All practice questions

976 questions

All types976 Multiple choice502 Multiple select450 Ordering24

A company has a compliance requirement to retain all system logs for exactly 90 days. A SysOps Administrator is auditing the current logging configuration and discovers several Amazon CloudWatch log groups with their retention periods set to 'Never expire'. The administrator wants to ensure that all current and future logs in these log groups are deleted after 90 days. Which action should the administrator take to meet this requirement?

Modify the retention settings directly on each CloudWatch log group to 90 days.

Modify the retention settings on each individual log stream within the log groups to 90 days.

Create an Amazon EventBridge rule that triggers an AWS Systems Manager Automation document to scan and delete log streams older than 90 days.

Apply an Amazon S3 Lifecycle policy with an expiration rule of 90 days directly to the CloudWatch log groups.

Show answer & explanation

Answer: Modify the retention settings directly on each CloudWatch log group to 90 days.

Answer

Modify the retention settings directly on each CloudWatch log group to 90 days.

Modifying the retention settings at the log group level is the standard and most efficient way to manage log expiration in Amazon CloudWatch. CloudWatch Logs automatically deletes log events older than the specified retention period for all streams within that log group.

Step-by-Step Solution

Identify the level at which retention policies are configured in Amazon CloudWatch Logs.

Confirm that retention policies can only be configured at the log group level, not the individual log stream level.

This determines where the configuration change must be applied.

Evaluate the native capabilities of CloudWatch Logs compared to external automation tools.

Understand that CloudWatch Logs natively supports automatic deletion of expired log events based on the log group's retention configuration.

This helps select the solution with the least administrative effort and operational complexity.

Apply the 90-day retention setting directly to the target CloudWatch log groups.

All existing and future log streams within these log groups will inherit the 90-day retention policy, satisfying the compliance requirement.

This implements the required configuration to resolve the issue.

Key Concept

CloudWatch Logs retention policy configuration

Question 582Question →

A SysOps Administrator is troubleshooting a connectivity issue where Amazon EC2 instances in a private subnet ( $10.0.1.0/24$ ) are incurring high data transfer charges when downloading large datasets from Amazon S3. The administrator discovers that the traffic is currently routed through a NAT Gateway. To resolve this and keep the traffic private, the administrator creates a Gateway VPC Endpoint for Amazon S3 in the VPC. However, the EC2 instances continue to route traffic to S3 through the NAT Gateway. Which of the following configuration steps must the administrator take to ensure the S3 traffic is routed through the Gateway VPC Endpoint? (Select TWO.)

Select all that apply

Associate the private subnet's route table with the S3 Gateway VPC Endpoint.

Verify that the outbound rules of the security group attached to the EC2 instances allow traffic to the Amazon S3 prefix list.

Add a static route to the private subnet's route table for the Amazon S3 DNS endpoint targeting the Internet Gateway (IGW).

Enable private DNS hostnames on the Amazon S3 Gateway VPC Endpoint.

Update the public subnet's route table to route traffic destined for the S3 prefix list through the NAT Gateway.

Show answer & explanation

Answer: Associate the private subnet's route table with the S3 Gateway VPC Endpoint.; Verify that the outbound rules of the security group attached to the EC2 instances allow traffic to the Amazon S3 prefix list.

Answer

To resolve the routing issue, the administrator must associate the private subnet's route table with the S3 Gateway VPC Endpoint and verify that the outbound rules of the security group attached to the EC2 instances allow traffic to the Amazon S3 prefix list.

The correct options are associating the private subnet's route table with the S3 Gateway VPC Endpoint and verifying that the outbound rules of the security group attached to the EC2 instances allow traffic to the Amazon S3 prefix list. Route table association is required because AWS automatically adds a route pointing to the VPC endpoint with the destination set to the S3 prefix list. Stateful security groups must also explicitly allow outbound traffic to the S3 prefix list for the instances to successfully establish connections.

Step-by-Step Solution

Associate the private subnet's route table with the S3 Gateway VPC Endpoint.

AWS automatically injects a route into the subnet's route table with the destination set to the Amazon S3 prefix list (e.g., pl-xxxx) and the target pointing to the Gateway VPC Endpoint (e.g., vpce-xxxx).

This updates the VPC router to direct traffic destined for S3 to the gateway endpoint instead of the default route (

0.0.0.0/0

) pointing to the NAT Gateway.

Ensure the stateful security group associated with the EC2 instances allows outbound traffic to the S3 prefix list.

The security group authorizes egress traffic to S3 endpoints.

Security groups are stateful and evaluate outbound traffic rules. Even if the route table points to the gateway endpoint, the instance's security group must explicitly permit outbound traffic to the S3 IP prefix list.

Key Concept

Gateway VPC Endpoints use prefix-list routing in subnet route tables to direct traffic privately to AWS services like S3, and stateful security groups must permit the outbound connection.

Question 583Question →

A company has recently added a new business unit to their AWS Organization as a member account. A SysOps Administrator is tasked with configuring cost monitoring for this specific account. The administrator needs to identify unexpected cost spikes that deviate from historical trends using machine learning and send immediate email alerts to the operations team. Additionally, the administrator must view a projection of the member account's total costs for the next three months. Which two actions should the SysOps Administrator take to meet these requirements? (Select two.)

Select all that apply

Create a Linked Account monitor in AWS Cost Anomaly Detection for the member account, and associate it with an alert subscription targeting the operations email address.

Open AWS Cost Explorer, apply a filter for the new member account, and run a forecast with a three-month prediction interval.

Configure a monthly cost budget in AWS Budgets for the member account, and define an alert threshold based on forecasted costs to notify the operations email.

Apply a custom 'BusinessUnit' tag to the resources in the member account, create a Cost Allocation Tag monitor in AWS Cost Anomaly Detection, and configure email alerting.

Configure an Amazon EventBridge rule that detects AWS Config evaluation changes for cost compliance, and trigger an AWS Systems Manager Automation runbook to send emails.

Show answer & explanation

Answer: Create a Linked Account monitor in AWS Cost Anomaly Detection for the member account, and associate it with an alert subscription targeting the operations email address.; Open AWS Cost Explorer, apply a filter for the new member account, and run a forecast with a three-month prediction interval.

Answer

Create a Linked Account monitor in AWS Cost Anomaly Detection for the member account, associate it with an alert subscription targeting the operations email address, and run a forecast in AWS Cost Explorer filtered by the new member account.

To detect machine learning-driven anomalies for a specific member account, a Linked Account monitor must be configured in AWS Cost Anomaly Detection along with an alert subscription. To project future costs for the next three months, AWS Cost Explorer's forecasting feature must be used with a filter applied to the specific member account. These two actions address both monitoring and forecasting requirements accurately.

Step-by-Step Solution

Navigate to the AWS Cost Anomaly Detection console and create a new monitor.

A Linked Account monitor is configured specifically for the target member account.

This establishes machine learning-driven anomaly detection on the account level to identify unexpected spend spikes.

Configure an alert subscription for the newly created Cost Anomaly monitor.

An alert subscription is linked to the monitor with the operations email address as the recipient.

This ensures the operations team receives immediate notifications when an anomaly exceeding the threshold is detected.

Navigate to AWS Cost Explorer, filter by the new member account, and select the Forecast option.

A projection graph showing the estimated total costs for the next three months is rendered.

This fulfills the requirement to view a three-month cost projection for the member account.

Key Concept

Using AWS Cost Anomaly Detection for machine learning-driven spend alerting alongside AWS Cost Explorer for future spend forecasting.

Question 584Question →

A SysOps Administrator in Account A is attempting to create an Amazon Elastic Block Store (EBS) volume from an encrypted EBS snapshot shared by Account B. The snapshot was encrypted using the default AWS managed key (aws/ebs) in Account B. The administrator's IAM user in Account A has full administrator permissions (AdministratorAccess), but the attempt to create the volume fails with an access denied error. Which of the following actions must be taken to successfully create the EBS volume in Account A? (Select TWO.)

Select all that apply

In Account B, copy the snapshot and encrypt the copy using a customer managed KMS key.

In Account B, update the key policy of the new customer managed KMS key to grant Account A permissions to perform the kms:Decrypt and kms:CreateGrant actions.

In Account B, modify the key policy of the default AWS managed key (aws/ebs) to grant Account A access to use the key.

In Account A, attach an IAM policy to the administrator's IAM user that allows the kms:Decrypt and kms:CreateGrant actions on the default AWS managed key in Account B.

In Account A, use the AWS CLI to copy the shared snapshot to Account A, specifying a customer managed KMS key in Account A as the target key.

Show answer & explanation

Answer: In Account B, copy the snapshot and encrypt the copy using a customer managed KMS key.; In Account B, update the key policy of the new customer managed KMS key to grant Account A permissions to perform the kms:Decrypt and kms:CreateGrant actions.

Answer

To resolve the issue, the snapshot in Account B must be copied and encrypted with a customer managed KMS key. Then, the key policy of that customer managed key in Account B must be updated to grant Account A permissions to perform kms:Decrypt and kms:CreateGrant actions.

Because AWS managed KMS keys cannot be shared across accounts, the snapshot must first be copied in Account B and encrypted using a customer managed KMS key. Once encrypted with a customer managed key, the key policy must be updated to grant Account A access. Specifically, the key policy must allow the kms:Decrypt action to read the snapshot data, and the kms:CreateGrant action to allow the EC2 service in Account A to attach the resulting volume.

Step-by-Step Solution

Identify the key type used to encrypt the source snapshot.

The snapshot is encrypted with the default AWS managed key (aws/ebs).

AWS managed keys cannot be shared across accounts, meaning the snapshot cannot be decrypted by Account A in its current state.

Re-encrypt the snapshot with a shareable key in the source account.

A copy of the snapshot is created in Account B, encrypted with a customer managed KMS key.

Customer managed KMS keys support key policy modifications, enabling cross-account sharing.

Configure cross-account permissions on the customer managed KMS key.

The KMS key policy in Account B is updated to allow Account A permissions to decrypt and create grants.

Account A needs kms:Decrypt to read the snapshot data and kms:CreateGrant because the Amazon EC2 service in Account A must create a cryptographic grant to attach the volume.

Key Concept

AWS managed keys cannot be shared across accounts. For cross-account resource sharing (such as EBS snapshots or RDS backups), the resource must be encrypted with a customer managed KMS key, and the key policy must grant permissions (including kms:CreateGrant for EBS/EC2) to the target account.

Question 585Question →

A SysOps Administrator is configuring a customer managed KMS key in an AWS account to encrypt sensitive application logs. The administrator attaches an IAM policy to a developer's IAM role that grants `kms:Decrypt` and `kms:GenerateDataKey` permissions for the KMS key. However, when the developer attempts to read the encrypted logs, they receive an 'AccessDenied' error. The administrator inspects the KMS key policy, which contains the following statement:

{
"Version": "2012-10-17",
"Id": "key-default-1",
"Statement": [
{
"Sid": "Allow administration of the key",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/AdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

Which action will resolve this issue and allow the developer to access the logs?

Modify the KMS key policy to grant the AWS account root principal (`arn:aws:iam::123456789012:root`) permissions to perform KMS actions, enabling the IAM policy attached to the developer's role to take effect.

Add the `kms:Decrypt` and `kms:GenerateDataKey` permissions directly to the log storage resource's bucket policy, which overrides the KMS key policy.

Modify the developer's IAM policy to include the `kms:DescribeKey` permission, as IAM policies automatically override KMS key policies when administrative access is configured.

Create a resource-based IAM policy, attach it directly to the KMS key, and enable automatic key rotation to sync permissions across the account.

Show answer & explanation

Answer: Modify the KMS key policy to grant the AWS account root principal (`arn:aws:iam::123456789012:root`) permissions to perform KMS actions, enabling the IAM policy attached to the developer's role to take effect.

Answer

The correct answer is to modify the KMS key policy to grant the AWS account root principal (`arn:aws:iam::123456789012:root`) permissions to perform KMS actions. This enables IAM policies in the account to delegate permissions. Without this delegation statement in the key policy, IAM policies attached to users or roles have no authority to grant access to the KMS key.

Step-by-Step Solution

Analyze the KMS key policy and identify the missing statement for IAM policy delegation.

The current key policy only grants access to `AdminRole` and does not grant access to the account root principal.

Without delegating permissions to the account root principal, IAM policies attached to users or roles in that account cannot grant key access.

Add the root principal statement to the KMS key policy.

The key policy now permits IAM-based access control.

This delegates the evaluation of key access permissions to the account's IAM policies.

Verify that the developer's IAM policy has the correct permissions.

The developer's IAM policy already contains `kms:Decrypt` and `kms:GenerateDataKey` permissions.

Once delegation is enabled in the key policy, the existing IAM policy will allow successful decryption of logs.

Key Concept

KMS key policy delegation to IAM policies via the account root principal

Question 586Question →

A SysOps administrator has deployed an Application Load Balancer (ALB) to distribute traffic to a fleet of Amazon EC2 instances in a private subnet. The web application listens on TCP port 5000. The target group is configured to perform HTTP health checks on port 5000 with the path `/ping`. However, all EC2 instances are showing an `Unhealthy` status with the reason `Health check target response code mismatch [404]`. Upon checking the application server logs, the administrator finds that the application's health endpoint is actually mapped to `/status` on TCP port 5000, and HTTP GET requests to `/ping` return a `404 Not Found` error. Additionally, the instance security group allows inbound traffic only from the ALB's security group on TCP port 443.

Which two changes must the SysOps administrator make to resolve the health check issues and allow the instances to pass health checks? (Select two.)

Select all that apply

Update the target group health check path to /status.

Update the instance security group to allow inbound TCP traffic on port 5000 from the ALB security group.

Change the target group health check port to 443.

Configure an Amazon Route 53 active-passive failover routing policy to bypass the load balancer.

Add a new rule to the Network ACL of the private subnet to allow inbound traffic on TCP port 443 from the public subnet.

Show answer & explanation

Answer: Update the target group health check path to /status.; Update the instance security group to allow inbound TCP traffic on port 5000 from the ALB security group.

Answer

To resolve the health check issues, the SysOps administrator must update the target group health check path to /status and update the instance security group to allow inbound TCP traffic on port 5000 from the ALB security group.

The Application Load Balancer requires both a correct health check endpoint and permissions to reach the target instances on the application port. Since the endpoint is mapped to /status and the application runs on port 5000, updating the path to /status and opening port 5000 on the instance security group allows the ALB health checks to succeed.

Step-by-Step Solution

Analyze the HTTP response code returned by the health check.

The target group shows a 404 response code for the path /ping, indicating the path does not exist on the application server.

Correcting the path to the actual endpoint (/status) is necessary for the health check to find the resource and return a successful 200 OK status.

Check the security group rules of the EC2 instances.

The instances only permit inbound traffic on port 443 from the ALB, blocking requests on the application port 5000.

Since the ALB is configured to send traffic and health checks to port 5000, the security group rules must be updated to allow inbound TCP traffic on port 5000 from the ALB security group.

Key Concept

Successful Application Load Balancer health checks require the correct health check path and permission for the load balancer to access the target group's port in the instance's security group.

Estimated Time:2m 0s

Question 587Question →

During a security review, an organization requires a SysOps administrator to confirm that all AWS CloudTrail logs stored in a centralized Amazon S3 bucket remain untampered. Although log file integrity validation is active, the administrator must run a manual check to verify the authenticity of the logs delivered over the past week. Which action should the administrator take to perform this verification?

Execute the aws cloudtrail validate-logs command via the AWS CLI to cryptographically verify the signatures of the log files against the digest files.

Query the S3 bucket access logs using Amazon Athena to identify any PUT or DELETE operations that occurred on the log files.

Configure an Amazon EventBridge rule to trace API activity and trigger a Systems Manager Automation runbook to compare the S3 object metadata.

Change the CloudTrail log group settings in Amazon CloudWatch Logs to verify the cryptographic checksum of the streamed log events.

Show answer & explanation

Answer: Execute the aws cloudtrail validate-logs command via the AWS CLI to cryptographically verify the signatures of the log files against the digest files.

Answer

Execute the aws cloudtrail validate-logs command via the AWS CLI to cryptographically verify the signatures of the log files against the digest files.

The correct action is to run the validate-logs command from the AWS CLI. When log file integrity validation is enabled, CloudTrail creates digest files every hour containing the hash of each log file and a digital signature. The command automatically downloads these digests and the corresponding log files, recalculates the hashes, and validates the digital signatures to ensure that the logs have not been tampered with or deleted since creation.

Step-by-Step Solution

Identify the requirement to manually verify the integrity of CloudTrail log files stored in an S3 bucket.

The trail has log file integrity validation enabled, which generates digest files containing hashes of the log files.

Log file integrity validation creates signature digest files that are signed using private keys, allowing authentication of the logs.

Determine the appropriate AWS tool or command to perform the verification.

The AWS CLI provides the validate-logs command.

This command downloads the digest files and log files, verifies the signatures, and checks the SHA-256 hashes to detect any tampering or deletion.

Key Concept

CloudTrail Log File Integrity Validation

Question 588Question →

A SysOps Administrator is managing an Amazon S3 bucket containing millions of objects encrypted using Server-Side Encryption with AWS KMS keys (SSE-KMS). Due to a high volume of read and write requests to the bucket, the organization has noticed a significant increase in AWS KMS API costs. The administrator needs to reduce these KMS API charges with minimal operational overhead. Which action should the administrator take to meet this requirement?

Enable S3 Bucket Keys on the S3 bucket configuration.

Configure a KMS grant for the Amazon S3 service principal that authorizes the GenerateDataKey and Decrypt actions with a custom duration constraint.

Create an S3 Lifecycle rule to transition the objects to Amazon S3 Glacier Instant Retrieval after 1 day.

Enable detailed monitoring for S3 request metrics and configure an Auto Scaling cooldown period to throttle request rates during peak hours.

Show answer & explanation

Answer: Enable S3 Bucket Keys on the S3 bucket configuration.

Answer

Enable S3 Bucket Keys on the S3 bucket configuration.

The correct answer is to enable S3 Bucket Keys. S3 Bucket Keys decrease the request traffic from Amazon S3 to AWS KMS by creating a bucket-level key that is used to derive unique data keys for objects. This reduces the KMS API call volume for GenerateDataKey and Decrypt by up to 99 percent, directly reducing costs with a simple bucket setting change.

Step-by-Step Solution

Analyze the cause of high AWS KMS API costs in the S3 bucket configuration.

The costs are driven by S3 making KMS API calls (GenerateDataKey and Decrypt) for every single read and write request when using standard SSE-KMS.

Understanding the source of the API calls is necessary to identify how to reduce them.

Evaluate S3 features designed to minimize KMS interactions.

S3 Bucket Keys create a bucket-level key generated by KMS. S3 uses this bucket-level key to encrypt and decrypt object-level keys locally within S3.

Caching the key within S3 reduces the frequency of outbound API calls from S3 to KMS.

Select the option that configures this optimization with minimal operational effort.

Enabling S3 Bucket Keys directly in the S3 bucket settings achieves this without policy or application modifications.

This is the native, AWS-recommended mechanism for S3 KMS cost reduction.

Key Concept

S3 Bucket Keys reduce KMS API costs by caching a bucket-level key within the S3 service, decreasing call volume to KMS.

Question 589Question →

A company runs a specialized API service on Amazon EC2 instances. The API service listens on port 8080. A SysOps Administrator configures an Application Load Balancer (ALB) with a target group that routes traffic to these instances on port 8080. The target group health check is configured with the protocol HTTP, the path `/health`, and the port explicitly set to 80. The security group associated with the EC2 instances allows inbound traffic from the ALB on port 8080. However, all EC2 instances in the target group are reported as unhealthy with the status reason `HealthCheck.Failed`. Which action should the administrator take to resolve this health check issue?

Modify the target group health check configuration to use the traffic-port or port 8080.

Add a rule to the security group of the EC2 instances to allow inbound traffic on port 80 from the ALB.

Update the target group health check path to `/` and change the protocol to HTTPS.

Configure an Amazon Route 53 failover routing policy to redirect health check traffic to a backup target group.

Show answer & explanation

Answer: Modify the target group health check configuration to use the traffic-port or port 8080.

Answer

Modify the target group health check configuration to use the traffic-port or port 8080.

The correct action is to modify the target group health check configuration to use the traffic-port or port 8080. By default, target group health checks are sent to the port on which the targets are registered (the traffic-port). Because the health check port was explicitly overridden to port 80 where no service is listening, the health checks failed. Reverting the health check port to the traffic-port (port 8080) aligns the health checks with the active application port.

Step-by-Step Solution

Analyze the application listening port and security group settings.

The application listens on port 8080, and the security group allows inbound traffic from the ALB on port 8080.

This establishes that port 8080 is the correct path and port for network traffic to reach the application.

Identify the misconfiguration in the health check settings.

The health check port is explicitly configured as port 80, which is neither open in the security group nor has any service listening on it on the EC2 instances.

This explains why the health checks are failing with `HealthCheck.Failed`.

Select the resolution that aligns the health check port with the active application port.

Updating the health check port to use the traffic-port (port 8080) aligns the health check destination with the active port of the application.

This allows the ALB to successfully connect to the service on port 8080 and receive a valid health response.

Key Concept

Elastic Load Balancing target groups perform health checks on registered targets. The health check port must align with the port where the backend service is actively listening, and the targets' security groups must permit inbound traffic on that health check port.

Question 590Question →

A company hosts a web application on Amazon EC2 instances in private subnets. The instances are registered with a target group of an Application Load Balancer (ALB) and are configured to listen on port 8080. A SysOps Administrator notices that the target group shows all registered instances as unhealthy with the status code HealthCodeMismatch. The Administrator verifies that the application is running and accessible locally on port 8080 on each instance, but the target group's health check is currently configured to use port 80 and the HTTP protocol. At the same time, the team reports that Amazon Route 53 failover is not triggering to the secondary disaster recovery region even when all primary ALB targets are unhealthy. Which two actions should the SysOps Administrator take to resolve these issues? (Select TWO.)

Select all that apply

Modify the target group's health check configuration to use port 8080 or the traffic port instead of port 80.

Set the 'Evaluate Target Health' parameter to 'Yes' on the Route 53 alias record pointing to the Application Load Balancer.

Change the Route 53 routing policy to a simple routing policy and manually define a secondary failover IP address.

Update the target group health check configuration to point to the local loopback address (127.0.0.1) on port 80.

Configure the private subnets' Network Access Control List (NACL) to deny outbound traffic on ephemeral ports to the ALB.

Show answer & explanation

Answer: Modify the target group's health check configuration to use port 8080 or the traffic port instead of port 80.; Set the 'Evaluate Target Health' parameter to 'Yes' on the Route 53 alias record pointing to the Application Load Balancer.

Answer

Modify the target group's health check configuration to use port 8080 or the traffic port instead of port 80, and set the 'Evaluate Target Health' parameter to 'Yes' on the Route 53 alias record pointing to the Application Load Balancer.

To resolve the target group health check failures, the target group's health check port must match the port where the application is listening (port 8080 or the 'traffic-port'). To enable automatic Route 53 DNS failover when target instances become unhealthy, the Route 53 alias record pointing to the Application Load Balancer must have the 'Evaluate Target Health' setting enabled (set to Yes). This allows Route 53 to check the health status of the ALB and its registered targets before routing DNS traffic.

Step-by-Step Solution

Address the target group health check failure.

The target group's health check configuration is updated from port 80 to port 8080 (or the traffic-port) to align with the application listening port.

Since the application listens on port 8080 and nothing is running on port 80, health check queries sent to port 80 will fail. Updating this configuration allows the load balancer to reach the application.

Configure Route 53 DNS failover.

The 'Evaluate Target Health' parameter is enabled (set to Yes) on the Route 53 alias record pointing to the primary ALB.

By default, Route 53 does not check target health for alias records unless 'Evaluate Target Health' is set to Yes. Without this, Route 53 will continue routing traffic to the primary ALB even if all backend instances are unhealthy.

Key Concept

Elastic Load Balancing Health Checks and Route 53 Failover Integration

Estimated Time:2m 0s

Question 591Question →

A company requires a real-time security monitoring and alerting solution to detect when any IAM user logs in to the AWS Management Console without using Multi-Factor Authentication (MFA). A SysOps Administrator must configure a solution that sends an email notification to the security team immediately upon detection.

Which two actions must the SysOps Administrator perform to meet these requirements?

Select all that apply

Create an Amazon EventBridge rule in the us-east-1 Region with an event pattern that matches the source aws.signin, the event name ConsoleLogin, and additionalEventData.MFAUsed set to No.

Configure the Amazon EventBridge rule to target an Amazon SNS topic that is subscribed to by the security team.

Create the Amazon EventBridge rule in the company's primary operational Region to capture regional ConsoleLogin events.

Enable CloudWatch detailed monitoring for the IAM service to increase metric granularity and capture authentication events.

Configure an AWS Config custom rule to monitor ConsoleLogin API calls and set the rule's remediation action to publish directly to the SNS topic.

Show answer & explanation

Answer: Create an Amazon EventBridge rule in the us-east-1 Region with an event pattern that matches the source aws.signin, the event name ConsoleLogin, and additionalEventData.MFAUsed set to No.; Configure the Amazon EventBridge rule to target an Amazon SNS topic that is subscribed to by the security team.

Answer

Creating an Amazon EventBridge rule in the us-east-1 Region that matches the ConsoleLogin event with MFAUsed set to No, and configuring the EventBridge rule to target an Amazon SNS topic subscribed to by the security team.

Console login is a global AWS service event, which is always routed to the default EventBridge event bus in the us-east-1 Region. To capture sign-in events without MFA, the EventBridge rule must be created in us-east-1 with a pattern matching ConsoleLogin where MFAUsed is set to No. The rule must target an Amazon SNS topic to immediately notify the security team.

Step-by-Step Solution

Identify the regional scope for AWS console sign-in events.

Console sign-in events are global and are processed in the us-east-1 Region.

Global service events logged by CloudTrail are sent to the default EventBridge event bus in us-east-1, meaning EventBridge rules for these events must reside there.

Create the EventBridge pattern to capture console logins without MFA.

Configure a rule matching the source 'aws.signin', event name 'ConsoleLogin', and 'additionalEventData.MFAUsed' set to 'No'.

This specific pattern filters the event stream to identify only insecure console logins.

Route the matching events to the security team.

Target the EventBridge rule to an Amazon SNS topic.

This allows immediate delivery of alerts to the email addresses subscribed to the SNS topic.

Key Concept

Monitoring global authentication events using Amazon EventBridge in the us-east-1 Region and routing them to Amazon SNS for real-time alerting.

Question 592Question →

A company runs a CPU-bound data processing workload using an AWS Lambda function. The function is currently configured with 512 MB of memory and is experiencing execution delays, occasionally timing out. A SysOps Administrator reviews AWS Compute Optimizer, which flags the function as under-provisioned and recommends increasing the memory to 1024 MB. The administrator notes that the function's peak memory utilization is only 200 MB. Which action should the administrator take to resolve the performance bottleneck in a cost-effective manner?

Enable Amazon CloudWatch detailed monitoring to capture memory utilization metrics at 1-minute intervals before modifying the configuration.

Use AWS Cost Explorer to configure a cost anomaly detection alert for the Lambda function to automatically scale the memory when utilization spikes.

Increase the memory configuration of the Lambda function to 1024 MB to allocate more CPU power and decrease execution time.

Configure an AWS Config rule to trigger an AWS Systems Manager Automation document that automatically lowers the memory to 256 MB to match the active memory footprint.

Show answer & explanation

Answer: Increase the memory configuration of the Lambda function to 1024 MB to allocate more CPU power and decrease execution time.

Answer

Increase the memory configuration of the Lambda function to 1024 MB to allocate more CPU power and decrease execution time.

The correct option is to increase the memory configuration to 1024 MB. AWS Lambda allocates CPU power proportionally to the configured memory. Since the workload is CPU-bound, increasing the memory allocation will increase the CPU power available to the function, which significantly speeds up the execution and resolves timeouts. Often, this can also reduce the overall cost because the execution finishes much faster.

Step-by-Step Solution

Analyze the workload characteristics and identify the bottleneck.

The workload is CPU-bound, but the Lambda function is currently constrained by its CPU allocation, causing execution delays.

AWS Lambda allocates CPU power proportionally to the configured memory size. At 512 MB, the function has half the CPU share of a 1024 MB configuration.

Evaluate AWS Compute Optimizer recommendations.

AWS Compute Optimizer recommends increasing the memory to 1024 MB, despite the low actual memory footprint of 200 MB.

Compute Optimizer models the execution time and costs of the function across different memory sizes to find the optimal point where execution speed increases enough to justify the higher cost per millisecond.

Apply the right-sizing recommendation to the function configuration.

The Lambda function memory is updated to 1024 MB, which increases CPU capacity, speeds up execution, resolves the timeouts, and minimizes total cost.

By reducing the total duration of the CPU-bound task, the overall execution cost may remain similar or decrease, while ensuring performance compliance.

Key Concept

Proportional CPU allocation in AWS Lambda and right-sizing CPU-bound workloads via AWS Compute Optimizer

Estimated Time:1m 30s

Question 593Question →

An application running on an IAM role in Account A (999988887777) needs to read messages from an encrypted Amazon SQS queue in Account B (555544443333). The queue is encrypted using a customer managed KMS key in Account B. The administrator has attached the following IAM policy to the role in Account A:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSQSandKMS",
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"kms:Decrypt"
],
"Resource": [
"arn:aws:sqs:us-east-1:555544443333:TargetQueue",
"arn:aws:kms:us-east-1:555544443333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
]
}
]
}

The SQS queue policy in Account B allows the IAM role in Account A to perform SQS actions. The KMS key policy in Account B contains the following default statement:

{
"Version": "2012-10-17",
"Id": "key-default-1",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::555544443333:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

When the application in Account A attempts to read messages from the queue, it fails with a KMS access denied error. What must the administrator do to resolve this issue?

Modify the SQS queue policy in Account B to include the kms:Decrypt permission on the KMS key for the IAM role in Account A.

Create a new IAM policy in Account B that grants the IAM role in Account A permissions to decrypt using the KMS key.

Modify the KMS key policy in Account B to explicitly allow the IAM role in Account A to perform the kms:Decrypt action.

Rely on the existing configuration, as the default key policy statement delegates all decryption permissions to the IAM policies of any trusting account.

Show answer & explanation

Answer: Modify the KMS key policy in Account B to explicitly allow the IAM role in Account A to perform the kms:Decrypt action.

Answer

Modify the KMS key policy in Account B to explicitly allow the IAM role in Account A to perform the kms:Decrypt action.

For cross-account access to a customer managed KMS key, permissions must be granted on both sides: the external account's IAM policy and the owning account's KMS key policy. The default key policy statement ('Enable IAM User Permissions') only delegates authorization power to IAM policies within the same account (Account B). Therefore, to allow the IAM role in Account A to decrypt using the key, the key policy in Account B must be modified to explicitly grant the role permission to perform the kms:Decrypt action.

Step-by-Step Solution

Determine the decryption requirements for reading messages from an encrypted SQS queue.

The caller (IAM role in Account A) needs sqs:ReceiveMessage on the SQS queue and kms:Decrypt on the KMS key used to encrypt the queue.

Since the SQS queue is encrypted using server-side encryption (SSE-KMS) with a customer managed key, callers must possess decryption rights on that key to retrieve the plaintext message payload.

Examine the default KMS key policy's delegation boundary in Account B.

The default key policy statement only delegates authorization capabilities to IAM policies within Account B.

The statement referencing the root user of Account B enables IAM policies within Account B to define access to the key. It does not grant authorization capabilities to IAM policies defined in Account A.

Apply cross-account access control rules for KMS.

Modify the customer managed KMS key policy in Account B to explicitly grant kms:Decrypt permissions to the Account A IAM role.

For cross-account KMS access, the trust must be established on both sides: the caller's IAM policy must allow the action, and the KMS key policy in the owning account must explicitly grant permission to the external identity.

Key Concept

Cross-account KMS key access and key policy precedence

Question 594Question →

A SysOps administrator is managing an Application Load Balancer (ALB) that routes traffic to Amazon EC2 instances in a private subnet. The instances host a web application listening on TCP port 8080. The ALB's target group is configured to perform health checks on HTTP port 8080. All target instances recently transitioned to an Unhealthy status, and the ALB is returning HTTP 502 Bad Gateway errors to clients. Security group rules allow inbound port 8080 traffic to the instances from the ALB, and outbound traffic from the instances is unrestricted. A custom Network Access Control List (NACL) is applied to the instance subnet. The NACL's inbound rules allow TCP port 8080 from the ALB's subnet, but all outbound rules have been removed. Which configuration change will resolve this issue and restore the instances to a healthy state?

Add a rule to the subnet's Network ACL that allows outbound TCP traffic on ephemeral ports 1024-65535 to the ALB's subnet.

Change the target group's health check configuration to use HTTP port 80 instead of port 8080.

Modify the Route 53 record set for the application to use an active-passive failover routing policy.

Add a route targeting the Internet Gateway in the route table associated with the private subnet.

Show answer & explanation

Answer: Add a rule to the subnet's Network ACL that allows outbound TCP traffic on ephemeral ports 1024-65535 to the ALB's subnet.

Answer

Add an outbound rule to the subnet's Network Access Control List (NACL) that permits TCP traffic on ephemeral ports 1024-65535 to the Application Load Balancer's subnet.

Because Network ACLs are stateless, outbound traffic must be explicitly allowed. When the Application Load Balancer initiates a health check on port 8080, the instance responds using a destination port from the ephemeral port range (1024-65535). Since the outbound NACL rules were removed, this return traffic is dropped. Adding an outbound rule for the ephemeral port range to the ALB subnet allows the health check requests to be successfully completed.

Step-by-Step Solution

Analyze the components and rule behaviors.

The Security Groups are configured correctly, and the target group is configured to check the correct port (8080). The issue lies with the custom Network Access Control List (NACL) applied to the subnet of the EC2 instances.

Since security groups are stateful and NACLs are stateless, return traffic from a subnet must be explicitly allowed by the NACL outbound rules.

Determine the necessary traffic flow for the response.

The ALB initiates health check requests on TCP port 8080 (which is allowed by the inbound NACL rule). The response traffic from the EC2 instances back to the ALB will use the ALB's ephemeral port range.

Outbound NACL rules must permit the return traffic; otherwise, the load balancer will not receive the response, causing a health check timeout.

Identify the configuration change that allows the return traffic.

Adding an outbound NACL rule for TCP ports 1024-65535 to the ALB subnet allows the instances to complete the TCP handshake and respond to HTTP health checks.

This resolves the health check failures and restores the target status to healthy.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit rules for both inbound request traffic and outbound return traffic (ephemeral ports) to enable communication between the Application Load Balancer and target EC2 instances.

Question 595Question →

A SysOps administrator is troubleshooting an Application Load Balancer (ALB) that is serving a web application. The application runs on Amazon EC2 instances in private subnets and listens on port 8081. The target group is configured to route traffic to the instances on port 8081. However, the ALB is returning HTTP 503 Service Unavailable errors to clients, and all instances in the target group are reported as unhealthy with the status description 'Healthcheck.Failed'. The administrator verifies that the target group's health check is configured to perform HTTP checks on port 80. Which of the following actions should the administrator take to resolve this issue and restore the health of the targets? (Select TWO.)

Select all that apply

Update the security group of the EC2 instances to allow inbound TCP traffic on port 8081 from the security group associated with the ALB.

Modify the target group health check configuration to use port 8081 instead of port 80.

Update the security group of the ALB to allow inbound TCP traffic on port 80 from the EC2 instances' security group.

Modify the subnet's outbound network ACL (NACL) rules to allow traffic on port 80 to the Internet Gateway.

Create an active-passive Amazon Route 53 DNS failover routing policy to route traffic directly to the EC2 instances.

Show answer & explanation

Answer: Update the security group of the EC2 instances to allow inbound TCP traffic on port 8081 from the security group associated with the ALB.; Modify the target group health check configuration to use port 8081 instead of port 80.

Answer

Update the security group of the EC2 instances to allow inbound TCP traffic on port 8081 from the security group associated with the ALB, and modify the target group health check configuration to use port 8081 instead of port 80.

To resolve the health check failure, the health check port must be aligned with the application port, and the firewall rules must permit this path. Specifically, the target group's health check configuration must be modified to target port 8081 where the application is listening. Concurrently, the security group of the EC2 instances must allow inbound TCP traffic on port 8081 from the ALB's security group so that the load balancer's health check probes can successfully reach the instances.

Step-by-Step Solution

Identify the port on which the web application is listening on the EC2 instances.

The application listens on port 8081.

Health check requests must be sent to the port where the backend service is actively running.

Compare the application port with the configured health check port in the target group settings.

The health check is configured to check port 80, which is incorrect.

No service is listening on port 80, causing the health check requests to fail.

Configure the security groups to permit communication between the ALB and the EC2 instances.

The EC2 instances' security group must allow inbound TCP traffic on port 8081 originating from the security group of the ALB.

Security groups are stateful and must explicitly allow inbound traffic from the load balancer on the application's port.

Key Concept

Elastic Load Balancing Health Check Port and Security Group Alignment

Question 596Question →

A SysOps Administrator is configuring an Amazon Simple Notification Service (Amazon SNS) topic in AWS account 123456789012. The topic is encrypted using a customer managed AWS KMS key.

A monitoring application running on an Amazon EC2 instance in the same account must publish alerts to this SNS topic. The EC2 instance is associated with an IAM role named MonitoringAppRole that has an attached policy allowing the sns:Publish action.

Currently, the application fails to publish alerts, receiving an access denied error. The KMS key has the following key policy:

{
"Version": "2012-10-17",
"Id": "key-policy-1",
"Statement": [
{
"Sid": "Allow key administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/SysOpsAdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

The administrator wants to manage permissions for the KMS key using the IAM role's policy.

Which combination of actions must the SysOps Administrator perform to resolve this issue? (Select TWO.)

Select all that apply

Modify the KMS key policy to add a statement that grants the AWS account root principal (arn:aws:iam::123456789012:root) the kms:* permissions.

Update the IAM policy attached to MonitoringAppRole to allow the kms:GenerateDataKey and kms:Decrypt actions on the KMS key.

Modify the KMS key policy to grant the SNS service principal (sns.amazonaws.com) the kms:GenerateDataKey and kms:Decrypt permissions.

Update the IAM policy attached to MonitoringAppRole to allow the kms:Encrypt and kms:Decrypt actions on the SNS topic ARN.

Update the SNS topic access policy to grant the MonitoringAppRole the kms:GenerateDataKey and kms:Decrypt permissions.

Show answer & explanation

Answer: Modify the KMS key policy to add a statement that grants the AWS account root principal (arn:aws:iam::123456789012:root) the kms:* permissions.; Update the IAM policy attached to MonitoringAppRole to allow the kms:GenerateDataKey and kms:Decrypt actions on the KMS key.

Answer

Modify the KMS key policy to grant the AWS account root principal (arn:aws:iam::123456789012:root) the kms:* permissions, and update the IAM policy attached to MonitoringAppRole to allow the kms:GenerateDataKey and kms:Decrypt actions on the KMS key.

To resolve the Access Denied error, the SysOps Administrator must first enable IAM-based policy delegation for the customer managed KMS key. The current KMS key policy does not delegate permissions to the AWS account root principal, which prevents IAM policies from granting access to the key. Adding a statement to the KMS key policy that allows the root principal (arn:aws:iam::123456789012:root) to perform kms:* actions enables IAM policies to control access to the key. Second, the administrator must modify the IAM role's policy to grant kms:GenerateDataKey and kms:Decrypt permissions on the KMS key. Both actions are required to successfully publish messages to the encrypted SNS topic.

Step-by-Step Solution

Analyze the current KMS key policy to identify why the attached IAM policy permissions are not taking effect.

Determine that the KMS key policy is missing the default statement delegating permissions to the root principal (arn:aws:iam::123456789012:root), which means identity-based IAM policies are ignored for this key.

KMS key policies are the primary authority, and IAM policies can only grant key access if the key policy explicitly delegates that authority to the account's root principal.

Modify the KMS key policy to enable IAM policy delegation.

A statement is added allowing the root principal (arn:aws:iam::123456789012:root) to perform kms:* actions.

This delegates key permission management to IAM policies, allowing the administrator to define permissions on individual IAM roles.

Update the EC2 instance's IAM role (MonitoringAppRole) policy with the required KMS permissions.

The IAM policy is updated to grant kms:GenerateDataKey and kms:Decrypt permissions on the KMS key ARN.

These actions are required by the publishing client to encrypt payloads before sending them to the SNS topic.

Key Concept

AWS KMS Key Policy Precedence and Delegation

Question 597Question →

A SysOps administrator has launched an Amazon EC2 instance in a new subnet to host a public web server. The instance has been assigned a public IPv4 address, and its associated security group is configured to allow outbound traffic to $0.0.0.0/0$ and inbound HTTP/HTTPS traffic on ports $80$ and $443$ . However, users cannot access the web server from the internet, and the instance is unable to communicate with any external resources. Which of the following troubleshooting steps should the administrator perform to resolve this connectivity issue? (Select TWO.)

Select all that apply

Verify that the subnet's route table contains a route for

0.0.0.0/0

targeting the attached Internet Gateway.

Verify that the Network ACL associated with the subnet has an outbound rule allowing traffic to

0.0.0.0/0

and an inbound rule allowing return traffic on ephemeral ports (

1024-65535

Modify the instance's security group to allow inbound traffic from ephemeral ports (

1024-65535

) to accommodate the return path.

Deploy a NAT gateway in the subnet and add a route targeting the NAT gateway for

0.0.0.0/0

in the subnet's route table.

Create a Gateway VPC Endpoint for the Internet Gateway and associate it with the subnet's route table.

Show answer & explanation

Answer: Verify that the subnet's route table contains a route for $0.0.0.0/0$ targeting the attached Internet Gateway.; Verify that the Network ACL associated with the subnet has an outbound rule allowing traffic to $0.0.0.0/0$ and an inbound rule allowing return traffic on ephemeral ports ( $1024-65535$ ).

Answer

Verify that the subnet's route table contains a route for

0.0.0.0/0

targeting the attached Internet Gateway, and verify that the Network ACL associated with the subnet has an outbound rule allowing traffic to

0.0.0.0/0

and an inbound rule allowing return traffic on ephemeral ports (

1024-65535

To make a subnet public and allow bidirectional internet communication for an EC2 instance with a public IP, the subnet's route table must have a route for

0.0.0.0/0

pointing to an Internet Gateway. Additionally, because Network ACLs are stateless, they must be explicitly configured to allow outbound traffic to

0.0.0.0/0

and inbound return traffic on ephemeral ports (

1024-65535

) to complete the connection handshake.

Step-by-Step Solution

Examine the route table associated with the subnet where the EC2 instance is deployed.

Ensure that a route for destination

0.0.0.0/0

is present and targets the Internet Gateway.

Without this route, the subnet remains private, and internet traffic to and from the public IP address cannot be routed.

Examine the Network ACL rules associated with the subnet.

Ensure that outbound rules allow traffic to the internet and inbound rules permit return traffic on ephemeral ports (

1024-65535

Network ACLs are stateless, meaning return traffic must be explicitly allowed.

Key Concept

VPC public routing and stateless network filtering troubleshooting

Estimated Time:2m 0s

Question 598Question →

A company hosts a web application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The application listens on port 8080. The target group is configured to perform health checks using the HTTP protocol on port 8080 with the path `/status`. Following a security update, the application now requires an API key in the HTTP header for all requests under the `/status` path, returning an HTTP 401 Unauthorized response to requests without the key. As a result, the ALB target group marks all instances as unhealthy. Which action should a SysOps administrator take to resolve this issue?

Configure a new, unauthenticated endpoint on the application, such as `/health`, that does not require an API key, and update the target group's health check path to `/health`.

Update the target group's health check settings to include 401 in the list of successful HTTP matcher codes.

Modify the ALB listener rule to inject a custom HTTP header containing the valid API key for all incoming health check requests.

Configure an Amazon Route 53 active-passive failover routing policy to route traffic directly to the EC2 instances' public IP addresses, bypassing the ALB health checks.

Show answer & explanation

Answer: Configure a new, unauthenticated endpoint on the application, such as `/health`, that does not require an API key, and update the target group's health check path to `/health`.

Answer

Configure a new, unauthenticated endpoint on the application, such as `/health`, that does not require an API key, and update the target group's health check path to `/health`.

The correct action is to create a new, unauthenticated endpoint on the application (such as `/health`) that returns a 200 OK status code, and update the target group to use this path. Since Application Load Balancers generate anonymous health check requests without custom headers, any endpoint requiring API keys or basic authentication will fail the health check. A dedicated, unauthenticated health check endpoint allows the target group to verify instance health safely.

Step-by-Step Solution

Identify the cause of the health check failure from the status code.

The target group is receiving an HTTP 401 Unauthorized status code because the `/status` endpoint now requires an API key in the request headers.

Target group health checks are sent as anonymous HTTP requests without custom headers, causing the authentication check to fail on the instances.

Evaluate configuration workarounds for the authentication requirement.

Since Application Load Balancers cannot be configured to inject custom headers into target group health checks, and adding 401 to success matchers compromises health check reliability, a separate endpoint must be used.

A clean separation of authenticated business logic and unauthenticated health reporting is required.

Create and configure a dedicated health check endpoint.

Create an unauthenticated `/health` endpoint on the web server that returns HTTP 200 OK when the application is functional, and update the target group health check path accordingly.

This allows the target group to verify that the web server is running and responding without requiring authentication credentials.

Key Concept

ELB Target Group Health Checks and Authentication

Question 599Question →

A SysOps administrator is designing an Amazon S3 Lifecycle policy to manage storage costs for weekly generated audit reports stored in an S3 Standard bucket. The reports are frequently accessed during the first $30$ days. After $30$ days, the reports are occasionally accessed but must be available immediately. After $60$ days, the reports are rarely accessed, but they must be retained for $7$ years ( $2555$ days) for compliance purposes. The administrator wants to use S3 Glacier Deep Archive for long-term storage, as retrieval times of up to $12$ hours are acceptable. Which lifecycle configuration is valid and minimizes storage costs?

Transition objects to S3 Standard-IA after

30

days, transition objects to S3 Glacier Deep Archive after

60

days, and expire objects after

2555

days.

Transition objects to S3 Standard-IA after

30

days, transition objects to S3 Glacier Deep Archive after

50

days, and expire objects after

2555

days.

Transition objects to S3 Glacier Deep Archive after

30

days, transition objects to S3 Standard-IA after

60

days, and expire objects after

2555

days.

Transition objects to S3 Standard-IA after

30

days, transition objects to S3 Glacier Instant Retrieval after

45

days, and expire objects after

2555

days.

Show answer & explanation

Answer: Transition objects to S3 Standard-IA after $30$ days, transition objects to S3 Glacier Deep Archive after $60$ days, and expire objects after $2555$ days.

Answer

Transition objects to S3 Standard-IA after

30

days, transition objects to S3 Glacier Deep Archive after

60

days, and expire objects after

2555

days.

The configuration that transitions objects to S3 Standard-IA after

30

days and then to S3 Glacier Deep Archive after

60

days is valid and minimizes costs. Amazon S3 Lifecycle rules require that objects spend at least

30

days in S3 Standard-IA before transitioning to S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive. Since the transition to Glacier Deep Archive occurs at day

60

, the objects spend exactly

30

days in S3 Standard-IA (

60 - 30 = 30

), satisfying the minimum duration requirement. S3 Glacier Deep Archive is also the most cost-effective storage class for archival data that can tolerate retrieval times of up to

12

hours.

Step-by-Step Solution

Determine the initial storage duration and the target storage class for occasional immediate access.

The objects must stay in S3 Standard for

30

days and then transition to S3 Standard-IA.

This matches the requirement for frequent access during the first

30

days followed by occasional, immediate access.

Calculate the earliest valid day to transition objects from S3 Standard-IA to S3 Glacier Deep Archive.

Since S3 Standard-IA requires a minimum storage duration of

30

days before transitioning to S3 Glacier classes, the transition to S3 Glacier Deep Archive must be scheduled for day

60

or later (

30 + 30 = 60

Transitioning earlier than

30

days after moving to S3 Standard-IA will cause an S3 Lifecycle rule validation failure.

Set the expiration action for the compliance retention period.

Configure the expiration action to execute after

2555

days.

This satisfies the

7

-year compliance retention requirement.

Key Concept

Amazon S3 Lifecycle transition rules and minimum storage constraints

Estimated Time:1m 30s

Question 600Question →

A SysOps administrator is managing an Application Load Balancer (ALB) that routes traffic to a Target Group of Amazon EC2 instances. The Target Group is configured to receive HTTPS traffic on port $443$ . The health check is configured to use the HTTP protocol on port $80$ targeting the `/health` endpoint. The security group associated with the EC2 instances allows inbound TCP traffic on port $443$ from the ALB's security group, but the ALB marks all instances as unhealthy. Which of the following actions should the administrator take to resolve this issue and allow the health checks to pass?

Modify the health check port in the target group configuration to use the traffic port (port

443

) but keep the protocol as HTTP.

Configure an Amazon Route

53

DNS failover routing policy to bypass the load balancer and send traffic directly to the instances when health checks fail.

Add a rule to the security group associated with the EC2 instances that allows inbound TCP traffic on port

80

from the load balancer's security group.

Modify the stateless network ACL of the EC2 instances' subnet to allow outbound ephemeral port traffic (

1024

65535

) to all destinations.

Show answer & explanation

Answer: Add a rule to the security group associated with the EC2 instances that allows inbound TCP traffic on port $80$ from the load balancer's security group.

Answer

Add a rule to the security group associated with the EC2 instances that allows inbound TCP traffic on port

80

from the load balancer's security group.

Adding an inbound rule for TCP port

80

from the load balancer's security group to the EC2 instances' security group resolves the issue because the Application Load Balancer performs health checks using the HTTP protocol on port

80

. Although the instances allow HTTPS traffic on port

443

, the health check requests on port

80

were being blocked by the instances' security group.

Step-by-Step Solution

Analyze the configuration of the load balancer and the targets.

The target group receives traffic on port

443

, but health checks are configured to use HTTP on port

80

Understanding which ports are used for application traffic versus health check traffic is critical to identifying potential network blocks.

Review the security group rules applied to the EC2 instances.

The EC2 security group allows traffic on port

443

from the ALB security group, but does not have any rules allowing inbound traffic on port

80

Since the ALB sends health checks on port

80

, the instances' security group must explicitly allow inbound traffic from the ALB on port

80

Add the missing security group rule.

Inbound TCP port

80

is allowed from the ALB's security group, causing the health checks to pass.

Allowing the HTTP health check traffic on port

80

enables the ALB to connect to the target group instances and verify their health status.

Key Concept

Elastic Load Balancing target group health check security group configuration

Estimated Time:2m 0s

PreviousPage 30 / 49Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept