the administrator must either manually recreate the deleted IAM role with the same name before continuing the rollback, or perform a Continue Update Rollback operation and specify the logical ID of the IAM role in the resources to skip list.
The correct options involve resolving the rollback failure either by manually recreating the IAM role with the same physical name (which satisfies CloudFormation's lookups during rollback) or by using the Continue Update Rollback feature and explicitly skipping the missing IAM role resource. Both actions successfully bypass the rollback failure and return the stack to a stable state.

Step-by-Step Solution

1
Analyze the stack status and events to identify the resource causing the rollback failure.
The resource is identified as the manually deleted IAM role.
Before acting, it is necessary to confirm which resource's absence is blocking the rollback.
2
Determine if the deleted resource has a custom name or an auto-generated physical ID.
The IAM role has a custom name that can be recreated.
Resources with user-defined names can be manually recreated to satisfy CloudFormation during rollback, whereas auto-generated physical IDs cannot.
3
Choose to either recreate the role or skip it during the rollback continuation.
Either the role is recreated with the same name, or it is specified in the ResourcesToSkip list.
These are the two supported methods in CloudFormation to bypass rollback blocks caused by missing resources.
4
Execute the Continue Update Rollback command or operation.
The stack transitions to UPDATE_ROLLBACK_COMPLETE.
This returns the stack to a stable state, allowing subsequent updates.

Key Concept

CloudFormation Continue Update Rollback and Skipping Resources
Question 450Question →

A SysOps Administrator needs to share an Amazon CloudWatch dashboard that visualizes Container Insights metrics for an Amazon ECS cluster with external business partners who do not have AWS accounts. The administrator must ensure that these partners can view the live dashboard securely without gaining access to any other AWS resources or console features. Which of the following actions will meet these requirements?

Show answer & explanation

Answer: Share the dashboard using a shareable link, select the option to share with specific email addresses, and allow CloudWatch to manage access using an Amazon Cognito user pool.

Answer

Share the dashboard using a shareable link, select the option to share with specific email addresses, and allow CloudWatch to manage access using an Amazon Cognito user pool.
The correct action is to share the dashboard using a shareable link and select the option to share with specific email addresses. Amazon CloudWatch supports sharing dashboards with users who do not have an AWS account by generating a unique URL and configuring username/password authentication. Behind the scenes, CloudWatch uses an Amazon Cognito user pool to manage these credentials securely, restricting external access strictly to the shared dashboard.

Step-by-Step Solution

1
Navigate to the Amazon CloudWatch console and select Dashboards.
The dashboards screen is displayed showing all existing dashboards.
To access the sharing options for the specific dashboard.
2
Select the target dashboard, choose Actions, and click Share dashboard.
The Share dashboard settings wizard is opened.
To configure external access control settings.
3
Select the option to share the dashboard with specific email addresses and enter the partners' emails.
CloudWatch creates and configures an Amazon Cognito user pool to handle sign-in credentials for these users.
This allows secure, authenticated access to the dashboard without requiring AWS account creation for the external users.

Key Concept

CloudWatch Dashboard Sharing
Estimated Time:1m 30s
Question 451Question →

A SysOps Administrator is configuring cross-region replication (CRR) between two Amazon S3 buckets. The source bucket is located in the us-west-2 Region and the destination bucket is located in the us-east-1 Region. The administrator enables versioning on the source bucket and creates the necessary IAM replication role with trust permissions for the Amazon S3 service. However, the destination bucket is a newly created bucket that does not have versioning enabled. What will happen when the administrator attempts to save the replication configuration?

Show answer & explanation

Answer: The configuration will fail to save, and Amazon S3 will return an error indicating that versioning must be enabled on the destination bucket.

Answer

The replication configuration will fail to save, and Amazon S3 will return an error indicating that versioning must be enabled on the destination bucket.
For S3 replication (both CRR and SRR), versioning must be enabled on both the source and destination buckets. If versioning is disabled on the destination bucket, Amazon S3 fails the validation check when the administrator tries to save the configuration, preventing the rule from being applied.

Step-by-Step Solution

1
Assess the S3 replication pre-requisites for both source and destination buckets.
Both the source and destination buckets must have S3 Versioning enabled.
Replication uses unique version IDs to track and copy objects accurately between buckets.
2
Evaluate the state of the destination bucket in the scenario.
The destination bucket does not have versioning enabled.
This violates the core structural requirements of Amazon S3 replication.
3
Determine the behavior of Amazon S3 when validation fails during configuration application.
Amazon S3 blocks the configuration from being saved and returns a validation error.
AWS validates all S3 replication configuration requirements at the time of submission.

Key Concept

S3 Versioning Requirements for Replication
Question 452Question →

A SysOps Administrator is setting up a custom Amazon CloudWatch dashboard to monitor container performance for an Amazon EKS cluster that runs on Amazon EC2 worker nodes. The Administrator has deployed the CloudWatch agent as a DaemonSet in the cluster, but no Container Insights metrics are appearing in CloudWatch. Which combination of actions will resolve this issue and allow the Administrator to display these metrics on the custom dashboard? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach the CloudWatchAgentServerPolicy managed policy to the IAM role associated with the Amazon EKS node groups.; Create a metric widget on the CloudWatch dashboard that references metrics under the ContainerInsights namespace.

Answer

The correct actions are to attach the CloudWatchAgentServerPolicy managed policy to the IAM role associated with the Amazon EKS node groups, and to create a metric widget on the CloudWatch dashboard that references metrics under the ContainerInsights namespace.
To collect Container Insights metrics on Amazon EKS running on EC2 worker nodes, the CloudWatch agent must be deployed and granted permissions to write metrics to CloudWatch via the CloudWatchAgentServerPolicy IAM policy. Once permissions are configured and metrics are sent, they are stored in the ContainerInsights namespace. Creating a metric widget pointing to this namespace allows the Administrator to visualize the EKS container performance on a custom dashboard.

Step-by-Step Solution

1
Attach the required IAM permissions to the EKS node group.
The CloudWatch agent DaemonSet running on the EC2 worker nodes gains the necessary write permissions to publish metric data to CloudWatch.
By default, EKS worker nodes do not have permission to write logs or metrics to CloudWatch, which prevents Container Insights from functioning.
2
Configure the dashboard widget to reference the correct namespace.
The custom CloudWatch dashboard displays container performance metrics like pod CPU and memory utilization.
Container Insights metrics are collected and pushed to the ContainerInsights namespace, which must be selected in the dashboard widget configuration.

Key Concept

Enabling CloudWatch Container Insights on an Amazon EKS cluster running on EC2 nodes requires deploying the CloudWatch agent and granting it write permissions using the CloudWatchAgentServerPolicy IAM policy. Once metrics are successfully collected, they are published to the ContainerInsights namespace, where they can be queried and visualized on custom CloudWatch dashboards.
Question 453Question →

A financial analytics company hosts its transaction-matching engine on a single-instance Amazon RDS for PostgreSQL DB instance. A SysOps Administrator must configure the database tier to achieve automated failover to a standby instance in a different Availability Zone within the same Region in the event of an infrastructure failure. Additionally, the administrator wants to offload read-heavy analytical queries from the primary instance. Which of the following database configurations should the SysOps Administrator implement to meet these requirements with the lowest Recovery Time Objective (RTO)?

Show answer & explanation

Answer: Modify the DB instance to a Multi-AZ deployment, and deploy one or more Read Replicas in different Availability Zones to handle the analytical queries.

Answer

Modify the DB instance to a Multi-AZ deployment, and deploy one or more Read Replicas in different Availability Zones to handle the analytical queries.
Modifying the database to a Multi-AZ deployment provides automatic, synchronous replication to a standby instance in a different Availability Zone within the same Region. In the event of an infrastructure failure, RDS automatically updates the DNS record to point to the standby instance, ensuring the lowest RTO. Deploying separate read replicas is the correct method to handle read-heavy analytical queries without affecting the primary write instance.

Step-by-Step Solution

1
Enable Multi-AZ on the RDS for PostgreSQL instance.
Amazon RDS provisions a standby replica in a different Availability Zone and establishes synchronous replication.
This guarantees zero-data-loss failover and automatic DNS endpoint redirection during an outage, minimizing RTO.
2
Create one or more PostgreSQL Read Replicas.
One or more read-only instances are created with asynchronous replication from the primary instance.
This offloads read-heavy analytical workloads from the primary database instance to prevent performance degradation.

Key Concept

Amazon RDS Multi-AZ deployments provide high availability and automatic failover through synchronous replication to a standby instance, whereas Read Replicas are designed for read scaling and use asynchronous replication.
Estimated Time:1m 30s
Question 454Question →

A SysOps Administrator manages an infrastructure stack deployed via AWS CloudFormation. The stack contains an Amazon EC2 instance and an Amazon RDS DB instance. Due to an emergency performance issue, a database administrator manually modified the RDS DB instance parameter group via the RDS console. Similarly, a systems engineer manually changed the EC2 instance type from t3.medium to m5.large via the EC2 console. The SysOps Administrator needs to update the stack to add a new Amazon S3 bucket. The administrator prepares a new CloudFormation template that includes the S3 bucket resource. The template definitions for the EC2 instance (specifying t3.medium) and the RDS DB instance remain identical to the original template. After the administrator successfully completes the stack update using the new template, what will be the configuration of the EC2 instance type and the RDS DB instance parameter group?

Show answer & explanation

Answer: The EC2 instance type remains m5.large and the RDS DB instance retains the manually modified parameter group.

Answer

The EC2 instance type remains m5.large and the RDS DB instance retains the manually modified parameter group.
The option stating that the EC2 instance type remains m5.large and the RDS DB instance retains the manually modified parameter group is correct. AWS CloudFormation evaluates changes by comparing the submitted template against the previously deployed template. Because the template definitions for the EC2 and RDS instances are identical in both templates, CloudFormation does not include these resources in the update execution plan. Consequently, the drift (the manual changes) is not detected or overwritten, and it persists after the stack update completes.

Step-by-Step Solution

1
Analyze how AWS CloudFormation processes stack updates.
Confirm that CloudFormation updates resources based on the differences between the newly submitted template and the template last used for the stack update, rather than the live state of the resources.
To understand that CloudFormation does not automatically inspect live resource configuration during standard updates.
2
Check the modifications in the new template.
Note that the S3 bucket is the only new addition, and the configurations for both the EC2 instance and the RDS DB instance are unchanged compared to the previous template.
To determine which resources will be included in the CloudFormation change set for modification.
3
Evaluate the state of the drifted resources post-update.
Because no template changes were made to the EC2 or RDS configurations, CloudFormation bypasses updating these resources, meaning the manually modified states (m5.large for the EC2 instance and the custom parameter group for the RDS DB instance) remain intact.
To identify that the drifted properties persist as they were not target properties for modification in the template update.

Key Concept

CloudFormation Stack Update Behavior with Drifted Resources
Question 455Question →

A SysOps administrator is configuring an automated remediation workflow to enable deletion protection on Amazon RDS DB instances that are flagged as non-compliant by AWS Config. The administrator creates an Amazon EventBridge rule that detects the compliance state change events and targets an AWS Systems Manager Automation runbook. The EventBridge rule must pass a specific IAM role (RDSRemediationRole) to the Systems Manager service so that the runbook can perform the modification.

Although the EventBridge rule triggers, the Automation execution fails to start with a permission error.

Which action will resolve this issue?

Show answer & explanation

Answer: Grant the EventBridge execution role the iam:PassRole permission for the RDSRemediationRole.

Answer

Grant the EventBridge execution role the iam:PassRole permission for the RDSRemediationRole.
The correct answer is to grant the EventBridge execution role the iam:PassRole permission for the RDSRemediationRole. In AWS, when a service (EventBridge) triggers an automation workflow in another service (Systems Manager) and passes a service role (AutomationAssumeRole) for that workflow to use, the invoking service's role must have the iam:PassRole permission. This ensures that EventBridge is authorized to pass the specified execution role to Systems Manager.

Step-by-Step Solution

1
Identify the service flow and permissions required for EventBridge to trigger Systems Manager Automation.
Determine that EventBridge acts as the caller that initiates the automation and must pass the execution role (RDSRemediationRole) to Systems Manager.
To understand why the invocation fails with a permission error.
2
Configure the EventBridge execution role's IAM policy.
Add the iam:PassRole permission specifying the RDSRemediationRole ARN as the resource.
This allows EventBridge to securely delegate permissions to Systems Manager to execute the remediation runbook.

Key Concept

IAM PassRole permissions in automated service remediation workflows
Question 456Question →

A SysOps Administrator is setting up Cross-Region Replication (CRR) for an Amazon S3 bucket to meet strict business continuity requirements. The compliance team mandates that 99.99% of all new objects must be replicated to the destination bucket in another AWS Region within 15 minutes, and the replication latency must be actively monitored. Which configuration will successfully meet these requirements?

Show answer & explanation

Answer: Enable Amazon S3 Replication Time Control (S3 RTC) on the replication rule, ensuring that versioning is enabled on both the source and destination buckets.

Answer

Enable Amazon S3 Replication Time Control (S3 RTC) on the replication rule, ensuring that versioning is enabled on both the source and destination buckets.
The correct answer configuration enables Amazon S3 Replication Time Control (S3 RTC) while keeping S3 Versioning enabled on both buckets. S3 RTC is designed specifically for compliance requirements needing guaranteed replication within 15 minutes, and it publishes replication latency metrics to CloudWatch. S3 Versioning must be active on both buckets to track version IDs during the replication process.

Step-by-Step Solution

1
Ensure that versioning is enabled on both the source and destination buckets.
Meets the basic technical requirement for S3 replication to be configured and run.
S3 replication relies on object versions to uniquely identify and track replication status across buckets.
2
Configure the replication rule on the source bucket and select the option to enable Replication Time Control (RTC).
Applies the SLA-backed 15-minute replication time window to the replication flow.
S3 RTC provides predictable replication times and generates CloudWatch metrics to monitor latency and pending replication operations.

Key Concept

S3 Replication Time Control (RTC) requires S3 Versioning on both source and destination buckets and provides SLA-backed 15-minute replication.
Question 457Question →

A SysOps Administrator is attempting to configure Same-Region Replication (SRR) between two Amazon S3 buckets in the same AWS account using the AWS CLI. The administrator has already enabled versioning on the source S3 bucket and created an IAM role with the correct permissions policy to replicate objects. However, when executing the `put-bucket-replication` CLI command, the administrator receives validation and permissions errors, preventing the replication configuration from being applied. Which two actions must the SysOps Administrator take to successfully establish replication? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable versioning on the destination S3 bucket.; Attach an IAM policy to the IAM user running the CLI command that grants the iam:PassRole permission for the replication IAM role.

Answer

To successfully establish replication, the administrator must enable versioning on the destination S3 bucket and attach an IAM policy to the IAM user running the CLI command that grants the iam:PassRole permission for the replication IAM role.
Establishing S3 Same-Region Replication (SRR) via the AWS CLI requires that both the source and destination buckets have versioning enabled. Additionally, the IAM user executing the CLI command must have the iam:PassRole permission to pass the replication role to the S3 service principal.

Step-by-Step Solution

1
Check the versioning status of both the source and destination S3 buckets.
Ensure that versioning is enabled on both buckets. If versioning is missing on the destination bucket, enable it.
Amazon S3 replication requires both buckets to have versioning active.
2
Review the permissions of the IAM user executing the CLI configuration command.
Identify if the user lacks the iam:PassRole permission for the replication role, and attach a policy granting this permission if missing.
Configuring S3 replication via AWS CLI requires the calling user to pass the replication service role to S3.

Key Concept

Amazon S3 replication requires versioning to be enabled on both source and destination buckets, and configuring replication via API/CLI requires the configuring user to have the iam:PassRole permission to pass the replication role to Amazon S3.
Question 458Question →

A SysOps Administrator is configuring a backup and high-availability strategy for a critical application. The application's database runs on an Amazon RDS for PostgreSQL DB instance, and its backup archives are stored in a primary Amazon S3 bucket. The administrator must replicate the S3 backup archives to an S3 bucket in a secondary AWS Region for compliance. Additionally, the administrator wants to ensure that the database has high availability and can fail over automatically with minimal downtime within the primary Region.

Which two actions should the SysOps Administrator take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable bucket versioning on both the source and destination Amazon S3 buckets, and configure S3 Cross-Region Replication (CRR).; Configure the Amazon RDS DB instance as a Multi-AZ deployment to enable automatic failover.

Answer

Enable bucket versioning on both the source and destination Amazon S3 buckets, configure S3 Cross-Region Replication (CRR), and configure the Amazon RDS DB instance as a Multi-AZ deployment.
The correct solution involves enabling versioning on both the source and destination S3 buckets and configuring Cross-Region Replication (CRR) to copy backup archives for compliance. In addition, the RDS instance must be configured as a Multi-AZ deployment to provide automatic failover and high availability within the primary Region.

Step-by-Step Solution

1
Enable versioning on both the source and destination S3 buckets.
Both buckets are prepared for replication, as S3 versioning is a strict prerequisite for Cross-Region Replication.
S3 CRR requires versioning to keep track of object versions and ensure replica consistency.
2
Set up S3 Cross-Region Replication (CRR) from the source bucket to the destination bucket in the secondary Region.
S3 backup archives are automatically replicated to the destination Region.
This satisfies the compliance requirement to store backup archives in a secondary AWS Region.
3
Modify the RDS DB instance to enable Multi-AZ deployment.
RDS provisions a synchronous standby replica in a different Availability Zone within the primary Region.
This enables automatic failover with minimal downtime in the event of an outage in the primary instance's Availability Zone.

Key Concept

Configuring S3 Cross-Region Replication requires versioning enabled on both source and destination buckets, and RDS Multi-AZ deployments provide automatic failover capability within a Region.
Estimated Time:2m 0s
Question 459Question →

A SysOps administrator is configuring a launch constraint for an AWS Service Catalog product using a custom IAM role named `CatalogProvisioningRole`. The role has the necessary policies attached to provision resources. When the administrator attempts to apply the launch constraint to the product in the AWS Service Catalog portfolio, the console returns an access denied error. Additionally, in a previous attempt where the constraint was active, the product provisioning failed and the CloudFormation stack rolled back because the service could not assume the role.

Which two actions should the administrator take to resolve these issues? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the `CatalogProvisioningRole` resource.; Configure the trust policy of the `CatalogProvisioningRole` to allow the `servicecatalog.amazonaws.com` service principal to assume the role.

Answer

To resolve the issues, the administrator must attach an IAM policy to their identity that grants the `iam:PassRole` permission for the launch constraint role, and configure the trust policy of that role to allow the `servicecatalog.amazonaws.com` service principal to assume it.
The correct options address both issues. First, the administrator must have `iam:PassRole` permissions to associate the role with the launch constraint. Second, the role's trust policy must allow `servicecatalog.amazonaws.com` to assume the role to resolve the assumption failure during product deployment.

Step-by-Step Solution

1
Analyze the console access denied error during launch constraint configuration.
Identify that the administrator lacks permissions to pass the specified role (`CatalogProvisioningRole`) to the Service Catalog service.
When associating a launch constraint role, AWS requires the configuring user to have the `iam:PassRole` permission to prevent privilege escalation.
2
Address the role configuration error by updating the administrator's IAM policy.
Attach a policy allowing `iam:PassRole` on the resource `arn:aws:iam::account-id:role/CatalogProvisioningRole`.
This grants the administrator the ability to bind the role to the launch constraint.
3
Analyze the stack rollback and product provisioning failure.
Identify that the Service Catalog service was unable to assume the role because of a trust relationship misconfiguration.
A launch constraint role must explicitly trust the Service Catalog service principal (`servicecatalog.amazonaws.com`) to assume the role via `sts:AssumeRole`.
4
Configure the trust policy of the IAM role.
Update the trust relationship of `CatalogProvisioningRole` to include the `servicecatalog.amazonaws.com` service principal.
This allows the Service Catalog service to successfully assume the role and execute the CloudFormation template.

Key Concept

AWS Service Catalog Launch Constraints require both the administrator to have `iam:PassRole` permissions and the IAM role's trust policy to trust the Service Catalog service principal.
Question 460Question →

A SysOps Administrator is using the AWS CLI to troubleshoot a CloudFormation stack that is stuck in the UPDATE_ROLLBACK_FAILED state. The rollback failed because the original custom IAM service role associated with the stack was deleted. The administrator has created a new IAM role with the correct permissions to manage the stack's resources. However, when the administrator executes `aws cloudformation continue-update-rollback --stack-name my-stack --role-arn arn:aws:iam::123456789012:role/NewCFNServiceRole`, the command fails with an AccessDenied error stating that the administrator's IAM user is not authorized to perform the action on the resource. Which of the following describes the root cause of this error, and how should it be resolved?

Show answer & explanation

Answer: The administrator's IAM user policy is missing the iam:PassRole permission for the new role's ARN. To resolve this, add a policy to the administrator's IAM user that grants iam:PassRole for the new role.

Answer

The administrator's IAM user policy is missing the iam:PassRole permission for the new role's ARN. To resolve this, add a policy to the administrator's IAM user that grants iam:PassRole for the new role.
The correct answer is that the administrator's IAM user policy is missing the iam:PassRole permission for the new role's ARN. When executing stack operations that specify a service role, AWS requires the calling user to have permission to pass that role to the service. Adding the iam:PassRole permission to the administrator's policy resolves the authorization error.

Step-by-Step Solution

1
Identify that the CLI command specifies a new IAM role ARN using the --role-arn parameter.
CloudFormation requires the user executing the command to have permission to pass this role.
CloudFormation will assume this role to perform rollback operations on behalf of the user.
2
Check the user's IAM permissions for the iam:PassRole action on the target role ARN.
An AccessDenied error occurs because the user's IAM policy does not explicitly allow passing the new role.
AWS security guidelines require explicit authorization to pass role permissions to services to prevent privilege escalation.
3
Modify the administrator's IAM policy to include iam:PassRole for the new role's ARN and re-run the CLI command.
The continue-update-rollback command succeeds and the rollback begins.
The user is now authorized to delegate permissions to the CloudFormation service.

Key Concept

IAM PassRole permissions during CloudFormation stack rollback recovery
Estimated Time:2m 0s
PreviousPage 23 / 49Next
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin