All practice questions

976 questions

All types976 Multiple choice502 Multiple select450 Ordering24

A company replicates its critical Amazon EC2 workloads from a primary Availability Zone to a secondary Availability Zone in the same AWS Region using AWS Elastic Disaster Recovery (AWS DRS). A SysOps Administrator is designing a disaster recovery (DR) drill. The administrator needs to configure the environment so that recovery EC2 instances are successfully provisioned with their designated instance IAM roles, and client traffic is automatically routed to the recovery instances if the primary Availability Zone experiences an outage. Which combination of actions must the SysOps Administrator take to meet these requirements? (Select TWO.)

Select all that apply

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the IAM role specified in the AWS DRS launch settings.

Configure Amazon Route 53 with an active-passive failover routing policy, associating a health check with the primary record and pointing the secondary record to the recovery endpoint.

Modify the trust relationship of the recovery instance IAM role to allow the sts:AssumeRole action for the AWS DRS replication service endpoint.

Configure Amazon Route 53 with an active-active failover routing policy and assign equal weights to both the primary and recovery record sets without health checks.

Create a CNAME record at the zone apex pointing to the AWS DRS staging area subnet's Elastic Network Interfaces (ENIs).

Show answer & explanation

Answer: Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the IAM role specified in the AWS DRS launch settings.; Configure Amazon Route 53 with an active-passive failover routing policy, associating a health check with the primary record and pointing the secondary record to the recovery endpoint.

Answer

The correct actions are to grant the iam:PassRole permission to the administrator's IAM identity for the role specified in the launch settings, and to configure Amazon Route 53 with an active-passive failover routing policy that uses a health check on the primary record.

To achieve the desired disaster recovery setup, the administrator must ensure both IAM permissions and DNS routing are correctly configured. First, when launching recovery instances, the administrator's IAM identity needs the permission to pass the EC2 instance role to the EC2 service. Second, an active-passive failover routing policy in Route 53 ensures that traffic is automatically redirected to the recovery endpoint only after the primary health check fails.

Step-by-Step Solution

Determine the required permission for launching EC2 instances with associated IAM roles via AWS DRS.

Identify that iam:PassRole must be granted to the calling IAM identity.

When launching recovery instances, AWS DRS requires the calling user or role to have permission to associate the target IAM role with the EC2 instances.

Determine the correct routing configuration for automatic redirection during a disaster.

Identify that an active-passive failover routing policy with a health check is required.

Active-passive configuration keeps the secondary (recovery) endpoint idle until the primary endpoint's health check fails, preventing traffic from being sent to unlaunched or unready instances prematurely.

Key Concept

AWS Elastic Disaster Recovery (AWS DRS) launch configuration and Route 53 disaster recovery integration.

Question 782Question →

A company uses AWS Config to monitor compliance across its AWS infrastructure. A SysOps administrator is configuring automatic, event-driven remediation for Amazon RDS DB instances that are identified as publicly accessible by the rds-instance-public-access-check AWS Config managed rule. The administrator intends to use the AWS Systems Manager Automation runbook AWS-ModifyRDSInstance to modify the non-compliant RDS DB instances and disable public accessibility.

The administrator wants to configure the remediation directly within AWS Config. Which two actions must the administrator perform to ensure that the remediation executes successfully?

Select all that apply

Create an IAM role for the Systems Manager Automation runbook that includes the rds:ModifyDBInstance permission and configure the role's trust policy to trust the ssm.amazonaws.com service principal.

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the Systems Manager Automation role.

Attach an IAM policy to the AWS Config service role that grants the iam:PassRole permission for the rds.amazonaws.com service principal.

Configure the trust policy of the Systems Manager Automation role to trust the config.amazonaws.com service principal and specify this role in the remediation configuration.

Enable Amazon CloudWatch detailed monitoring on all RDS DB instances to ensure AWS Config can detect compliance status changes with a one-minute granularity.

Show answer & explanation

Answer: Create an IAM role for the Systems Manager Automation runbook that includes the rds:ModifyDBInstance permission and configure the role's trust policy to trust the ssm.amazonaws.com service principal.; Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the Systems Manager Automation role.

Answer

To successfully configure the remediation, the administrator must create an IAM role for Systems Manager Automation that permits the rds:ModifyDBInstance action and trusts ssm.amazonaws.com, and they must grant their own IAM identity the iam:PassRole permission for that execution role.

For event-driven auto-remediation to operate correctly when initiated by AWS Config, the remediation action runs as an AWS Systems Manager Automation. The SSM Automation requires a service role that has permission to modify the target resource (in this case, rds:ModifyDBInstance) and must trust the Systems Manager service principal (ssm.amazonaws.com) to assume it. Additionally, the administrator who configures the remediation rule needs the iam:PassRole permission to allow AWS Config to pass this execution role to the Systems Manager service.

Step-by-Step Solution

Create an IAM role that will act as the Automation execution role.

An IAM role is created with the rds:ModifyDBInstance policy attached, and its trust relationship is configured to allow the ssm.amazonaws.com service principal to assume it.

Systems Manager Automation requires permissions to modify the RDS instances, and it must be allowed to assume the designated execution role.

Attach the iam:PassRole permission to the administrator's IAM policy.

The administrator's IAM user or role gains the permission to pass the newly created Automation execution role to the Systems Manager service.

AWS security requires that any user who associates a service role with an automation or service must have explicit permissions to pass that role.

Key Concept

IAM role delegation and service trust relationships for event-driven Systems Manager Automation remediation via AWS Config.

Question 783Question →

A company hosts a production application on an Amazon Aurora MySQL DB cluster. The cluster contains one primary (writer) instance and three replica (reader) instances named reader-1, reader-2, and reader-3, distributed across three Availability Zones. To support business continuity, a SysOps Administrator must ensure that if the primary instance fails, reader-2 is promoted to the primary writer role first. If reader-2 is unavailable, reader-1 must be promoted next. Which configuration will meet these requirements?

Set the Promotion Tier of reader-2 to Tier

0

, reader-1 to Tier

1

, and reader-3 to Tier

2

Set the Promotion Tier of reader-2 to Tier

15

, reader-1 to Tier

14

, and reader-3 to Tier

13

Configure an Amazon Route 53 failover routing policy pointing to the individual endpoints of reader-2 as primary and reader-1 as secondary.

Modify the DB cluster parameter group to define the failover sequence favoring reader-2, followed by reader-1.

Show answer & explanation

Answer: Set the Promotion Tier of reader-2 to Tier $0$ , reader-1 to Tier $1$ , and reader-3 to Tier $2$ .

Answer

Set the Promotion Tier of reader-2 to Tier

0

, reader-1 to Tier

1

, and reader-3 to Tier

2

The correct configuration is to set the Promotion Tier of reader-2 to Tier

0

, reader-1 to Tier

1

, and reader-3 to Tier

2

. Amazon Aurora determines which replica to promote to the primary writer role based on the Promotion Tier configuration of each DB instance. Aurora evaluates these tiers in ascending order, where Tier

0

has the highest priority and Tier

15

has the lowest priority. Therefore, setting reader-2 to Tier

0

ensures it is evaluated first, setting reader-1 to Tier

1

ensures it is evaluated second, and setting reader-3 to Tier

2

ensures it is evaluated last.

Step-by-Step Solution

Determine the mechanism Aurora uses to prioritize replica promotion during a failover event.

Identify that Amazon Aurora uses Promotion Tiers (from

0

through

15

) defined at the DB instance level to manage failover priority.

This establishes that we must configure instance-level promotion settings rather than cluster parameter groups or DNS routing.

Analyze the priority order of the Promotion Tier values.

Verify that Tier

0

represents the highest priority (first to be promoted) and Tier

15

represents the lowest priority.

This allows us to correctly assign the tiers to ensure reader-2 is prioritized over reader-1, which in turn is prioritized over reader-3.

Assign the appropriate Promotion Tiers to each replica instance.

Assign Tier

0

to reader-2, Tier

1

to reader-1, and Tier

2

(or higher, up to Tier

15

) to reader-3.

This guarantees that if the primary instance fails, Aurora will evaluate reader-2 first, then reader-1, and finally reader-3.

Key Concept

Amazon Aurora Failover Priority and Promotion Tiers

Question 784Question →

A SysOps Administrator is planning to deploy an application update to a critical production environment running on AWS Elastic Beanstalk. The environment utilizes an Application Load Balancer (ALB) and an Auto Scaling group with a minimum capacity of $4$ instances. The deployment must satisfy the following constraints:

1. The environment must maintain $100\%$ of its current serving capacity ( $4$ instances) at all times to prevent performance degradation.
2. A canary test must be performed by routing exactly $10\%$ of incoming production traffic to the new application version for an evaluation period of $15$ minutes.
3. If any CloudWatch alarms (such as HTTP $5\text{xx}$ error rates) trigger during the evaluation period, the deployment must immediately roll back with zero downtime.

Which combination of configuration settings and deployment strategies will meet these requirements? (Select TWO.)

Select all that apply

Configure the environment deployment policy to Traffic splitting, and set the split percentage to

10\%

with an evaluation time of

15

minutes.

Configure environment rollback rules to monitor active CloudWatch alarms, enabling automated rollback if thresholds are exceeded during the evaluation period.

Configure the environment deployment policy to Rolling with additional batch, and configure an Amazon Route 53 weighted routing policy to route

10\%

of traffic to the new instances.

Configure the environment deployment policy to Immutable, and configure an AWS CodeDeploy deployment group with a canary traffic shifting configuration.

Configure the environment deployment policy to Rolling, configure a minimum healthy percentage of

100\%

, and apply the update using an AWS Systems Manager (SSM) Patch Baseline.

Show answer & explanation

Answer: Configure the environment deployment policy to Traffic splitting, and set the split percentage to $10\%$ with an evaluation time of $15$ minutes.; Configure environment rollback rules to monitor active CloudWatch alarms, enabling automated rollback if thresholds are exceeded during the evaluation period.

Answer

The correct configurations are setting the deployment policy to Traffic splitting with a

10\%

split percentage and a

15

-minute evaluation time, and configuring environment rollback rules to monitor CloudWatch alarms.

The Traffic splitting deployment policy enables a canary deployment by creating a parallel group of instances running the new version and routing a defined percentage of traffic (

10\%

) to them for a trial duration (

15

minutes) while keeping the original instances at full capacity. By combining this policy with CloudWatch alarm monitoring on the Elastic Beanstalk environment, any failure detected during the trial period will trigger an immediate rollback, routing all traffic back to the original healthy instances with zero downtime.

Step-by-Step Solution

Analyze the capacity requirement.

Determine that the environment must keep

4

instances active at all times. Standard rolling or all-at-once policies are disqualified since they reduce active capacity unless additional batches are provisioned.

To maintain

100\%

serving capacity during the update.

Evaluate the canary traffic routing requirement.

Identify Traffic splitting as the only native Elastic Beanstalk policy that can route a specific percentage of traffic (

10\%

) to a new version via the load balancer for a timed trial period (

15

minutes).

To ensure client request routing is controlled at the load balancer level, avoiding DNS caching issues.

Determine the automatic rollback mechanism.

Select the option to associate CloudWatch alarms with the environment's rollback rules.

This enables Elastic Beanstalk to automatically cancel the deployment and shift all traffic back to the original instances if metrics exceed thresholds during the evaluation period.

Key Concept

AWS Elastic Beanstalk Traffic Splitting deployment policy and CloudWatch alarm-based rollbacks.

Question 785Question →

A company uses Amazon Route 53 active-passive failover to route traffic to a primary web application in the us-east-1 Region. The primary DNS record is associated with a Route 53 health check that monitors a CloudWatch alarm. This alarm is configured to monitor a custom metric, ApplicationErrorCount, which is only published to CloudWatch when the application encounters internal server errors. During periods of no traffic, no metrics are published, causing the CloudWatch alarm to enter the INSUFFICIENT_DATA state. This transitions the Route 53 health check to unhealthy, triggering an undesired failover to the passive region. Which configuration change will prevent the undesired failovers while maintaining automated failover capability?

Modify the primary Route 53 record's routing policy to weighted routing, assigning a weight of 100 to the primary record and a weight of 0 to the secondary record.

Configure the Route 53 health check to treat the INSUFFICIENT_DATA state of the CloudWatch alarm as "Healthy".

Enable detailed monitoring on the application's EC2 instances to ensure metrics are reported at 1-minute intervals, keeping the CloudWatch alarm in the OK state.

Reconfigure the Application Load Balancer target group to use Multi-AZ deployment and automatically redirect traffic to a standby target group in another region without Route 53.

Show answer & explanation

Answer: Configure the Route 53 health check to treat the INSUFFICIENT_DATA state of the CloudWatch alarm as "Healthy".

Answer

Configure the Route 53 health check to treat the INSUFFICIENT_DATA state of the CloudWatch alarm as "Healthy".

Configuring the Route 53 health check to treat the INSUFFICIENT_DATA state of the CloudWatch alarm as 'Healthy' solves the issue. When a Route 53 health check is configured to monitor a CloudWatch alarm, the administrator must specify how the health check behaves if the alarm has insufficient data. Since the custom metric ApplicationErrorCount is only published when errors occur, the alarm naturally enters the INSUFFICIENT_DATA state during healthy, low-traffic periods. Treating this state as 'Healthy' prevents false failovers.

Step-by-Step Solution

Analyze why the Route 53 health check is failing over during periods of no traffic.

The health check monitors a CloudWatch alarm that tracks a custom metric. The custom metric is only published when errors occur. Without traffic, no errors occur, causing no data to be published and the alarm to transition to the INSUFFICIENT_DATA state.

Understanding the source of the false unhealthy status is necessary to target the correct setting.

Determine the behavior of Route 53 health status when a CloudWatch alarm enters the INSUFFICIENT_DATA state.

By default or if misconfigured, Route 53 can treat INSUFFICIENT_DATA as unhealthy, which triggers the failover.

Identifying the relationship between the alarm's state and Route 53's evaluation of that state.

Configure the Route 53 health check's 'health status if insufficient data' setting.

Changing the setting to 'Healthy' ensures that the Route 53 health check remains healthy when the alarm has no data, preventing failover unless the alarm explicitly enters the ALARM state.

This resolves the false failover behavior while maintaining automatic failover when errors actually occur and trigger the ALARM state.

Key Concept

Route 53 DNS Failover using CloudWatch Alarm Health Checks

Estimated Time:1m 30s

Question 786Question →

A SysOps administrator is tasked with configuring automated remediation to delete unencrypted Amazon EBS volumes immediately after they are created. The administrator decides to use AWS Config to evaluate compliance and run the remediation. Which two steps must the administrator perform to configure this automated operational response? (Select TWO.)

Select all that apply

Configure a remediation action within the AWS Config rule that targets the AWS-DeleteVolume Systems Manager Automation document.

Create an IAM service role for Systems Manager Automation that contains permissions for ec2:DeleteVolume and trusts ssm.amazonaws.com to assume the role.

Create an Amazon EventBridge rule that detects non-compliant evaluation results from AWS Config and targets the Systems Manager Automation document directly.

Add sts:AssumeRole permissions to the IAM user policy of the administrator setting up the remediation to grant access to the remediation execution role.

Enable Amazon CloudWatch detailed monitoring to decrease the detection latency of the AWS Config rule evaluations to one minute.

Show answer & explanation

Answer: Configure a remediation action within the AWS Config rule that targets the AWS-DeleteVolume Systems Manager Automation document.; Create an IAM service role for Systems Manager Automation that contains permissions for ec2:DeleteVolume and trusts ssm.amazonaws.com to assume the role.

Answer

Configure a remediation action within the AWS Config rule that targets the AWS-DeleteVolume Systems Manager Automation document, and create an IAM service role for Systems Manager Automation that contains permissions for ec2:DeleteVolume and trusts ssm.amazonaws.com to assume the role.

To automate the deletion of non-compliant EBS volumes, the administrator must configure a remediation action directly in the AWS Config rule using the AWS-DeleteVolume Systems Manager document. Additionally, the Systems Manager service needs permissions to delete the volume on the user's behalf. This is achieved by creating an IAM service role containing the ec2:DeleteVolume action and configuring the trust policy to allow ssm.amazonaws.com to assume the role.

Step-by-Step Solution

Define the remediation target.

The AWS Config rule for EBS volume encryption is associated with the AWS-DeleteVolume Systems Manager Automation document as its remediation action.

This establishes the link between a non-compliant event (unencrypted volume) and the execution runbook.

Configure the execution permissions for the remediation action.

An IAM role is created with a policy allowing ec2:DeleteVolume, and its trust policy is configured to trust ssm.amazonaws.com.

Systems Manager Automation needs an IAM role to perform the ec2:DeleteVolume action on the administrator's behalf.

Grant the administrator PassRole permission.

The administrator's IAM policy is updated to include iam:PassRole for the created SSM execution role.

This allows the administrator to delegate the execution role to the Systems Manager service during configuration.

Key Concept

AWS Config native remediation allows SysOps administrators to associate AWS-managed or custom Systems Manager Automation documents directly with AWS Config rules. This requires configuring a service execution role with appropriate permissions and trust relationships.

Question 787Question →

An organization's legacy web application streams its access logs to an Amazon CloudWatch Logs group named `/apps/web-server/access_log` in the following Common Log Format (CLF):

192.0.2.10 - - [14/Jul/2026:10:15:30 +0000] "POST /api/v1/payment HTTP/1.1" 401 1024

A SysOps Administrator needs to create a custom metric to count HTTP $401$ unauthorized access attempts to the `/api/v1/payment` endpoint. If the rate of these attempts exceeds $10$ per minute, an automated remediation workflow must be triggered. Which configuration and architecture should the SysOps Administrator implement to meet these requirements?

Create a metric filter on the log group with the pattern `[ip, identity, user, timestamp, request = "*payment*", status_code = 401, size]` to publish a custom metric, and configure a CloudWatch alarm on this metric to trigger an Amazon EventBridge rule.

Enable CloudWatch Detailed Monitoring on the underlying web servers to decrease log processing latency to

1

-minute, and configure a metric filter using the JSON pattern `{

.request = "*payment*" &&

.status_code = 401 }`.

Configure a metric filter using the pattern `[ip, identity, user, timestamp, request = "%payment%", status_code = 401, size]`, and set the log group retention period to at least

30

days to preserve the metric data.

Create an Amazon EventBridge rule with an event pattern matching the log group directly using `[ip, identity, user, timestamp, request = "*payment*", status_code = 401, size]` to route matching logs directly to an AWS Systems Manager Automation document.

Show answer & explanation

Answer: Create a metric filter on the log group with the pattern `[ip, identity, user, timestamp, request = "*payment*", status_code = 401, size]` to publish a custom metric, and configure a CloudWatch alarm on this metric to trigger an Amazon EventBridge rule.

Answer

The correct option correctly uses the space-delimited array syntax to define the fields in the Common Log Format (CLF). It filters the fifth field (request) using wildcard asterisks to match requests containing the word 'payment', and filters the sixth field (status_code) to match HTTP 401. It then publishes this count as a custom metric, which is monitored by a CloudWatch alarm that triggers an EventBridge rule for remediation.

Step-by-Step Solution

Analyze the log format to identify how fields are delimited.

The log format is space-delimited (Common Log Format), which requires a space-delimited filter pattern `[field1, field2, ...]` where fields containing spaces (like request) are grouped by quotes.

Choosing the correct filter syntax ensures CloudWatch Logs can parse the fields correctly.

Define the filter pattern rules using wildcard operators and status code filters.

The filter pattern is defined as `[ip, identity, user, timestamp, request = "*payment*", status_code = 401, size]`, using asterisks (`*`) as wildcards.

This isolates HTTP

401

status codes for requests containing '/payment'.

Connect the custom metric to an alarm and remediation action.

Create a CloudWatch alarm based on the custom metric published by the filter and configure it to notify an Amazon EventBridge rule when the threshold of

10

attempts per minute is breached.

This establishes the automated remediation workflow.

Key Concept

CloudWatch Logs Metric Filters allow you to parse space-delimited or JSON log entries to publish custom metrics, which can then trigger alarms and automated remediation via EventBridge.

Estimated Time:1m 30s

Question 788Question →

An enterprise distributes standardized development environments across a multi-account organization using AWS Organizations. The SysOps administrator in the central hub account (111122223333) has shared a Service Catalog portfolio containing a web application product with a member development account (444455556666). In the hub account, the portfolio is configured with a launch constraint that specifies a launch role named ServiceCatalogLaunchRole.

When an IAM user in the development account attempts to provision the shared product, the provisioning fails, and the underlying CloudFormation stack rolls back.

Which two actions must the SysOps administrator take in the development account to ensure the product can be successfully provisioned? (Select TWO.)

Select all that apply

Define an IAM role named ServiceCatalogLaunchRole within the development account, assign the required resource provisioning permissions, and configure its trust relationship to allow servicecatalog.amazonaws.com to assume the role.

Associate an IAM policy with the provisioning user in the development account to grant the PassRole permission for the ServiceCatalogLaunchRole ARN.

Associate an IAM policy with the provisioning user in the development account that permits the user to assume the ServiceCatalogLaunchRole in the hub account using the STS AssumeRole API.

Update the trust relationship of the ServiceCatalogLaunchRole in the hub account to trust the development account's users, and share the role's ARN with the development account.

In the development account, create a custom resource policy on the shared portfolio that explicitly allows CloudFormation to execute API calls on behalf of the provisioning user.

Show answer & explanation

Answer: Define an IAM role named ServiceCatalogLaunchRole within the development account, assign the required resource provisioning permissions, and configure its trust relationship to allow servicecatalog.amazonaws.com to assume the role.; Associate an IAM policy with the provisioning user in the development account to grant the PassRole permission for the ServiceCatalogLaunchRole ARN.

Answer

To resolve the provisioning failure, the administrator must define the ServiceCatalogLaunchRole locally in the development account with a trust policy allowing the servicecatalog.amazonaws.com service principal to assume it, and grant the provisioning user the PassRole permission for that local role ARN.

When a portfolio is shared across accounts in AWS Organizations, launch constraints are evaluated in the context of the recipient account. Therefore, the specified execution role must exist in the recipient account (development account) and have a trust relationship allowing the AWS Service Catalog service principal to assume it. Additionally, the user provisioning the product must have the permission to pass this local role to the service.

Step-by-Step Solution

Analyze the cross-account launch constraint behavior.

Identify that the launch role name specified in the hub portfolio constraint must map to a local role in the target development account.

AWS Service Catalog executes CloudFormation deployments locally within the target account using the specified role name.

Define the IAM role in the recipient account.

Create ServiceCatalogLaunchRole in account 444455556666 with resource creation permissions.

The role must exist locally in the development account to have the authority to provision resources in that specific account.

Establish the service trust relationship on the local role.

Configure the trust policy of the local role to trust servicecatalog.amazonaws.com.

Allows the AWS Service Catalog service principal to assume this execution role during provisioning.

Configure provisioning user permissions.

Grant PassRole permission for the local role to the provisioning IAM user.

Ensures the user has the authority to delegate the execution role to the AWS Service Catalog service.

Key Concept

AWS Service Catalog cross-account portfolio sharing requires the specified launch constraint role to exist locally in the recipient account and requires the provisioning principal to have PassRole permission for that role.

Question 789Question →

A SysOps administrator has configured an Amazon EC2 instance to upload files to an Amazon S3 bucket. The bucket is encrypted using a customer managed key (CMK) in AWS Key Management Service (AWS KMS). The administrator has attached an IAM policy to the EC2 instance's IAM role that grants 's3:PutObject' permission. However, when the application on the EC2 instance attempts to write to the S3 bucket, it receives an Access Denied error. Which configuration change will resolve this issue?

Update the KMS key policy to allow the EC2 instance's IAM role permissions for the 'kms:GenerateDataKey' and 'kms:Decrypt' actions.

Attach an IAM policy to the EC2 instance's IAM role that grants the 'kms:GenerateDataKey' and 'kms:Decrypt' permissions without modifying the KMS key policy.

Add the 'iam:PassRole' permission to the EC2 instance's IAM role to allow the S3 service to assume the role and access the KMS key.

Configure an Amazon S3 Gateway VPC Endpoint in the VPC and associate it with the subnet's route table.

Show answer & explanation

Answer: Update the KMS key policy to allow the EC2 instance's IAM role permissions for the 'kms:GenerateDataKey' and 'kms:Decrypt' actions.

Answer

Update the KMS key policy to allow the EC2 instance's IAM role permissions for the 'kms:GenerateDataKey' and 'kms:Decrypt' actions.

The correct answer is to update the KMS key policy to allow the EC2 instance's IAM role permissions for the 'kms:GenerateDataKey' and 'kms:Decrypt' actions. When writing to an S3 bucket encrypted with a customer managed key, the client must request a data key from KMS to encrypt the object before uploading it. Therefore, the IAM role needs KMS permissions, and because KMS key policies are the primary authority for key access, the KMS key policy must be updated to allow the IAM role to perform these actions.

Step-by-Step Solution

Identify the resource-based policy that controls access to the KMS key.

The KMS customer managed key has a key policy that governs access, separate from S3 bucket policies.

AWS KMS requires a key policy to authorize key usage, and IAM policies alone are not sufficient unless explicitly enabled by the key policy.

Determine the required API actions for writing encrypted data to S3.

Writing to a KMS-encrypted S3 bucket requires 'kms:GenerateDataKey' and 'kms:Decrypt' permissions.

The client must generate a data key to encrypt the object metadata/payload and decrypt keys during write verification.

Modify the KMS key policy to include the EC2 instance's IAM role ARN as a principal allowed to perform these actions.

The Access Denied error is resolved and the application can successfully upload files.

This establishes the necessary trust relationship and grants the required key usage permissions directly to the IAM role.

Key Concept

KMS key policies take precedence over IAM policies, and accessing a KMS-encrypted S3 bucket requires both S3 and KMS permissions.

Question 790Question →

A SysOps administrator is configuring automated, event-driven remediation for non-compliant resources. The administrator sets up the AWS Config managed rule `rds-snapshots-public-prohibited` to detect public Amazon RDS DB snapshots. To automatically remediate non-compliant snapshots, the administrator configures AWS Config to trigger the Systems Manager Automation document `AWS-DisablePublicAccessForRDSSnapshot`.

The administrator creates an IAM role named `ConfigRemediationExecutionRole` with a trust policy that allows `config.amazonaws.com` to assume the role. The role has an identity-based policy that allows `ssm:StartAutomationExecution` and `rds:ModifyDBSnapshotAttribute`. The administrator also creates a separate IAM role named `SSMAutomationAssumeRole` with a trust policy that allows `ssm.amazonaws.com` to assume it. This role has the permissions required to modify RDS snapshot attributes.

When configuring the remediation action in AWS Config, the administrator specifies `ConfigRemediationExecutionRole` as the remediation execution role, and passes the ARN of `SSMAutomationAssumeRole` as the `AutomationAssumeRole` parameter for the Systems Manager document. During testing, AWS Config detects a public snapshot, but the remediation fails with an execution error indicating authorization failure.

What configuration adjustment must the administrator make to resolve this issue?

Modify the trust policy of ConfigRemediationExecutionRole to allow the ssm.amazonaws.com service principal to assume the role.

Add iam:PassRole permission to ConfigRemediationExecutionRole targeting the resource SSMAutomationAssumeRole.

Create an Amazon EventBridge rule that triggers on AWS Config compliance changes to invoke the Systems Manager Automation document directly, as AWS Config cannot initiate remediation actions natively.

Enable detailed monitoring on the Amazon RDS instances and configure the AWS Config recorder to perform evaluations at one-minute intervals.

Show answer & explanation

Answer: Add iam:PassRole permission to ConfigRemediationExecutionRole targeting the resource SSMAutomationAssumeRole.

Answer

Add iam:PassRole permission to ConfigRemediationExecutionRole targeting the resource SSMAutomationAssumeRole.

The correct answer states that the administrator must add the iam:PassRole permission to ConfigRemediationExecutionRole targeting the resource SSMAutomationAssumeRole. When AWS Config starts a Systems Manager Automation execution that specifies a service role (AutomationAssumeRole), the role assumed by AWS Config (ConfigRemediationExecutionRole) must have permission to pass that service role to Systems Manager. Without iam:PassRole, the delegation fails with an authorization error.

Step-by-Step Solution

Analyze the event-driven automation flow.

AWS Config acts as the detection mechanism, which triggers AWS Systems Manager (SSM) Automation as the target to perform remediation.

Understanding the interaction between AWS Config remediation and Systems Manager Automation is key to identifying permission gaps.

Identify the role delegation chain.

AWS Config assumes ConfigRemediationExecutionRole to call the ssm:StartAutomationExecution API. During execution, SSM Automation assumes SSMAutomationAssumeRole to perform the actual remediation steps.

Since AWS Config is instructing Systems Manager to execute a document using a specific service role, AWS Config must be authorized to pass that service role to Systems Manager.

Determine the missing IAM permission.

The execution role assumed by AWS Config (ConfigRemediationExecutionRole) requires the iam:PassRole permission to pass SSMAutomationAssumeRole to Systems Manager.

Without iam:PassRole on the initiating role, any attempt by that role to start an automation execution specifying an AutomationAssumeRole parameter will fail with an authorization error.

Key Concept

Delegating permissions between services in automated remediations requires the calling service's role to possess the iam:PassRole permission for the role being assumed by the target service.

Question 791Question →

A SysOps administrator is configuring AWS CodeDeploy to deploy updates to a web application running on an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer. The deployment process must maintain full application capacity during the deployment to avoid performance degradation, automatically revert to the previous version with the minimum possible recovery time if application-specific Amazon CloudWatch alarms are triggered, and ensure that active user sessions connected to the old version are not abruptly disconnected. Which configuration should the administrator select to meet these requirements?

Configure a blue/green deployment with an automatic rollback configuration for CloudWatch alarms, and set a deregistration delay on the load balancer's target group.

Configure an in-place deployment with an automatic rollback configuration for CloudWatch alarms, and set a deregistration delay on the load balancer's target group.

Configure a blue/green deployment with a manual rollback action, and configure connection draining on the Auto Scaling group lifecycle hooks.

Configure an in-place deployment with a custom deployment configuration of CodeDeployDefault.AllAtOnce, and enable automatic rollback when a deployment fails.

Show answer & explanation

Answer: Configure a blue/green deployment with an automatic rollback configuration for CloudWatch alarms, and set a deregistration delay on the load balancer's target group.

Answer

Configure a blue/green deployment with an automatic rollback configuration for CloudWatch alarms, and set a deregistration delay on the load balancer's target group.

The correct configuration is a blue/green deployment combined with automatic rollback and load balancer deregistration delay. A blue/green deployment maintains full capacity by provisioning a new auto scaling group (the green environment) alongside the existing one (the blue environment). If a CloudWatch alarm triggers a rollback, CodeDeploy can instantly redirect traffic back to the original instances, resulting in the shortest recovery time. The deregistration delay (connection draining) ensures that existing sessions on the old instances are allowed to complete before the instances are terminated.

Step-by-Step Solution

Analyze the capacity requirement during deployment.

Determine that a blue/green deployment strategy is required because it provisions a separate fleet (green) to deploy the new version, maintaining 100% capacity on the existing fleet (blue) until the update is successful.

In-place deployments take instances out of service or update them directly, reducing active capacity or risking downtime.

Evaluate the rollback speed and automation requirements.

Configure automatic rollback based on CloudWatch alarms. A blue/green deployment allows CodeDeploy to instantly route traffic back to the original instances, minimizing rollback recovery time.

Rolling back an in-place deployment requires running a new deployment of the previous code revision, which is slow and violates the minimum recovery time requirement.

Address the requirement to prevent abrupt disconnection of active user sessions.

Configure a deregistration delay (connection draining) on the load balancer's target group.

Deregistration delay allows existing connections to complete their requests before CodeDeploy terminates the original instances.

Key Concept

AWS CodeDeploy deployment strategies (In-place vs Blue/Green), rollback behaviors, and Load Balancer integration settings.

Question 792Question →

A SysOps administrator has configured automatic rotation for a database credential stored in AWS Secrets Manager. During the first scheduled rotation, the administrator notices that the rotation status changes to failed, and the database credentials are not updated. Which of the following is the most likely cause of this rotation failure?

The database instance is missing an IAM service role that grants access to decrypt the secret using the customer managed KMS key.

The administrator's IAM policy is missing the iam:PassRole permission required to associate the rotation role with the database.

The AWS Lambda rotation function cannot network-communicate with the database endpoint to update the credentials.

The Systems Manager Automation document lacks an EventBridge trigger to schedule the secret rotation.

Show answer & explanation

Answer: The AWS Lambda rotation function cannot network-communicate with the database endpoint to update the credentials.

Answer

The AWS Lambda rotation function cannot network-communicate with the database endpoint to update the credentials.

For AWS Secrets Manager to rotate a database credential, it runs an AWS Lambda rotation function that connects to the database to update the password. If the Lambda function cannot establish a network connection to the database (e.g., due to VPC security groups, network access control lists, or routing rules), the rotation process fails.

Step-by-Step Solution

Analyze how AWS Secrets Manager rotates credentials.

Secrets Manager invokes a Lambda rotation function to update the credentials in the database.

Understanding the rotation architecture helps isolate the components involved in the failure.

Determine the network requirements for the Lambda rotation function.

The Lambda function must have network access to the database endpoint (e.g., inside a VPC) and the database must accept connections from the Lambda function's security group.

Since the Lambda function needs to log in and change the password, a network path must exist between the function and the database.

Identify the root cause of the rotation failure.

A lack of network connectivity prevents the Lambda function from reaching the database, causing the rotation to fail.

This direct network communication is a prerequisite for a successful rotation.

Key Concept

Secrets Manager automatic rotation requires a Lambda rotation function that has both the correct database access permissions and direct network connectivity to the target database endpoint.

Estimated Time:1m 0s

Question 793Question →

An organization runs a containerized microservice on Amazon ECS in Account B ( $111122223333$ ). The application must retrieve database credentials stored in AWS Secrets Manager in Account A ( $444455556666$ ). The secret in Account A is encrypted using a customer managed KMS key.

The SysOps administrator has configured the secret's resource policy in Account A to allow the ECS task execution role in Account B to perform `secretsmanager:GetSecretValue`. In Account B, the administrator attached an IAM policy to the ECS task execution role allowing `secretsmanager:GetSecretValue` on the secret ARN and `kms:Decrypt` on the KMS key ARN in Account A.

During container startup, the task fails with an `AccessDeniedException` indicating that the ECS container agent is unauthorized to perform `kms:Decrypt` on the customer managed KMS key.

Which action should the administrator take to resolve this issue?

Add the `iam:PassRole` permission to the ECS task execution role in Account B targeting the AWS Secrets Manager service role in Account A.

Change the encryption of the secret in Account A to use the default AWS managed key (`aws/secretsmanager`) to automatically delegate decryption authority to Account B.

Add a statement to the key policy of the customer managed KMS key in Account A that allows the ECS task execution role in Account B to perform the `kms:Decrypt` action.

Deploy a VPC endpoint for AWS Secrets Manager in Account B's VPC, and ensure the endpoint's route table includes a route pointing to the VPC peering connection with Account A.

Show answer & explanation

Answer: Add a statement to the key policy of the customer managed KMS key in Account A that allows the ECS task execution role in Account B to perform the `kms:Decrypt` action.

Answer

Add a statement to the key policy of the customer managed KMS key in Account A that allows the ECS task execution role in Account B to perform the `kms:Decrypt` action.

For cross-account access where an IAM role in Account B needs to retrieve a secret encrypted with a customer managed KMS key in Account A, both resource policies in Account A must permit the access. The secret's resource policy must permit the role to call `secretsmanager:GetSecretValue`, and the KMS key policy must permit the role to call `kms:Decrypt`. Because the KMS key is in a different account, IAM policies in Account B alone cannot grant the permission without the source key policy delegating authority.

Step-by-Step Solution

Analyze the authorization chain for cross-account encrypted secret retrieval.

Identify that the ECS task execution role in Account B requires both Secrets Manager permissions on the secret and KMS Decrypt permissions on the customer managed key.

When a secret is encrypted with a KMS customer managed key, the decryption permission is evaluated separately from the secret read permission.

Evaluate why the identity-based policy in Account B is insufficient on its own.

Recognize that identity policies in one account cannot grant access to KMS resources in another account unless the KMS key policy in the source account delegates that authority.

AWS Key Management Service key policies must explicitly trust external accounts or specific external roles for cross-account cryptographic operations.

Formulate the correct policy modification.

Determine that updating the customer managed KMS key policy in Account A to trust the ECS task execution role in Account B with `kms:Decrypt` resolves the authorization issue.

This establishes the necessary trust relationship, allowing the ECS container agent to decrypt the secret payload during container startup.

Key Concept

Cross-account AWS KMS key access for Secrets Manager encryption keys

Estimated Time:2m 30s

Question 794Question →

A SysOps Administrator is managing a business-critical application that currently uses a single-instance Amazon RDS for MySQL DB instance. The database needs to be upgraded to support high availability with automatic failover to minimize downtime during unplanned outages. Additionally, the reporting team needs to run daily query-intensive reports without impacting the performance of the write operations on the primary database. Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Modify the DB instance to enable Multi-AZ deployment, creating a synchronous standby instance in a different Availability Zone.

Create an RDS Read Replica and configure the reporting application to direct queries to the read replica endpoint.

Configure Amazon Route 53 with a failover routing policy that points to a Read Replica, designating it as the primary failover target.

Enable Multi-AZ deployment and configure the reporting application to read directly from the standby instance's endpoint.

Configure the DB instance to perform synchronous replication to an RDS Read Replica, allowing it to serve as the automatic failover target.

Show answer & explanation

Answer: Modify the DB instance to enable Multi-AZ deployment, creating a synchronous standby instance in a different Availability Zone.; Create an RDS Read Replica and configure the reporting application to direct queries to the read replica endpoint.

Answer

Modifying the DB instance to enable Multi-AZ deployment and creating an RDS Read Replica to offload reporting queries are the correct actions.

To achieve database high availability with automatic failover, the SysOps Administrator must enable Multi-AZ deployment, which replicates data synchronously to a standby instance in a different Availability Zone. To handle query-intensive reports without affecting the primary write performance, the administrator must create an RDS Read Replica and route the read traffic to its endpoint.

Step-by-Step Solution

Identify high availability requirements.

The primary database requires high availability with automatic failover to minimize downtime.

Unplanned outages can be mitigated by RDS Multi-AZ deployments, which automatically fail over to a synchronous standby.

Identify reporting query requirements.

The reporting queries must be offloaded to avoid performance impact on write operations.

RDS Read Replicas are designed to handle read-heavy workloads and operate independently of the primary instance's write workload.

Eliminate options that use incorrect failover or read methods.

Options proposing reading from the Multi-AZ standby, using Route 53 failover for read replicas, or configuring synchronous replication to a read replica are incorrect.

Standby instances are passive and inaccessible; read replicas are asynchronous and do not support automatic failover via DNS routing policies.

Key Concept

Database High Availability

Estimated Time:2m 0s

Question 795Question →

A SysOps administrator is configuring event-driven remediation for non-compliant security groups using AWS Config. The administrator selects the AWS Config rule `restricted-common-ports` and sets up an automatic remediation action using the AWS Systems Manager (SSM) Automation document `AWS-CloseSecurityGroup`.

The administrator creates an IAM role named `SSMRemediationRole` that has the required permissions to modify security groups and a trust relationship allowing the Systems Manager service (`ssm.amazonaws.com`) to assume the role.

When the administrator attempts to save the remediation configuration in AWS Config with the `SSMRemediationRole` ARN specified in the `AutomationAssumeRole` parameter, the operation fails with an 'Access Denied' error.

Which action will resolve this error?

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the SSMRemediationRole.

Update the trust relationship of the SSMRemediationRole to allow the AWS Config service (config.amazonaws.com) to assume the role.

Create an Amazon EventBridge rule that triggers the Systems Manager Automation document directly, bypassing AWS Config remediation.

Enable detailed monitoring on the target EC2 instances and configure a CloudWatch Logs metric filter to trigger the SSM document.

Show answer & explanation

Answer: Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the SSMRemediationRole.

Answer

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the SSMRemediationRole.

To configure automatic remediation in AWS Config, the user setting up the remediation must have permission to pass the role that AWS Systems Manager Automation will assume. This is done by adding the iam:PassRole permission for the target role resource to the administrator's IAM policy. Without this permission, the console or API prevents the user from assigning that role to the service, resulting in an 'Access Denied' error.

Step-by-Step Solution

Analyze the error message and context.

The configuration fails with 'Access Denied' when trying to assign the SSMRemediationRole as the AutomationAssumeRole in the AWS Config remediation configuration.

This error occurs because the active IAM user/role (the administrator) does not have permission to pass the SSMRemediationRole to the Systems Manager service.

Identify the required IAM permission.

The iam:PassRole action is required to delegate permissions to another AWS service.

When configuring AWS services (like AWS Config or Systems Manager) to perform actions using a specific role, AWS requires the configuring user to have iam:PassRole for that target role to prevent privilege escalation.

Apply the remediation to the administrator's policy.

Add iam:PassRole for the SSMRemediationRole ARN to the administrator's IAM user or role policy.

This allows the administrator to delegate the SSMRemediationRole to Systems Manager, enabling the remediation configuration to save successfully.

Key Concept

Delegating permissions to AWS services using the iam:PassRole permission for event-driven automation remediation.

Question 796Question →

A SysOps administrator is configuring an AWS Systems Manager Automation workflow. The workflow requires a custom IAM role to perform actions on AWS resources. The administrator has already created the IAM role with the necessary permissions policies.

Which combination of actions is required to allow the Systems Manager Automation workflow to run successfully using this role? (Select TWO.)

Select all that apply

Configure the trust policy of the custom IAM role to allow the ssm.amazonaws.com service principal to perform the sts:AssumeRole action

Attach an IAM permissions policy to the administrator's IAM identity that grants the iam:PassRole permission for the custom IAM role

Configure the trust policy of the custom IAM role to allow the administrator's IAM identity to perform the iam:PassRole action

Attach an IAM permissions policy to the custom IAM role that grants the sts:AssumeRole permission to the ssm.amazonaws.com service principal

Show answer & explanation

Answer: Configure the trust policy of the custom IAM role to allow the ssm.amazonaws.com service principal to perform the sts:AssumeRole action; Attach an IAM permissions policy to the administrator's IAM identity that grants the iam:PassRole permission for the custom IAM role

Answer

The correct actions are to configure the trust policy of the custom IAM role to allow the Systems Manager service principal to assume the role, and to attach an IAM permissions policy to the administrator's IAM identity that grants the iam:PassRole permission.

To delegate permissions to an AWS service like Systems Manager Automation, the service must be allowed to assume the custom role, which is configured in the role's trust policy. Additionally, the administrator who passes the role to the service must have the iam:PassRole permission granted in their identity-based policy.

Step-by-Step Solution

Review the requirement for the AWS service to assume the custom IAM role.

Identify that the trust policy (trust relationship) of the custom IAM role must grant sts:AssumeRole to the ssm.amazonaws.com service principal.

AWS services need explicit permission via a trust policy to assume execution roles in your account.

Review the requirement for the administrator executing the Systems Manager Automation.

Identify that the administrator's IAM user or group policy must contain the iam:PassRole action targeting the custom IAM role's ARN.

Users require iam:PassRole permissions to associate an IAM role with an AWS service.

Key Concept

Configuring trust policies and passing roles to AWS services

Question 797Question →

A SysOps Administrator is designing a deployment pipeline for a production application running on Amazon EC2 instances managed by an Auto Scaling group behind an Application Load Balancer (ALB). The deployment strategy must satisfy the following constraints:
- Deploy the new version with zero downtime.
- Route exactly $10\%$ of live user traffic to the new version for a 10-minute validation period.
- Automatically route the remaining $90\%$ of traffic after the validation period if no CloudWatch alarms are active.
- Support instantaneous rollback to the original version during the validation period.

The administrator discovers that the current AWS CodeDeploy blue/green configuration cannot perform fractional traffic routing for the EC2 Auto Scaling group.

Which strategy should the administrator implement to meet all requirements?

Deploy the application using AWS Elastic Beanstalk and configure a traffic splitting deployment policy with a

10\%

traffic split and a 10-minute evaluation period.

Modify the CodeDeploy deployment group configuration to use the CodeDeployDefault.LambdaCanary10Percent10Minutes deployment configuration.

Update the AWS CloudFormation template for the Auto Scaling group to use an AutoScalingRollingUpdate policy with a MinSuccessfulInstancesPercent set to

90\%

Use an AWS Systems Manager Automation document to perform an in-place deployment to

10\%

of the instances first, then deploy to the remaining instances after 10 minutes.

Show answer & explanation

Answer: Deploy the application using AWS Elastic Beanstalk and configure a traffic splitting deployment policy with a $10\%$ traffic split and a 10-minute evaluation period.

Answer

Deploy the application using AWS Elastic Beanstalk and configure a traffic splitting deployment policy with a

10\%

traffic split and a 10-minute evaluation period.

The correct strategy is to deploy the application using AWS Elastic Beanstalk with a traffic splitting deployment policy. Elastic Beanstalk supports traffic splitting, which allows a SysOps Administrator to route a small, configurable percentage of traffic (such as 10%) to the new version in a temporary environment. It monitors the health of the new version for a set duration, and if any CloudWatch alarms are triggered, it immediately redirects all traffic back to the original version, providing an instantaneous rollback.

Step-by-Step Solution

Identify the limitations of the current deployment tools.

AWS CodeDeploy cannot perform canary or fractional traffic shifting for EC2/On-Premises deployments natively; it only supports this for AWS Lambda and Amazon ECS.

This rules out utilizing CodeDeploy's built-in canary configurations for EC2 instances.

Evaluate alternative deployment strategies that support traffic splitting on EC2.

AWS Elastic Beanstalk supports a traffic splitting deployment policy, which handles deploying the application to a new Auto Scaling group and splitting the ALB traffic by a specified percentage.

This matches all key constraints of the deployment scenario: zero downtime, 10% traffic verification, and automatic rollback.

Verify rollback mechanisms.

Elastic Beanstalk monitors CloudWatch alarms during the evaluation period and will automatically roll back traffic to the old version instantly if a threshold is crossed.

This guarantees the instantaneous rollback requirement is met.

Key Concept

Deployment Strategies and Traffic Splitting on AWS

Estimated Time:2m 30s

Question 798Question →

An organization wants to automatically stop idle Amazon EC2 instances to reduce costs. A SysOps administrator configures an Amazon CloudWatch alarm that transitions to the ALARM state when CPU utilization remains below $5\%$ for 1 hour. The administrator then creates an Amazon EventBridge rule that detects the CloudWatch alarm state change and targets an AWS Systems Manager (SSM) Automation document using the `AWS-StopEC2Instance` template. During testing, the CloudWatch alarm enters the ALARM state, but the EC2 instance is not stopped. The EventBridge dead-letter queue (DLQ) indicates a delivery failure due to an authorization issue. Which action will resolve this issue?

Configure the CloudWatch alarm to trigger an Amazon CloudWatch Logs subscription filter that executes the SSM Automation document directly.

Add the iam:PassRole permission to the EventBridge rule's IAM execution role to allow it to pass the SSM Automation execution role to Systems Manager.

Enable detailed monitoring on the target EC2 instances to ensure CloudWatch metrics are evaluated at 1-minute intervals.

Modify the trust policy of the SSM Automation execution role to allow the EC2 service principal to assume the role.

Show answer & explanation

Answer: Add the iam:PassRole permission to the EventBridge rule's IAM execution role to allow it to pass the SSM Automation execution role to Systems Manager.

Answer

Add the iam:PassRole permission to the EventBridge rule's IAM execution role to allow it to pass the SSM Automation execution role to Systems Manager.

The correct option is to add the `iam:PassRole` permission to the EventBridge rule's execution role. When an EventBridge rule triggers an AWS Systems Manager Automation document that requires an execution role, the EventBridge rule's role must have the `iam:PassRole` permission to pass that execution role to Systems Manager. Without this permission, EventBridge cannot initiate the automation execution, resulting in an authorization error in the DLQ.

Step-by-Step Solution

Analyze the error message from the EventBridge dead-letter queue (DLQ).

The error indicates a delivery failure due to an authorization issue, pointing to a permissions problem between EventBridge and the target service.

Before making modifications, the SysOps administrator needs to locate where the delivery failed in the event-driven workflow.

Verify the IAM role permissions assigned to the EventBridge rule.

The role has `ssm:StartAutomationExecution` but lacks the `iam:PassRole` permission for the SSM Automation execution role.

When EventBridge triggers Systems Manager Automation, it must pass a service role to Systems Manager to perform actions on the resources. This requires the `iam:PassRole` permission.

Add the `iam:PassRole` policy statement to the EventBridge execution role pointing to the SSM Automation role ARN.

The policy update allows EventBridge to successfully invoke the automation target with the required execution context.

This grants EventBridge the authorization to delegate execution permissions to Systems Manager Automation, resolving the DLQ delivery failure.

Key Concept

Configuring correct IAM permissions, specifically iam:PassRole, for event-driven targets like AWS Systems Manager Automation in EventBridge.

Question 799Question →

A company runs a critical application using a single-node Amazon RDS for PostgreSQL DB instance. A SysOps Administrator has set up a read-only reporting environment by adding an RDS Read Replica. During a review of the disaster recovery plan, the administrator needs to ensure that the primary database has high availability with automatic failover and zero data loss in the event of an Availability Zone outage. Which action should the administrator take to meet these requirements with the shortest recovery time?

Modify the DB instance to enable the Multi-AZ deployment option.

Configure Amazon Route 53 with a failover routing policy pointing to the Read Replica endpoint.

Create an Amazon EventBridge rule to trigger an AWS Lambda function that promotes the Read Replica when the primary instance becomes unhealthy.

Modify the Read Replica to enable Multi-AZ replication and use its endpoint as the primary connection string.

Show answer & explanation

Answer: Modify the DB instance to enable the Multi-AZ deployment option.

Answer

Modify the DB instance to enable the Multi-AZ deployment option.

Enabling the Multi-AZ option on the primary RDS DB instance replicates data synchronously to a standby instance in a different Availability Zone. If the primary instance fails, AWS automatically updates the DNS record to point to the standby instance, ensuring automatic failover with zero data loss and the shortest recovery time.

Step-by-Step Solution

Analyze the business requirements for database high availability.

The solution must support automatic failover, zero data loss (synchronous replication), and recover from Availability Zone outages with minimal recovery time.

Establishing the requirements isolates the native Multi-AZ feature as the correct target architecture.

Evaluate the capabilities of Amazon RDS Multi-AZ deployments.

RDS Multi-AZ replicates data synchronously to a standby instance in a different Availability Zone and performs automatic DNS updates during failover, guaranteeing zero data loss.

This aligns perfectly with the requirement for zero data loss and automated failover.

Compare against Read Replica alternatives.

Read replicas utilize asynchronous replication, which introduces data loss risk (non-zero Recovery Point Objective) and requires manual or scripted promotion, increasing recovery time.

This disqualifies replica-based solutions for primary database high availability.

Key Concept

Amazon RDS Multi-AZ deployments provide synchronous replication, automatic failover, and high availability across Availability Zones within an AWS Region.

Estimated Time:1m 30s

Question 800Question →

A SysOps administrator is configuring an AWS Systems Manager (SSM) Automation workflow in a multi-account organization. The administrator initiates execution from Account A (Operations, 111111111111) to remediate non-compliant EC2 instances in Account B (Production, 222222222222).

The workflow uses a custom automation execution role in Account B called SSMExecutionRole to perform remediation actions, which include attaching an IAM role named RemediationEC2Role to the target EC2 instances.

The administrator has configured the following:
1. The IAM role CentralOpsRole in Account A has permissions to assume SSMExecutionRole in Account B.
2. The trust policy of SSMExecutionRole in Account B allows CentralOpsRole to assume it.
3. The trust policy of RemediationEC2Role in Account B allows ec2.amazonaws.com to assume it.

The administrator initiates the automation execution from Account A using the assumed credentials of SSMExecutionRole. The execution fails at the step that associates RemediationEC2Role with the target EC2 instances with an AccessDenied error stating that the caller is not authorized to perform iam:PassRole.

Which configuration change is required to resolve this error using the principle of least privilege?

Attach an IAM policy to the SSMExecutionRole in Account B that grants the iam:PassRole permission for the RemediationEC2Role ARN, specifying ec2.amazonaws.com in the iam:PassedToService condition key.

Attach an IAM policy to the CentralOpsRole in Account A that grants the iam:PassRole permission for the SSMExecutionRole ARN, allowing it to be passed to ssm.amazonaws.com.

Modify the trust policy of the RemediationEC2Role in Account B to allow the sts:AssumeRole action for the CentralOpsRole ARN from Account A.

Attach an IAM policy to the CentralOpsRole in Account A that grants the sts:AssumeRole permission for the RemediationEC2Role ARN in Account B.

Show answer & explanation

Answer: Attach an IAM policy to the SSMExecutionRole in Account B that grants the iam:PassRole permission for the RemediationEC2Role ARN, specifying ec2.amazonaws.com in the iam:PassedToService condition key.

Answer

The correct answer is correct because the SSMExecutionRole in Account B is the active session executing the command that associates RemediationEC2Role with the target EC2 instances. To attach an IAM role to an EC2 instance, the caller must have the iam:PassRole permission for that role. Restricting the permission with the iam:PassedToService condition key to ec2.amazonaws.com aligns with the principle of least privilege.

Step-by-Step Solution

Identify the identity performing the failing action.

The SSMExecutionRole in Account B is the active caller performing the remediation step that associates the role with the EC2 instance.

Permissions are evaluated for the credentials currently executing the action, which are those of the assumed role session in Account B.

Identify the required IAM action for associating a role with an EC2 instance.

The iam:PassRole action is required to delegate permissions to an AWS service like Amazon EC2.

When attaching a role to an EC2 instance, the service must be allowed to assume that role on behalf of the user, which requires passing the role.

Formulate the least privilege policy.

Create a policy granting iam:PassRole for the specific role ARN and use the iam:PassedToService condition key to restrict the destination service.

Using the iam:PassedToService condition prevents the role from being passed to unauthorized services.

Key Concept

Understanding iam:PassRole vs sts:AssumeRole in cross-account service delegation

Estimated Time:3m 0s

PreviousPage 40 / 49Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept