Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 501Question →

An organization hosts a multi-tier application in a VPC. A SysOps Administrator is troubleshooting database connection timeouts between the application servers in Subnet A (10.0.1.0/2410.0.1.0/24) and a PostgreSQL database in Subnet B (10.0.2.0/2410.0.2.0/24).

The Security Groups are configured as follows:
- The application servers belong to `sg-app`, which has an outbound rule allowing TCP port 54325432 to `sg-db`.
- The database belongs to `sg-db`, which has an inbound rule allowing TCP port 54325432 from `sg-app`.

The Network ACLs (NACLs) are configured as follows:
- Subnet A NACL: Inbound rule allows all traffic from 0.0.0.0/00.0.0.0/0. Outbound rule allows TCP port 54325432 to 10.0.2.0/2410.0.2.0/24.
- Subnet B NACL: Inbound rule allows TCP port 54325432 from 10.0.1.0/2410.0.1.0/24. Outbound rule allows TCP port 54325432 to 10.0.1.0/2410.0.1.0/24.

Which configuration change will resolve the connection timeouts while maintaining the principle of least privilege?

Show answer & explanation

Answer: Modify Subnet B's NACL outbound rule to allow TCP traffic on ports 1024−655351024-65535 to 10.0.1.0/2410.0.1.0/24.

Answer

Modify Subnet B's NACL outbound rule to allow TCP traffic on ports 1024−655351024-65535 to 10.0.1.0/2410.0.1.0/24.
The correct configuration is to modify Subnet B's outbound NACL to allow TCP traffic on ports 1024−655351024-65535 targeting Subnet A's CIDR. Because NACLs are stateless, they must explicitly permit both request and response paths. When a client initiates a connection, it uses a random source port from the ephemeral port range (1024−655351024-65535). The database's response is sent back to this ephemeral port, requiring Subnet B's outbound NACL to allow traffic to those ports.

Step-by-Step Solution

1
Analyze the request path from the application servers to the database.
The application server initiates a connection on destination port 54325432 from a randomly chosen ephemeral port (1024−655351024-65535). Subnet A's outbound NACL allows port 54325432, and Subnet B's inbound NACL allows port 54325432. The request successfully reaches the database.
To verify that the forward path is clear.
2
Analyze the response path from the database to the application servers.
The database sends responses back to the application server's ephemeral source port. Subnet B's outbound NACL only allows outbound traffic on destination port 54325432. Because the response target port is in the 1024−655351024-65535 range, Subnet B's outbound NACL blocks the return traffic.
To identify why the connection times out despite successful forward routing.
3
Formulate the correct NACL rule modification.
Update Subnet B's outbound NACL to permit TCP traffic on destination ports 1024−655351024-65535 directed to the application subnet CIDR (10.0.1.0/2410.0.1.0/24).
NACLs are stateless and require explicit rules to permit response traffic.

Key Concept

Stateful vs. Stateless Network Filtering in AWS
Estimated Time:2m 0s
Question 502Question →

A SysOps administrator is setting up an AWS Glue crawler to catalog data in an Amazon S3 bucket. The administrator creates an IAM role named GlueCrawlerRole that has the required permissions to access the S3 bucket. However, when the administrator attempts to run the crawler, the execution fails. The error logs indicate that the AWS Glue service is not authorized to assume the role, and the administrator is not authorized to associate the role with the crawler. Which of the following actions must the administrator take to successfully run the crawler? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the GlueCrawlerRole resource.; Configure the trust relationship on GlueCrawlerRole to allow the glue.amazonaws.com service principal to perform the sts:AssumeRole action.

Answer

Configure the trust relationship on the GlueCrawlerRole to allow the glue.amazonaws.com service principal to perform the sts:AssumeRole action, and attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the GlueCrawlerRole resource.
To successfully run the AWS Glue crawler, two permission configurations are required. First, the AWS Glue service itself must be allowed to assume the service role (GlueCrawlerRole). This is configured by adding a trust policy (trust relationship) to the role that lists the service principal glue.amazonaws.com and allows the sts:AssumeRole action. Second, the user or administrator who initiates the crawler must have permission to pass this role to the AWS Glue service. This is configured by attaching an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the specific role resource.

Step-by-Step Solution

1
Analyze the trust relationship error.
The service cannot assume the role.
For AWS Glue to execute tasks using the GlueCrawlerRole, the role's trust policy must list the Glue service principal (glue.amazonaws.com) as a trusted entity and allow the sts:AssumeRole action.
2
Analyze the role association error.
The administrator cannot associate the role.
When a user configures a service to run using a specific IAM role, AWS requires that the user have the iam:PassRole permission for that role to prevent privilege escalation.
3
Combine the required configurations.
Both the trust relationship and the user permissions must be correctly configured.
Configuring only one of these permissions will not resolve the entire access denied issue, so both steps are required.

Key Concept

Delegating permissions to AWS services requires configuring both a service trust policy (sts:AssumeRole) and user delegation permissions (iam:PassRole).
Question 503Question →

A SysOps Administrator is troubleshooting a new application deployment in a VPC. A backend microservice runs on Amazon EC2 instances in private Subnet A (CIDR block 172.16.1.0/24172.16.1.0/24). These instances must communicate with a self-managed database cluster on EC2 instances in private Subnet B (CIDR block 172.16.2.0/24172.16.2.0/24) over TCP port 2701727017.

The Security Groups are already configured to allow TCP port 2701727017 outbound from the backend Security Group, and TCP port 2701727017 inbound to the database Security Group. However, both subnets are associated with separate, custom Network Access Control Lists (NACLs) that block all traffic by default.

Which two changes must the Administrator make to the custom NACL rules to successfully enable communication between the subnets? (Select two.)

Select all that apply

Show answer & explanation

Answer: In the custom NACL associated with Subnet A, add an inbound rule that allows traffic from Subnet B (172.16.2.0/24172.16.2.0/24) on TCP ports 1024−655351024-65535.; In the custom NACL associated with Subnet B, add an outbound rule that allows traffic to Subnet A (172.16.1.0/24172.16.1.0/24) on TCP ports 1024−655351024-65535.

Answer

Add an inbound rule to Subnet A's NACL allowing TCP ports 1024−655351024-65535 from Subnet B, and add an outbound rule to Subnet B's NACL allowing TCP ports 1024−655351024-65535 to Subnet A.
Because Network Access Control Lists (NACLs) are stateless, they evaluate traffic in each direction independently. When the backend microservice in Subnet A initiates a connection to the database in Subnet B on TCP port 2701727017, the client operating system assigns a random source port from the ephemeral port range (1024−655351024-65535). The return packets sent by the database back to the client will have a destination port corresponding to this ephemeral port. Therefore, to allow the response packets through the stateless NACLs, Subnet B must allow outbound traffic on the ephemeral port range to Subnet A, and Subnet A must allow inbound traffic on the ephemeral port range from Subnet B.

Step-by-Step Solution

1
Determine request and return paths for database communication.
Requests are sent from Subnet A to Subnet B on destination port 2701727017. Responses are sent from Subnet B to Subnet A on destination ephemeral ports 1024−655351024-65535.
Client applications use ephemeral ports as source ports when initiating outbound TCP connections, and return traffic is directed back to these ports.
2
Identify client-side NACL requirements for return traffic.
Subnet A's custom NACL must permit inbound TCP traffic on ports 1024−655351024-65535 from Subnet B.
Since NACLs are stateless, the inbound return traffic from the database would be blocked by default unless explicitly allowed.
3
Identify server-side NACL requirements for return traffic.
Subnet B's custom NACL must permit outbound TCP traffic on ports 1024−655351024-65535 to Subnet A.
Since NACLs are stateless, outbound response traffic from the database to the client's ephemeral ports must be explicitly allowed.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit rules for both outbound request and inbound response paths, specifically using ephemeral ports (1024−655351024-65535) for return traffic.
Question 504Question →

A SysOps administrator is configuring an Amazon EC2 Auto Scaling group to use a new launch template. The launch template specifies an IAM instance profile associated with an IAM role named 'ApplicationServerRole'. When the administrator attempts to create the launch template, the action fails with an 'Access Denied' error. The administrator already has full administrative access to Amazon EC2, but their IAM permissions are restricted. Which permission must be added to the administrator's IAM policy to resolve this issue?

Show answer & explanation

Answer: Allow the iam:PassRole action on the ApplicationServerRole resource in the administrator's IAM policy.

Answer

Allow the iam:PassRole action on the ApplicationServerRole resource in the administrator's IAM policy.
The correct answer is correct because the iam:PassRole action is specifically designed to control which roles a user can assign to AWS services (like EC2). When creating resources like launch templates that specify service roles, the user's IAM policy must grant permission to pass that role to the service.

Step-by-Step Solution

1
Analyze the error context.
The error is 'Access Denied' occurring during the creation of an EC2 launch template that references an IAM instance profile.
Creating a launch template with an instance profile requires the creator to delegate permissions to the service.
2
Determine the required API permission for delegation.
Identify the iam:PassRole permission as the mandatory authorization needed to pass an IAM role to an AWS service.
AWS prevents privilege escalation by requiring that a user must have explicit permission to assign a role to a service.
3
Select the option that resolves the permission gap.
Grant the iam:PassRole action on the ApplicationServerRole resource in the administrator's policy.
This allows the administrator to pass the ApplicationServerRole to the EC2 service via the launch template.

Key Concept

IAM Role Delegation and the iam:PassRole Permission
Question 505Question →

An administrator is setting up automated security updates for a hybrid fleet of Red Hat Enterprise Linux (RHEL) managed nodes. The administrator configures a custom patch baseline and attempts to associate it with a specific subset of nodes using a custom patch group. The patching process is orchestrated using an AWS Systems Manager Maintenance Window that triggers the AWS-RunPatchBaseline document. During execution, the task fails to run on the targeted nodes, and they do not receive the specified updates. The managed nodes are verified as online and active in Systems Manager.

Which two configuration adjustments must the administrator make to ensure the custom patch baseline is applied to the target nodes during the maintenance window?

Select all that apply

Show answer & explanation

Answer: Update the resource tags on the managed nodes to use the exact, case-sensitive key 'Patch Group' and match the baseline association value.; Assign the 'iam:PassRole' permission to the IAM user or role that registers the Maintenance Window task for the task execution role.

Answer

Updating the resource tags to the case-sensitive 'Patch Group' key and assigning the 'iam:PassRole' permission to the IAM identity registering the Maintenance Window task.
To resolve the issue, the administrator must ensure the target nodes are correctly associated with the patch group and the orchestration tasks are authorized. Systems Manager Patch Manager requires target nodes to be tagged with the exact case-sensitive key 'Patch Group' to apply the matching baseline. Additionally, the IAM user or role registering the Maintenance Window task must have the 'iam:PassRole' permission for the task execution role so that Systems Manager can assume it.

Step-by-Step Solution

1
Inspect the tags of the managed nodes targeted for patching.
Ensure they match the exact case-sensitive key 'Patch Group' and match the value defined in the baseline mapping.
Systems Manager Patch Manager relies strictly on this case-sensitive tag key to group and target instances correctly.
2
Examine the IAM permissions of the administrator or pipeline registering the Maintenance Window task.
Confirm that the identity has 'iam:PassRole' permissions for the designated task execution role.
AWS services require a delegation mechanism to assume a role on behalf of the caller, which is enforced via the 'iam:PassRole' permission.

Key Concept

Configuring correct tag casing for SSM Patch Groups and granting iam:PassRole permissions for executing Maintenance Window tasks.
Question 506Question →

A SysOps Administrator needs to implement a solution that continuously audits the configuration of AWS resources against security best practices, such as ensuring all Amazon EBS volumes are encrypted. The solution must track configuration history and report compliance status. Which AWS service is designed to meet this requirement?

Show answer & explanation

Answer: AWS Config

Answer

AWS Config
AWS Config is the dedicated AWS service that continuously audits and assesses the configurations of your AWS resources. It records configuration changes over time and allows you to define rules (such as checking if EBS volumes are encrypted) to evaluate whether those resources are compliant.

Step-by-Step Solution

1
Analyze the requirement for continuous configuration auditing and tracking configuration history.
The requirement is for auditing compliance against specific configurations (like EBS encryption) and tracking resource state history.
This helps differentiate between services that track API calls, services that monitor metrics, and services that record configuration states.
2
Evaluate the capabilities of AWS Config.
AWS Config maintains a configuration history of supported AWS resources and uses rules to evaluate whether resource configurations match desired compliance settings.
This matches the core requirement of compliance auditing and historical tracking.

Key Concept

AWS Config provides continuous monitoring, compliance auditing, and configuration history tracking of AWS resources.
Question 507Question →

A SysOps administrator is configuring cross-account access for an application running on an Amazon EC2 instance in Account A. The application must retrieve a database credential stored in AWS Secrets Manager in Account B. The secret in Account B is currently encrypted using a customer managed AWS KMS key. Which combination of actions must the administrator perform to grant the application access to the secret? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the resource-based policy of the secret in Account B to grant secretsmanager:GetSecretValue permissions to the IAM role of the EC2 instance in Account A.; Configure the key policy of the customer managed KMS key in Account B to grant kms:Decrypt permissions to the IAM role of the EC2 instance in Account A.

Answer

Configure the resource-based policy of the secret in Account B to grant secretsmanager:GetSecretValue permissions to the IAM role of the EC2 instance in Account A, and configure the key policy of the customer managed KMS key in Account B to grant kms:Decrypt permissions to the IAM role of the EC2 instance in Account A.
To successfully set up cross-account access to a secret in AWS Secrets Manager, two key configurations are required in the owning account (Account B): first, the secret's resource policy must grant the external IAM role access to retrieve the secret value; second, the key policy of the customer managed KMS key used to encrypt the secret must grant the external IAM role decryption privileges.

Step-by-Step Solution

1
Examine the encryption key requirements for cross-account access.
Identify that the secret must be encrypted with a customer managed KMS key rather than an AWS managed key, as AWS managed keys cannot be shared across accounts.
This establishes that permissions must be modified on a customer managed KMS key policy.
2
Configure permissions on the secret resource policy.
Modify the resource-based policy of the secret in Account B to allow the IAM role from Account A to perform the secretsmanager:GetSecretValue action.
Secrets Manager resource-based policies must explicitly grant cross-account access to external principals.
3
Configure permissions on the KMS key policy.
Modify the customer managed KMS key policy in Account B to grant kms:Decrypt permissions to the external IAM role in Account A.
IAM policies alone cannot grant access to KMS keys across accounts; the KMS key policy in the owning account must explicitly permit the decryption.

Key Concept

Cross-account access to AWS Secrets Manager secrets requires using a customer managed KMS key, configuring the resource-based policy of the secret, and configuring the key policy of the KMS key to allow decryption by the external IAM principal.
Estimated Time:2m 0s
Question 508Question →

A company is hosting a centralized monitoring server on an Amazon EC2 instance in Subnet A (172.31.1.0/24172.31.1.0/24). This server is configured to scrape metrics from production application servers located in Subnet B (172.31.2.0/24172.31.2.0/24) on TCP port 9100.

The custom Network Access Control List (NACL) for Subnet A has the following rules:
* Inbound: Allow TCP traffic on ports 1024−655351024-65535 from Subnet B (172.31.2.0/24172.31.2.0/24)
* Outbound: Allow TCP traffic on port 9100 to Subnet B (172.31.2.0/24172.31.2.0/24)

The custom NACL for Subnet B has the following rules:
* Inbound: Allow TCP traffic on port 9100 from Subnet A (172.31.1.0/24172.31.1.0/24)
* Outbound: Allow TCP traffic on port 9100 to Subnet A (172.31.1.0/24172.31.1.0/24)

The Security Groups associated with the EC2 instances are configured correctly to allow traffic on port 9100. However, the monitoring server cannot establish a connection to scrape metrics.

Which modification to the Subnet B NACL rules is required to resolve this connectivity issue?

Show answer & explanation

Answer: Modify the outbound rule for Subnet B to allow TCP traffic on ports 1024-65535 to Subnet A.

Answer

Modify the outbound rule for Subnet B to allow TCP traffic on ports 1024-65535 to Subnet A.
The correct answer is to modify the outbound rule for Subnet B to allow TCP traffic on ports 1024-65535 to Subnet A. Because Network Access Control Lists (NACLs) are stateless, they evaluate inbound and outbound traffic independently. When the monitoring server in Subnet A initiates a connection to port 9100 on the application servers in Subnet B, the monitoring server uses a dynamically allocated ephemeral port (within the range 1024-65535) as the source port. The application server responds from port 9100 to that ephemeral destination port. Therefore, the outbound NACL rules for Subnet B must allow traffic on ports 1024-65535 to Subnet A in order for the response to pass through.

Step-by-Step Solution

1
Analyze the direction of the connection initiation.
The connection is initiated by the monitoring server in Subnet A (IP range 172.31.1.0/24172.31.1.0/24) and targets port 9100 on the application servers in Subnet B (IP range 172.31.2.0/24172.31.2.0/24).
Understanding the source and destination is critical to diagnosing NACL issues.
2
Determine the ports used for the outbound request and response.
The request goes from Subnet A (source: ephemeral port 1024−655351024-65535) to Subnet B (destination: port 9100). The response goes from Subnet B (source: port 9100) back to Subnet A (destination: ephemeral port 1024−655351024-65535).
NACLs are stateless, meaning both request and response traffic must be explicitly allowed by separate rules.
3
Evaluate the current configuration of Subnet B's NACL rules.
Subnet B's inbound rules allow port 9100 from Subnet A, which is correct. However, Subnet B's outbound rules only allow port 9100 to Subnet A. This blocks the response traffic because it is destined for the client's ephemeral port range (1024−655351024-65535) instead of port 9100.
Identifying where the traffic is blocked points to the correct configuration change.
4
Formulate the required correction for Subnet B's NACL.
Change the outbound rule of Subnet B to allow TCP traffic on ports 1024−655351024-65535 targeting Subnet A.
This allows the application servers to send the metrics response back to the client's ephemeral ports.

Key Concept

NACLs are stateless, which requires outbound rules to explicitly permit return traffic to the client's ephemeral port range (typically 1024-65535).
Question 509Question →

A SysOps Administrator needs to execute a custom bash script on several on-premises servers using AWS Systems Manager Run Command. The on-premises servers are not yet registered with AWS. An IAM service role for Systems Manager hybrid activation has already been created.

What is the correct sequence of steps to register these on-premises servers and execute the script?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, create a hybrid activation to get the Activation ID and Activation Code. Second, install the SSM Agent on the on-premises servers and register them using the activation details. Third, verify that the servers appear as managed nodes in the Systems Manager console. Fourth, execute the command using AWS-RunShellScript targeting the managed nodes.
The registration process must begin with creating the activation credentials, then applying them locally to the hybrid servers. Only after confirming they are registered as managed nodes can commands be executed on them.

Step-by-Step Solution

1
Create a hybrid activation in Systems Manager.
Activation ID and Activation Code are generated.
These credentials allow the hybrid instances to securely register with AWS Systems Manager.
2
Install SSM Agent and register on-premises servers.
The SSM Agent registers with Systems Manager.
The on-premises servers require the agent and registration credentials to join the AWS account's managed fleet.
3
Verify instances appear as managed nodes.
Instances appear with the 'mi-' prefix.
Ensures that the agent is properly communicating and ready to receive commands.
4
Execute Run Command.
Run Command successfully targets the instances and runs the script.
Once the target nodes are managed, standard SSM Run Command documents can be targeted to them.

Key Concept

AWS Systems Manager hybrid activations and Run Command execution sequence
Question 510Question →

A SysOps Administrator is setting up automated patching for a group of production Amazon EC2 instances running Red Hat Enterprise Linux (RHEL). The administrator designs a custom patch baseline that approves only security updates with a 'Critical' severity. The administrator tags the target EC2 instances with the key `Patch Group` and the value `RHEL-Production`. A maintenance window is configured to run the `AWS-RunPatchBaseline` document on these instances. During the next scheduled execution, the administrator notices that the instances are patched using the default AWS-provided RHEL patch baseline instead of the custom patch baseline.

Which action must the administrator take to ensure the custom patch baseline is applied to these instances?

Show answer & explanation

Answer: Associate the custom patch baseline with the `RHEL-Production` patch group within Systems Manager Patch Manager.

Answer

Associate the custom patch baseline with the RHEL-Production patch group within Systems Manager Patch Manager.
Associating the custom patch baseline with the 'RHEL-Production' patch group ensures that Systems Manager Patch Manager selects the custom baseline when executing the AWS-RunPatchBaseline document on the tagged instances. If an instance has a patch group tag but that group is not associated with any baseline, the default baseline is used.

Step-by-Step Solution

1
Verify that the managed instances are correctly tagged with the case-sensitive key 'Patch Group' and the value 'RHEL-Production'.
The target instances are verified to belong to the correct patch group.
Systems Manager Patch Manager uses this tag to associate instances with a patch group.
2
In Systems Manager Patch Manager, select the custom patch baseline and associate it with the patch group 'RHEL-Production'.
The custom baseline is mapped to the 'RHEL-Production' patch group.
Without this explicit association, Systems Manager falls back to the default patch baseline for the instance's operating system.
3
Execute the maintenance window task running the 'AWS-RunPatchBaseline' document.
The instances are successfully patched using the rule defined in the custom patch baseline.
The 'AWS-RunPatchBaseline' document resolves the baseline dynamically from the associated patch group.

Key Concept

Systems Manager Patch Manager maps managed nodes to patch baselines using patch groups. The tag key 'Patch Group' must be explicitly registered and associated with the custom baseline in Patch Manager; otherwise, the default baseline is applied.
Question 511Question →

A SysOps Administrator is setting up an administrative logging server on an Amazon EC2 instance in a public subnet (10.0.1.0/2410.0.1.0/24) to receive remote log streams over TCP port 514 from a legacy on-premises logging agent (192.168.1.50/32192.168.1.50/32). The public subnet is associated with a custom Network Access Control List (NACL), and the EC2 instance is associated with a custom Security Group. The custom Security Group has an inbound rule allowing TCP port 514 from 192.168.1.50/32192.168.1.50/32 and an outbound rule allowing all traffic. However, logs are not reaching the server, and connection attempts are timing out. Which two updates to the custom NACL rules must the administrator perform to resolve this connectivity issue?

Select all that apply

Show answer & explanation

Answer: Inbound rule: Allow TCP traffic from 192.168.1.50/32192.168.1.50/32 on port 514; Outbound rule: Allow TCP traffic to 192.168.1.50/32192.168.1.50/32 on ports 1024-65535

Answer

To resolve the connectivity issue, the administrator must add an inbound NACL rule allowing TCP traffic from 192.168.1.50/32192.168.1.50/32 on port 514, and an outbound NACL rule allowing TCP traffic to 192.168.1.50/32192.168.1.50/32 on ephemeral ports 1024-65535.
Network ACLs are stateless. To allow the TCP connection to succeed, the inbound NACL rule must permit the initial packet on the application's service port (TCP 514). Because NACLs do not track connection state, the response packet must also be explicitly allowed outbound. The response is sent back to the client's dynamically allocated ephemeral port, which lies within the 1024-65535 range. Thus, both the inbound rule for port 514 and the outbound rule for ports 1024-65535 are required.

Step-by-Step Solution

1
Analyze the stateless nature of Network Access Control Lists (NACLs).
Realize that unlike stateful Security Groups, NACLs require explicit rules for both inbound request traffic and outbound response traffic.
Security Groups track connection state and automatically allow return traffic, but NACLs do not.
2
Determine the required inbound NACL rule configuration.
Identify that the source IP (192.168.1.50/32192.168.1.50/32) initiates a connection to the server on port 514, requiring an inbound rule for TCP port 514.
Without an inbound rule, the incoming packet to port 514 will be dropped by the default deny rule.
3
Determine the required outbound NACL rule configuration.
Identify that the return traffic from the server to the client goes to the client's ephemeral ports (1024-65535), requiring an outbound rule targeting ports 1024-65535.
Omitting outbound ephemeral ports blocks the server's TCP handshake response, resulting in a connection timeout.

Key Concept

Statelessness of Network ACLs and the requirement of ephemeral ports for return traffic.
Question 512Question →

A SysOps Administrator manages an AWS CloudFormation stack that contains an Amazon DynamoDB table. A developer manually deleted a global secondary index (GSI) from the DynamoDB table using the AWS Management Console to test an application performance issue. The SysOps Administrator runs drift detection on the stack, and the table is reported as DRIFTED. The administrator wants to restore the GSI to the DynamoDB table using AWS CloudFormation. Which action should the administrator take to achieve this?

Show answer & explanation

Answer: Update the CloudFormation template to remove the GSI definition, perform a stack update, and then perform another stack update using the original template containing the GSI definition.

Answer

Update the CloudFormation template to remove the GSI definition, perform a stack update, and then perform another stack update using the original template containing the GSI definition.
The correct action is to update the template to match the drifted state (removing the GSI), execute a stack update to sync the stack metadata, and then perform a subsequent stack update using the original template containing the GSI. Because CloudFormation evaluates changes by comparing the submitted template against the last deployed template rather than the physical resource directly, this two-step update process is required to force CloudFormation to register the resource addition and provision the GSI.

Step-by-Step Solution

1
Modify the CloudFormation template by removing the DynamoDB global secondary index (GSI) configuration.
The template now matches the current physical state of the DynamoDB table where the GSI is missing.
This establishes a matching baseline between the template and the live resource so that CloudFormation registers them as aligned.
2
Perform a stack update using the modified template.
The stack completes the update successfully, updating its metadata to reflect that the table has no GSI, and clearing the drift status.
CloudFormation updates its internal state to reflect the removal without modifying the live database since the GSI was already manually deleted.
3
Perform another stack update using the original template that includes the GSI configuration.
CloudFormation detects the difference between the current stack state (no GSI) and the target template (with GSI), and provisions the GSI on the DynamoDB table.
This forces CloudFormation to physically create the GSI on the DynamoDB table, restoring the resource to the desired configuration.

Key Concept

CloudFormation drift remediation via stack updates requires establishing a baseline by matching the template to the drifted state before re-applying the desired configuration, as CloudFormation compares template versions rather than directly querying live resource states.
Question 513Question →

A developer is troubleshooting an Amazon EC2 instance that has a public IPv4 address but cannot access the internet to download updates. The security groups and network ACLs are configured to allow all outbound traffic. What is the most likely cause of this connectivity failure?

Show answer & explanation

Answer: The route table associated with the subnet does not contain a route for 0.0.0.0/0 pointing to the VPC's Internet Gateway.

Answer

The route table associated with the subnet does not contain a route for 0.0.0.0/0 pointing to the VPC's Internet Gateway.
For an EC2 instance with a public IP address to access the internet, the subnet in which it is launched must be configured as a public subnet. This requires a route table entry that sends all internet-bound traffic (0.0.0.0/0) to the VPC's attached Internet Gateway.

Step-by-Step Solution

1
Analyze the requirements for public internet connectivity for an EC2 instance.
The instance needs a public IP address, and its subnet's route table must route internet traffic (0.0.0.0/0) to an Internet Gateway (IGW).
Security groups and network ACLs are already configured to allow outbound traffic, so the issue points to a routing layer configuration.
2
Evaluate the route table configurations.
A missing route for 0.0.0.0/0 pointing to the IGW is the most common reason why an instance with a public IP in a subnet cannot reach the internet.
Without this route, the VPC router does not know where to send traffic destined for external internet addresses.

Key Concept

VPC Route Tables and Internet Gateway Routing
Question 514Question →

An organization hosts a web application on Amazon EC2 instances in Subnet A (172.16.1.0/24172.16.1.0/24). The application uses an Amazon ElastiCache for Redis cluster in Subnet B (172.16.2.0/24172.16.2.0/24) to cache session data.

Subnet A and Subnet B are associated with custom Network Access Control Lists (NACLs): NACL-A and NACL-B, respectively.

The EC2 instances and the Redis cluster are configured with security groups that allow traffic on TCP port 63796379. However, the application instances are experiencing connection timeouts when trying to write to the Redis cluster.

A SysOps Administrator reviews the custom NACL configurations:

NACL-A (Associated with Subnet A):
- Inbound: Rule 100100 | Protocol: TCP | Port Range: 10241024-6553565535 | Source: 172.16.2.0/24172.16.2.0/24 | ALLOW
- Outbound: Rule 100100 | Protocol: TCP | Port Range: 63796379 | Destination: 172.16.2.0/24172.16.2.0/24 | ALLOW

NACL-B (Associated with Subnet B):
- Inbound: Rule 100100 | Protocol: TCP | Port Range: 63796379 | Source: 172.16.1.0/24172.16.1.0/24 | ALLOW
- Outbound: Rule 100100 | Protocol: TCP | Port Range: 63796379 | Destination: 172.16.1.0/24172.16.1.0/24 | ALLOW

Which configuration change must the administrator make to resolve this connection issue?

Show answer & explanation

Answer: In NACL-B, modify the outbound rule to allow TCP traffic on port range 10241024-6553565535 to destination 172.16.1.0/24172.16.1.0/24.

Answer

Modify the outbound rule of NACL-B (associated with Subnet B) to allow TCP traffic on port range 10241024-6553565535 to destination 172.16.1.0/24172.16.1.0/24.
The correct configuration change is to modify the outbound rule of NACL-B (associated with Subnet B) to allow TCP traffic on port range 10241024-6553565535 to destination 172.16.1.0/24172.16.1.0/24. Network ACLs are stateless, which means response traffic must be explicitly allowed. Since application instances in Subnet A initiate the connection to the Redis port 63796379 from random ephemeral ports (10241024-6553565535), the return traffic sent by the Redis cluster from its local port 63796379 must be allowed to travel back to the client's destination ephemeral ports in Subnet A. Configuring NACL-B's outbound rule to only allow destination port 63796379 blocks this return traffic.

Step-by-Step Solution

1
Identify the client and server roles in the network communication flow.
EC2 instances in Subnet A (172.16.1.0/24172.16.1.0/24) act as clients, and the Redis cluster in Subnet B (172.16.2.0/24172.16.2.0/24) acts as the server.
This establishes the direction of initial requests and return traffic.
2
Trace the destination and source ports for both inbound and outbound directions.
Outbound requests go from Subnet A ephemeral ports (10241024-6553565535) to Subnet B port 63796379. Inbound responses go from Subnet B port 63796379 to Subnet A ephemeral ports (10241024-6553565535).
Network ACLs are stateless, meaning separate rules are required for both directions.
3
Evaluate the current NACL rules against the traced traffic flow.
NACL-B's outbound rule incorrectly limits return traffic to destination port 63796379, blocking the return traffic heading to the client's ephemeral ports in Subnet A.
This identifies the exact rule preventing successful network transmission.
4
Determine the correct modification to resolve the block.
Modify NACL-B's outbound rule to allow TCP traffic on port range 10241024-6553565535 to Subnet A.
This permits the stateless response packets to reach the client instances.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit rules for both request and response traffic, necessitating the inclusion of client ephemeral ports for return traffic.
Question 515Question →

An application server running on an Amazon EC2 instance in a private subnet is unable to retrieve software updates from the internet. A SysOps administrator needs to troubleshoot this connectivity issue.

Which of the following configurations are required to resolve this problem? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A NAT gateway deployed and running in a public subnet within the VPC; A route in the private subnet's route table that directs 0.0.0.0/0 traffic to the NAT gateway

Answer

The correct configurations are deploying a NAT gateway in a public subnet and adding a route in the private subnet's route table that directs 0.0.0.0/0 traffic to the NAT gateway.
For an EC2 instance in a private subnet to access the internet, outbound traffic must be routed to a NAT gateway located in a public subnet. The NAT gateway performs source network address translation and forwards the traffic to the Internet Gateway. Thus, the solution requires both a NAT gateway in a public subnet and a route directing internet-bound traffic (0.0.0.0/0) to that NAT gateway.

Step-by-Step Solution

1
Identify that the instance is in a private subnet and requires outbound-only internet connectivity for updates.
The solution must use network address translation since private instances lack public IP addresses.
Private subnets cannot directly route traffic to an Internet Gateway.
2
Deploy a NAT Gateway in a public subnet of the same VPC.
The NAT Gateway will have a public IP address and a route to the Internet Gateway, enabling it to perform NAT for private instances.
NAT gateways must reside in public subnets to communicate with the internet.
3
Modify the route table associated with the private subnet to add a route for 0.0.0.0/0 with the target as the NAT Gateway.
All outbound internet traffic from the private subnet is successfully routed through the NAT Gateway.
Subnets require explicit routing table entries to direct outbound traffic to the NAT gateway.

Key Concept

NAT Gateway and Routing Configuration for Private Subnets
Question 516Question →

A SysOps Administrator is troubleshooting an access issue where an application running on an Amazon EC2 instance cannot decrypt data using an AWS KMS Customer Managed Key (CMK). The application uses an IAM role named AppExecutionRole. An IAM policy attached to this role allows the kms:Decrypt action on the CMK's Amazon Resource Name (ARN). However, the application continues to receive an AccessDenied error.

The CMK is configured with the following key policy:

{
"Version": "2012-10-17",
"Id": "key-policy-1",
"Statement": [
{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/AdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

Which of the following actions can the administrator take to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add a statement to the KMS key policy that grants the account's root user (arn:aws:iam::111122223333:root) permissions to perform kms:Decrypt and kms:DescribeKey actions.; Modify the KMS key policy to add a statement that explicitly grants the AppExecutionRole principal permissions to perform kms:Decrypt and kms:DescribeKey actions.

Answer

The administrator can resolve the issue by either adding a key policy statement that grants permissions to the account's root user (enabling IAM policy delegation) or explicitly granting the decryption permissions to the application role directly in the KMS key policy.
For Customer Managed Keys, access control is governed by the key policy. To allow a principal in the same account to use the key, the key policy must either explicitly grant the permission to that principal, or it must delegate permission management to IAM by granting the account's root principal (arn:aws:iam::111122223333:root) key permissions.

Step-by-Step Solution

1
Inspect the existing KMS key policy configuration.
The current KMS key policy only grants administrative rights to the AdminRole and does not delegate access to the account's IAM policies, nor does it explicitly authorize the application's role.
By default, Customer Managed Keys require explicit configuration in their key policy to allow usage; IAM policies alone cannot grant access without the key policy delegating authority.
2
Evaluate key policy delegation or direct authorization.
Authorizing the account's root principal in the key policy activates the attached IAM policy on the role. Alternatively, granting permissions directly to the role's principal in the key policy resolves the access restriction.
These represent the two valid access control paths for KMS key usage within the same AWS account.

Key Concept

KMS Key Policy Authorization and IAM Delegation
Question 517Question →

A SysOps Administrator is setting up an organization-wide trail in AWS CloudTrail to log API activity across all member accounts. The trail is configured to deliver logs to a centralized Amazon S3 bucket in a dedicated security account. The S3 bucket is encrypted using SSE-KMS with a customer managed key. The S3 bucket policy is already configured to allow the `cloudtrail.amazonaws.com` service principal to perform `s3:GetBucketAcl` and `s3:PutObject` actions. However, the Administrator notices that no log files are being delivered to the S3 bucket, and the CloudTrail console displays a log delivery error. Which action must the SysOps Administrator take to resolve this log delivery issue?

Show answer & explanation

Answer: Update the key policy of the customer managed KMS key in the security account to grant the `cloudtrail.amazonaws.com` service principal permissions to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions.

Answer

Update the key policy of the customer managed KMS key in the security account to grant the `cloudtrail.amazonaws.com` service principal permissions to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions.
To successfully deliver logs to an S3 bucket encrypted with a customer managed KMS key, the CloudTrail service principal (`cloudtrail.amazonaws.com`) must have explicit permission to use that key. This is done by modifying the KMS key policy to allow the service principal to perform the `kms:GenerateDataKey*` and `kms:DescribeKey` actions. Without this, CloudTrail cannot encrypt the logs, resulting in log delivery failure.

Step-by-Step Solution

1
Identify the root cause of the CloudTrail log delivery failure when using SSE-KMS encryption.
The failure occurs because CloudTrail lacks the required permissions to generate an encryption key using the customer managed KMS key.
When CloudTrail delivers logs to a bucket encrypted with SSE-KMS using a customer managed key, CloudTrail must be able to use that key to encrypt the logs before uploading them.
2
Verify where KMS key permissions must be declared.
KMS key permissions must be configured in the KMS key policy itself, as S3 bucket policies cannot govern KMS actions.
An S3 bucket policy only supports S3 API actions. Any KMS access control must be explicitly defined in the customer managed KMS key's key policy.
3
Identify the required KMS API permissions and the correct principal.
The CloudTrail service principal (`cloudtrail.amazonaws.com`) requires `kms:GenerateDataKey*` and `kms:DescribeKey` permissions.
CloudTrail uses `kms:GenerateDataKey*` to generate a unique data key for encrypting each log file, and `kms:DescribeKey` to check the key properties. Using the correct service principal ensures CloudTrail can execute these operations directly.

Key Concept

AWS CloudTrail SSE-KMS Encryption Key Policies
Question 518Question →

A SysOps administrator is attempting to create an AWS Step Functions state machine using the AWS CLI. The state machine needs to use an existing IAM execution role named StepFunctionsExecutionRole to perform its tasks. When running the creation command, the administrator receives an Access Denied error, despite having full administrator access to AWS Step Functions. To resolve this issue, which permission must be attached to the administrator's IAM user policy?

Show answer & explanation

Answer: An IAM policy statement that allows the iam:PassRole action on the StepFunctionsExecutionRole ARN.

Answer

The administrator's IAM user policy must include a statement that allows the iam:PassRole action on the StepFunctionsExecutionRole ARN.
To configure an AWS service to act on your behalf using an IAM role, your IAM identity must have permission to pass that role to the service. This is achieved by granting the iam:PassRole permission on the target role's Amazon Resource Name (ARN) in your user or group policy. Since the administrator is creating a state machine that runs under the StepFunctionsExecutionRole, the administrator must be allowed to pass this specific role to the Step Functions service.

Step-by-Step Solution

1
Analyze the error message and context.
The administrator is attempting to associate an existing IAM role with an AWS service (Step Functions) but is blocked by an Access Denied error despite having full Step Functions administrative access.
Associating a role with a service requires explicit permission to delegate or pass that role to the service.
2
Identify the correct IAM permission required to associate a role with a service.
The iam:PassRole permission is required on the IAM user/role attempting the configuration.
AWS prevents users from passing roles with higher privileges than their own unless they are explicitly authorized via iam:PassRole.
3
Determine the target resource and Action for the policy statement.
The Action must be iam:PassRole, and the Resource must be the ARN of the StepFunctionsExecutionRole.
This complies with the principle of least privilege by only allowing the administrator to pass the specific role required for the state machine.

Key Concept

IAM Role Delegation and the PassRole Permission
Question 519Question →

An application tier runs on Amazon EC2 instances in Subnet A (10.0.1.0/2410.0.1.0/24). A PostgreSQL database runs on an Amazon EC2 instance in Subnet B (10.0.2.0/2410.0.2.0/24). Both subnets are in the same VPC. The Security Group associated with the database instance allows inbound TCP traffic on port 54325432 from the security group of the application tier. Subnet A is associated with the default Network Access Control List (NACL), which allows all inbound and outbound traffic. Subnet B is associated with a custom NACL that contains only the default deny rules. Currently, the application instances are unable to connect to the database. Which of the following rules must be added to the Subnet B NACL to allow successful database connections from the application tier? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An inbound rule that allows TCP traffic on port 54325432 from source 10.0.1.0/2410.0.1.0/24; An outbound rule that allows TCP traffic on ports 1024−655351024-65535 to destination 10.0.1.0/2410.0.1.0/24

Answer

An inbound rule that allows TCP traffic on port 54325432 from source 10.0.1.0/2410.0.1.0/24, and an outbound rule that allows TCP traffic on ports 1024−655351024-65535 to destination 10.0.1.0/2410.0.1.0/24.
For a successful TCP connection to the PostgreSQL database, the Subnet B Network ACL must allow both the inbound connection request and the outbound response. The inbound rule must permit TCP traffic on the database port (54325432) from the application tier's subnet (10.0.1.0/2410.0.1.0/24). Because Network ACLs are stateless, the outbound response is not automatically allowed; a corresponding outbound rule must be created. This outbound rule must allow TCP traffic to destination 10.0.1.0/2410.0.1.0/24 on ports 1024−655351024-65535, which represents the ephemeral ports allocated by the client operating systems for the connection.

Step-by-Step Solution

1
Analyze the request flow path.
The application tier initiates a database request from Subnet A (10.0.1.0/2410.0.1.0/24) to the database in Subnet B (10.0.2.0/2410.0.2.0/24) on destination port 54325432.
An inbound rule on Subnet B's NACL must permit TCP port 54325432 from Subnet A's CIDR block to allow the connection request to reach the database instance.
2
Analyze the response flow path and identify client port allocation.
The client OS in Subnet A allocates a random source port from the ephemeral range (1024−655351024-65535) for the connection request. The database returns traffic to this destination port.
Network ACLs are stateless. Therefore, the response traffic from Subnet B to Subnet A is not tracked or automatically allowed, requiring an outbound rule.
3
Configure the outbound NACL rule for Subnet B.
An outbound rule allowing TCP traffic on ports 1024−655351024-65535 to destination 10.0.1.0/2410.0.1.0/24 is required.
This outbound rule ensures the database server can respond to the ephemeral ports of the application instances in Subnet A.

Key Concept

Stateless Network ACL configuration requires explicitly allowing both request and response traffic, accounting for target service ports inbound and ephemeral client ports outbound.
Question 520Question →

An organization uses an AWS CloudFormation stack to manage its network infrastructure. A SysOps Administrator runs drift detection on the stack and identifies that a security group has a status of MODIFIED because a developer manually added an inbound rule allowing TCP port 3389. The administrator wants to resolve this drift so that the security group's actual configuration matches the expected configuration defined in the CloudFormation template.

Which action should the administrator take to remediate the drift?

Show answer & explanation

Answer: Manually delete the inbound rule allowing TCP port 3389 from the security group using the Amazon EC2 console or the AWS CLI.

Answer

Manually delete the inbound rule allowing TCP port 3389 from the security group using the Amazon EC2 console or the AWS CLI.
To resolve drift and align the resource back to the template's expected state, the out-of-band changes must be manually reverted (e.g., deleting the manually added security group rule). CloudFormation does not provide an automated tool to revert drifted configurations back to their template-defined state.

Step-by-Step Solution

1
Identify the drifted resource and the specific parameters that are drifted from the template.
The security group is identified as MODIFIED due to the manual addition of the inbound rule for TCP port 3389.
Understanding the exact nature of the drift is necessary to determine the required remediation steps.
2
Determine the target state for the resource (in this case, returning it to the template's expected state).
The target state is the configuration defined in the original template, which does not include the TCP port 3389 inbound rule.
Remediating drift to match the template requires removing out-of-band changes.
3
Manually remove the out-of-band configuration directly on the resource.
The inbound rule for TCP port 3389 is deleted from the security group via the EC2 console or CLI, resolving the drift.
CloudFormation does not automate the rollback of drifted resources, requiring manual intervention to sync back to the template.

Key Concept

AWS CloudFormation Drift Remediation
Estimated Time:1m 30s
PreviousPage 26 / 49Next
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin