All practice questions

976 questions

All types976 Multiple choice502 Multiple select450 Ordering24

A company uses AWS Organizations to manage multiple accounts. A SysOps administrator is configuring a monthly cost budget of $1,000 for a development sandbox account. The administrator wants to set up an AWS Budgets action that will automatically stop all running Amazon EC2 instances in the sandbox account as soon as the monthly forecasted spend is projected to exceed 120% ($ 1,200) of the budgeted amount. Which of the following configuration steps are required to ensure the budget action executes successfully? (Select TWO.)

Select all that apply

Create an IAM role with a trust policy that allows the budgets.amazonaws.com service principal to assume the role, and attach an IAM policy to the role that allows the ec2:StopInstances and ec2:DescribeInstances actions.

Attach an IAM policy to the SysOps administrator's identity that grants the iam:PassRole permission for the specific execution IAM role used by the budget action.

Create an AWS Cost Anomaly Detection monitor with a threshold of $1,200, and configure an anomaly subscription to run an automated action to stop the EC2 instances.

Create an Amazon CloudWatch billing alarm for estimated charges with a static threshold of $1,200, and add an EC2 action directly to the alarm to stop the running instances.

Show answer & explanation

Answer: Create an IAM role with a trust policy that allows the budgets.amazonaws.com service principal to assume the role, and attach an IAM policy to the role that allows the ec2:StopInstances and ec2:DescribeInstances actions.; Attach an IAM policy to the SysOps administrator's identity that grants the iam:PassRole permission for the specific execution IAM role used by the budget action.

Answer

To configure the AWS Budgets action successfully, the administrator must create an IAM execution role with a trust policy allowing the budgets.amazonaws.com service principal to assume the role and permissions to stop EC2 instances, and also attach an IAM policy to the administrator's identity granting the iam:PassRole permission for the execution role.

The correct configuration requires creating an IAM role that the AWS Budgets service principal can assume to stop the EC2 instances, and granting the administrator the iam:PassRole permission to pass that role to the Budgets service. This ensures the service has the authority to execute the stop action when the forecasted threshold is exceeded.

Step-by-Step Solution

Identify the target action and trigger requirements.

The requirement is to automatically stop EC2 instances based on a forecasted spend of $1,200 using a native AWS Budgets action.

AWS Budgets Actions allow native integration to stop EC2 or RDS instances when actual or forecasted costs cross a defined threshold.

Determine the necessary IAM permissions for the AWS Budgets service principal.

AWS Budgets must be allowed to assume an IAM role that has the ec2:StopInstances and ec2:DescribeInstances permissions.

AWS Budgets requires a trust relationship with budgets.amazonaws.com to assume the execution role and run the API calls on behalf of the user.

Determine the user-level permissions required to associate the role with the budget action.

The SysOps administrator must possess the iam:PassRole permission targeting the execution role.

AWS enforces iam:PassRole to ensure that users cannot elevate their privileges by passing a highly privileged role to an AWS service.

Key Concept

AWS Budgets Actions configuration requirements, specifically the target execution role trust relationships and user PassRole permissions.

Estimated Time:2m 0s

Question 662Question →

A SysOps Administrator has configured an Interface VPC Endpoint for the Amazon EC2 service (com.amazonaws.us-east-1.ec2) to allow Amazon EC2 instances in a private subnet to call the Amazon EC2 API. The VPC has DNS support and DNS hostnames enabled, and the Interface VPC Endpoint has Private DNS enabled. The EC2 instances are associated with a security group that allows all outbound traffic. However, when attempting to run the command 'aws ec2 describe-instances' from one of the instances, the command hangs and eventually times out. Which of the following is the most likely cause of this issue?

The security group associated with the Interface VPC Endpoint does not allow inbound TCP port 443 traffic from the security group of the EC2 instances.

The route table associated with the private subnet does not contain a route that targets the Interface VPC Endpoint ID for the destination traffic.

The private subnet's Network ACL does not have a rule allowing outbound traffic to the AWS public IP range for the EC2 service.

The EC2 instances are unable to resolve the public DNS endpoint of the EC2 service because there is no route to an Internet Gateway in the route table.

Show answer & explanation

Answer: The security group associated with the Interface VPC Endpoint does not allow inbound TCP port 443 traffic from the security group of the EC2 instances.

Answer

The security group associated with the Interface VPC Endpoint does not allow inbound TCP port 443 traffic from the security group of the EC2 instances.

The correct answer is that the security group associated with the Interface VPC Endpoint does not allow inbound TCP port 443 traffic from the security group of the EC2 instances. Interface VPC Endpoints create Elastic Network Interfaces (ENIs) inside the subnet. The security group attached to these ENIs acts as a firewall. Since the AWS CLI communicates over HTTPS, the endpoint's security group must permit inbound traffic on TCP port 443 from the EC2 instances or their subnet CIDR.

Step-by-Step Solution

Analyze the symptom.

The AWS CLI command hangs and times out, indicating a network-level blockage (traffic is being dropped silently) rather than a DNS resolution failure (which would result in an immediate 'Could not resolve host' error).

Timeouts in AWS VPC environments typically point to security groups, network ACLs, or routing table issues dropping packets.

Evaluate the routing requirement.

Since this is an Interface VPC Endpoint (AWS PrivateLink), traffic is directed to the ENIs associated with the endpoint via DNS. No route table changes are required for the subnet.

Interface VPC Endpoints do not use Gateway-style route table entries.

Evaluate the security group configuration.

The security group on the EC2 instances allows all outbound traffic, but the security group on the VPC Endpoint's ENIs must allow inbound traffic on TCP port 443 from the EC2 instances.

Security groups are stateful, but inbound rules must still be explicitly configured on the destination (the endpoint ENI) to accept connection requests.

Key Concept

Security group configuration for Interface VPC Endpoints (AWS PrivateLink)

Question 663Question →

A SysOps Administrator is designing a security and monitoring architecture for a database tier containing private Amazon RDS DB instances. The database instances must only accept MySQL traffic on port 3306 from the application tier subnets, and all network traffic to and from the database subnet must be monitored using VPC Flow Logs sent to Amazon CloudWatch Logs. The administrator must ensure that the IAM role used by the flow logs can publish to CloudWatch Logs and that log storage costs are managed efficiently. Which of the following actions should the administrator perform to meet these requirements? (Select TWO.)

Select all that apply

Configure the destination Amazon CloudWatch Logs group with a specific retention period, such as 90 days, instead of the default setting of Never Expire.

Configure the CloudWatch Logs group to keep logs indefinitely and set up a daily scheduled Amazon EventBridge rule to export the logs to Amazon S3.

Create the VPC Flow Log using an IAM role that has a trust relationship with the VPC Flow Logs service principal and contains the necessary logs write permissions, ensuring the administrator has the permission to pass this role.

Create the VPC Flow Log using an IAM role that has an AWS-managed policy for EC2 access, without configuring a trust relationship for the VPC Flow Logs service principal or granting the administrator permission to pass the role.

Modify the database subnet's Network ACL to allow inbound TCP traffic on port 3306 from the application subnet, and allow outbound TCP traffic on port 3306 to the application subnet, without allowing outbound ephemeral ports.

Show answer & explanation

Answer: Configure the destination Amazon CloudWatch Logs group with a specific retention period, such as 90 days, instead of the default setting of Never Expire.; Create the VPC Flow Log using an IAM role that has a trust relationship with the VPC Flow Logs service principal and contains the necessary logs write permissions, ensuring the administrator has the permission to pass this role.

Answer

To secure and monitor the database subnets while keeping costs low, the CloudWatch Logs group must be configured with a specific retention period to prevent infinite storage fees, and the VPC Flow Log must be created using an IAM role that trusts the flow logs service principal, has write permissions to CloudWatch, and is passed by an administrator who possesses the iam:PassRole permission.

Configuring a specific retention period on the CloudWatch Logs group ensures that log data does not accumulate indefinitely, minimizing storage costs. Furthermore, creating the VPC Flow Log requires an IAM role with a trust relationship that allows the VPC Flow Logs service principal to assume it, and the administrator must have the iam:PassRole permission to attach this role to the flow log.

Step-by-Step Solution

Set a retention limit on the destination CloudWatch Logs group.

The log group automatically purges logs older than the defined period (e.g., 90 days).

By default, CloudWatch Logs are kept forever, resulting in continuous growth of storage costs. Specifying a retention period controls costs.

Set up the IAM role for the VPC Flow Logs and ensure correct trust and permission policies are present.

The Flow Logs service principal is authorized to assume the role, and the user can pass the role to the service.

VPC Flow Logs need permission to call CreateLogStream and PutLogEvents. The role's trust policy must allow vpc-flow-logs.amazonaws.com to assume it, and the SysOps Administrator needs iam:PassRole to assign the role to the flow log.

Key Concept

VPC Flow Logs IAM roles and CloudWatch retention policies are critical components for secure traffic auditing and cost optimization in AWS networking.

Question 664Question →

A company operates a microservices application split across two VPCs (VPC A and VPC B) in the same AWS Region. VPC A hosts the front-end API gateway, and VPC B hosts the backend database services. Approximately $30\text{ TB}$ of data is transferred monthly between VPC A and VPC B. Currently, the VPCs are connected using an AWS Transit Gateway, which has caused a significant increase in the monthly AWS bill due to data processing charges. Which of the following strategies should a SysOps administrator implement to minimize data transfer costs while keeping the traffic entirely within the AWS private network? (Select TWO.)

Select all that apply

Establish a VPC Peering connection between VPC A and VPC B, and route the traffic between the VPCs through the peering connection.

Ensure that the resources in VPC A and VPC B that communicate with each other are deployed in the same Availability Zone.

Deploy NAT Gateways in each Availability Zone of VPC A and VPC B, and route the traffic between VPCs through the NAT Gateways.

Create an Interface VPC Endpoint (AWS PrivateLink) in VPC A pointing to a Network Load Balancer in VPC B, and route all traffic through the endpoint.

Configure a Gateway Load Balancer endpoint in VPC A to distribute traffic to the backend database instances in VPC B.

Show answer & explanation

Answer: Establish a VPC Peering connection between VPC A and VPC B, and route the traffic between the VPCs through the peering connection.; Ensure that the resources in VPC A and VPC B that communicate with each other are deployed in the same Availability Zone.

Answer

Establish a VPC Peering connection between VPC A and VPC B, and ensure that the resources in VPC A and VPC B that communicate with each other are deployed in the same Availability Zone.

Establishing a VPC Peering connection eliminates the

\$0.02

per GB AWS Transit Gateway data processing charges since VPC Peering has no processing fees. Furthermore, ensuring that communicating resources are deployed in the same Availability Zone eliminates the cross-AZ data transfer charge of

\$0.01

per GB, reducing the data transfer cost for this traffic to zero.

Step-by-Step Solution

Analyze the current network architecture and pricing model.

AWS Transit Gateway charges

\$0.02

per GB for data processing in the same region. For

30\text{ TB}

of data, this results in

\$600

per month in Transit Gateway data processing fees.

Understanding current costs helps identify the most cost-effective alternative.

Evaluate alternative private connectivity options.

VPC Peering has no data processing fees, making it

\$0

per GB for data processing. Compared to Transit Gateway and AWS PrivateLink (Interface Endpoints, which charge

\$0.01

per GB), VPC Peering is the most cost-effective transport mechanism.

VPC Peering provides direct routing between VPCs without intermediate processing costs.

Optimize the placement of resources across Availability Zones.

Data transfer over VPC Peering is free if both the source and target resources reside in the same Availability Zone. If they reside in different Availability Zones, a charge of

\$0.01

per GB applies for both egress and ingress.

Aligning resources in the same Availability Zone eliminates cross-AZ data transfer fees, reducing the variable cost to zero.

Key Concept

Minimizing AWS intra-region data transfer costs by using VPC Peering instead of Transit Gateway and matching Availability Zones to avoid cross-AZ fees.

Estimated Time:1m 30s

Question 665Question →

An organization has EC2 instances running in a private VPC subnet that must send log data to Amazon CloudWatch Logs. To comply with security policies, this traffic must remain entirely within the AWS network. A SysOps Administrator creates an Interface VPC Endpoint for CloudWatch Logs (com.amazonaws.us-east-1.logs) in the VPC. However, the EC2 instances are still unable to reach CloudWatch Logs, and application log agents report connection timeouts. Which of the following actions should the SysOps Administrator take to resolve this connectivity issue? (Select TWO.)

Select all that apply

Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on port 443 from the security group of the EC2 instances.

Enable Private DNS on the Interface VPC Endpoint, and ensure that both DNS resolution and DNS hostnames are enabled for the VPC.

Add a route to the private subnet route table with com.amazonaws.us-east-1.logs as the destination and the Interface VPC Endpoint ID as the target.

Attach an Internet Gateway to the VPC, and add a route in the private subnet route table pointing to the Internet Gateway for all destination traffic.

Show answer & explanation

Answer: Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on port 443 from the security group of the EC2 instances.; Enable Private DNS on the Interface VPC Endpoint, and ensure that both DNS resolution and DNS hostnames are enabled for the VPC.

Answer

To resolve the connectivity issue, the Administrator must modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS (port 443) traffic from the EC2 instances, and enable Private DNS on the endpoint along with DNS resolution and DNS hostnames in the VPC.

The correct options are to modify the endpoint's security group to allow inbound HTTPS traffic from the EC2 instances, and to enable Private DNS on the endpoint along with DNS hostnames and resolution on the VPC. This combination allows traffic to flow securely to the endpoint's ENIs and enables standard DNS queries to resolve to private endpoint IPs without code modifications.

Step-by-Step Solution

Check the security group configuration of the Interface VPC Endpoint.

Ensure that the security group attached to the endpoint network interfaces allows inbound HTTPS (port 443) traffic from the source EC2 instances.

Interface VPC Endpoints are represented by Elastic Network Interfaces (ENIs) in the VPC and require security group rules to permit traffic.

Verify VPC DNS settings and Endpoint Private DNS configuration.

Enable 'DNS resolution' and 'DNS hostnames' on the VPC, and check the 'Enable Private DNS' box on the Interface VPC Endpoint settings.

This allows the default regional service endpoint to automatically resolve to the private IP addresses of the endpoint's ENIs, preventing the need to change the application's configuration.

Key Concept

Interface VPC Endpoints rely on DNS resolution and security groups rather than route tables to secure private connectivity to AWS services.

Question 666Question →

A SysOps Administrator is designing a backup and recovery solution for a critical web application. The application's static media files are stored in an Amazon S3 bucket, and its transactional data is hosted on a single-node Amazon RDS for PostgreSQL DB instance.

The recovery plan has the following operational requirements:
* All static media files must be automatically copied to a secondary AWS Region for disaster recovery.
* The database must automatically fail over to a standby instance in another Availability Zone with minimal downtime if the primary instance fails.

Which combination of actions must the SysOps Administrator perform to meet these requirements? (Select TWO.)

Select all that apply

Enable bucket versioning on both the source and destination Amazon S3 buckets, and configure S3 Cross-Region Replication (CRR).

Modify the Amazon RDS DB instance to a Multi-AZ deployment to enable synchronous replication and automated failover.

Enable S3 Cross-Region Replication (CRR) on the source bucket to copy objects to the destination bucket without enabling versioning on either bucket.

Deploy an Amazon RDS Read Replica in a different Availability Zone and configure the application's connection endpoint to target it as the primary automated failover destination.

Create an AWS Backup plan with daily snapshot replication to a vault in another Availability Zone to automate database failover during a primary instance outage.

Show answer & explanation

Answer: Enable bucket versioning on both the source and destination Amazon S3 buckets, and configure S3 Cross-Region Replication (CRR).; Modify the Amazon RDS DB instance to a Multi-AZ deployment to enable synchronous replication and automated failover.

Answer

Enable bucket versioning on both the source and destination Amazon S3 buckets, configure S3 Cross-Region Replication (CRR), and modify the Amazon RDS DB instance to a Multi-AZ deployment.

To meet the disaster recovery and backup requirements, the SysOps Administrator must configure S3 Cross-Region Replication (CRR) and RDS Multi-AZ. Enabling bucket versioning on both the source and destination S3 buckets is a prerequisite for configuring S3 CRR. Converting the RDS PostgreSQL instance from Single-AZ to Multi-AZ enables synchronous replication to a standby instance in another Availability Zone and ensures automatic DNS failover with minimal downtime in the event of an outage.

Step-by-Step Solution

Configure versioning on the S3 buckets.

Bucket versioning is enabled on both the source bucket in the primary Region and the destination bucket in the secondary Region.

S3 Cross-Region Replication requires versioning to be enabled on both source and destination buckets to track object versions during replication.

Set up S3 Cross-Region Replication.

An IAM role is created with replication permissions, and a replication rule is configured on the source bucket pointing to the destination bucket.

This automates the copying of all new static media uploads to the secondary AWS Region to satisfy the disaster recovery requirement.

Modify the RDS DB instance to Multi-AZ.

The Single-AZ RDS PostgreSQL DB instance is converted to a Multi-AZ deployment.

AWS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a failure, RDS automatically switches to the standby with minimal downtime and updates the DNS endpoint.

Key Concept

Disaster recovery and backup management using S3 replication and RDS Multi-AZ deployments.

Estimated Time:2m 0s

Question 667Question →

A company's production database runs on an Amazon RDS for PostgreSQL DB instance. A SysOps Administrator must establish a cross-Region disaster recovery (DR) solution that guarantees a Recovery Point Objective (RPO) of less than 30 minutes and a Recovery Time Objective (RTO) of less than 15 minutes. Which strategy should the administrator implement to meet these requirements?

Enable Multi-AZ deployment for the DB instance and specify the disaster recovery Region as the secondary Availability Zone to automate synchronous replication and failover.

Configure Amazon S3 Cross-Region Replication (CRR) to replicate the automated DB snapshots from the source Region's automated backup bucket to a destination bucket, without enabling S3 versioning on either bucket.

Create a cross-Region Read Replica of the DB instance in the disaster recovery Region. During a disaster, promote the Read Replica to a standalone DB instance and update the application endpoint.

Configure a Route 53 active-active failover routing policy between the primary DB instance and a cross-Region Read Replica without health checks, allowing Route 53 to automatically redirect write traffic during a regional outage.

Show answer & explanation

Answer: Create a cross-Region Read Replica of the DB instance in the disaster recovery Region. During a disaster, promote the Read Replica to a standalone DB instance and update the application endpoint.

Answer

Create a cross-Region Read Replica of the DB instance in the disaster recovery Region. During a disaster, promote the Read Replica to a standalone DB instance and update the application endpoint.

Creating a cross-Region Read Replica provides asynchronous replication to another AWS Region, which typically keeps replication lag (RPO) to under a few minutes. If a regional disaster occurs, promoting the Read Replica to a standalone DB instance and modifying the application's endpoint is a quick operation that easily fits within the 15-minute RTO.

Step-by-Step Solution

Analyze the cross-Region disaster recovery requirements (RPO of 30 minutes, RTO of 15 minutes).

Determine that the replication must cross AWS Regions, and the recovery process must take less than 15 minutes.

This establishes the constraints needed to evaluate the options.

Evaluate the capabilities of Amazon RDS Multi-AZ.

Determine that Multi-AZ replication is synchronous but only functions within a single AWS Region.

This rules out standard Multi-AZ for cross-Region DR.

Evaluate using Amazon S3 Cross-Region Replication (CRR) for automated backups.

Identify that RDS automated backups cannot be replicated using S3 CRR directly, and S3 CRR requires versioning on both buckets.

This rules out S3 CRR without versioning on system-managed buckets.

Evaluate the cross-Region Read Replica solution.

A cross-Region Read Replica provides asynchronous cross-Region replication (low RPO). Promoting the replica to a standalone instance takes minutes (low RTO).

This confirms that Read Replica promotion meets both the RPO and RTO requirements.

Key Concept

Cross-Region disaster recovery for Amazon RDS using Read Replicas.

Question 668Question →

A SysOps Administrator is configuring a backup and disaster recovery architecture for a business-critical application. The application stores uploaded documents in an Amazon S3 bucket and utilizes an Amazon RDS for PostgreSQL database. To meet reliability and compliance requirements:

1. S3 bucket data must be replicated to a destination bucket in a different AWS Region.
2. The database must support automatic failover with zero manual intervention to mitigate Availability Zone outages in the primary Region.
3. Access to the replicated S3 bucket must go through a private network path within the AWS VPC without traversing the public internet.

The administrator initiates S3 cross-Region replication and configures an RDS Read Replica. However, during testing, replication of new S3 objects fails, database failover is not automatic during an outage, and S3 traffic continues over the public internet.

Which combination of configuration changes will resolve these issues?

Enable versioning on both the source and destination S3 buckets. Modify the database to use a Multi-AZ deployment. Create an S3 Gateway VPC Endpoint and associate it with the subnet route tables.

Enable versioning on the source S3 bucket only. Modify the database to use a Multi-AZ deployment. Create an S3 Gateway VPC Endpoint and associate it with the subnet route tables.

Enable versioning on both the source and destination S3 buckets. Maintain the RDS Read Replica and configure application-level scripting to promote it during an outage. Create an S3 Gateway VPC Endpoint and associate it with the subnet route tables.

Enable versioning on both the source and destination S3 buckets. Modify the database to use a Multi-AZ deployment. Create an S3 Gateway VPC Endpoint but do not associate it with the subnet route tables.

Show answer & explanation

Answer: Enable versioning on both the source and destination S3 buckets. Modify the database to use a Multi-AZ deployment. Create an S3 Gateway VPC Endpoint and associate it with the subnet route tables.

Answer

The configuration that enables versioning on both the source and destination S3 buckets, modifies the database to use a Multi-AZ deployment, and creates an S3 Gateway VPC Endpoint associated with the subnet route tables.

The correct configuration requires enabling versioning on both the source and destination S3 buckets to support Cross-Region Replication, converting the database to a Multi-AZ deployment to enable automated database failover, and creating an S3 Gateway VPC Endpoint associated with the subnet route tables to route traffic to S3 privately. This addresses all three requirements of replication, automatic failover, and private networking.

Step-by-Step Solution

Identify the requirements for Amazon S3 Cross-Region Replication (CRR).

Determine that bucket versioning must be enabled on both the source and destination S3 buckets.

AWS S3 CRR requires versioning to track and replicate object versions across Regions.

Evaluate the database failover requirement to mitigate Availability Zone outages automatically.

Determine that a Multi-AZ deployment is required, whereas Read Replicas are for scaling read traffic and do not support automated failover without custom scripting.

RDS Multi-AZ provides synchronous replication to a standby instance in another Availability Zone with automated DNS failover during outages.

Analyze the networking path required to access S3 privately from within the VPC.

Determine that an S3 Gateway VPC Endpoint must be created and explicitly associated with the subnet route tables.

Creating the gateway endpoint is not enough; without route table association, traffic destined for S3 will continue to route via the internet gateway.

Key Concept

Multi-component backup, recovery, and access configuration in AWS, including S3 Cross-Region Replication, RDS Multi-AZ failover, and Gateway VPC Endpoint routing.

Estimated Time:1m 30s

Question 669Question →

An organization runs a fleet of Amazon EC2 instances in a private VPC subnet ( $10.0.2.0/24$ ) that must initiate outbound connections to a third-party payment gateway on the internet on TCP port $8443$ . The client application on the EC2 instances uses ephemeral ports ( $1024-65535$ ) as source ports. Outbound traffic is routed through a NAT Gateway located in a public subnet ( $10.0.1.0/24$ ). Both the private subnet's Network Access Control List (NACL) and the EC2 instances' security group are custom and currently deny all inbound and outbound traffic. Which combination of rule configurations will successfully allow the EC2 instances to establish connections and receive responses from the payment gateway? (Select TWO.)

Select all that apply

In the custom security group, add an outbound rule that allows TCP traffic on port

8443

0.0.0.0/0

In the private subnet's custom NACL, add an outbound rule that allows TCP traffic on port

8443

0.0.0.0/0

, and an inbound rule that allows TCP traffic on port range

1024-65535

from

0.0.0.0/0

In the private subnet's custom NACL, add an outbound rule that allows TCP traffic on port

8443

0.0.0.0/0

, and an inbound rule that allows TCP traffic on port

8443

from

0.0.0.0/0

In the custom security group, add an outbound rule that allows TCP traffic on port

8443

to the private IP address of the NAT Gateway.

In the private subnet's custom NACL, add an inbound rule that allows TCP traffic on port

8443

from

0.0.0.0/0

, and an outbound rule that allows TCP traffic on port range

1024-65535

0.0.0.0/0

Show answer & explanation

Answer: In the custom security group, add an outbound rule that allows TCP traffic on port $8443$ to $0.0.0.0/0$ .; In the private subnet's custom NACL, add an outbound rule that allows TCP traffic on port $8443$ to $0.0.0.0/0$ , and an inbound rule that allows TCP traffic on port range $1024-65535$ from $0.0.0.0/0$ .

Answer

In the custom security group, add an outbound rule that allows TCP traffic on port

8443

0.0.0.0/0

; and in the private subnet's custom NACL, add an outbound rule that allows TCP traffic on port

8443

0.0.0.0/0

, and an inbound rule that allows TCP traffic on port range

1024-65535

from

0.0.0.0/0

The correct configuration requires allowing outbound TCP port

8443

in the security group to

0.0.0.0/0

, as security groups are stateful and track the destination IP of the packet. In addition, because NACLs are stateless, the private subnet's NACL must explicitly allow the outbound request on port

8443

and the inbound response on the ephemeral port range (

1024-65535

Step-by-Step Solution

Analyze the Security Group requirements for the outbound payment gateway traffic.

Since Security Groups are stateful, only an outbound rule is needed. The destination must be the payment gateway's IP address (or

0.0.0.0/0

), not the next-hop NAT Gateway's private IP, because security groups evaluate the packet's destination IP. No inbound rule is required because response traffic is automatically allowed.

To configure the security group correctly, we must allow port

8443

outbound and rely on stateful packet tracking for the return traffic.

Analyze the Network Access Control List (NACL) requirements for the private subnet.

NACLs are stateless, meaning rules must be configured for both the outbound request and the inbound response. The outbound rule must allow destination port

8443

. The inbound rule must allow the return traffic to the client's ephemeral port range (

1024-65535

Without the inbound NACL rule for the ephemeral port range, the return response from the payment gateway will be blocked at the subnet boundary.

Key Concept

Stateful vs. Stateless network controls in AWS VPC (Security Groups vs. NACLs) and their handling of ephemeral ports.

Question 670Question →

A SysOps administrator is deploying an application on Amazon EC2 instances. The application needs to retrieve database credentials from AWS Systems Manager (SSM) Parameter Store. The credentials are stored as a SecureString parameter named `/prod/db/password` and are encrypted using a customer managed KMS key.

The EC2 instances are associated with an IAM role that has the following policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:GetParameter",
"ssm:GetParameters"
],
"Resource": "arn:aws:ssm:us-east-1:111122223333:parameter/prod/db/password"
},
{
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": "arn:aws:kms:us-east-1:111122223333:key/12345678-abcd-1234-abcd-123456789abc"
}
]
}

Despite this configuration, the application logs show an `AccessDeniedException` when calling the `ssm:GetParameter` API with decryption enabled. Which of the following is the most likely cause of this access denied error?

The KMS key policy for the customer managed key does not allow the EC2 IAM role or the AWS account root principal to perform the `kms:Decrypt` action.

The administrator must add a permissions boundary to the IAM role that allows the `kms:Decrypt` action, as IAM policies alone cannot grant access to KMS resources without a boundary.

The IAM role policy must include the `iam:PassRole` permission targeting the KMS key to allow Systems Manager to assume the role and decrypt the parameter on behalf of the application.

The subnet route table associated with the EC2 instances is missing a gateway route to the KMS service endpoint, preventing the instance from reaching AWS KMS to perform the decryption.

Show answer & explanation

Answer: The KMS key policy for the customer managed key does not allow the EC2 IAM role or the AWS account root principal to perform the `kms:Decrypt` action.

Answer

The KMS key policy for the customer managed key does not allow the EC2 IAM role or the AWS account root principal to perform the `kms:Decrypt` action.

For customer managed KMS keys, the key policy is the primary authority. Even if an IAM policy grants `kms:Decrypt` permission to the EC2 IAM role, the request will be denied unless the KMS key policy explicitly permits the role or delegates access control to the account root principal (which allows IAM policies to take effect). Therefore, the lack of permission in the KMS key policy is the cause of the `AccessDeniedException`.

Step-by-Step Solution

Identify the service and components involved in the request.

The application calls SSM Parameter Store (`ssm:GetParameter`) to retrieve a `SecureString` encrypted with a custom KMS key.

Retrieving encrypted parameters requires both read access to the SSM parameter and decrypt access to the associated KMS key.

Analyze the IAM policy attached to the EC2 instances.

The IAM policy correctly grants `ssm:GetParameter` on the parameter resource and `kms:Decrypt` on the KMS key resource.

This confirms that identity-based permissions are correctly configured.

Evaluate resource-based policy requirements for AWS KMS keys.

Unlike other resources, KMS key policies must explicitly allow IAM policies to govern key access (using the account root principal) or explicitly grant the principal permissions.

Without this delegation in the KMS key policy, identity-based IAM policies cannot grant access to the key, resulting in an `AccessDeniedException`.

Key Concept

KMS Key Policy Precedence over IAM Policies

Estimated Time:2m 0s

Question 671Question →

A SysOps Administrator is managing an AWS CloudFormation stack that contains an Amazon RDS DB instance and an IAM role. A drift detection operation on the stack reports that both resources are in a DRIFTED status because of manual modifications. The Administrator needs to bring the stack and the physical resources back into alignment. Which of the following actions should the Administrator take to remediate this resource drift? (Select TWO.)

Select all that apply

Manually modify the RDS DB instance and the IAM role outside of CloudFormation to match the expected configurations defined in the stack template.

Update the CloudFormation template or parameters to match the current manual configurations of the resources, and then perform a stack update.

Run the `aws cloudformation resolve-stack-drift` AWS CLI command to force the resources to synchronize with the stack template.

Update the stack using a service role that has `iam:PassRole` permissions to allow CloudFormation to automatically overwrite the manual changes to the IAM role.

Initiate a stack update using the original template, and enable the option to automatically recreate drifted resources during the update.

Show answer & explanation

Answer: Manually modify the RDS DB instance and the IAM role outside of CloudFormation to match the expected configurations defined in the stack template.; Update the CloudFormation template or parameters to match the current manual configurations of the resources, and then perform a stack update.

Answer

Remediate the drift by either manually modifying the RDS DB instance and the IAM role outside of CloudFormation to match the template, or by updating the CloudFormation template to match the drifted resources and running a stack update.

To remediate resource drift in AWS CloudFormation, you can either manually modify the resources directly in their respective services to align with the template's expected configurations, or you can update the template and parameters to reflect the drifted configurations and perform a stack update. Modifying the resources manually resets them to the state defined in the template, while updating the template accepts the changes as the new source of truth.

Step-by-Step Solution

Detect drift on the stack.

Identify that the RDS DB instance and the IAM role have configurations that differ from the template.

This establishes which resource properties have changed from their expected template definitions.

Choose remediation path: either align resources with the template, or align the template with the resources.

Decide whether to revert manual changes on the physical resources or update the template to accept the manual modifications.

CloudFormation does not auto-sync drift; the administrator must perform these manual reconciliation actions.

Perform stack update or manual configuration changes.

The stack status returns to IN_SYNC.

Completing the chosen path resolves the configuration discrepancy.

Key Concept

CloudFormation drift detection identifies manual changes made to stack resources outside of CloudFormation. Remediation requires either manually reverting the changes on the resource or updating the template to reflect the current state and updating the stack.

Question 672Question →

A SysOps Administrator is configuring an AWS Systems Manager State Manager association to run a custom script on a fleet of target Amazon EC2 instances. The target instances have the SSM Agent installed and running, and they are configured with an IAM instance profile containing the AmazonSSMManagedInstanceCore policy. The administrator configures the association to use a custom service role named StateManagerExecutionRole to perform the operations. However, when the administrator attempts to create the association, the action fails with an "Access Denied" error. What is the most likely cause of this failure?

The trust policy of the StateManagerExecutionRole does not list the administrator's IAM user or role as a trusted entity to assume the role.

The target EC2 instances are missing the patch group tag that is required to align them with the custom association in Systems Manager Patch Manager.

The administrator's IAM user or role policy is missing the iam:PassRole permission for the StateManagerExecutionRole.

The administrator's IAM policy grants access to the KMS key used to encrypt Systems Manager outputs, but the KMS key policy itself does not explicitly allow the administrator's IAM user.

Show answer & explanation

Answer: The administrator's IAM user or role policy is missing the iam:PassRole permission for the StateManagerExecutionRole.

Answer

The administrator's IAM policy is missing the iam:PassRole permission for the StateManagerExecutionRole, preventing the user from passing the role to Systems Manager.

The correct answer is correct because creating a State Manager association that executes tasks using a custom service role requires the user to have the iam:PassRole permission for that role. Without this permission, the AWS API prevents the user from passing the role to Systems Manager, resulting in an Access Denied error during creation.

Step-by-Step Solution

Analyze the error message and context.

The error is 'Access Denied' when creating the State Manager association using a custom service role. This indicates an IAM authorization failure.

Before passing a role to an AWS service, AWS verifies that the caller has permission to pass that specific role.

Identify the permission required to pass a role to a service.

The iam:PassRole action is required in the policy attached to the administrator's IAM user or role.

This prevents unauthorized users from passing highly privileged roles to services.

Select the option that correctly identifies this missing authorization.

The correct option is the one stating that the administrator's policy is missing the iam:PassRole permission.

Without this permission, any attempt to create a service association or task using that role will fail with an Access Denied error.

Key Concept

IAM PassRole requirement for AWS Systems Manager Service Roles

Estimated Time:1m 30s

Question 673Question →

A SysOps administrator is troubleshooting a connectivity issue between an Amazon EC2 instance in a private subnet of VPC A ( $10.10.1.0/24$ ) and a database instance in a private subnet of VPC B ( $10.20.2.0/24$ ). The two VPCs are connected via an AWS Transit Gateway. The administrator verifies the following configuration details:

1. Security Groups: The EC2 instance security group allows all outbound traffic, and the database security group allows inbound traffic on port $3306$ from VPC A's CIDR ( $10.10.0.0/16$ ).
2. Network ACLs: The Network ACLs for both subnets allow all inbound and outbound traffic.
3. Subnet Route Tables:
- VPC A's private subnet route table has a route: $10.20.0.0/16 \rightarrow$ tgw-0123456789abcdef0 (Transit Gateway).
- VPC B's private subnet route table has a route: $10.10.0.0/16 \rightarrow$ tgw-0123456789abcdef0 (Transit Gateway).
4. Transit Gateway Route Tables:
- The Transit Gateway has two route tables: `TGW-RT-1` and `TGW-RT-2`.
- The VPC A attachment is associated with `TGW-RT-1` and propagates its routes to `TGW-RT-2`.
- The VPC B attachment is associated with `TGW-RT-2` and propagates its routes to `TGW-RT-2`.

Which of the following explains why the EC2 instance cannot connect to the database?

The Transit Gateway route table `TGW-RT-1` lacks a route to VPC B because the VPC B attachment only propagates to `TGW-RT-2`.

VPC A and VPC B are associated with different Transit Gateway route tables, which completely prevents them from routing traffic to each other.

The Network ACL associated with VPC B's subnet blocks the connection because stateless Network ACLs require explicit outbound rules for ephemeral ports

1024

65535

The subnet route table in VPC A must target the VPC B Transit Gateway attachment ID (`tgw-attach-xxxx`) rather than the Transit Gateway ID (`tgw-xxxx`).

Show answer & explanation

Answer: The Transit Gateway route table `TGW-RT-1` lacks a route to VPC B because the VPC B attachment only propagates to `TGW-RT-2`.

Answer

The Transit Gateway route table `TGW-RT-1` lacks a route to VPC B because the VPC B attachment only propagates to `TGW-RT-2`.

The correct answer is that the Transit Gateway route table associated with VPC A (`TGW-RT-1`) does not have a route to VPC B because VPC B's attachment is only configured to propagate to `TGW-RT-2`. When a packet arrives at the Transit Gateway from an attachment, the Transit Gateway looks up the route table that is associated with that source attachment. In this case, it checks `TGW-RT-1` for a route to VPC B's CIDR (

10.20.2.0/24

). Because VPC B's attachment does not propagate to `TGW-RT-1`, no route exists, and the traffic is dropped.

Step-by-Step Solution

Trace the outbound traffic path from VPC A to VPC B.

The traffic leaves VPC A's private subnet and is routed to the Transit Gateway based on the VPC subnet route table entry (

10.20.0.0/16 \rightarrow

Transit Gateway).

This confirms that the initial VPC-level routing is correct.

Identify the Transit Gateway route table evaluated for packets arriving from VPC A.

The Transit Gateway evaluates `TGW-RT-1` because the VPC A attachment is associated with `TGW-RT-1`.

Transit Gateway routes incoming traffic based on the route table associated with the source attachment.

Check the routes present in `TGW-RT-1`.

There is no route to VPC B (

10.20.0.0/16

) in `TGW-RT-1` because the VPC B attachment only propagates to `TGW-RT-2`.

Propagations determine which route tables automatically learn the CIDRs of the attached VPCs. Since VPC B only propagates to `TGW-RT-2`, `TGW-RT-1` has no knowledge of VPC B's CIDR.

Determine the packet outcome.

The Transit Gateway drops the packet due to a missing route in the evaluated route table (`TGW-RT-1`).

Without a destination route in the associated route table, the traffic cannot be forwarded.

Key Concept

AWS Transit Gateway route evaluation depends on the association of the source attachment and the propagation of the destination attachment.

Question 674Question →

A SysOps administrator is configuring AWS Config in a new AWS account. The administrator wants to use the AWS CLI to create a configuration recorder that uses a custom, pre-created IAM role named `ConfigRecorderRole`. However, when attempting to run the CLI command, the administrator receives an Access Denied error.

Which of the following actions are required to resolve this issue and successfully create the configuration recorder? (Select TWO.)

Select all that apply

Configure the trust policy of `ConfigRecorderRole` to allow the `config.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

Attach an IAM policy to the SysOps administrator's IAM identity that grants the `iam:PassRole` permission for the Amazon Resource Name (ARN) of `ConfigRecorderRole`.

Attach an IAM policy to the SysOps administrator's IAM identity that grants the `sts:AssumeRole` permission for the Amazon Resource Name (ARN) of `ConfigRecorderRole`.

Add a service control policy (SCP) to the organization's root that explicitly allows the `config.amazonaws.com` service principal to assume the `ConfigRecorderRole`.

Configure the Key Management Service (KMS) key policy associated with the AWS Config S3 bucket to grant the `iam:PassRole` permission to the configuration recorder.

Show answer & explanation

Answer: Configure the trust policy of `ConfigRecorderRole` to allow the `config.amazonaws.com` service principal to perform the `sts:AssumeRole` action.; Attach an IAM policy to the SysOps administrator's IAM identity that grants the `iam:PassRole` permission for the Amazon Resource Name (ARN) of `ConfigRecorderRole`.

Answer

To successfully configure the AWS Config recorder, the administrator must configure the trust policy of the IAM role to allow the AWS Config service principal to perform the assume-role action, and attach an IAM policy to their own IAM identity that grants the permission to pass the IAM role.

The correct options are the action to configure the trust policy of the IAM role to trust the AWS Config service principal and the action to attach an IAM policy to the administrator's identity granting the pass-role permission. These actions address the two independent permission boundaries required for service role assignment: trusting the service to assume the role, and authorizing the user to delegate the role.

Step-by-Step Solution

Analyze the Access Denied error context when assigning an IAM role to an AWS service.

Identify that the operation involves delegation of permissions where a service (AWS Config) needs to act on behalf of the account using a specific IAM role.

This establishes that both service trust (AssumeRole) and user authorization to delegate the role (PassRole) are required.

Verify and update the trust relationship of the IAM role.

Ensure that the trust policy explicitly allows the `config.amazonaws.com` service principal to call `sts:AssumeRole`.

Without this trust relationship, the service principal cannot assume the role, regardless of user permissions.

Ensure the administrator has delegation permissions.

Grant the `iam:PassRole` permission for the target role's ARN to the administrator's IAM identity.

This prevents users from passing highly privileged roles to services without explicit authorization.

Key Concept

Configuring service trust relationships and role delegation permissions for AWS services.

Estimated Time:1m 30s

Question 675Question →

A SysOps Administrator is configuring a custom Network Access Control List (NACL) for a private subnet that hosts a fleet of Amazon EC2 instances. These instances must download security patches from an external repository over HTTPS (TCP port 443) via a NAT gateway. The security group associated with the instances permits all outbound traffic.

The private subnet's custom NACL has the following rules:
- Outbound: Rule 100 allows TCP port 443 to $0.0.0.0/0$ .
- Inbound: Rule 100 allows TCP port 443 from $0.0.0.0/0$ .
All other traffic is denied by the default rules. The instances are currently unable to download the patches.

Which configuration change will resolve this connectivity issue?

Add an inbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 from

0.0.0.0/0

Add an inbound rule to the security group allowing TCP traffic on ports 1024-65535 from

0.0.0.0/0

Add an outbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 to

0.0.0.0/0

Modify the private subnet's route table to route outbound traffic (

0.0.0.0/0

) directly to the Internet Gateway.

Show answer & explanation

Answer: Add an inbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 from $0.0.0.0/0$ .

Answer

Add an inbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 from the internet.

Because Network Access Control Lists (NACLs) are stateless, return traffic must be explicitly allowed. When an EC2 instance initiates a connection to an external repository over HTTPS (TCP port 443), the return traffic from the repository is sent to the instance's ephemeral port range (1024-65535). Therefore, an inbound NACL rule must be configured to allow TCP traffic on ports 1024-65535.

Step-by-Step Solution

Identify the nature of the network security controls in use.

The security group is stateful, while the Network Access Control List (NACL) is stateless.

Since the security group is stateful, it automatically permits the response traffic for any established outbound connection. However, because the NACL is stateless, we must configure rules to allow both the outbound request and the inbound response.

Analyze the port requirements for the outbound request and inbound response.

The outbound connection goes to destination port 443 (HTTPS) from an ephemeral source port (1024-65535). The inbound response comes from source port 443 to the destination ephemeral port (1024-65535) of the EC2 instance.

We must verify that both paths are permitted by the NACL rules.

Review the existing NACL rules and identify the bottleneck.

The outbound NACL rule allows TCP port 443, which permits the outbound request. However, the inbound NACL rule only allows TCP port 443, which blocks the inbound response since its destination port is an ephemeral port (1024-65535).

Adding an inbound NACL rule for TCP ports 1024-65535 allows the response traffic to reach the instances.

Key Concept

Statelessness of Network Access Control Lists (NACLs) and the requirement of ephemeral ports for return traffic.

Question 676Question →

A company runs a production application using an Amazon RDS for MariaDB DB instance configured in a Multi-AZ deployment. During a scheduled maintenance window, Amazon RDS performs a failover to the standby replica. The SysOps Administrator needs to confirm that the failover was successful and ensure that the application servers reconnect to the newly promoted primary instance as quickly as possible. Which of the following actions should the SysOps Administrator take? (Select TWO.)

Select all that apply

Monitor the Amazon RDS events for the DB instance to verify that a failover has started and completed.

Ensure that the DNS caching configuration (TTL) on the application servers is set to a low value so that they quickly resolve the DB instance CNAME record to the new primary IP address.

Manually promote the standby read replica to primary using the Amazon RDS console to complete the failover process.

Modify the application configuration files to point to the dedicated DNS endpoint of the standby replica.

Configure an Amazon Route 53 failover routing policy to redirect database connections from the primary database IP address to the standby database IP address.

Show answer & explanation

Answer: Monitor the Amazon RDS events for the DB instance to verify that a failover has started and completed.; Ensure that the DNS caching configuration (TTL) on the application servers is set to a low value so that they quickly resolve the DB instance CNAME record to the new primary IP address.

Answer

To verify the failover status and ensure rapid application reconnection, the administrator should monitor the Amazon RDS events and configure a low DNS caching TTL on the application servers.

The correct options recommend monitoring Amazon RDS events to verify failover completion and configuring client-side DNS TTL settings to a low value. Since Amazon RDS manages Multi-AZ failover by updating the CNAME record for the DB instance endpoint, the application needs to query DNS for the new IP address quickly without using cached values.

Step-by-Step Solution

Check the Amazon RDS events for the DB instance.

Locate events showing the failover started and completed.

Amazon RDS logs failover activities as service events, providing a definitive audit trail of the transition.

Analyze client-side DNS caching settings on application servers.

Set client or OS-level DNS TTL to a small value (e.g., less than 30 seconds).

Amazon RDS Multi-AZ failover relies on updating a CNAME record. If the client caches the old IP address, it will continue attempting to connect to the offline primary instance.

Key Concept

Amazon RDS Multi-AZ failover utilizes automatic CNAME redirection, requiring short client-side DNS caching (TTL) for quick application recovery.

Question 677Question →

An organization operates an e-commerce platform using an Amazon Aurora PostgreSQL DB cluster. The cluster consists of one primary DB instance and three Aurora Replicas. During a localized Availability Zone outage affecting the primary instance, the SysOps Administrator needs to ensure that the replica configured with the highest compute specifications is prioritized for promotion to the primary instance during failover.

Which configuration should the administrator modify to guarantee this promotion order?

Assign a promotion tier value of 0 to the high-specification replica, and higher tier values to the remaining replicas.

Configure the Route 53 failover routing policy to map the cluster endpoint directly to the instance endpoint of the high-specification replica.

Configure the high-specification replica as the designated Multi-AZ synchronous standby target and convert the remaining replicas into read-only endpoints.

Assign a promotion tier value of 15 to the high-specification replica, and lower tier values to the remaining replicas.

Show answer & explanation

Answer: Assign a promotion tier value of 0 to the high-specification replica, and higher tier values to the remaining replicas.

Answer

Assign a promotion tier value of 0 to the high-specification replica, and higher tier values to the remaining replicas.

The correct option correctly configures the high-specification replica with a promotion tier of 0, which represents the highest promotion priority. Since the other replicas are assigned higher tier numbers (lower priority), Amazon Aurora will always attempt to promote the high-specification replica first during a failover event.

Step-by-Step Solution

Analyze the cluster architecture and identify how Amazon Aurora handles failover promotions.

Amazon Aurora promotes one of the existing Aurora Replicas to become the new primary instance during a failover, using a designated promotion tier setting (values 0-15).

Understanding the failover mechanism is necessary to determine which configuration parameter controls replica promotion order.

Evaluate the priority order of the promotion tiers.

Replicas in lower-numbered tiers (starting at 0) have higher priority for promotion than those in higher-numbered tiers (up to 15).

Determining the correct priority scale avoids the misconception that larger numbers indicate higher priority.

Assign the appropriate promotion tier values to each replica to ensure the high-specification replica is promoted first.

The high-specification replica is configured with tier 0, while the remaining replicas are configured with tier 1 or higher.

Setting the lowest tier value to the targeted replica guarantees it will be evaluated and promoted before the other replicas.

Key Concept

Amazon Aurora Replica Promotion Tiers

Question 678Question →

An organization is setting up Amazon S3 Cross-Region Replication (CRR) to copy objects from a source bucket in the us-east-1 Region to a destination bucket in the us-west-2 Region. A SysOps Administrator has created the destination bucket and configured the replication rule on the source bucket, specifying an IAM role for replication. However, new objects uploaded to the source bucket are not replicating. Which of the following actions must the SysOps Administrator perform to successfully enable replication? (Select TWO.)

Select all that apply

Enable S3 Versioning on both the source bucket and the destination bucket.

Grant the Amazon S3 service principal permissions to assume the IAM replication role, and configure the role's policy to permit replication actions.

Enable S3 Versioning on the source bucket, and leave the destination bucket unversioned so that replicated objects are written without version IDs.

Attach an IAM policy to the administrator identity configuring replication that grants sts:AssumeRole permissions for the replication role, instead of the iam:PassRole permission.

Configure an S3 Lifecycle rule on the source bucket to transition objects from S3 Standard-IA to S3 Standard after 15 days, expecting replication to process the restored objects.

Show answer & explanation

Answer: Enable S3 Versioning on both the source bucket and the destination bucket.; Grant the Amazon S3 service principal permissions to assume the IAM replication role, and configure the role's policy to permit replication actions.

Answer

To successfully enable replication, S3 Versioning must be enabled on both the source and destination buckets, and the IAM replication role must be assumable by the Amazon S3 service principal with appropriate permissions to read from the source and write to the destination.

To configure S3 replication, versioning must be enabled on both the source and destination buckets. Additionally, the IAM replication role must have a trust relationship that allows the Amazon S3 service principal to assume the role, and the role must be granted permissions to retrieve object versions from the source bucket and replicate objects to the destination bucket.

Step-by-Step Solution

Enable versioning on the source and destination buckets.

Both buckets support versioned objects, which is required for S3 to track and replicate individual object states.

S3 replication requires versioning to be enabled on both the source and destination buckets.

Configure the trust relationship of the IAM replication role to trust s3.amazonaws.com and allow sts:AssumeRole.

The Amazon S3 service principal is authorized to assume the role.

Amazon S3 needs to assume the replication role to perform replication actions on your behalf.

Attach a policy to the IAM replication role allowing s3:GetObjectVersion and s3:GetObjectVersionAcl on the source bucket, and s3:ReplicateObject on the destination bucket.

The role has the necessary permissions to read replication source metadata and write replication target objects.

Replication fails if the replication role lacks permissions to read source objects or write to the destination bucket.

Key Concept

Amazon S3 replication requires versioning to be enabled on both source and destination buckets, and an IAM role trusted by the Amazon S3 service principal with appropriate bucket and object access permissions.

Estimated Time:1m 30s

Question 679Question →

A company's infrastructure team distributes standardized environments across multiple business units using AWS Service Catalog portfolios. An administrator is configuring a launch constraint in a spoke account using an IAM role named CatalogLaunchRole to enforce principal-based execution. When a team member attempts to provision a product, the deployment fails. The provisioning details reveal two distinct errors: one stating that the user is not authorized to pass the launch role, and another in the AWS CloudFormation event log showing a failure to create an IAM instance profile. Which of the following actions must be taken to resolve these deployment errors? (Select TWO.)

Select all that apply

Configure the developer's IAM identity policy to allow the iam:PassRole action targeting the CatalogLaunchRole resource.

Update the permissions policy of CatalogLaunchRole to include the iam:CreateInstanceProfile action.

Modify the trust relationship of CatalogLaunchRole to grant iam:PassRole permissions to the developer's IAM principal.

Add the iam:CreateInstanceProfile action directly to the developer's IAM identity policy.

Modify the CloudFormation stack policy in the spoke account to explicitly allow the creation of IAM resources.

Show answer & explanation

Answer: Configure the developer's IAM identity policy to allow the iam:PassRole action targeting the CatalogLaunchRole resource.; Update the permissions policy of CatalogLaunchRole to include the iam:CreateInstanceProfile action.

Answer

Configure the developer's IAM identity policy to allow the iam:PassRole action targeting the CatalogLaunchRole resource, and update the permissions policy of CatalogLaunchRole to include the iam:CreateInstanceProfile action.

The correct actions are to configure the developer's IAM identity policy to allow the iam:PassRole action targeting the CatalogLaunchRole resource, and to update the permissions policy of CatalogLaunchRole to include the iam:CreateInstanceProfile action. When using an AWS Service Catalog launch constraint, the user launching the product must have the iam:PassRole permission to pass the specified launch role to the Service Catalog service. Additionally, because the launch role is used to execute the underlying CloudFormation deployment, that role must possess the permissions needed to create every resource in the template, including the IAM instance profile.

Step-by-Step Solution

Address the user-side authorization failure by examining the developer's IAM policy.

Identify that the developer lacks the permission to pass the CatalogLaunchRole.

Before AWS Service Catalog can assume the launch role under a launch constraint, the requesting principal must have iam:PassRole permission for that specific role.

Add the iam:PassRole permission to the developer's policy, targeting the CatalogLaunchRole ARN.

The developer is now authorized to delegate provisioning actions to the launch role.

This resolves the authorization error preventing the deployment from starting.

Address the underlying CloudFormation resource creation failure by examining the CatalogLaunchRole permissions.

Identify that the role lacks permissions to create IAM instance profiles.

During launch constraint execution, all resource creation actions are executed by the launch role. The role must have policies allowing it to provision all resources in the CloudFormation template.

Add iam:CreateInstanceProfile (and other required IAM actions) to the CatalogLaunchRole's permission policy.

The launch role can successfully create the instance profile during deployment.

This resolves the CloudFormation permission failure and prevents the stack from rolling back.

Key Concept

Under AWS Service Catalog launch constraints, the user needs iam:PassRole permissions for the launch role, and the launch role itself must have all the permissions required to create the resources in the underlying CloudFormation template.

Question 680Question →

A compliance auditor operating from an external AWS account (Account B) requires access to read consolidated AWS CloudTrail logs stored in an Amazon S3 bucket within the main corporate AWS account (Account A). The log files are encrypted with an AWS KMS customer managed key in Account A. The SysOps Administrator has attached an IAM policy to the auditor's IAM role in Account B that permits s3:GetObject on the S3 bucket and kms:Decrypt on the KMS key. The S3 bucket policy in Account A has also been updated to allow access from the auditor's role in Account B. However, when the auditor attempts to retrieve a log file, they receive an Access Denied error. Which action must the SysOps Administrator perform to resolve this issue?

Configure a bucket policy on the S3 bucket in Account A to grant kms:Decrypt permissions directly to the auditor's IAM role in Account B.

Add the iam:PassRole permission to the auditor's IAM role in Account B, specifying the ARN of the KMS key in Account A as the resource.

Update the key policy of the KMS key in Account A to allow the auditor's IAM role in Account B to perform the kms:Decrypt action.

Enable detailed monitoring on the CloudTrail trail in Account A to automatically propagate decryption credentials to Account B.

Show answer & explanation

Answer: Update the key policy of the KMS key in Account A to allow the auditor's IAM role in Account B to perform the kms:Decrypt action.

Answer

Update the key policy of the KMS key in Account A to allow the auditor's IAM role in Account B to perform the kms:Decrypt action.

For cross-account access to KMS-encrypted data, authorization must be granted by both the external identity's account and the resource owner's account. Because the customer managed key is in Account A and the auditor is in Account B, the KMS key policy in Account A must explicitly allow the auditor's IAM role ARN to perform the kms:Decrypt action. Once this key policy permission is in place, it works in tandem with the auditor's IAM policy in Account B to permit successful decryption.

Step-by-Step Solution

Identify that the access request is cross-account (Account B requesting access to resources in Account A).

Confirm that IAM policies in the destination account (Account B) cannot automatically grant access to resources in the source account (Account A) without resource-level permissions.

Cross-account authorization requires both the identity-based policy in the consuming account and the resource-based policy in the owning account to allow the action.

Evaluate the encryption configuration of the target files.

Observe that the CloudTrail logs are encrypted with a customer managed KMS key.

Accessing the encrypted objects requires both s3:GetObject permissions on the S3 bucket and kms:Decrypt permissions on the KMS key.

Examine the KMS key policy in Account A.

Determine that the KMS key policy does not explicitly permit the external auditor's role to decrypt.

By default, KMS key policies restrict access. Unlike S3 bucket policies where trust can sometimes be delegated purely via IAM, cross-account KMS access requires the key policy itself to explicitly trust the external IAM principal.

Update the KMS key policy in Account A.

Include the ARN of the auditor's IAM role from Account B in the Principal element of a policy statement allowing the kms:Decrypt action.

This establishes the necessary trust in the key owner's account to allow the external IAM role to use the key.

Key Concept

Cross-account KMS key delegation and policy precedence

Estimated Time:2m 30s

PreviousPage 34 / 49Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept