All practice questions

976 questions

All types976 Multiple choice502 Multiple select450 Ordering24

A company runs a web application on an Amazon EC2 instance within a VPC. The instance is launched in a public subnet with a CIDR block of $172.31.10.0/24$ and has an associated Elastic IP address. The application must accept incoming HTTPS requests from clients on the internet on port 443, and the instance must also initiate outbound HTTPS connections on port 443 to download software updates from an external repository.

Currently, the EC2 instance cannot be reached from the internet, and it cannot access the external update repository. A SysOps administrator confirms the following configurations:
- The EC2 instance's Security Group allows inbound and outbound TCP traffic on port 443.
- The subnet is associated with a custom Network ACL (NACL) that allows inbound and outbound TCP traffic on port 443, but blocks all other traffic.
- The subnet's route table has a route for the local VPC CIDR block, but no route for the destination $0.0.0.0/0$ .

Which of the following actions should the SysOps administrator take to resolve these connectivity issues? (Select TWO.)

Select all that apply

Add a route to the subnet's route table with a destination of

0.0.0.0/0

and the Internet Gateway as the target.

Update the custom Network ACL rules to allow inbound and outbound traffic on the ephemeral port range of

1024-65535

Add a route to the subnet's route table with a destination of

0.0.0.0/0

and a newly created NAT Gateway as the target.

Add rules to the EC2 instance's security group to allow inbound traffic on ephemeral ports

1024-65535

Associate a Gateway VPC Endpoint with the subnet's route table for the destination of the external software repository.

Show answer & explanation

Answer: Add a route to the subnet's route table with a destination of $0.0.0.0/0$ and the Internet Gateway as the target.; Update the custom Network ACL rules to allow inbound and outbound traffic on the ephemeral port range of $1024-65535$ .

Answer

To restore internet connectivity and resolve the routing issues, the SysOps administrator must add a default route (

0.0.0.0/0

) targeting the Internet Gateway in the subnet's route table, and update the custom Network ACL rules to allow traffic on the ephemeral port range (

1024-65535

) in both directions.

The correct options are the actions to add a route to the subnet's route table with a destination of

0.0.0.0/0

targeting the Internet Gateway, and to update the custom Network ACL rules to allow traffic on the ephemeral port range of

1024-65535

. These address the missing route to the internet and ensure that return traffic is not blocked by the stateless Network ACL.

Step-by-Step Solution

Verify and update the subnet's route table configuration.

Adding a route with destination

0.0.0.0/0

targeting the Internet Gateway allows the instance's outbound traffic to reach the internet and inbound traffic to be routed to the subnet.

Without a default route to an Internet Gateway, the subnet behaves as a private subnet, preventing any direct internet communication despite having an Elastic IP address.

Analyze the Network ACL (NACL) rules for stateless traffic flow.

Allowing inbound and outbound traffic on ephemeral ports (

1024-65535

) enables return traffic for both client-initiated and instance-initiated connections.

Because NACLs are stateless, they do not automatically allow return traffic. Since the current custom NACL only allows port 443 in both directions, return traffic directed at ephemeral ports is blocked.

Key Concept

VPC public routing requires an Internet Gateway route in the route table, and stateless Network ACLs require explicit rules for both request ports and response (ephemeral) ports.

Question 622Question →

A company uses an automated CI/CD pipeline to deploy utility servers into a designated subnet within a custom VPC. After a recent deployment, the utility servers are assigned public IPv4 addresses, but administrators are unable to establish SSH connections ( $22$ ) or ping the servers from the internet. The security group and Network ACL associated with the subnet both explicitly allow SSH traffic.

Which of the following routing issues is preventing external access to these utility servers?

A default route (

0.0.0.0/0

) targeting the VPC's Internet Gateway is missing from the subnet's route table.

The stateless Network ACL is missing an inbound rule to allow return traffic on ephemeral ports

1024\text{-}65535

A route targeting the Gateway VPC Endpoint for SSH traffic has not been added to the subnet's routing configuration.

The routing configuration directs all external traffic (

0.0.0.0/0

) to a NAT gateway provisioned in the same subnet.

Show answer & explanation

Answer: A default route ( $0.0.0.0/0$ ) targeting the VPC's Internet Gateway is missing from the subnet's route table.

Answer

A default route (

0.0.0.0/0

) targeting the VPC's Internet Gateway is missing from the subnet's route table.

A public subnet must have a route table containing a default route (

0.0.0.0/0

) pointing to the Internet Gateway. If this route is missing, instances in the subnet cannot communicate with resources outside the VPC, causing external connection attempts to time out.

Step-by-Step Solution

Analyze the subnet configuration and connectivity type.

The utility servers have public IPv4 addresses and need to receive incoming SSH connections from the internet, which means they must reside in a public subnet.

To determine why traffic from the internet is timing out despite security groups and Network ACLs being open.

Check the routing path from the subnet to the internet.

A subnet is only public if its route table explicitly routes internet-bound traffic (

0.0.0.0/0

) to the VPC's Internet Gateway.

Without this route, the VPC router does not know how to forward traffic to the internet, and incoming packets cannot be returned, leading to connection timeouts.

Key Concept

VPC Route Table Configuration for Public Subnets

Question 623Question →

A company has migrated a web application to an Amazon EC2 instance in a VPC. The instance is assigned a public IPv4 address and is placed in a subnet with a CIDR block of $172.16.1.0/24$ . The security group associated with the instance allows all inbound traffic on port $80$ and port $443$ , and the network ACL allows all inbound and outbound traffic. However, users are reporting that they receive connection timeouts when trying to access the application. The SysOps Administrator confirms that the application is running locally on the instance. Which of the following troubleshooting steps should the administrator perform next to resolve the connectivity issue?

Configure a route for

0.0.0.0/0

targeting an Internet Gateway (igw-xxxxxx) in the route table associated with the subnet.

Modify the network ACL to allow outbound traffic on ephemeral ports

1024-65535

back to the client.

Associate a Gateway VPC Endpoint for the web application's subnet route tables to direct the traffic.

Update the Target Group health check path to point to a static file on the EC2 instance instead of the root directory.

Show answer & explanation

Answer: Configure a route for $0.0.0.0/0$ targeting an Internet Gateway (igw-xxxxxx) in the route table associated with the subnet.

Answer

Configure a route for

0.0.0.0/0

targeting an Internet Gateway (igw-xxxxxx) in the route table associated with the subnet.

For an EC2 instance in a VPC to be reachable from the internet, it must have a public IPv4 address and its subnet's route table must route internet-bound traffic (

0.0.0.0/0

) to an Internet Gateway. Although the security group and network ACL are configured correctly, the absence of this route prevents response packets from leaving the VPC, causing connection timeouts for external users.

Step-by-Step Solution

Analyze the network configuration: the instance has a public IP, and both security groups and network ACLs are configured to allow HTTP and HTTPS traffic.

Since security group and network ACL rules are permissive, traffic filtering is not the cause of the connection timeout.

This isolates the problem to the routing configuration rather than firewall rules.

Examine the route table associated with the subnet of the EC2 instance to check for an outbound route to the internet.

Identify that the subnet does not have a route directing traffic destination

0.0.0.0/0

to the VPC's Internet Gateway.

An instance in a public subnet cannot communicate with the internet without a default route pointing to an Internet Gateway.

Add a route in the subnet's route table for destination

0.0.0.0/0

with the target set to the Internet Gateway.

The routing path is established, enabling the instance to reply to incoming internet traffic.

This configuration makes the subnet a public subnet, enabling bidirectionally successful connectivity.

Key Concept

VPC Route Table Configuration and Internet Gateway Association

Question 624Question →

A SysOps Administrator has deployed an Amazon EC2 instance in a newly created subnet. The instance has been assigned a public IPv4 address, and its security group is configured to allow all outbound traffic and inbound SSH traffic from the administrator's IP address. However, the administrator is unable to establish an SSH connection to the instance, and the instance cannot reach external internet-based repositories. Which two configurations should the administrator verify to resolve this connectivity issue?

Select all that apply

Confirm that the subnet's route table contains a route for

0.0.0.0/0

targeting the Internet Gateway.

Confirm that the subnet's network access control list (network ACL) allows outbound traffic on ephemeral ports

1024-65535

Confirm that the instance's security group allows inbound traffic on ephemeral ports

1024-65535

from the internet.

Confirm that a Gateway VPC endpoint is associated with the subnet's route table.

Confirm that the EC2 instance's IAM role includes the `iam:PassRole` permission.

Show answer & explanation

Answer: Confirm that the subnet's route table contains a route for $0.0.0.0/0$ targeting the Internet Gateway.; Confirm that the subnet's network access control list (network ACL) allows outbound traffic on ephemeral ports $1024-65535$ .

Answer

Verify that the subnet's route table contains a route for

0.0.0.0/0

targeting the Internet Gateway, and verify that the subnet's network ACL allows outbound traffic on ephemeral ports

1024-65535

For an EC2 instance in a VPC to communicate with the internet, it must be located in a public subnet, which is defined by having a route table entry pointing

0.0.0.0/0

to an Internet Gateway. Additionally, because Network ACLs are stateless, outbound rules must explicitly permit return traffic to client connections on ephemeral ports (

1024-65535

Step-by-Step Solution

Check the routing configuration for the subnet.

Ensure there is a route for

0.0.0.0/0

that has a target of the Internet Gateway attached to the VPC, making it a public subnet.

Without a route targeting the Internet Gateway, the VPC routing table does not know where to send traffic destined for external internet-based repositories or how to route response traffic back to external clients.

Examine the Network Access Control List (NACL) rules associated with the subnet.

Ensure the inbound rules allow traffic on port

22

and outbound rules allow return traffic on ephemeral ports (

1024-65535

Since Network ACLs are stateless, they evaluate inbound and outbound traffic independently. A missing outbound rule for ephemeral ports will drop return packets, causing connection timeouts even if the route table and security groups are configured correctly.

Key Concept

VPC public routing requires a route to an Internet Gateway, and stateless Network ACLs require explicit configuration of outbound ephemeral ports to allow response traffic.

Question 625Question →

A SysOps Administrator is managing an application on a standalone Amazon EC2 instance. The administrator configures a custom script on the instance to publish a custom metric named ActiveConnections to Amazon CloudWatch every 10 seconds. The administrator then creates a CloudWatch alarm with a period of 10 seconds and an evaluation period of 3 to monitor this metric. The goal is to automatically trigger an AWS Systems Manager (SSM) Automation runbook to reboot the instance if active connections exceed 500.

During a traffic spike, the active connections exceeded 500 for several minutes, but the alarm remained in the INSUFFICIENT_DATA state and the instance did not reboot.

Which two of the following configuration changes will resolve these issues and ensure the automated reboot executes successfully? (Select TWO.)

Select all that apply

Modify the custom script to publish the metric with the StorageResolution parameter set to 1.

Configure an Amazon EventBridge rule that intercepts the CloudWatch alarm state change and targets the Systems Manager Automation runbook.

Enable detailed monitoring on the EC2 instance to allow the custom metric to be evaluated at 1-minute intervals.

Add a direct action in the CloudWatch alarm configuration to trigger the Systems Manager Automation runbook.

Adjust the Auto Scaling group cooldown period to prevent the alarm from entering the INSUFFICIENT_DATA state during reboots.

Show answer & explanation

Answer: Modify the custom script to publish the metric with the StorageResolution parameter set to 1.; Configure an Amazon EventBridge rule that intercepts the CloudWatch alarm state change and targets the Systems Manager Automation runbook.

Answer

The issues can be resolved by modifying the script to publish the custom metric with a StorageResolution of 1, and configuring an Amazon EventBridge rule to intercept the alarm state change and trigger the Systems Manager Automation runbook.

To support a CloudWatch alarm with a sub-minute period (like 10 seconds), the underlying metric must be published with a StorageResolution of 1, indicating high resolution. Standard resolution metrics are aggregated at 1-minute intervals, which causes shorter-period alarms to evaluate with insufficient data. Additionally, CloudWatch alarms do not support executing Systems Manager Automation runbooks as a direct alarm action. The state transition must be intercepted by Amazon EventBridge to invoke the Automation runbook.

Step-by-Step Solution

Analyze the cause of the INSUFFICIENT_DATA state for a 10-second period alarm.

By default, custom metrics are stored with standard resolution (1-minute intervals). Publishing data every 10 seconds without specifying high-resolution storage causes CloudWatch to aggregate data at 1-minute intervals, leaving the 10-second periods empty and resulting in INSUFFICIENT_DATA.

To fix this, the metric must be published as a high-resolution metric by setting the StorageResolution parameter to 1.

Analyze the cause of the failed automated reboot execution.

CloudWatch alarms cannot directly invoke Systems Manager Automation runbooks from their native alarm actions list.

To remediate this, you must configure an Amazon EventBridge rule that detects when the alarm enters the ALARM state and executes the Systems Manager Automation runbook as its target.

Key Concept

CloudWatch High-Resolution Alarms and Systems Manager Remediation Integration

Estimated Time:2m 30s

Question 626Question →

A SysOps Administrator is configuring an Amazon CloudWatch alarm to automatically reboot a critical standalone Amazon EC2 instance if its CPU utilization remains above 90% for three consecutive minutes. The administrator configures the alarm with the following settings:

* Metric: CPUUtilization in the AWS/EC2 namespace
* Period: 1 minute
* Evaluation Periods: 3
* Action: EC2 Reboot action (arn:aws:automate:us-east-1:ec2:reboot) when the alarm is in the ALARM state

During testing, the administrator notices two issues: the alarm remains in the INSUFFICIENT_DATA state even when the instance is under heavy load, and the console displays a validation error stating that the EC2 reboot action cannot be associated with the alarm.

Which of the following actions must the administrator take to resolve these issues and ensure the reboot action executes successfully? (Select TWO.)

Select all that apply

Enable detailed monitoring on the target EC2 instance.

Modify the alarm configuration to include the InstanceId dimension specifying the target instance.

Attach an IAM role with the ec2:RebootInstances permission to the EC2 instance profile.

Change the alarm period to 5 minutes and keep standard monitoring enabled on the EC2 instance.

Increase the alarm evaluation period to match the Auto Scaling group cooldown period to prevent multiple reboot actions.

Show answer & explanation

Answer: Enable detailed monitoring on the target EC2 instance.; Modify the alarm configuration to include the InstanceId dimension specifying the target instance.

Answer

To resolve these issues, the administrator must enable detailed monitoring on the EC2 instance to supply 1-minute metric data points, and modify the alarm configuration to include the InstanceId dimension specifying the target instance, which is required for EC2 alarm actions.

The correct options are to enable detailed monitoring on the EC2 instance and to modify the alarm configuration to include the InstanceId dimension. Enabling detailed monitoring is necessary because the alarm uses a 1-minute period, but standard monitoring only publishes EC2 metrics every 5 minutes, leading to an insufficient data state. Specifying the InstanceId dimension is required because Amazon EC2 alarm actions (such as reboot, stop, terminate, or recover) are only supported on alarms targeting metrics in the AWS/EC2 namespace that contain the InstanceId dimension.

Step-by-Step Solution

Enable detailed monitoring on the target EC2 instance.

The CPUUtilization metric is published to CloudWatch every 1 minute instead of the default 5-minute standard monitoring interval.

This satisfies the alarm's 1-minute period configuration and prevents the alarm from entering the INSUFFICIENT_DATA state.

Configure the CloudWatch alarm to filter by the InstanceId dimension.

The alarm is associated with a single EC2 instance, resolving the dimension configuration validation error.

Amazon EC2 alarm actions such as reboot are only supported for metrics in the AWS/EC2 namespace when configured with the InstanceId dimension.

Key Concept

Configuring CloudWatch alarms with EC2 actions requires detailed monitoring for short evaluation periods and the InstanceId dimension for target identification.

Question 627Question →

A SysOps Administrator is configuring an Amazon EC2 Auto Scaling group (ASG) to dynamically scale out. The ASG is currently using standard monitoring. The administrator needs to configure a CloudWatch alarm that will trigger the scale-out policy when the average CPU utilization exceeds $80\%$ for two consecutive 1-minute periods. Which two configurations or actions must the administrator perform to achieve this?

Select all that apply

Enable detailed monitoring in the Auto Scaling group launch template to ensure metric data is available at 1-minute granularity

Configure the CloudWatch alarm with a period of

60

seconds and evaluation periods of

2

Leave standard monitoring enabled and configure the CloudWatch alarm with a period of

300

seconds and evaluation periods of

2

Configure the CloudWatch alarm to trigger the scale-out policy by directly targeting an Amazon Kinesis Data Firehose delivery stream when the alarm state changes

Configure the scaling policy cooldown period to

0

seconds to ensure the scaling policy executes immediately when the alarm triggers

Show answer & explanation

Answer: Enable detailed monitoring in the Auto Scaling group launch template to ensure metric data is available at 1-minute granularity; Configure the CloudWatch alarm with a period of $60$ seconds and evaluation periods of $2$

Answer

To configure the alarm to trigger on two consecutive 1-minute CPU utilization periods, the administrator must enable detailed monitoring on the Auto Scaling group launch template to get 1-minute metric granularity, and configure the CloudWatch alarm with a period of 60 seconds and an evaluation period of 2.

To resolve this requirement, the administrator must ensure that CPU utilization metrics are reported to CloudWatch at 1-minute intervals by enabling detailed monitoring. Then, they must configure the CloudWatch alarm with a period of 60 seconds and an evaluation period of 2 so that it evaluates two consecutive 1-minute datapoints before triggering the scaling policy.

Step-by-Step Solution

Enable detailed monitoring for the EC2 instances in the Auto Scaling group launch template.

EC2 metric data (including CPU utilization) is sent to CloudWatch at 1-minute intervals instead of the default 5-minute intervals.

Standard monitoring does not support the 1-minute granularity required for this alarm.

Configure the CloudWatch alarm with a period of 60 seconds (1 minute) and evaluation periods set to 2.

The alarm will evaluate the CPU utilization metric over two consecutive 1-minute windows.

This satisfies the requirement to trigger the alarm when CPU utilization exceeds the threshold for two consecutive 1-minute periods.

Key Concept

Enabling detailed monitoring is required to monitor EC2 metrics at 1-minute granularity, and the alarm period and evaluation periods must be configured to match the desired window of observation.

Question 628Question →

A CPU-intensive data analysis application runs on Amazon EC2 instances within an Auto Scaling group. The group uses a target tracking scaling policy based on average CPU utilization. The workload arrives in unpredictable batches. The operations team notices two problems:

1. When a new batch of workload arrives, it takes up to 10 minutes before the Auto Scaling group begins to launch new instances, causing a temporary performance bottleneck.
2. Once scaling begins, the group frequently launches more instances than are needed to handle the load, resulting in underutilized resources and unnecessary costs.

Which two actions should the administrator take to address these problems? (Select TWO.)

Select all that apply

Enable detailed monitoring for the EC2 instances in the launch template used by the Auto Scaling group.

Increase the estimated instance warmup time in the target tracking scaling policy configuration.

Decrease the estimated instance warmup time in the target tracking scaling policy configuration.

Enable detailed monitoring for the Auto Scaling group metrics in the AWS Management Console.

Create an Amazon EventBridge rule that triggers an AWS Systems Manager Automation document to increase group capacity when CPU utilization spikes.

Show answer & explanation

Answer: Enable detailed monitoring for the EC2 instances in the launch template used by the Auto Scaling group.; Increase the estimated instance warmup time in the target tracking scaling policy configuration.

Answer

Enable detailed monitoring for the EC2 instances in the launch template, and increase the estimated instance warmup time in the target tracking scaling policy.

Enabling detailed monitoring on the EC2 instances in the launch template changes the CPU utilization reporting frequency from 5 minutes to 1 minute, which reduces the time required for CloudWatch to trigger scaling actions. Increasing the estimated instance warmup time ensures that newly launched instances are not included in the average metric calculations until they are ready to handle the load, preventing the Auto Scaling group from launching unnecessary additional instances.

Step-by-Step Solution

Identify the cause of the scale-out delay.

The 10-minute delay is caused by CloudWatch receiving CPU utilization metrics at the default 5-minute interval (standard monitoring).

By enabling detailed monitoring in the launch template, EC2 instances will report CPU metrics every 1 minute, allowing CloudWatch to detect load spikes and trigger scaling much faster.

Identify the cause of the overprovisioning.

The Auto Scaling group launches too many instances because the scaling policy assumes the group still lacks capacity before the new instances are fully warmed up and processing load.

Increasing the estimated instance warmup time ensures that newly launched instances are excluded from the average CPU utilization calculation until they are ready, preventing redundant scale-out actions.

Key Concept

Auto Scaling responsiveness and overprovisioning prevention using detailed monitoring and instance warmup settings.

Estimated Time:2m 0s

Question 629Question →

A SysOps Administrator is monitoring a web application hosted on Amazon EC2 instances. The application writes structured JSON logs to an Amazon CloudWatch Logs log group. A representative log event is shown below:

{
"environment": "production",
"http_details": {
"status_code": 502,
"duration_ms": 420
}
}

The Administrator needs to create a custom metric named `BackendLatency` in the `App/Monitoring` namespace. This metric must record the `duration_ms` value only for production environment requests that result in an HTTP 5xx server error (status code $500$ to $599$ ). Additionally, if the latency exceeds $500$ ms, the Administrator wants to trigger an automated workflow to restart the application service on the EC2 instances. Which configuration should the Administrator implement to meet these requirements?

Create a CloudWatch Logs metric filter with the filter pattern `{ (

.environment = "production") && (

.http_details.status_code >= 500) && (

.http_details.status_code < 600) }` and set the metric value to `

.http_details.duration_ms`. Create a CloudWatch alarm based on this metric, and configure an Amazon EventBridge rule that reacts to the alarm state change to trigger an AWS Systems Manager Automation document.

Create a CloudWatch Logs metric filter with the filter pattern `{ (

.environment = "production") && (

.http_details.status_code = 5*) }` and set the metric value to `$.http_details.duration_ms`. Configure the metric filter's metric transformation properties to directly execute an AWS Systems Manager Automation document when a matching log event is detected.

Enable detailed monitoring on the EC2 instances to allow CloudWatch Logs to process custom metrics at 1-minute granularity. Create a metric filter with the filter pattern `{ (

.environment = "production") && (

.http_details.status_code = 5??) }` and set the metric value to `$.http_details.duration_ms`. Configure a CloudWatch alarm to trigger an Auto Scaling policy to replace the instances.

Create a CloudWatch Logs metric filter with the filter pattern `{ (

.environment = "production") && (

.http_details.status_code >= 500) && (

.http_details.status_code < 600) }` and set the metric value to `

.http_details.duration_ms`. Set the log group retention period to 14 days within the metric filter configuration to control storage costs, and configure a custom AWS Config rule to monitor the metric's alarm state and trigger the service restart.

Show answer & explanation

Answer: Create a CloudWatch Logs metric filter with the filter pattern `{ ( $.environment = "production") && ($ .http_details.status_code >= 500) && ( $.http_details.status_code < 600) }` and set the metric value to `$ .http_details.duration_ms`. Create a CloudWatch alarm based on this metric, and configure an Amazon EventBridge rule that reacts to the alarm state change to trigger an AWS Systems Manager Automation document.

Answer

Create a CloudWatch Logs metric filter using the pattern `{ (

.environment = "production") && (

.http_details.status_code >= 500) && (

.http_details.status_code < 600) }` and set the metric value to `

.http_details.duration_ms`. Create a CloudWatch alarm based on this metric, and use an Amazon EventBridge rule triggered by the alarm state change to run an AWS Systems Manager Automation document that restarts the service.

The correct option correctly uses JSON comparison operators (`>= 500` and `< 600`) to capture the numeric 5xx status codes, extracts the correct nested property (`$.http_details.duration_ms`) as the metric value, and uses a standard CloudWatch alarm coupled with an Amazon EventBridge rule to execute the Systems Manager Automation document. This properly decouples log metric extraction from resource remediation.

Step-by-Step Solution

Define the CloudWatch Logs metric filter pattern to match JSON structure and numeric ranges.

The pattern `{ (

.environment = "production") && (

.http_details.status_code >= 500) && (

.http_details.status_code < 600) }` is configured. This matches events where the status code is a number between

500

and

599$ inclusive, and the environment is 'production'.

CloudWatch Logs JSON metric filters require explicit comparison operators for numeric fields. Wildcards are only supported for string values.

Specify the metric value to extract from the log event structure.

The metric value is set to `$.http_details.duration_ms`.

This extracts the value of the duration_ms field from the matched log events to populate the metric data points.

Configure the automated remediation trigger workflow.

A CloudWatch alarm is created on the custom metric. An Amazon EventBridge rule is set up to listen for the alarm state transition to ALARM and targets an AWS Systems Manager Automation document to perform the restart.

Metric filters themselves cannot perform remediation actions. CloudWatch alarms must be paired with EventBridge or SNS to invoke automation tools like Systems Manager.

Key Concept

CloudWatch Logs JSON metric filters require numeric range operators rather than wildcards, and automation must flow from alarms via EventBridge or SNS rather than directly from metric filters.

Question 630Question →

A SysOps Administrator is configuring VPC Flow Logs to monitor network traffic for security compliance. The flow logs must be published to a new Amazon CloudWatch Logs log group. Any high-frequency network rejections should trigger an automated system teardown via an AWS Systems Manager (SSM) Automation runbook. The administrator attempts to configure the workflow but encounters two issues: they receive an access denied error when attempting to create the flow log, and the SSM Automation runbook is not being triggered during simulated network rejection events. Which of the following actions should the SysOps Administrator take to successfully configure the flow log delivery and the automated remediation path? (Select TWO).

Select all that apply

Attach an IAM policy to the SysOps Administrator's identity that grants the iam:PassRole permission for the IAM role associated with the flow log.

Configure a CloudWatch metric filter to extract REJECT patterns, associate it with a CloudWatch alarm, and create an Amazon EventBridge rule that triggers the Systems Manager Automation runbook when the alarm changes to the ALARM state.

Modify the trust policy of the flow logs IAM role to allow the SysOps Administrator's IAM user to perform the sts:AssumeRole action.

Configure the CloudWatch Logs metric filter to directly trigger the Systems Manager Automation runbook as its target.

Set the log retention policy directly inside the VPC Flow Log configuration settings to automatically delete logs older than 14 days.

Show answer & explanation

Answer: Attach an IAM policy to the SysOps Administrator's identity that grants the iam:PassRole permission for the IAM role associated with the flow log.; Configure a CloudWatch metric filter to extract REJECT patterns, associate it with a CloudWatch alarm, and create an Amazon EventBridge rule that triggers the Systems Manager Automation runbook when the alarm changes to the ALARM state.

Answer

Attach an IAM policy to the SysOps Administrator's identity that grants the iam:PassRole permission for the IAM role associated with the flow log, and configure a CloudWatch metric filter to extract REJECT patterns, associate it with a CloudWatch alarm, and create an Amazon EventBridge rule that triggers the Systems Manager Automation runbook when the alarm changes to the ALARM state.

To create a VPC Flow Log targeting CloudWatch Logs, the IAM identity performing the configuration must be granted the 'iam:PassRole' permission on the role that VPC Flow Logs will assume to deliver the logs. To establish the remediation workflow, raw log data must first be transformed into metrics via a CloudWatch Logs metric filter, which is then mapped to a CloudWatch alarm. An EventBridge rule is then configured to listen for the alarm state changes and trigger the Systems Manager Automation runbook.

Step-by-Step Solution

Add the iam:PassRole permission to the administrator's IAM identity.

The SysOps Administrator is authorized to associate the flow logs service role with the new flow log configuration, resolving the access denied error.

When creating a resource that requires a service role, AWS checks if the calling identity is permitted to pass that role to the service.

Create a metric filter on the CloudWatch log group searching for the term 'REJECT'.

A custom metric tracking the number of rejected packets is generated.

A metric filter must extract data from the raw text stream of VPC Flow Logs before alarms can be configured.

Create a CloudWatch alarm on the custom metric and route its state changes through EventBridge to target the SSM Automation runbook.

The EventBridge rule successfully intercepts the transition to the ALARM state and executes the remediation runbook.

Metric filters cannot directly execute remediation targets; they require an alarm state change event captured by Amazon EventBridge to invoke Systems Manager Automation.

Key Concept

VPC Flow Logs publishing to CloudWatch Logs requires appropriate iam:PassRole permissions for the configuring administrator, and automated remediation requires routing log-derived metrics through CloudWatch Alarms and EventBridge.

Question 631Question →

A SysOps Administrator is setting up VPC Flow Logs to capture traffic for a critical application and stream it to an Amazon CloudWatch Logs log group. The administrator creates an IAM role named FlowLogDeliveryRole with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role. The role has an attached IAM policy granting logs:CreateLogStream and logs:PutLogEvents permissions. When the administrator attempts to create the flow log using the AWS CLI command 'aws ec2 create-flow-logs', the command returns an AccessDenied error. Which of the following is the most likely cause of this issue?

The administrator's IAM identity does not have the iam:PassRole permission for the FlowLogDeliveryRole resource.

The trust policy of the FlowLogDeliveryRole must grant the logs.amazonaws.com service principal permission to assume the role.

The CloudWatch Logs log group does not have a resource-based policy that explicitly grants write permissions to the flow logs service.

The AWS CLI command must be initiated via an AWS Systems Manager Automation runbook triggered by an Amazon EventBridge rule to successfully pass the credentials.

Show answer & explanation

Answer: The administrator's IAM identity does not have the iam:PassRole permission for the FlowLogDeliveryRole resource.

Answer

The administrator's IAM identity does not have the iam:PassRole permission for the FlowLogDeliveryRole resource.

The correct answer is the option stating that the administrator's IAM identity does not have the iam:PassRole permission. When configuring an AWS service like VPC Flow Logs to run actions on your behalf, you must pass an IAM role to the service. To do this, your IAM user or role must have the iam:PassRole permission for that specific target role. Without this permission, the create-flow-logs API call fails with an AccessDenied error.

Step-by-Step Solution

Analyze the IAM configuration of the administrator's identity and the service delivery role.

The service delivery role is configured correctly with the vpc-flow-logs.amazonaws.com service principal and the necessary logs actions, but the CLI command execution fails with AccessDenied.

When passing an IAM role to an AWS service, the user executing the call must be authorized to perform the iam:PassRole action on that role.

Differentiate between service-linked roles, trust policies, and pass-role permissions.

The trust policy enables the service to assume the role, but the iam:PassRole permission enables the administrator to associate that role with the flow log resource.

This prevents unauthorized users from assigning high-privilege roles to AWS services.

Key Concept

IAM PassRole requirement for AWS service configuration

Estimated Time:2m 30s

Question 632Question →

A SysOps administrator must establish a disaster recovery and backup strategy for an application hosted in us-east-1. The application uses an Amazon S3 bucket for object storage and an Amazon RDS for MySQL DB instance. The architecture must satisfy the following criteria:
1. All objects uploaded to the S3 bucket must be replicated to a bucket in us-west-2 while preserving their version history.
2. The database must achieve a Recovery Time Objective (RTO) of less than 2 minutes during an Availability Zone outage in us-east-1 without manual intervention or DNS endpoint updates.
3. Database backups must be copied to us-west-2 daily.

Which two actions should the SysOps administrator take to meet these requirements? (Select TWO.)

Select all that apply

Enable S3 Versioning on both the source S3 bucket in us-east-1 and the destination S3 bucket in us-west-2, and configure an S3 Cross-Region Replication (CRR) rule.

Configure an S3 Cross-Region Replication (CRR) rule from the source S3 bucket in us-east-1 to the destination S3 bucket in us-west-2 while keeping versioning disabled on both buckets.

Modify the primary RDS MySQL DB instance to a Multi-AZ deployment, and configure the automated backups to copy snapshots to us-west-2 daily.

Deploy an RDS MySQL read replica in a different Availability Zone within us-east-1, and configure an Amazon Route 53 CNAME record with a short TTL pointing to the replica for automated failover.

Configure an Amazon Route 53 active-active failover routing policy between the primary RDS MySQL instance and a cross-Region read replica in us-west-2 to handle write traffic during an outage.

Show answer & explanation

Answer: Enable S3 Versioning on both the source S3 bucket in us-east-1 and the destination S3 bucket in us-west-2, and configure an S3 Cross-Region Replication (CRR) rule.; Modify the primary RDS MySQL DB instance to a Multi-AZ deployment, and configure the automated backups to copy snapshots to us-west-2 daily.

Answer

Enable S3 Versioning on both the source and destination buckets, configure S3 Cross-Region Replication, modify the primary RDS instance to a Multi-AZ deployment, and configure automated snapshot copies to the destination Region.

Enabling versioning on both source and destination S3 buckets is a prerequisite for Cross-Region Replication (CRR). Multi-AZ deployment for Amazon RDS provides synchronous replication and automated DNS failover during an AZ outage, meeting the RTO requirement without manual DNS updates.

Step-by-Step Solution

Verify S3 replication requirements.

Determine that versioning must be enabled on both source and destination buckets before setting up Cross-Region Replication (CRR).

S3 replication relies on version IDs to track and copy objects accurately across buckets.

Evaluate DB failover mechanisms for RTO and automation.

Select Multi-AZ deployment over Read Replicas for automatic DNS redirection and synchronous replication.

Multi-AZ deployments automate the failover process within minutes using DNS updates managed by AWS, whereas Read Replicas require manual promotion and endpoint updates.

Identify the snapshot copy strategy.

Configure automated DB snapshot copies to the target Region.

This satisfies the requirement for daily copies to the destination Region for disaster recovery.

Key Concept

Implementing cross-Region replication for Amazon S3 and configuring high availability with automated cross-Region backup copying for Amazon RDS.

Question 633Question →

A company hosts a production web application in the us-east-1 Region. The application uses Amazon EC2 instances behind an Application Load Balancer (ALB) and an Amazon RDS for PostgreSQL DB instance. The SysOps Administrator needs to design a disaster recovery (DR) strategy to the us-west-2 Region. The business requires a Recovery Point Objective (RPO) of $15$ minutes and a Recovery Time Objective (RTO) of $4$ hours. The strategy must minimize ongoing infrastructure costs in the secondary region.

Which configuration meets these requirements?

Enable Amazon RDS cross-region automated backups from us-east-1 to us-west-2. Store the application deployment templates in AWS CloudFormation. In the event of a disaster, restore the RDS DB instance from the replicated backups in us-west-2, and provision the application infrastructure using the CloudFormation templates.

Deploy the RDS DB instance as a Multi-AZ deployment with the standby replica located in the us-west-2 Region. In the event of a disaster in us-east-1, Route 53 will automatically failover the database to us-west-2.

Create a cross-region RDS read replica in us-west-2. Configure an Amazon Route 53 active-active failover routing policy to route write traffic to the replica in us-west-2 and automatically promote it during a failover event.

Export automated RDS snapshots to an Amazon S3 bucket. Configure Amazon S3 Cross-Region Replication (CRR) without enabling S3 Versioning to copy the snapshots from us-east-1 to us-west-2, and restore the database from the copied snapshots.

Show answer & explanation

Answer: Enable Amazon RDS cross-region automated backups from us-east-1 to us-west-2. Store the application deployment templates in AWS CloudFormation. In the event of a disaster, restore the RDS DB instance from the replicated backups in us-west-2, and provision the application infrastructure using the CloudFormation templates.

Answer

The correct configuration is to enable Amazon RDS cross-region automated backups, which continuously replicates transaction logs to the secondary region. This satisfies the 15-minute RPO. Restoring the database from these backups and deploying the application tier using AWS CloudFormation satisfies the 4-hour RTO. This approach is highly cost-effective because it incurs only backup storage costs in the secondary region until a failover is executed.

Step-by-Step Solution

Evaluate the RPO requirement.

An RPO of 15 minutes requires replication of database transaction logs or very frequent backups to the secondary region.

This determines which backup copying or replication mechanism is needed to prevent losing more than 15 minutes of data.

Evaluate the RTO and cost requirements.

An RTO of 4 hours allows enough time to restore a database from backups and provision EC2 instances via CloudFormation, which avoids the cost of running active standby instances.

This allows the selection of a cost-effective Backup and Restore disaster recovery pattern rather than an active-passive pilot light or warm standby pattern.

Assess the AWS service options against the requirements.

RDS cross-region automated backups replicate transaction logs with minimal lag (typically under 5 minutes) directly to the secondary region. Combining this with CloudFormation for application provisioning meets both RTO and RPO targets at the lowest cost.

This identifies the most optimal, reliable, and cost-effective configuration that fits all constraints.

Key Concept

Disaster Recovery strategies and the trade-offs between RTO, RPO, and cost efficiency using RDS cross-region backup capabilities.

Question 634Question →

A company hosts a document management application in the us-west-2 Region. The application uses Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer for the compute tier, Amazon Aurora PostgreSQL for the database tier, and an Amazon S3 bucket for document storage.

The company needs to establish a disaster recovery (DR) plan in the us-east-1 Region. The DR strategy must achieve a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes, while minimizing idle resource costs.

Which combination of actions should a SysOps Administrator perform to meet these requirements? (Select TWO.)

Select all that apply

Configure an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. Deploy the Application Load Balancer and the Auto Scaling group with a desired capacity of 0 in us-east-1.

Enable versioning on both the source S3 bucket in us-west-2 and a new destination S3 bucket in us-east-1, and configure Amazon S3 Cross-Region Replication (CRR) between the buckets.

Configure Amazon S3 Cross-Region Replication (CRR) to copy documents from us-west-2 to a bucket in us-east-1, ensuring versioning remains disabled on both buckets to minimize storage fees.

Create an Amazon RDS Read Replica in us-east-1 and configure it as a Multi-AZ deployment to serve as the automatic, synchronous cross-region failover target for database traffic.

Configure a Route 53 active-active routing policy with latency-based records to automatically split traffic and fail over all compute and database write traffic between us-west-2 and us-east-1 without administrator intervention.

Show answer & explanation

Answer: Configure an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. Deploy the Application Load Balancer and the Auto Scaling group with a desired capacity of 0 in us-east-1.; Enable versioning on both the source S3 bucket in us-west-2 and a new destination S3 bucket in us-east-1, and configure Amazon S3 Cross-Region Replication (CRR) between the buckets.

Answer

Configuring an Amazon Aurora Global Database with a secondary cluster in us-east-1 and an ASG capacity of 0, and enabling versioning to configure Amazon S3 Cross-Region Replication (CRR) between buckets.

The correct combination of actions is configuring an Amazon Aurora Global Database with a secondary cluster in us-east-1 alongside an Auto Scaling group with a desired capacity of 0, and enabling versioning on both buckets to configure Amazon S3 Cross-Region Replication (CRR). Aurora Global Database provides replication with lag typically under a second, meeting the 5-minute RPO. Scale-up of the compute tier from a capacity of 0 (Pilot Light pattern) combined with secondary cluster promotion allows achieving the 15-minute RTO at minimal idle cost. S3 Cross-Region Replication asynchronously mirrors storage contents, satisfying the RPO, but strictly requires versioning to be enabled on both source and destination buckets.

Step-by-Step Solution

Evaluate the database tier requirements for RPO (5 minutes) and cost efficiency.

Select Amazon Aurora Global Database as it offers sub-second cross-region replication lag, easily satisfying the 5-minute RPO.

To meet the tight RTO/RPO requirements while minimizing cost, a pilot light pattern with a secondary cluster is the most efficient choice compared to active-active multi-region deployments.

Evaluate the S3 bucket replication configuration requirement.

Enable versioning on both the source bucket and the destination bucket, then enable Cross-Region Replication (CRR).

S3 CRR requires versioning to be enabled on both source and destination buckets. Attempting to configure replication without versioning will result in a configuration error.

Evaluate the compute tier configuration for a Pilot Light disaster recovery strategy.

Configure the Auto Scaling group in the recovery region (us-east-1) with a desired capacity of 0.

Setting the desired capacity to 0 minimizes idle compute costs while allowing the instances to be launched quickly during a failover event, meeting the 15-minute RTO.

Key Concept

Multi-region disaster recovery (DR) strategies (Pilot Light) utilizing Aurora Global Database and S3 Cross-Region Replication (CRR).

Question 635Question →

An operations team is deploying a compliance control using AWS Config to ensure all Amazon DynamoDB tables have point-in-time recovery (PITR) enabled. To automatically correct non-compliant tables, the team intends to use an AWS Systems Manager (SSM) Automation runbook. They create a dedicated IAM role named 'SSMExecutionRole' containing the DynamoDB update permissions. During testing, when AWS Config identifies a non-compliant table, the remediation fails to execute. What configuration steps must be performed to allow AWS Config to successfully run the remediation using the specified role?

Establish an EventBridge rule that monitors AWS Config compliance change events and triggers the SSM runbook directly, bypassing the native AWS Config remediation configuration.

Modify the trust relationship of the SSMExecutionRole to authorize the config.amazonaws.com service principal, and grant the administrator's IAM policy the iam:PassRole privilege for this role.

Modify the trust relationship of the SSMExecutionRole to authorize the ssm.amazonaws.com service principal, and grant the administrator's IAM policy the iam:PassRole privilege for this role.

Assign the AWSConfigServiceRolePolicy managed policy to the SSMExecutionRole, and configure the DynamoDB tables to trust the config.amazonaws.com service principal.

Show answer & explanation

Answer: Modify the trust relationship of the SSMExecutionRole to authorize the ssm.amazonaws.com service principal, and grant the administrator's IAM policy the iam:PassRole privilege for this role.

Answer

Modify the trust relationship of the SSMExecutionRole to authorize the ssm.amazonaws.com service principal, and grant the administrator's IAM policy the iam:PassRole privilege for this role.

For AWS Config automatic remediation using Systems Manager (SSM) Automation, the remediation role (AutomationAssumeRole) is assumed by the Systems Manager service. Therefore, its trust relationship must allow the ssm.amazonaws.com service principal to perform the sts:AssumeRole operation. Additionally, the administrator who configures the remediation must have the iam:PassRole permission to pass the role to Systems Manager.

Step-by-Step Solution

Analyze the execution flow of AWS Config automatic remediation.

Identify that AWS Config triggers a Systems Manager (SSM) Automation runbook, which must assume the specified 'SSMExecutionRole' (AutomationAssumeRole) to modify resources.

Determines which AWS service principal actually executes the remediation actions and assumes the role.

Configure trust relationships for the remediation execution role.

Ensure the trust policy allows ssm.amazonaws.com to perform the sts:AssumeRole action.

Allows Systems Manager to assume the role needed to run the DynamoDB update operations.

Ensure appropriate permissions exist for the identity setting up the Config remediation.

Ensure the administrator configuring the Config remediation has iam:PassRole permissions targeting the SSMExecutionRole.

Required because AWS Config needs permission to pass the execution role to the Systems Manager service.

Key Concept

AWS Config automatic remediation requires configuring a trust relationship allowing Systems Manager to assume the remediation role, and granting iam:PassRole permissions to the user or role setting up the remediation configuration.

Estimated Time:2m 0s

Question 636Question →

A company hosts a document archiving application on AWS. The application uses a single Amazon EC2 instance to process PDF uploads, stores the files in an Amazon S3 bucket, and writes metadata to a Single-AZ Amazon RDS for PostgreSQL DB instance. A SysOps administrator must configure a cost-effective disaster recovery (DR) strategy in a secondary AWS Region. The DR strategy must meet a Recovery Point Objective (RPO) of 4 hours and a Recovery Time Objective (RTO) of 24 hours. Which combination of actions should the SysOps administrator take to meet these requirements? (Select TWO.)

Select all that apply

Enable Amazon S3 Cross-Region Replication (CRR) to replicate documents to a bucket in the secondary Region, ensuring that versioning is enabled on both buckets.

Configure Amazon RDS cross-Region automated backups replication to copy backups of the DB instance to the secondary Region.

Deploy an Amazon RDS read replica in the secondary Region to serve as the standby database.

Configure a Route 53 active-active failover routing policy to distribute traffic across both Regions.

Configure Amazon S3 Cross-Region Replication (CRR) to copy documents to the secondary Region without enabling versioning on either bucket.

Show answer & explanation

Answer: Enable Amazon S3 Cross-Region Replication (CRR) to replicate documents to a bucket in the secondary Region, ensuring that versioning is enabled on both buckets.; Configure Amazon RDS cross-Region automated backups replication to copy backups of the DB instance to the secondary Region.

Answer

The correct strategy involves enabling S3 Cross-Region Replication (with versioning active on both buckets) and configuring Amazon RDS cross-Region automated backups replication.

To meet an RPO of 4 hours and an RTO of 24 hours cost-effectively, the administrator should implement a backup-and-restore DR strategy. Enabling S3 Cross-Region Replication (with versioning enabled) ensures that documents are replicated with minimal latency. Replicating Amazon RDS automated backups to the secondary Region ensures that database snapshots and transaction logs are copied asynchronously to the target region. During a disaster, the database can be restored from the replicated backups, and EC2 instances can be launched from AMIs, meeting the 24-hour RTO without incurring the cost of running database or compute instances in the secondary region during normal operations.

Step-by-Step Solution

Evaluate RPO and RTO requirements to select the appropriate DR strategy.

An RPO of 4 hours and RTO of 24 hours allows for a backup-and-restore strategy where no compute or active database instances run in the DR region, maximizing cost-effectiveness.

This avoids unnecessary hourly costs for idle standby infrastructure.

Configure database replication for backup-and-restore.

Enabling RDS cross-Region automated backups replication copies snapshots and transaction logs asynchronously to the destination region.

This allows database restoration to the destination region within the 4-hour RPO target.

Configure storage replication.

Enabling S3 Versioning on both source and destination S3 buckets allows the configuration of Cross-Region Replication (CRR) to replicate documents.

Versioning is a hard requirement for S3 replication features.

Key Concept

Selecting and configuring a cost-effective backup-and-restore disaster recovery strategy using RDS cross-Region automated backups replication and S3 Cross-Region Replication with versioning.

Estimated Time:2m 0s

Question 637Question →

A SysOps Administrator is managing an application that writes JSON-formatted log events to an Amazon CloudWatch Logs group named `/aws/apps/auth-service`. A sample log event is shown below:

{
"timestamp": "2026-07-14T10:00:00Z",
"request_id": "req-98213",
"service": "auth-service",
"event": "LoginFailed",
"user_type": "premium",
"latency_ms": 350
}

The administrator needs to monitor the frequency of failed login events specifically for premium users. Additionally, the administrator must ensure that logs in this log group are kept for only 90 days to avoid indefinite storage costs.

Which two actions should the administrator take to meet these requirements? (Select TWO.)

Select all that apply

Create a metric filter on the /aws/apps/auth-service log group with the filter pattern { (

.event = "LoginFailed") && (

.user_type = "premium") }.

Modify the retention settings of the /aws/apps/auth-service log group and set the retention period to 90 days.

Enable CloudWatch detailed monitoring on the EC2 instances hosting the application to automatically enforce a 90-day retention limit on application logs.

Configure an Amazon EventBridge rule that triggers an AWS Systems Manager Automation runbook daily to delete log events older than 90 days from the log group.

Create an Amazon S3 lifecycle policy with a transition rule to expire objects after 90 days and apply it directly to the CloudWatch log group.

Show answer & explanation

Answer: Create a metric filter on the /aws/apps/auth-service log group with the filter pattern { ( $.event = "LoginFailed") && ($ .user_type = "premium") }.; Modify the retention settings of the /aws/apps/auth-service log group and set the retention period to 90 days.

Answer

Create a metric filter on the /aws/apps/auth-service log group with the filter pattern { (

.event = "LoginFailed") && (

.user_type = "premium") } and modify the retention settings of the /aws/apps/auth-service log group to set the retention period to 90 days.

To monitor JSON logs, the metric filter pattern must use valid JSON syntax, where individual criteria are prefixed with $. and enclosed in parentheses, combined with logical operators like &&. To limit log storage costs, the SysOps Administrator must configure the retention settings directly on the CloudWatch log group, setting the expiration period to 90 days.

Step-by-Step Solution

Identify the correct JSON filter pattern syntax for CloudWatch Logs metric filters.

The pattern { (

.event = "LoginFailed") && (

.user_type = "premium") } matches JSON log events where the event field equals LoginFailed and the user_type field equals premium. Each logical condition must be enclosed in parentheses.

This isolates the specific log events of interest using valid AWS CloudWatch Logs JSON filter syntax.

Configure the retention settings for the CloudWatch log group to prevent indefinite storage costs.

Modifying the retention setting of the /aws/apps/auth-service log group to 90 days automatically expires logs older than that period.

This satisfies the requirement to keep logs for exactly 90 days to avoid ongoing costs.

Key Concept

CloudWatch Logs metric filter patterns for JSON log events and configuring log group retention periods.

Estimated Time:1m 30s

Question 638Question →

A company uses Amazon Route 53 for active-passive failover routing. The primary record is a non-Alias A record with a TTL of 300 seconds pointing to an on-premises application server. The secondary record points to a static maintenance page hosted on Amazon S3. To monitor the primary server, a custom script on-premises publishes a heartbeat metric to Amazon CloudWatch every 60 seconds. A CloudWatch alarm is configured to trigger if the heartbeat is missing for 3 consecutive periods. A Route 53 health check is set up to monitor the state of this CloudWatch alarm and is associated with the primary A record. During a network outage, the on-premises server is disconnected, causing the CloudWatch alarm to enter the INSUFFICIENT_DATA state. Users continue to experience connection timeouts because they are still routed to the primary server. Which of the following is the correct configuration change to resolve this issue and minimize client failover time?

Enable 'Evaluate Target Health' on the primary A record to force Route 53 to actively query the on-premises public IP, and reduce the record's TTL.

Enable detailed monitoring for the custom metric in CloudWatch to ensure it updates at 1-minute intervals, and configure the alarm to trigger immediately without waiting for 3 consecutive periods.

Configure the Route 53 health check to treat INSUFFICIENT_DATA as unhealthy, and reduce the TTL of the primary A record to a lower value such as 60 seconds.

Configure the primary record as an Alias record pointing to an RDS Multi-AZ DB instance, and configure Route 53 to use the Multi-AZ automated failover mechanism.

Show answer & explanation

Answer: Configure the Route 53 health check to treat INSUFFICIENT_DATA as unhealthy, and reduce the TTL of the primary A record to a lower value such as 60 seconds.

Answer

Configure the Route 53 health check to treat INSUFFICIENT_DATA as unhealthy, and reduce the TTL of the primary A record to a lower value such as 60 seconds.

The correct response is to configure the Route 53 health check to treat the INSUFFICIENT_DATA state as unhealthy and to reduce the TTL of the primary record. By default, Route 53 health checks configured to monitor CloudWatch alarms consider the INSUFFICIENT_DATA state to be healthy. When the on-premises network fails, the server stops publishing metrics, causing the alarm to have insufficient data. Setting the health check to treat this state as unhealthy triggers the failover. Reducing the TTL to 60 seconds ensures that clients discard cached DNS entries quickly and query Route 53 again to receive the secondary endpoint's IP address.

Step-by-Step Solution

Analyze the state of the CloudWatch alarm during the network outage.

The alarm enters the INSUFFICIENT_DATA state because the metric is no longer being published by the on-premises script.

To understand the input signal the Route 53 health check receives during an outage.

Identify the Route 53 health check's behavior for the alarm's state.

By default, Route 53 health checks that monitor CloudWatch alarms treat the INSUFFICIENT_DATA state as healthy, meaning the health check remains green and failover is not triggered.

To determine why the active-passive failover configuration did not transition to the secondary S3 page.

Adjust the health check settings and the record caching parameters.

Change the health check to treat insufficient data as unhealthy to trigger the failover. Reduce the primary A record TTL from 300 seconds to 60 seconds to ensure client DNS caches expire quickly.

To minimize both detection time and client cut-over propagation time.

Key Concept

Route 53 Health Checks monitoring CloudWatch Alarms and the impact of DNS TTL on failover propagation.

Estimated Time:2m 30s

Question 639Question →

An Auto Scaling group (ASG) uses a step scaling policy based on the `CPUUtilization` metric. The EC2 instances in the ASG require approximately $6$ minutes to run bootstrapping scripts and start processing tasks. During traffic spikes, the SysOps administrator observes that the ASG launches additional instances every $5$ minutes before the previously launched instances can finish bootstrapping, resulting in over-provisioning. Additionally, the ASG is slow to trigger scaling actions when traffic initially spikes because the CPU utilization data points are evaluated at $5$ -minute intervals. Which actions should the SysOps administrator take to resolve these issues? (Select TWO.)

Select all that apply

Enable detailed monitoring in the launch template used by the Auto Scaling group.

Increase the estimated instance warmup time in the step scaling policy to

360

seconds.

Increase the default cooldown period of the Auto Scaling group to

360

seconds.

Configure standard monitoring and reduce the CloudWatch alarm evaluation period to

1

minute.

Attach an IAM policy with `iam:PassRole` permissions to the EC2 instances' instance profile.

Show answer & explanation

Answer: Enable detailed monitoring in the launch template used by the Auto Scaling group.; Increase the estimated instance warmup time in the step scaling policy to $360$ seconds.

Answer

Enable detailed monitoring in the launch template used by the Auto Scaling group, and increase the estimated instance warmup time in the step scaling policy to

360

seconds.

The correct solution involves enabling detailed monitoring to get

1

-minute EC2 metrics, which allows the CloudWatch alarms to react faster, and increasing the estimated instance warmup time to

360

seconds (

6

minutes) so that the step scaling policy allows newly launched instances to complete bootstrapping before initiating further scaling actions.

Step-by-Step Solution

Analyze the bootstrapping issue.

The instances require

6

minutes to bootstrap, but the ASG launches additional instances every

5

minutes.

Since a step scaling policy is used, the estimated instance warmup must be adjusted to match or exceed the bootstrapping time (

360

seconds) to prevent the policy from launching more instances before the current ones are ready.

Analyze the metric latency issue.

Scaling is slow because CPU utilization data points are evaluated at

5

-minute intervals.

To resolve this, detailed monitoring must be enabled in the launch template, which changes the metric reporting interval for CPUUtilization from

5

minutes (standard monitoring) to

1

minute.

Key Concept

Auto Scaling step scaling policies utilize estimated instance warmup to manage scaling frequency during instance bootstrapping, and detailed monitoring enables

1

-minute metric granularity to improve scaling responsiveness.

Question 640Question →

A SysOps Administrator performs a drift detection operation on an AWS CloudFormation stack containing an Amazon EC2 instance and a Security Group. The drift detection report indicates that the stack is DRIFTED because a new inbound port was manually added to the Security Group. Which two methods can the administrator use to resolve the drift and align the stack's actual configuration with its expected template configuration? (Select TWO.)

Select all that apply

Manually remove the inbound port from the Security Group, then run drift detection on the stack again.

Update the CloudFormation stack using a modified template that includes the new inbound port configuration.

Execute the AWS CLI command detect-stack-drift with the --remediate parameter to automatically revert the manual changes.

Apply a CloudFormation stack policy that blocks updates to the Security Group to trigger an automatic rollback to the template definition.

Configure the stack's IAM service role to grant iam:PassRole permissions, enabling the CloudFormation drift detection tool to rewrite the Security Group rules.

Show answer & explanation

Answer: Manually remove the inbound port from the Security Group, then run drift detection on the stack again.; Update the CloudFormation stack using a modified template that includes the new inbound port configuration.

Answer

Manually removing the inbound port from the Security Group and running drift detection again, or updating the CloudFormation stack using a modified template that includes the new inbound port configuration.

To resolve resource drift, a SysOps Administrator can either change the resource manually to match the expected template configuration, or update the template to match the actual resource configuration and perform a stack update. Manually removing the inbound port or updating the template to include the new port both bring the resource and template configurations back into alignment.

Step-by-Step Solution

Analyze the drift detection report to identify the specific drifted property, which is the manually added inbound port on the Security Group.

The target state and current state differences are clearly understood.

This establishes what resource configuration must be corrected or aligned.

Decide on the remediation strategy: either revert the manual change out-of-band or update the CloudFormation template to match the current manual state.

Two valid paths identified: manually deleting the security group rule or updating the template with the new rule.

Both methods align the template and resource configurations to resolve drift.

Execute the chosen remediation action and run drift detection again to verify the stack status.

The stack drift status returns to IN_SYNC.

Drift detection must be run again to update the stack's recorded status.

Key Concept

Remediating resource drift in AWS CloudFormation by either reverting out-of-band changes manually or updating the stack template to match the actual configuration.

PreviousPage 32 / 49Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept