Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 481Question →

A SysOps Administrator needs to automate a weekly security compliance script on a fleet of Amazon EC2 instances. The administrator wants to use AWS Systems Manager State Manager to execute a custom SSM document. The execution logs must be saved to a centralized, encrypted Amazon S3 bucket. The administrator needs to configure the required IAM permissions, Systems Manager components, and verify the setup.

What is the correct sequence of steps to configure, automate, and verify this setup?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, attach the IAM instance profile with AmazonSSMManagedInstanceCore to the EC2 instances; second, create the custom SSM Command document containing the compliance script; third, create the IAM service role for Systems Manager with S3 write permissions; fourth, create the State Manager association targeting the instances and configuring S3 logging; fifth, verify the execution status and output logs in the S3 bucket.
To automate a compliance script with Systems Manager, the instances must first be registered as managed nodes, which requires the AmazonSSMManagedInstanceCore IAM role and the SSM Agent. Next, the script must be defined in an SSM Command document. To write logs to an S3 bucket, an IAM service role for Systems Manager with S3 write permissions is required. Once these prerequisites are met, a State Manager association can be created to bind the document to the targets on a schedule with the logging configuration. Finally, the execution and logs can be verified.

Step-by-Step Solution

1
Configure IAM permissions and SSM agent on the target EC2 instances.
EC2 instances become managed nodes in Systems Manager.
Systems Manager cannot run command documents on instances unless they are registered as managed nodes with the SSM Agent active and the AmazonSSMManagedInstanceCore policy attached.
2
Define the compliance script in a custom SSM Command document.
The SSM Command document is available for execution.
An SSM document must be defined to encapsulate the script execution logic before it can be referenced in any association.
3
Create an IAM service role for Systems Manager with S3 bucket permissions.
An IAM role with ssm.amazonaws.com trust relationship and s3:PutObject permission is created.
Systems Manager requires an IAM service role to gain authorization to write execution logs directly to the target S3 bucket.
4
Create a State Manager association linking the document, targets, schedule, and S3 role.
State Manager automates the execution of the compliance script.
The association binds the SSM document to the target instances (using resource tags) and specifies the execution parameters including scheduling and logging configuration.
5
Verify execution logs and status.
The status is shown as Success in State Manager, and log files are present in the S3 bucket.
Verifying the console status and checking the S3 bucket ensures the script executed successfully and the logs were written correctly.

Key Concept

AWS Systems Manager Configuration and Run Command Automation
Question 482Question →

A SysOps administrator is managing configuration parameters in AWS Systems Manager Parameter Store. To satisfy a security compliance requirement, a sensitive configuration parameter must be updated at least once every 9090 days. If the parameter is not updated within this period, the operations team must receive a notification. If the parameter remains unmodified after 120120 days, it must be automatically deleted to prevent the use of stale configurations.

Which combination of actions should the SysOps administrator take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply a parameter policy to the parameter that includes a NoChangeNotification policy set to 9090 days and an Expiration policy set to 120120 days.; Create an Amazon EventBridge rule that filters for Systems Manager Parameter Store parameter policy events and sends notifications to an Amazon Simple Notification Service (Amazon SNS) topic.

Answer

To meet the requirements, the SysOps administrator should apply a parameter policy containing both a NoChangeNotification policy set to 90 days and an Expiration policy set to 120 days, and create an Amazon EventBridge rule to route the parameter policy events to an Amazon SNS topic.
Applying a parameter policy containing both a NoChangeNotification type (for the 90-day alert) and an Expiration type (for the 120-day deletion) enables the native enforcement of parameter lifecycles. Creating an Amazon EventBridge rule that detects Parameter Store policy actions and routes them to an Amazon SNS topic ensures that the operations team receives alerts when the 90-day no-change limit is reached.

Step-by-Step Solution

1
Define parameter policies for Systems Manager Parameter Store.
The parameter is configured with a NoChangeNotification policy of 90 days and an Expiration policy of 120 days, which triggers events and deletes the parameter automatically.
Parameter policies allow native lifecycle management of parameters, including expiration (deletion) and change monitoring.
2
Configure event monitoring for the parameter policies.
An Amazon EventBridge rule is set up to capture SSM Parameter Store policy execution events.
Parameter Store policy actions emit events to Amazon EventBridge, which can be captured to trigger notifications.
3
Integrate notifications using Amazon SNS.
The EventBridge rule is targeted to an Amazon SNS topic subscribed to by the operations team.
SNS provides the mechanism to deliver alerts to the operations team when the 90-day no-change threshold is crossed.

Key Concept

Systems Manager Parameter Store Parameter Policies
Question 483Question →

A SysOps administrator is configuring an AWS Database Migration Service (DMS) replication task to migrate database schemas to Amazon S3. The administrator creates a custom IAM role named DMSS3AccessRole to provide the required write access to the target S3 bucket. When the administrator attempts to save the DMS target endpoint with this role attached, the AWS Management Console displays an 'Access Denied' error. Which combination of actions must the SysOps administrator take to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add a policy statement to the administrator's IAM policy that allows the iam:PassRole action on the DMSS3AccessRole resource.; Update the trust policy of the DMSS3AccessRole role to allow the dms.amazonaws.com service principal to perform the sts:AssumeRole action.

Answer

Add a policy statement to the administrator's IAM policy that allows the iam:PassRole action on the DMSS3AccessRole resource, and update the trust policy of the DMSS3AccessRole role to allow the dms.amazonaws.com service principal to perform the sts:AssumeRole action.
To successfully delegate permissions to AWS DMS, two configurations are required. First, the administrator must have permission to delegate the role. This is done by adding iam:PassRole on the DMSS3AccessRole resource to the administrator's policy. Second, AWS DMS must be authorized to assume the role. This is achieved by updating the trust policy of the role to allow the dms.amazonaws.com service principal to execute sts:AssumeRole.

Step-by-Step Solution

1
Determine why the 'Access Denied' error occurs when attaching the role to the endpoint.
The AWS DMS service must be trusted to assume the role, and the administrator must be authorized to pass the role.
AWS security requires explicit permission delegation when services perform actions on behalf of a user.
2
Grant the administrator permission to pass the custom role to the DMS service.
An identity-based policy statement allowing 'iam:PassRole' on the role's resource is attached to the administrator.
This satisfies the verification check when the administrator submits the role to the DMS service endpoint configuration.
3
Establish trust between the IAM role and the AWS DMS service.
The trust relationship of the role is updated with a principal block for 'dms.amazonaws.com' allowing 'sts:AssumeRole'.
This allows the DMS service container to call STS to obtain temporary security credentials associated with the role.

Key Concept

IAM Role Delegation and Service Authorization using iam:PassRole and sts:AssumeRole
Question 484Question →

An organization manages its multi-account environment using AWS Organizations. A SysOps administrator is configuring a deployment script on an Amazon EC2 instance in member Account A (123456789012123456789012). The EC2 instance is associated with an IAM instance profile that uses a role named `DeployerRole`.

The deployment script must launch new EC2 instances for an application tier and associate them with an existing IAM role named `ApplicationRole` in the same account. The administrator has attached the following IAM policy to the `DeployerRole`:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EC2RunInstances",
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": "*"
},
{
"Sid": "AssumeApplicationRole",
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::123456789012:role/ApplicationRole"
}
]
}

At the organization root, a Service Control Policy (SCP) is attached that includes the following statement to prevent unauthorized IAM modifications:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EnforceIAMGuardrails",
"Effect": "Deny",
"Action": [
"iam:Create*",
"iam:Delete*",
"iam:Update*"
],
"Resource": "*"
}
]
}

When the script executes, the attempt to launch the new EC2 instances fails with an `UnauthorizedOperation` error. Which action must the SysOps administrator take to resolve this issue and allow the script to successfully launch the instances?

Show answer & explanation

Answer: Modify the IAM policy attached to DeployerRole by replacing the 'AssumeApplicationRole' statement with a statement that allows the 'iam:PassRole' action on 'arn:aws:iam::123456789012:role/ApplicationRole'.

Answer

Modify the IAM policy attached to DeployerRole by replacing the 'AssumeApplicationRole' statement with a statement that allows the 'iam:PassRole' action on 'arn:aws:iam::123456789012:role/ApplicationRole'.
The correct answer is to replace the 'AssumeApplicationRole' statement in the DeployerRole policy with one that allows 'iam:PassRole' on the ApplicationRole resource. When launching an EC2 instance with an associated IAM role, the launching principal does not assume the role directly. Instead, it passes the role to the EC2 service, which then assumes the role on the instance's behalf. This action is governed by the 'iam:PassRole' permission. The attached SCP does not block the operation since 'iam:PassRole' does not match the 'iam:Create*', 'iam:Delete*', or 'iam:Update*' patterns restricted by the SCP.

Step-by-Step Solution

1
Analyze the IAM policy attached to the DeployerRole principal.
The current policy contains permissions to run EC2 instances and perform the 'sts:AssumeRole' action on the ApplicationRole resource, but lacks 'iam:PassRole'.
To launch an EC2 instance with an associated IAM role, the calling principal does not assume the role itself. Instead, the principal must have permission to pass the role to the AWS service (EC2) that will assume it.
2
Evaluate the Service Control Policy (SCP) attached to the Organizational Unit.
The SCP denies 'iam:Create*', 'iam:Delete*', and 'iam:Update*'. It does not contain a deny rule matching 'iam:PassRole'.
This confirms that the organization-level guardrails are not blocking the required role delegation action, pointing the issue directly to the lack of 'iam:PassRole' in the local policy.
3
Select the correct permission action to resolve the UnauthorizedOperation failure.
Determine that the policy must be updated to replace the 'sts:AssumeRole' action with 'iam:PassRole' for the ApplicationRole ARN.
Adding 'iam:PassRole' satisfies the authorization requirements of the ec2:RunInstances action when referencing a target IAM instance profile.

Key Concept

IAM role delegation via iam:PassRole versus role assumption via sts:AssumeRole, evaluated alongside SCP scope filters.
Question 485Question →

A SysOps Administrator is setting up an AWS Systems Manager Automation execution that uses a custom runbook to perform administrative tasks across multiple Amazon EC2 instances. The SSM Agent is running on all target instances, and an IAM instance profile containing the AmazonSSMManagedInstanceCore policy is already attached. When the administrator attempts to start the Automation execution using a service role, the execution fails immediately with an access denied error. Which two actions are required to resolve this error and run the automation successfully? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the Systems Manager service role ARN.; Configure the trust policy of the Systems Manager service role to allow the service principal ssm.amazonaws.com to assume the role.

Answer

The administrator must attach an IAM policy to their own IAM identity that grants the iam:PassRole permission for the Systems Manager service role ARN, and configure the trust policy of the Systems Manager service role to allow the service principal ssm.amazonaws.com to assume the role.
Executing Systems Manager Automation using a service role requires the user to have iam:PassRole permissions for the service role. Additionally, the service role itself must trust the ssm.amazonaws.com service principal to allow the Systems Manager service to assume it.

Step-by-Step Solution

1
Identify the missing administrative permission by verifying the error message and IAM policies.
Confirm that the administrator lacks the iam:PassRole permission to pass the role to Systems Manager.
Systems Manager requires the administrator to pass the service role so the service can execute the automation steps under that role.
2
Attach a policy to the administrator's IAM user or group containing the iam:PassRole permission targeting the service role ARN.
The administrator now has the authority to delegate the service role to Systems Manager.
This grants the necessary delegation permission required by IAM when passing roles to AWS services.
3
Verify and update the trust relationship on the Systems Manager service role.
The service role trust policy allows the ssm.amazonaws.com service principal to assume the role.
Without this trust relationship, Systems Manager cannot assume the role to perform actions on AWS resources.

Key Concept

IAM PassRole permissions and service trust relationships for Systems Manager Automation
Estimated Time:1m 30s
Question 486Question →

A SysOps administrator is troubleshooting log delivery for a multi-account setup. AWS CloudTrail in Account B is configured to send logs to a central Amazon S3 bucket in Account A. The S3 bucket is encrypted using an AWS Key Management Service (AWS KMS) customer managed key in Account A. Currently, no logs from Account B are being delivered to the S3 bucket.

Which of the following configuration changes are required to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the Amazon S3 bucket policy in Account A to grant the CloudTrail service principal s3:PutObject permissions for the folder path corresponding to Account B.; Update the KMS key policy in Account A to allow the CloudTrail service principal to perform the kms:GenerateDataKey* action.

Answer

Updating the Amazon S3 bucket policy in Account A to grant s3:PutObject permissions to the CloudTrail service principal, and updating the AWS KMS key policy in Account A to allow the CloudTrail service principal to perform the kms:GenerateDataKey* action.
To successfully deliver CloudTrail logs across accounts to an encrypted S3 bucket, two distinct permissions must be configured in the destination account (Account A). First, the Amazon S3 bucket policy must allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action for the folders containing Account B's logs. Second, since a customer managed KMS key is used for encryption, the KMS key policy in Account A must allow the CloudTrail service principal to execute the kms:GenerateDataKey* action to encrypt the objects.

Step-by-Step Solution

1
Identify the service principal responsible for log delivery.
CloudTrail uses the service principal cloudtrail.amazonaws.com to deliver logs directly.
Since the logs are written by the AWS service itself rather than an IAM role, permissions must be granted directly to the CloudTrail service principal.
2
Grant S3 write permissions to the destination bucket in Account A.
The bucket policy in Account A is updated to allow s3:PutObject for the CloudTrail service principal, referencing Account B's path.
By default, cross-account write access is denied. The bucket policy must explicitly permit the CloudTrail service principal to write to the bucket.
3
Configure KMS key usage permissions in Account A.
The customer managed KMS key policy in Account A is updated to grant kms:GenerateDataKey* and kms:Decrypt permissions to the CloudTrail service principal.
When a destination bucket uses KMS customer managed key encryption, the CloudTrail service must have key permissions to generate data keys and encrypt the log files.

Key Concept

Cross-account CloudTrail log delivery requires configuring both the destination S3 bucket policy and the associated KMS key policy to permit the CloudTrail service principal (cloudtrail.amazonaws.com) to write objects and generate data keys.

Alternative Method

If SSE-KMS encryption is not strictly required to be managed via a customer managed key, changing the S3 bucket encryption to use the default Amazon S3 managed key (SSE-S3) would remove the need to configure KMS key policies, though the S3 bucket policy update would still be required.
Estimated Time:2m 0s
Question 487Question →

An operations team manages an application's infrastructure using an AWS CloudFormation stack. During an unannounced maintenance window, an Amazon RDS DB instance managed by the stack was accidentally deleted and manually recreated with a new physical ID. The stack now shows a drift status of DELETED for the database resource. The team wants to associate the newly recreated DB instance with the existing CloudFormation stack without causing downtime or modifying the configuration of the active database.

Which of the following procedures should a SysOps administrator perform to achieve this goal?

Show answer & explanation

Answer: Remove the database resource definition from the CloudFormation template, update the stack, add the database resource definition back to the template, and then create and execute an import change set using the new database instance's physical ID.

Answer

Remove the database resource definition from the CloudFormation template, update the stack, add the database resource definition back to the template, and then create and execute an import change set using the new database instance's physical ID.
To import an out-of-band recreated resource into an existing stack, the resource must first be removed from the stack's state by modifying the template and updating the stack. After the resource is removed from the stack state, it can be added back to the template and imported into the stack using its new physical ID with an import change set.

Step-by-Step Solution

1
Remove the database resource definition from the CloudFormation template.
The template is prepared without the RDS resource definition.
This is necessary to clean up the stack state in the next step before importing the new resource.
2
Execute a stack update using the modified template.
The stack state is updated and the deleted database resource is removed from CloudFormation management.
Because the resource is already deleted out-of-band, the deletion action completes successfully in the stack state.
3
Add the database resource definition back into the template.
The template configuration matches the desired state of the new RDS database instance.
The resource must be defined in the template so that CloudFormation knows what configuration to import.
4
Create and execute an import change set, providing the new physical ID of the manually recreated RDS DB instance.
The new resource is successfully imported and bound to the stack logical resource without recreation.
The import process associates the logical resource in the template with the new physical resource.

Key Concept

Remediating drift for deleted and recreated resources via stack import
Question 488Question →

A SysOps Administrator is using AWS Systems Manager Run Command to execute a custom shell script on a group of Amazon EC2 instances to perform a security configuration change. The target instances are located in a private subnet, have the SSM Agent installed and running, and have an IAM instance profile with the AmazonSSMManagedInstanceCore managed policy attached. The administrator specifies an encrypted Amazon S3 bucket to store the command execution logs. The S3 bucket is encrypted using a Customer Managed Key (CMK) in AWS KMS. Although the Run Command completes successfully on the instances, the administrator finds that no logs are delivered to the S3 bucket. A check of the SSM Agent log on the instances reveals an access denied error when attempting to upload the log files. Which action should the SysOps Administrator take to resolve this issue?

Show answer & explanation

Answer: Attach a custom IAM policy to the EC2 instances' IAM role that grants kms:GenerateDataKey permissions for the Customer Managed Key, and verify that the KMS key policy permits these actions for the role.

Answer

Attach a custom IAM policy to the EC2 instances' IAM role that grants kms:GenerateDataKey permissions for the Customer Managed Key, and verify that the KMS key policy permits these actions for the role.
The correct answer is correct because when Amazon S3 buckets are encrypted using a Customer Managed Key (CMK) in AWS KMS, any IAM role attempting to write data (such as the SSM Agent uploading Run Command logs) must be granted kms:GenerateDataKey permissions in its IAM policy. In addition, the KMS key policy must explicitly allow the instance's IAM role to perform this action, as KMS key policies are the primary authorizers and cannot be bypassed solely by IAM policies.

Step-by-Step Solution

1
Diagnose the log upload failure.
The SSM Agent on the EC2 instances successfully ran the script but failed to upload execution logs to the encrypted S3 bucket, resulting in an access denied message.
Determining where the access denied error originates helps narrow down the missing permissions.
2
Analyze bucket encryption requirements.
The destination S3 bucket is encrypted using a Customer Managed Key (CMK) in AWS KMS, which requires client-side encrypt/decrypt permissions.
Since the SSM Agent runs on the EC2 instance, the instance's IAM role must have explicit permission to generate data keys for the KMS key.
3
Verify and align IAM and KMS key policies.
Create a policy allowing kms:GenerateDataKey for the instance role and configure the KMS key policy to permit the role.
Unlike standard IAM policies, KMS key policy evaluation requires explicit permission on the key policy itself or proper delegation to IAM policies.

Key Concept

Systems Manager Run Command log encryption permissions
Estimated Time:2m 0s
Question 489Question →

An organization uses AWS Systems Manager State Manager to enforce configuration compliance across a fleet of Amazon EC2 instances. The SSM Agent is installed and running on all instances, and they have the AmazonSSMManagedInstanceCore role attached. A SysOps administrator is configuring a State Manager association that runs a custom automation runbook requiring an IAM service role to execute. When attempting to create the association, the administrator receives an access denied error stating that they are not authorized to perform the iam:PassRole action on the resource. Which action must the administrator take to successfully create the association?

Show answer & explanation

Answer: Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the automation service role's Amazon Resource Name (ARN).

Answer

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the automation service role's Amazon Resource Name (ARN).
The correct action is to grant the administrator's IAM identity the iam:PassRole permission on the target automation service role. This permission allows the administrator to pass the role to Systems Manager so that State Manager can successfully execute the automation document using the designated role.

Step-by-Step Solution

1
Analyze the error message showing unauthorized access for the iam:PassRole action on the target role resource.
Identify that the administrator is attempting to pass an IAM service role to Systems Manager to execute the custom automation runbook.
AWS requires that the identity initiating the task has permission to pass the execution role to the service.
2
Locate the IAM policy associated with the administrator's IAM user, group, or role.
Determine that the policy lacks the iam:PassRole permission specifically targeted at the role ARN.
This permission must be assigned to the identity performing the configuration action, not to the target role itself.
3
Add the iam:PassRole action targeting the specific role ARN into the administrator's IAM policy.
Apply the policy and verify the creation of the State Manager association completes successfully.
This satisfies the authorization check, allowing Systems Manager to accept and assume the service role for automation tasks.

Key Concept

Configuring IAM PassRole permissions to allow AWS services to assume roles on behalf of users.
Question 490Question →

A SysOps administrator is configuring an AWS Systems Manager (SSM) Automation runbook in Account A (111122223333111122223333) to automate security analysis. The runbook runs under the execution context of a service role named SSMAutomationServiceRole. The runbook is designed to launch a temporary Amazon EC2 instance that will perform the analysis. The EC2 instance must be launched with an instance profile associated with an IAM role named DiskAnalyzerInstanceRole.

Which of the following configuration steps must the administrator perform to ensure that the runbook can successfully launch the EC2 instance with the required role? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the trust policy of DiskAnalyzerInstanceRole to allow the ec2.amazonaws.com service principal to perform the sts:AssumeRole action.; Attach an IAM policy to SSMAutomationServiceRole that allows the iam:PassRole action on the ARN of DiskAnalyzerInstanceRole.

Answer

Configure the trust policy of DiskAnalyzerInstanceRole to allow the ec2.amazonaws.com service principal to perform the sts:AssumeRole action, and attach an IAM policy to SSMAutomationServiceRole that allows the iam:PassRole action on the ARN of DiskAnalyzerInstanceRole.
The configuration requires two distinct elements: First, the Systems Manager service role (SSMAutomationServiceRole) must have permission to pass the instance role to the EC2 service using the iam:PassRole permission. Second, the trust policy of the instance role (DiskAnalyzerInstanceRole) must trust the EC2 service principal (ec2.amazonaws.com) to perform sts:AssumeRole, which allows the instance to assume the role upon launch.

Step-by-Step Solution

1
Determine which service principal is assuming the instance role.
The EC2 service (ec2.amazonaws.com) is the service principal that assumes the DiskAnalyzerInstanceRole to retrieve temporary credentials for the instance.
This establishes the trust relationship required for the EC2 instance to execute actions with the permissions of the role.
2
Configure the trust relationship policy on the instance role.
The trust policy of DiskAnalyzerInstanceRole is updated to allow the ec2.amazonaws.com service principal to assume the role.
This satisfies the AWS requirement that any principal assuming a role must be trusted in that role's trust policy.
3
Determine the permission required by the execution role to associate the instance role with the EC2 instance.
The SSMAutomationServiceRole requires the iam:PassRole permission on the DiskAnalyzerInstanceRole resource.
AWS prevents unauthorized role association by requiring the service/identity launching the resource to have explicit permission to pass that specific IAM role.

Key Concept

IAM PassRole vs AssumeRole and Service Trust Relationships
Question 491Question →

A SysOps administrator is configuring an Amazon EC2 instance to execute a script that automatically retrieves configuration parameters from AWS Systems Manager Parameter Store. The administrator creates an IAM role named EC2ParameterStoreRole with the appropriate permissions and a trust policy that allows ec2.amazonaws.com to assume the role. A junior technician is assigned to launch the EC2 instance using the AWS CLI and associate the EC2ParameterStoreRole with the instance. The technician's IAM policy grants full access to EC2 (ec2:*). When attempting to run the CLI command to launch the instance with the specified role, the command fails with an UnauthorizedOperation error. Which action must the administrator add to the technician's IAM policy to resolve this error?

Show answer & explanation

Answer: iam:PassRole for the ARN of the EC2ParameterStoreRole role

Answer

iam:PassRole for the ARN of the EC2ParameterStoreRole role
To configure an AWS service (such as Amazon EC2) with an IAM role, the user performing the configuration must be authorized to pass that role to the service. The iam:PassRole permission grants this authorization. Since the technician has full EC2 permissions but lacks the ability to pass the specific IAM role, the launch operation fails with an UnauthorizedOperation error. Adding iam:PassRole for the EC2ParameterStoreRole role resolves the issue.

Step-by-Step Solution

1
Analyze the error message and current permissions.
The technician has full EC2 permissions (ec2:*) but receives an UnauthorizedOperation error when attempting to launch an EC2 instance with an associated IAM role.
This indicates that the restriction is on the IAM side rather than the EC2 side.
2
Identify the mechanism AWS uses to prevent unauthorized role delegation.
AWS requires users to have the iam:PassRole permission to pass an IAM role to an AWS service like Amazon EC2.
This prevents users from escalating their own privileges by passing roles with higher permissions than their own to services.
3
Select the correct permission required on the technician's IAM policy.
Adding iam:PassRole for the specific ARN of the EC2ParameterStoreRole role to the technician's policy allows them to successfully launch the instance with the role.
This completes the delegation chain safely and satisfies the authorization check.

Key Concept

Delegating IAM roles to AWS services requires the user to have iam:PassRole permissions on the target role.
Estimated Time:1m 30s
Question 492Question →

A SysOps Administrator is designing a centralized backup strategy using AWS Backup. The administrator needs to automatically copy weekly backups of Amazon EBS volumes from multiple member accounts in an AWS Organization to a centralized backup vault in a dedicated disaster recovery account. Which combination of actions must the administrator take to allow these cross-account copies? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable the cross-account backup feature in the AWS Backup console from the AWS Organizations management account.; Apply a backup vault access policy to the centralized backup vault in the destination account that grants permission to the member accounts to copy backups.

Answer

To perform cross-account backup copying in AWS Backup, you must enable the cross-account backup setting in the AWS Organizations management account and apply a vault access policy to the destination backup vault allowing the member accounts to copy backups.
The combination of enabling cross-account backup in the AWS Organizations management account and configuring a resource-based vault access policy on the destination backup vault correctly establishes the permissions needed for AWS Backup to copy recovery points across accounts. This setup allows source accounts to perform copy operations into the destination vault within the AWS Organization.

Step-by-Step Solution

1
Enable cross-account backup at the organization level.
Allows AWS Backup to initiate copy actions between member accounts within the same organization.
By default, AWS Backup does not allow copying backups across accounts until the feature is enabled in the Organizations management account.
2
Configure the resource-based access policy on the destination backup vault.
Grants permission to the source member accounts or the organization to write to the destination backup vault.
The destination backup vault requires permission to allow the backup:CopyIntoBackupVault action from external source accounts.
3
Avoid using default AWS-managed KMS keys for backup encryption.
Ensures that recovery points can be copied across accounts using customer managed KMS keys.
AWS Backup does not support cross-account copying when the backup is encrypted with the default AWS-managed KMS key.

Key Concept

Centralized cross-account backup management using AWS Backup and AWS Organizations.
Question 493Question →

A company hosts a web application behind an Application Load Balancer (ALB). A SysOps administrator is tasked with protecting the application from SQL injection and Cross-Site Scripting (XSS) attacks. Which AWS service should the administrator configure to meet this requirement?

Show answer & explanation

Answer: AWS WAF

Answer

AWS WAF is the correct service because it inspects HTTP/HTTPS traffic at Layer 7 and can block common web exploits like SQL injection and Cross-Site Scripting (XSS).
The correct service is AWS WAF because it operates at the application layer (Layer 7) and allows administrators to configure web access control lists (Web ACLs) that scan incoming HTTP/HTTPS requests for malicious patterns, including SQL injection and Cross-Site Scripting (XSS). It can be directly associated with resources such as Application Load Balancers, CloudFront, and Amazon API Gateway.

Step-by-Step Solution

1
Identify the type of threat that needs to be blocked.
The threats are SQL injection and Cross-Site Scripting (XSS), which are Layer 7 (application layer) web application vulnerabilities.
Different AWS services operate at different layers of the OSI model, and the correct service must be capable of inspecting HTTP/HTTPS payloads.
2
Evaluate the capabilities of the available AWS security and management options.
Network ACLs operate at Layer 4 (IP/port level). AWS KMS is for key management/encryption. AWS Systems Manager Run Command is for OS administration. AWS WAF is a Layer 7 web application firewall designed specifically to inspect application payloads.
Matching the requirements to the correct service capabilities ensures a secure design.
3
Select the service designed for Layer 7 threat protection.
AWS WAF is the appropriate service to associate with the Application Load Balancer.
AWS WAF provides out-of-the-box managed rules and custom rule options to detect and block SQL injection and XSS patterns.

Key Concept

AWS WAF (Web Application Firewall) operates at the application layer (Layer 7) to inspect HTTP/HTTPS requests and protect applications from common web exploits like SQL injection (SQLi) and Cross-Site Scripting (XSS).
Question 494Question →

A SysOps Administrator needs to automate a multi-step patching and reboot sequence across a fleet of Amazon EC2 instances using a custom AWS Systems Manager Automation runbook. The SSM Agent is already installed and running on all target instances. The administrator wants to follow security best practices by using a service role to perform these actions.

Arrange the steps in the correct order to configure, authorize, and run this Automation workflow.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence requires first configuring the IAM service role for Systems Manager, followed by granting the administrator the iam:PassRole permission. Next, the custom Automation runbook document must be created. Once these prerequisites are met, the administrator can execute the Automation runbook referencing the service role and targets, and finally monitor the execution progress in the console.
The correct sequence begins with setting up the necessary IAM permissions: first, the service role itself must exist, and second, the executing identity must have permission to pass it. Next, the Automation runbook must be defined. Finally, the execution is initiated using the runbook and service role, and its progress is monitored.

Step-by-Step Solution

1
Configure the IAM service role
An IAM service role with a trust relationship for ssm.amazonaws.com is created, allowing SSM to interact with EC2 resources.
Systems Manager needs permissions to perform actions on target resources on your behalf.
2
Assign PassRole permissions
The administrator's IAM user or role is authorized to pass the service role to Systems Manager.
Without iam:PassRole, AWS prevents users from delegating roles to services to avoid privilege escalation.
3
Author the custom Automation runbook
An SSM Document of type Automation is saved in the AWS account.
The runbook contains the declaration of execution steps, inputs, and outputs for the patching process.
4
Initiate the execution
The Systems Manager Automation workflow begins executing on the target instances.
This step triggers the runbook using the specified parameters, target instances, and service role.
5
Monitor execution
Visual progress and outputs for each step are visible in the Systems Manager console.
SysOps administrators must verify that each step (patching, rebooting, verifying) succeeds without errors.

Key Concept

Authorizing and executing Systems Manager Automation runbooks using service roles and PassRole permissions.
Estimated Time:2m 0s
Question 495Question →

A company uses an Amazon S3 bucket to store user-uploaded document archives in the us-east-1 Region. The system also uses a single-instance Amazon RDS for PostgreSQL database to manage document metadata. A SysOps Administrator is tasked with implementing a disaster recovery plan. The plan requires replicating the document archives to the us-west-2 Region, and configuring the database for high availability with automated, zero-downtime failover within the primary Region. Which actions must the SysOps Administrator take to meet these requirements?

Show answer & explanation

Answer: Enable bucket versioning on both the source and destination S3 buckets, configure S3 Cross-Region Replication (CRR), and convert the RDS DB instance to a Multi-AZ deployment.

Answer

Enable bucket versioning on both the source and destination S3 buckets, configure S3 Cross-Region Replication (CRR), and convert the RDS DB instance to a Multi-AZ deployment.
Enabling versioning on both the source and destination S3 buckets is a prerequisite for Amazon S3 Cross-Region Replication (CRR). Converting the single-instance RDS DB instance to a Multi-AZ deployment enables synchronous replication to a standby instance in another Availability Zone, providing automatic failover with zero developer intervention.

Step-by-Step Solution

1
Verify versioning requirements for Amazon S3 Cross-Region Replication (CRR).
Versioning must be enabled on both the source S3 bucket and the destination S3 bucket.
S3 CRR relies on versioning to track and replicate object versions across Regions.
2
Determine the appropriate high availability and failover mechanism for the Amazon RDS DB instance.
Modify the single-instance RDS DB instance to a Multi-AZ deployment.
Multi-AZ deployments provide synchronous replication to a standby instance in a different Availability Zone with automated DNS-based failover.
3
Evaluate wrong option configurations such as RDS read replicas or Route 53 routing policies for HA.
Exclude read replicas as automatic failover targets and Route 53 active-active policies for DB failover.
RDS read replicas require manual promotion for failover and are asynchronously replicated. Route 53 active-active routing is not suitable for single-primary database failover.

Key Concept

AWS Data Replication and High Availability configurations involving S3 versioned replication and RDS Multi-AZ replication.
Estimated Time:1m 30s
Question 496Question →

A SysOps administrator is tasked with protecting a regional Amazon API Gateway endpoint from SQL injection attacks using AWS WAF. Which actions must the administrator perform to achieve this security objective? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a regional Web Access Control List (Web ACL) and add a rule statement that inspects for SQL injection patterns.; Associate the regional Web ACL with the specific Amazon API Gateway stage.

Answer

Create a regional Web Access Control List (Web ACL) with a rule statement that inspects for SQL injection patterns, and associate this Web ACL with the specific Amazon API Gateway stage.
To protect a regional Amazon API Gateway stage, the SysOps administrator must create a regional Web Access Control List (Web ACL) in AWS WAF that contains a rule statement to inspect request payloads for SQL injection patterns, and then associate that Web ACL directly with the API Gateway stage. AWS WAF functions at layer 7 to inspect and filter incoming traffic based on configured rules.

Step-by-Step Solution

1
Create the AWS WAF Web ACL
A regional Web ACL is created containing a SQL injection match rule statement.
AWS WAF requires a Web ACL to define the inspection rules, and it must be created in the regional scope to be compatible with regional API Gateway endpoints.
2
Associate Web ACL with API Gateway
The Web ACL is bound to the target API Gateway stage.
AWS WAF protection only takes effect once the Web ACL is associated with the deployment stage of the API Gateway.

Key Concept

AWS WAF protects API Gateway stages by using regional Web ACLs containing rule statements that inspect HTTP/S request components for SQL injection attacks.
Estimated Time:1m 0s
Question 497Question →

A company is using a multi-account AWS architecture. A SysOps administrator is configuring an application running on an Amazon EC2 instance in Account A (account ID 111111111111111111111111) that must retrieve a database connection string. The connection string is stored as a SecureString parameter named `/prod/db/connection_string` in AWS Systems Manager Parameter Store in Account B (account ID 222222222222222222222222). The parameter is encrypted with a customer managed AWS KMS key in Account B. Which configuration will allow the application in Account A to retrieve the parameter value?

Show answer & explanation

Answer: Configure the application to assume an IAM role in Account B that has permissions to perform ssm:GetParameter on the parameter and kms:Decrypt on the KMS key. Grant the EC2 instance profile in Account A permissions to assume this role.

Answer

Configure the application to assume an IAM role in the destination account that has permissions to retrieve the parameter and decrypt it using the customer managed KMS key, while granting the EC2 instance profile in the source account permissions to assume this role.
Systems Manager Parameter Store does not support resource-based policies. To access a parameter across AWS accounts, the application must assume an IAM role in the target account (Account B) that has the required permission policies (ssm:GetParameter and kms:Decrypt). The source account's IAM role must have permission to perform sts:AssumeRole on the target role.

Step-by-Step Solution

1
Determine if AWS Systems Manager Parameter Store supports resource-based policies.
It does not support resource-based policies, meaning cross-account sharing cannot be done directly at the resource level.
This determines that cross-account access must be handled via IAM role assumption.
2
Configure an IAM role in Account B with the necessary access permissions.
An IAM role is created in Account B with a trust policy allowing Account A to assume it, and permissions to execute ssm:GetParameter and kms:Decrypt on the parameter and KMS key respectively.
The role must have permission to access both the encrypted parameter and the KMS key used for its decryption.
3
Configure the EC2 instance profile in Account A.
The instance profile role in Account A is granted sts:AssumeRole permissions targeting the IAM role in Account B.
This allows the application on the EC2 instance to assume the role in Account B and retrieve the secret.

Key Concept

Cross-account access to Systems Manager Parameter Store parameters using IAM role assumption
Estimated Time:1m 30s
Question 498Question →

A SysOps Administrator is tasked with setting up automated patch management for a fleet of Amazon Linux 2 EC2 instances. The organization requires that a custom patch baseline be applied to these instances during a specific weekly maintenance window. The patching process must target only the instances configured with the patch group 'Prod-Linux'. Arrange the following steps in the correct chronological sequence to configure this automated workflow.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with creating the custom patch baseline, followed by tagging the instances with the case-sensitive 'Patch Group' tag, associating that patch group with the baseline, creating the Maintenance Window with registered targets, and registering the Run Command task to execute the AWS-RunPatchBaseline document.
The correct sequence begins with creating the custom patch baseline first to define approval rules. Next, target EC2 instances are tagged with the case-sensitive 'Patch Group' tag. The patch group is then registered with the custom baseline so Patch Manager maps the instances to this baseline instead of the default. After that, a Maintenance Window is defined, and the instances are registered as targets using their patch group tags. Finally, the task is registered in the Maintenance Window to run the 'AWS-RunPatchBaseline' SSM document on the registered targets.

Step-by-Step Solution

1
Create a custom patch baseline.
A custom patch baseline exists with defined rules for Amazon Linux 2.
Custom baselines must be defined before they can be configured with specific patch groups.
2
Tag EC2 instances with the key 'Patch Group' and value 'Prod-Linux'.
Instances are categorized into the patch group.
Systems Manager relies on the case-sensitive 'Patch Group' tag to map instances to baselines.
3
Associate the 'Prod-Linux' patch group with the custom baseline.
The custom baseline is mapped to the 'Prod-Linux' group.
This mapping overrides the default patch baseline for these instances.
4
Create a Maintenance Window and register targets using the 'Patch Group' tag.
A defined maintenance schedule and its target instances are configured.
Targets must be registered with the window before a task can execute on them.
5
Register a task running 'AWS-RunPatchBaseline' within the Maintenance Window.
A task is configured to execute during the window.
This schedules the patching command to execute on the registered targets during the specified schedule.

Key Concept

Automated operating system patching using Systems Manager Patch Manager, custom baselines, patch groups, and maintenance windows.
Estimated Time:2m 0s
Question 499Question →

An operations engineer is setting up scheduled credential updates for an Amazon RDS for MySQL database using AWS Secrets Manager. Both the database instance and the Lambda function performing the rotation are deployed inside private subnets of a VPC that lacks a NAT gateway and internet connectivity. The initial test of the rotation fails because the Lambda function cannot access either the database or the Secrets Manager API. Which of the following actions should the administrator take to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an interface VPC endpoint (AWS PrivateLink) for Secrets Manager in the VPC, and ensure the Lambda function's security group allows outbound traffic to the endpoint's security group on port 443.; Configure the RDS for MySQL database security group to allow inbound traffic on port 3306 from the security group assigned to the Lambda rotation function.

Answer

Configure an interface VPC endpoint for Secrets Manager and allow HTTPS traffic, and configure the RDS database security group to allow inbound port 3306 traffic from the Lambda security group.
To successfully rotate secrets for a database in a private subnet without internet access, two network communication paths must be established. First, the Lambda rotation function needs to communicate with AWS Secrets Manager. Since Secrets Manager is a public service and there is no NAT gateway, the administrator must create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager in the VPC and ensure the Lambda's security group allows outbound HTTPS traffic to the endpoint. Second, the Lambda function must connect to the database to alter the user credentials. This requires configuring the RDS instance's security group to allow inbound database traffic on port 3306 from the Lambda function's security group.

Step-by-Step Solution

1
Analyze the VPC environment and the Lambda function's communication requirements.
The Lambda function is running in a private subnet with no outbound internet access. It must connect to the Secrets Manager service (HTTPS port 443) and the MySQL database (MySQL port 3306).
Determining where traffic is blocked is key to configuring the appropriate network pathways and security groups.
2
Select the correct VPC endpoint configuration for Secrets Manager.
Create an interface VPC endpoint for Secrets Manager in the private subnets and configure security groups to allow HTTPS traffic from the Lambda function.
Since the VPC lacks a NAT gateway, an interface endpoint (AWS PrivateLink) is required to establish private communication with the Secrets Manager service.
3
Establish the database network path.
Allow inbound traffic on port 3306 in the RDS database's security group from the Lambda function's security group.
The Lambda rotation function must establish a direct connection to the database instance to perform credential update operations.

Key Concept

AWS Secrets Manager automated rotation in a private VPC requires network paths to both the database and Secrets Manager. Private communication with Secrets Manager is achieved via an interface VPC endpoint, while security groups must be configured to permit traffic between the rotation Lambda function and the target database.
Estimated Time:2m 0s
Question 500Question →

A SysOps Administrator manages an AWS CloudFormation stack that contains an Amazon EC2 instance. A developer manually changed the instance type from t3.microt3.micro to t3.smallt3.small and added a new tag with key EnvironmentEnvironment and value TestingTesting directly using the Amazon EC2 console. The administrator runs a drift detection scan on the stack, which reports the EC2 instance resource status as DRIFTED. The administrator wants to resolve this drift so that the CloudFormation stack matches the actual state of the running instance, and any future stack updates do not revert these changes. Which two actions should the administrator perform to resolve this drift? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Update the CloudFormation template to reflect the new instance type and the environment tag in the resource declaration.; Perform a stack update using the modified template to bring the stack's expected configuration in sync with the actual state.

Answer

Update the CloudFormation template to reflect the new instance type and the environment tag in the resource declaration, and perform a stack update using the modified template.
To resolve drift where manual changes are to be preserved, the SysOps Administrator must update the CloudFormation template to match the current real-world state of the resources. Once the template is updated, executing a stack update syncs the stack's expected configuration with the actual resource configuration without triggering any resource updates or interruptions.

Step-by-Step Solution

1
Identify the drifted configuration by reviewing the drift detection results, noting the manual modifications to the instance type and tags.
Confirming the resource configuration details match the actual resource state.
This determines what changes need to be incorporated into the CloudFormation template.
2
Modify the CloudFormation template by changing the instance type property to the new value and adding the environment tag under the resource's properties block.
The CloudFormation template matches the current state of the running instance.
To remediate drift while keeping manual changes, the template must be updated to align with the actual resource state.
3
Run a CloudFormation stack update using the updated template.
The stack expected configuration is updated, and a subsequent drift scan will report the resource as in-sync.
This updates the CloudFormation stack database to match the new template configuration without modifying the running EC2 instance.

Key Concept

To resolve resource drift and keep the manual changes, the CloudFormation template must be updated to match the actual state of the resources, followed by running a stack update.
Estimated Time:1m 30s
PreviousPage 25 / 49Next