Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 801Question →

A SysOps Administrator deploys an AWS Config conformance pack containing a rule that evaluates whether Amazon S3 buckets have public read access enabled. After deployment, the compliance status for the rule remains in the 'No Data Available' state, despite the presence of active S3 buckets in the AWS account. Which of the following troubleshooting actions should the administrator perform to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Verify that the AWS Config configuration recorder is turned on and is configured to record changes for the S3 bucket resource type (AWS::S3::Bucket).; Verify that the S3 bucket designated as the AWS Config delivery channel has a bucket policy that permits AWS Config to write configuration history and snapshot files.

Answer

Verify that the AWS Config configuration recorder is turned on and is configured to record changes for S3 buckets, and verify that the S3 bucket designated as the AWS Config delivery channel has a bucket policy that permits AWS Config to write configuration files.
The correct actions are verifying that the configuration recorder is actively recording S3 buckets and that the delivery channel S3 bucket policy allows AWS Config to write files. Without the configuration recorder actively tracking S3 buckets, AWS Config cannot generate configuration items, which keeps the compliance status in a 'No Data Available' state. Similarly, delivery channel authorization issues halt the pipeline.

Step-by-Step Solution

1
Check the status and scope of the AWS Config configuration recorder.
Confirming the recorder is active and recording the AWS::S3::Bucket resource type.
If the recorder is off or S3 buckets are excluded, AWS Config will not generate configuration items for S3 buckets, resulting in a 'No Data Available' state.
2
Inspect the bucket policy of the S3 bucket used as the AWS Config delivery channel.
Confirming the policy contains the required permissions allowing the AWS Config service principal to write objects.
AWS Config needs permission to write configuration snapshots to the delivery channel bucket to function properly and complete evaluations.

Key Concept

AWS Config rules rely on the configuration recorder and delivery channel configuration to capture resource states before evaluating compliance rules.
Question 802Question →

An application runs on an Amazon EC2 instance that retrieves its database credentials at startup from AWS Systems Manager Parameter Store. The credentials are encrypted as a SecureString parameter using a custom AWS KMS customer managed key. Although the instance's IAM role has a policy allowing both ssm:GetParameter and kms:Decrypt actions, the application logs show an AccessDeniedException when trying to retrieve the parameter. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The KMS key policy associated with the custom key does not grant the EC2 instance's IAM role permission to perform the kms:Decrypt action.

Answer

The KMS key policy associated with the custom key does not grant the EC2 instance's IAM role permission to perform the kms:Decrypt action.
For custom AWS KMS keys, access is evaluated by examining both the caller's IAM policies and the KMS key policy. Even if the EC2 instance role has an IAM policy allowing the decrypt operation, the request will be denied if the key policy does not explicitly permit the role or delegate permissions to the account.

Step-by-Step Solution

1
Identify the service and encryption method used for the credentials.
The credentials are a SecureString parameter in Systems Manager Parameter Store, encrypted with a custom AWS KMS customer managed key.
Accessing a SecureString parameter requires both read access to the parameter and decrypt permissions on the underlying KMS key.
2
Evaluate the error type and existing permissions.
The error is AccessDeniedException, indicating a permission restriction rather than a network or service availability issue. The IAM policy already allows ssm:GetParameter and kms:Decrypt.
Since the IAM policy allows the actions, the restriction must reside in another policy type that controls access to the resource.
3
Determine the access control mechanism for custom AWS KMS keys.
Custom AWS KMS keys require explicit permission in their key policies to allow IAM policies to delegate or grant access.
Without the KMS key policy granting permissions to the EC2 role, the KMS request is denied, causing the Parameter Store retrieval to fail with AccessDeniedException.

Key Concept

KMS key policy permissions and precedence when decrypting secure parameters
Estimated Time:1m 30s
Question 803Question →

A company hosts a web application on a fleet of Amazon EC2 instances managed by an Auto Scaling group. A SysOps Administrator is configuring AWS CodeDeploy to perform in-place deployments of application updates. The deployment must maintain at least 75% of the total instance capacity to ensure performance is not degraded. Since the Auto Scaling group dynamically scales based on CPU utilization, the configuration must adapt to varying instance counts. Which configuration for the minimum healthy hosts parameter in CodeDeploy will meet these requirements?

Show answer & explanation

Answer: A custom deployment configuration with the type set to FLEET_PERCENT and the value set to 75

Answer

A custom deployment configuration with the type set to FLEET_PERCENT and the value set to 75.
The custom deployment configuration using FLEET_PERCENT set to 75 ensures that CodeDeploy keeps at least 75% of the instances in the deployment group healthy at any given time during the deployment. Because the Auto Scaling group dynamically scales, using a percentage (FLEET_PERCENT) rather than a static count (HOST_COUNT) ensures that the 75% capacity threshold is dynamically calculated and maintained regardless of the fleet size.

Step-by-Step Solution

1
Analyze the capacity requirement and environment characteristics.
Identify that the application must maintain at least 75% capacity and that the Auto Scaling group scales dynamically, which means the instance count varies.
This rules out any static host count configurations, as they cannot scale proportionally with the Auto Scaling group.
2
Determine the parameter mapping for minimum healthy hosts in CodeDeploy.
Identify that CodeDeploy uses the minimum healthy hosts parameter to specify the minimum capacity that must remain online, rather than the capacity that can be taken offline.
This ensures the percentage is configured as 75 (minimum healthy) instead of 25 (maximum offline).
3
Evaluate standard versus custom deployment configurations.
Determine that predefined configurations (like HalfAtOnce or OneAtTime) do not guarantee 75% healthy capacity for dynamically scaling fleets, requiring a custom deployment configuration.
A custom deployment configuration with FLEET_PERCENT set to 75 dynamically calculates and maintains the correct threshold as the fleet size changes.

Key Concept

AWS CodeDeploy Custom Deployment Configurations and Capacity Management
Question 804Question →

A company runs a high-traffic web application on AWS Elastic Beanstalk. The application's performance is critical, and a SysOps administrator needs to deploy a major software update. The administrator wants to use a canary-style deployment where 10%10\% of incoming traffic is directed to the new version for an evaluation period of 1010 minutes. If any error metrics spike, the deployment must immediately roll back with zero downtime for existing users.

Which two actions should the SysOps administrator take to configure this deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the deployment policy of the Elastic Beanstalk environment to Traffic Splitting, setting the traffic split percentage to 10%10\% and the evaluation time to 1010 minutes.; Ensure that Enhanced Health Reporting is enabled for the Elastic Beanstalk environment to evaluate the health of the new version and trigger an automatic rollback.

Answer

To configure this deployment, the SysOps administrator should configure the Elastic Beanstalk deployment policy to Traffic Splitting, specifying a split percentage of 10% and an evaluation time of 10 minutes, and ensure that Enhanced Health Reporting is enabled for the environment to evaluate health and trigger rollbacks.
The correct options correctly identify that Elastic Beanstalk's Traffic Splitting deployment policy enables a temporary canary environment to receive a configured percentage of traffic for a set evaluation window. Furthermore, they identify that Enhanced Health Reporting must be enabled for Elastic Beanstalk to monitor the environment's health metrics and automate rollbacks if necessary.

Step-by-Step Solution

1
Identify the appropriate Elastic Beanstalk deployment policy for canary testing.
Traffic Splitting is selected as it is specifically designed to route a percentage of traffic to a new version for a specified evaluation period before completing the rollout.
Using Traffic Splitting ensures that client traffic is split natively without manual Route 53 DNS record manipulation.
2
Identify the health monitoring requirement for Traffic Splitting.
Enhanced Health Reporting must be enabled on the Elastic Beanstalk environment.
Traffic Splitting relies on Elastic Beanstalk's Enhanced Health Reporting to monitor the health of the new instances during the evaluation period and to trigger automatic rollbacks if any issues are detected.

Key Concept

AWS Elastic Beanstalk Traffic Splitting Deployment Policy and its dependency on Enhanced Health Reporting for automated rollbacks.
Question 805Question →

A SysOps administrator needs to configure automatic rotation for database credentials stored in AWS Secrets Manager. What must the administrator configure to execute the rotation code and update the credentials in both Secrets Manager and the database?

Show answer & explanation

Answer: An AWS Lambda function with the appropriate execution role and database connectivity

Answer

An AWS Lambda function with the appropriate execution role and database connectivity
The correct answer is the option specifying an AWS Lambda function with the appropriate execution role and database connectivity. AWS Secrets Manager relies on Lambda to execute rotation templates (or custom code) that connect to the database to alter the credentials, and then call Secrets Manager to complete the rotation lifecycle.

Step-by-Step Solution

1
Identify the compute component required by AWS Secrets Manager to perform secret rotation.
AWS Secrets Manager triggers an AWS Lambda function to run the rotation logic.
Secrets Manager cannot log into databases directly to run SQL commands; it delegates this execution to a Lambda function.
2
Determine the network and permission requirements for the Lambda function.
The Lambda function must be configured to access the database's network (typically inside a VPC) and have IAM permissions to update Secrets Manager.
The function must establish a network connection to change the database user password and invoke the Secrets Manager API to store the new password.

Key Concept

AWS Secrets Manager automates secret rotation by executing an AWS Lambda function that updates the credential at the target service and records the change in the secret.
Question 806Question →

A SysOps Administrator is configuring cross-account Amazon S3 replication from a source bucket in AWS Account A to a destination bucket in AWS Account B. S3 Versioning is enabled on both buckets, and a replication rule is configured with an IAM role in Account A. Although objects successfully replicate to the destination bucket, IAM users in Account B receive an Access Denied error when trying to read the replicated objects because they are still owned by Account A. Which combination of actions must the administrator take to allow Account B's users to access the replicated objects?

Show answer & explanation

Answer: Configure the replication rule in Account A to override the replica owner to the destination bucket owner, and update Account B's bucket policy to grant the replication IAM role in Account A the s3:ObjectOwnerOverrideToBucketOwner and s3:ReplicateObject permissions.

Answer

Configure the replication rule in Account A to override the replica owner to the destination bucket owner, and update Account B's bucket policy to grant the replication IAM role in Account A the s3:ObjectOwnerOverrideToBucketOwner and s3:ReplicateObject permissions.
The correct action is to configure the replica owner override option in the replication rule (AccessControlTranslation) and grant the replication IAM role the s3:ObjectOwnerOverrideToBucketOwner permission in both the IAM policy and the destination bucket policy. This transfers ownership of replicated objects to the destination bucket owner, enabling users in Account B to access them.

Step-by-Step Solution

1
Enable replica owner override in the replication configuration.
The replication rule specifies that the replica owner should be translated to the destination bucket owner.
By default, replicated objects in cross-account replication are still owned by the source account, which prevents the destination account's users from accessing them.
2
Modify the destination bucket policy in Account B.
The bucket policy allows the source replication IAM role to perform s3:ObjectOwnerOverrideToBucketOwner.
The replication role requires explicit permission from the destination bucket owner to change the ownership of the replicated objects to the destination bucket owner.
3
Ensure the replication IAM role in Account A has the required permissions.
The role can successfully replicate the objects and perform the owner override action.
The replication role must be allowed to apply the owner override setting during the replication process.

Key Concept

Cross-Account S3 Replication Object Ownership Override
Question 807Question →

A SysOps Administrator is configuring a production database environment for a MySQL application on Amazon RDS. The database must be highly available with automatic failover support in the event of an Availability Zone outage. Additionally, the administrator must offload high-volume read traffic to reduce the load on the primary database instance. Which combination of actions should the SysOps Administrator take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Modify the RDS DB instance to be a Multi-AZ deployment to enable synchronous replication and automated failover.; Create an RDS Read Replica and update the application configuration to route read queries to the Read Replica endpoint.

Answer

To meet the high availability and read performance requirements, the SysOps Administrator must modify the RDS DB instance to be a Multi-AZ deployment and create an RDS Read Replica to offload read queries to its endpoint.
The correct actions are to modify the RDS DB instance to be a Multi-AZ deployment and create an RDS Read Replica. A Multi-AZ deployment provides high availability and automatic failover by maintaining a synchronous standby instance in a different Availability Zone. The failover is managed by AWS changing the DNS record to point to the standby. Creating a Read Replica allows you to offload read queries to a separate database endpoint, reducing the read load on the primary DB instance.

Step-by-Step Solution

1
Identify the high availability requirement.
Enable Multi-AZ deployment on the RDS instance to provide synchronous replication and automated failover.
Multi-AZ deployments provide automatic failover and high availability across Availability Zones by maintaining a synchronous standby replica.
2
Identify the read scaling requirement.
Create an RDS Read Replica and configure the application to send read queries to its specific endpoint.
Read replicas offload read traffic from the primary writer instance asynchronously, preserving resources on the primary instance for write operations.

Key Concept

Distinguishing between RDS Multi-AZ deployments for high availability/automated failover and RDS Read Replicas for read scalability.
Question 808Question →

A SysOps Administrator is setting up cross-Region disaster recovery using AWS Elastic Disaster Recovery (AWS DRS) to replicate critical Amazon EC2 workloads from Region A to Region B. The replication traffic must remain entirely within the AWS network and must not travel over the public internet. Additionally, when a disaster recovery drill is executed, the newly launched recovery instances must be automatically deployed into specific target subnets with the correct security groups. Which TWO configurations should the SysOps Administrator perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create interface VPC endpoints (AWS PrivateLink) for AWS DRS in the replication VPC in Region B, and configure replication to use private IP addresses.; Configure the launch settings for the source servers in the AWS DRS console to define the target subnets, security groups, and instance types for the recovery instances.

Answer

Create interface VPC endpoints (AWS PrivateLink) for AWS DRS in the replication VPC in Region B, and configure replication to use private IP addresses. Also, configure the launch settings for the source servers in the AWS DRS console to define the target subnets, security groups, and instance types for the recovery instances.
The correct options are to create interface VPC endpoints (AWS PrivateLink) for AWS DRS in the target Region B to keep replication traffic private, and to configure the target subnets, security groups, and instance types in the launch settings for the source servers in the AWS DRS console.

Step-by-Step Solution

1
Configure private connectivity for replication.
Interface VPC endpoints (AWS PrivateLink) for the AWS DRS service are created in the replication VPC in Region B, allowing the replication traffic to remain on the private AWS network.
Traffic must not travel over the public internet, and interface endpoints provide private access to AWS DRS.
2
Configure the launch settings in the AWS DRS console.
The target subnet, security groups, and instance types are defined in the launch settings (which updates the underlying EC2 launch templates) for each source server.
This ensures that when a recovery or drill instance is launched, it is deployed with the correct network and security configurations in the target VPC.

Key Concept

AWS Elastic Disaster Recovery (AWS DRS) private replication configuration and launch settings customization.
Question 809Question →

A company manages its multi-account environment using AWS Organizations. A SysOps administrator is deploying an organization conformance pack to enforce Amazon EBS volume encryption. The conformance pack template contains an AWS Config rule and a remediation configuration that executes an AWS Systems Manager (SSM) Automation document to delete any non-compliant volumes.

While testing the deployment in a member account, the administrator finds that the AWS Config rule successfully marks unencrypted volumes as non-compliant, but the remediation status displays an execution failure due to a permissions issue.

How should the administrator resolve this execution failure?

Show answer & explanation

Answer: Grant the AWS Config service role the iam:PassRole permission for the SSM Automation execution role, and verify that the execution role's trust policy allows ssm.amazonaws.com to assume it.

Answer

Grant the AWS Config service role the iam:PassRole permission for the SSM Automation execution role, and verify that the execution role's trust policy allows ssm.amazonaws.com to assume it.
The correct answer correctly addresses the permission flow required for AWS Config automatic remediations. When AWS Config initiates remediation, it passes the specified execution role to AWS Systems Manager. For this to succeed, the AWS Config service role must have the iam:PassRole permission for the execution role. Concurrently, the execution role's trust policy must allow ssm.amazonaws.com to assume it, as Systems Manager is the service executing the API actions.

Step-by-Step Solution

1
Inspect the remediation configuration in the conformance pack to identify the IAM role specified for SSM Automation execution.
Identified the target execution role ARN used by the SSM Automation document.
Before making permission changes, you must know which execution role is assigned to the remediation action.
2
Add the iam:PassRole permission to the AWS Config service role policy, targeting the execution role identified in the previous step.
The AWS Config service is granted permission to pass the execution role to Systems Manager.
AWS Config requires iam:PassRole to hand off the execution role to the Systems Manager service for document execution.
3
Update the trust policy of the SSM Automation execution role to allow the Systems Manager service principal (ssm.amazonaws.com) to perform the sts:AssumeRole action.
Systems Manager is authorized to assume the execution role.
Since Systems Manager performs the actual resource remediation, it must have permission to assume the execution role.

Key Concept

AWS Config rules remediation relies on Systems Manager Automation, which requires the AWS Config service role to have iam:PassRole permissions for the execution role, and the execution role to trust ssm.amazonaws.com.
Estimated Time:1m 30s
Question 810Question →

A SysOps administrator is configuring a multi-account execution workflow using AWS Systems Manager (SSM) Automation in Account A (111111111111111111111111). The SSM Automation execution must perform two primary functions: launch a temporary Amazon EC2 instance in Account A and attach a pre-existing IAM role named `EC2DataProcessorRole` to it, and assume a cross-account IAM role named `S3ReaderRole` in Account B (222222222222222222222222) to read data files from an Amazon S3 bucket. The SSM Automation workflow runs under a service role named `SSMExecutionRole` in Account A. Which of the following configuration steps are required to achieve this setup? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In Account A, attach a policy to SSMExecutionRole allowing the iam:PassRole action on the resource arn:aws:iam::111111111111:role/EC2DataProcessorRole, and the sts:AssumeRole action on the resource arn:aws:iam::222222222222:role/S3ReaderRole.; In Account B, configure the trust policy of S3ReaderRole to allow the principal arn:aws:iam::111111111111:role/SSMExecutionRole to perform the sts:AssumeRole action.

Answer

In Account A, attach a policy to SSMExecutionRole allowing iam:PassRole on the EC2DataProcessorRole and sts:AssumeRole on the S3ReaderRole in Account B; and in Account B, configure the trust policy of S3ReaderRole to allow SSMExecutionRole to perform sts:AssumeRole.
The correct options state that the execution role in Account A requires iam:PassRole to assign the EC2 role, and sts:AssumeRole to assume the cross-account role. Concurrently, the trust policy of the cross-account role in Account B must trust the execution role from Account A to authorize the assume role operation.

Step-by-Step Solution

1
Configure role-passing permissions in Account A.
The SSMExecutionRole is granted the iam:PassRole permission on the target EC2DataProcessorRole.
When Systems Manager launches an EC2 instance and associates an IAM role, the systems manager execution role must have permission to pass that IAM role to the Amazon EC2 service.
2
Configure cross-account delegation permission in Account A.
The SSMExecutionRole is granted the sts:AssumeRole permission on the S3ReaderRole in Account B.
To assume a target role in another AWS account, the initiating IAM role must be granted permissions to request the STS security tokens.
3
Establish trust relationship in Account B.
The S3ReaderRole trust policy is configured to specify the SSMExecutionRole ARN as a trusted principal.
An IAM role cannot be assumed by an identity in another account unless its trust policy explicitly trusts that identity.

Key Concept

IAM PassRole vs AssumeRole in Multi-Account Service Delegations
Question 811Question →

A SysOps administrator is configuring cross-region replication for an AWS Secrets Manager secret. The primary secret is stored in the us-east-1 Region, and it must be replicated to the us-west-2 Region to support a disaster recovery configuration. The secret contains database credentials that must be rotated automatically every 30 days. Which of the following actions must the administrator perform to configure this setup? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the automatic rotation schedule and rotation Lambda function on the primary secret in the us-east-1 Region.; Specify or allow Secrets Manager to create a KMS key located in the us-west-2 Region to encrypt the replica secret.

Answer

To configure cross-region replication for an AWS Secrets Manager secret with automatic rotation, the administrator must configure the rotation on the primary secret in the source region and ensure a regional KMS key is specified or created in the destination region for encrypting the replica secret.
To successfully configure cross-region replication with automatic rotation, the SysOps administrator must configure rotation on the primary secret in the source region. Secrets Manager will then automatically propagate the rotated values to all replica regions. Additionally, because AWS KMS keys are region-locked, a KMS key located in the destination region must be specified or created to encrypt the replicated secret.

Step-by-Step Solution

1
Identify the primary source secret and target replica Region.
Confirming primary secret is in us-east-1 and target is us-west-2.
Determines where resources and policies must be created.
2
Configure automatic rotation on the primary secret.
Automatic rotation runs in the primary Region and updates are automatically replicated.
Secrets Manager replica secrets are read-only and do not support independent rotation configurations.
3
Specify or create an AWS KMS key in the target replica Region.
A KMS key in us-west-2 is mapped to encrypt the replica secret.
AWS KMS keys are region-bound and cannot be shared across different AWS Regions.

Key Concept

AWS Secrets Manager cross-region replication automatically replicates secrets to replica regions, but requires regional KMS keys for encryption, and rotation must be configured exclusively on the primary secret.
Question 812Question →

A company's security policy requires that any exposed IAM access keys detected by AWS Health must be automatically deactivated immediately. A SysOps administrator is configuring an event-driven remediation workflow using AWS Systems Manager Automation. Which of the following actions should the SysOps administrator take to implement this automation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon EventBridge rule that filters for the AWS Health service event type AWS_RISK_CREDENTIAL_EXPOSED, and select the Systems Manager Automation runbook AWS-DisableAccessKey as the target.; Configure an IAM service role for Systems Manager Automation that contains the iam:UpdateAccessKey permission, and attach a policy allowing iam:PassRole for this role to the identity configuring the automation.

Answer

Create an Amazon EventBridge rule filtering for the AWS Health event type AWS_RISK_CREDENTIAL_EXPOSED targeting the AWS-DisableAccessKey runbook, and configure an IAM service role for Systems Manager Automation with iam:UpdateAccessKey and grant iam:PassRole permissions to the configuring user.
The correct actions involve setting up an Amazon EventBridge rule that filters for the specific AWS Health event type AWS_RISK_CREDENTIAL_EXPOSED and targets the Systems Manager Automation runbook AWS-DisableAccessKey. Additionally, the service role assumed by Systems Manager must have permissions to update the access key state (iam:UpdateAccessKey), and the configuring user must have iam:PassRole permissions to pass the role to the service.

Step-by-Step Solution

1
Identify the trigger event and target runbook for exposed credentials.
Determine that the AWS Health event AWS_RISK_CREDENTIAL_EXPOSED can trigger an EventBridge rule that targets the AWS-DisableAccessKey Systems Manager Automation runbook.
EventBridge is the primary event routing service in AWS that can match AWS Health notifications and trigger operational responses.
2
Define the IAM permissions and roles required for executing the Systems Manager Automation runbook.
Create an IAM role that trusts ssm.amazonaws.com with iam:UpdateAccessKey permissions, and ensure the configuration identity has iam:PassRole permissions for this role.
Systems Manager Automation needs to assume a service role with appropriate permissions to modify IAM resources, and the user must be authorized to pass this role to the service.

Key Concept

Automating security remediation through event-driven workflows using Amazon EventBridge, AWS Health events, and AWS Systems Manager Automation with proper IAM permissions.
Estimated Time:2m 0s
Question 813Question →

A SysOps Administrator is configuring a rolling update deployment strategy for a containerized application running on an Amazon ECS cluster with the Amazon EC2 launch type. The ECS service is configured with a desired task count of 1010 tasks.

The deployment must satisfy the following operational requirements:
* No running tasks from the current version can be terminated until the replacement tasks are verified as healthy.
* The total CPU and memory reservation on the container instances must never exceed 120%120\% of the desired task allocation during the deployment due to tight cluster capacity constraints.
* The application must remain highly available, ensuring that the number of active, healthy tasks never drops below 80%80\% of the desired count.

Which two ECS service definition parameters must the administrator configure to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Set minimumHealthyPercent to 100100; Set maximumPercent to 120120

Answer

Configure the Amazon ECS service with minimumHealthyPercent set to 100100 and maximumPercent set to 120120.
The correct options are configuring the service with minimumHealthyPercent set to 100100 and maximumPercent set to 120120. Setting the minimum healthy percent to 100%100\% guarantees that the ECS scheduler will not terminate any existing tasks before new ones are verified as healthy. Setting the maximum percent to 120%120\% limits the temporary scale-up capacity during the rolling update to at most 1212 tasks (120%120\% of the desired 1010 tasks), which prevents exceeding the cluster resource reservation limit.

Step-by-Step Solution

1
Analyze the constraint that no running tasks can be terminated before replacement tasks are verified as healthy.
Determine that the minimum healthy percent must be at least 100%100\%. This ensures the service scheduler launches new tasks first and only terminates older tasks once the new ones are healthy.
Lower values like 80%80\% would allow ECS to terminate tasks beforehand to make room, violating the zero-downtime dependency check.
2
Analyze the capacity constraint that resource reservations must not exceed 120%120\% of the desired task allocation.
Determine that the maximum percent must be set to 120%120\%. For a desired count of 1010 tasks, this limits the total tasks in the RUNNING or PENDING state to at most 1212 tasks at any time.
This prevents overloading the cluster's EC2 container instances with excess CPU and memory reservations during the rolling transition.
3
Verify that the availability requirement (minimum healthy tasks never dropping below 80%80\%) is met.
Confirm that keeping the minimum healthy percent at 100%100\% maintains exactly 1010 healthy tasks (100%100\%) during the deployment, which is greater than the 80%80\% (88 tasks) threshold.
This configuration safely meets all three requirements simultaneously.

Key Concept

Configuring ECS rolling update deployment parameters (minimumHealthyPercent and maximumPercent) to balance application availability and resource capacity.
Estimated Time:2m 30s
Question 814Question →

A SysOps Administrator is configuring automated remediation within an AWS Config conformance pack to address non-compliant, unencrypted Amazon EBS volumes. The administrator plans to use the standard AWS-EncryptElasticBlockStoreVolume Systems Manager (SSM) Automation document as the remediation target. Which of the following configuration actions are required to ensure that the automated remediation successfully executes when a non-compliant volume is detected? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the AWS Config remediation action with the SSM Automation document and provide an IAM execution role ARN that has permissions to modify and encrypt EBS volumes.; Ensure that the IAM identity configuring the remediation has the iam:PassRole permission for the Systems Manager Automation execution role.

Answer

Configure the AWS Config remediation action with the SSM Automation document and provide an IAM execution role ARN that has permissions to modify and encrypt EBS volumes, and ensure that the IAM identity configuring the remediation has the iam:PassRole permission for the Systems Manager Automation execution role.
To set up native remediation in AWS Config, the administrator must define a remediation configuration targeting an SSM Automation document. The automation requires an IAM service role with permissions to perform the actual resource modifications (e.g., encrypting EBS volumes). Furthermore, because AWS Config passes this execution role to the Systems Manager service, the identity setting up the configuration must have the iam:PassRole permission for the execution role. Without it, the pass role action will fail.

Step-by-Step Solution

1
Define the remediation execution role.
An IAM role is created with a trust policy allowing Systems Manager (ssm.amazonaws.com) to assume it, and attached policies that allow modifying and encrypting EBS volumes.
SSM Automation needs permissions to interact with EC2/EBS resources to perform the remediation.
2
Grant the iam:PassRole permission.
The administrator or service role configuring the remediation is granted iam:PassRole for the SSM Automation execution role.
AWS Config requires iam:PassRole permissions to successfully pass the execution role to Systems Manager Automation.
3
Configure the remediation action in AWS Config.
The AWS Config rule's remediation configuration is set to target the SSM document with the execution role specified as a parameter.
This establishes the link between the compliance state of the AWS Config rule and the automation workflow that remediates the resource.

Key Concept

Configuring AWS Config Rules native remediation requires linking to an SSM Automation document, providing an SSM execution role, and granting iam:PassRole permissions to pass that role to Systems Manager.
Question 815Question →

A SysOps Administrator is designing the database tier for a new multi-region application. The primary database cluster will run on Amazon Aurora MySQL in the us-east-1 Region. The database must be replicated to the us-west-2 Region to support a disaster recovery plan with a Recovery Point Objective (RPO) of under 5 seconds and a Recovery Time Objective (RTO) of under 2 minutes. The disaster recovery database must also serve read queries for users in the us-west-2 Region. Which configuration will meet these requirements with the least administrative effort?

Show answer & explanation

Answer: Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Direct local read traffic in us-west-2 to the secondary cluster's reader endpoint. In a disaster recovery event, promote the secondary cluster to a standalone primary cluster.

Answer

Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Direct local read traffic in us-west-2 to the secondary cluster's reader endpoint. In a disaster recovery event, promote the secondary cluster to a standalone primary cluster.
The configuration utilizing Amazon Aurora Global Database is correct because it uses dedicated, storage-based replication that delivers an RPO of less than 1 second. The secondary cluster in the us-west-2 Region is fully active for read-only workloads, which directly satisfies the requirement to serve local read queries. In a disaster recovery event, the secondary cluster can be promoted to a standalone primary cluster with a write endpoint in under a minute, comfortably meeting the RTO of under 2 minutes.

Step-by-Step Solution

1
Evaluate the disaster recovery and performance requirements: RPO under 5 seconds, RTO under 2 minutes, and readable databases in the secondary region (us-west-2).
Identify that a solution must support storage-level cross-region replication and fast promotion of the target database.
This establishes the baseline requirements for selecting the appropriate database high availability and replication features.
2
Analyze Amazon Aurora Global Database capabilities.
Confirm that Aurora Global Database features an RPO of less than 1 second, an RTO of under 1 minute for promoting a secondary region, and supports local read-only endpoints in the secondary region.
This shows that the global database configuration natively matches all performance, HA, and DR requirements.
3
Compare against standard RDS Multi-AZ and Route 53 failover limitations.
Determine that Route 53 cannot automate cross-region replica promotion and that standard RDS standby instances cannot accept read requests.
This eliminates incorrect configurations that assume automatic cross-region database promotion via DNS or readable RDS standby nodes.

Key Concept

Amazon Aurora Global Database provides low-latency cross-region replication and fast, manual or automated failover/promotion to secondary clusters, while allowing secondary clusters to serve read-only workloads.
Question 816Question →

A company runs a production application using a combination of Amazon EC2 instances and AWS Fargate container tasks. A SysOps administrator needs to recommend a cost optimization plan that automatically applies discounts to both of these compute services with the greatest flexibility. Which AWS pricing model should the administrator select to achieve this goal?

Show answer & explanation

Answer: Compute Savings Plans

Answer

Compute Savings Plans
Compute Savings Plans provide the greatest flexibility because they apply automatically to compute usage across Amazon EC2, AWS Fargate, and AWS Lambda, regardless of instance family, size, Availability Zone, Region, or operating system.

Step-by-Step Solution

1
Analyze the components of the workload requiring cost optimization.
The workload consists of both Amazon EC2 instances and AWS Fargate tasks.
The selected plan must be capable of applying discounts to both of these compute services simultaneously.
2
Evaluate the coverage scope of Savings Plans and Reserved Instances.
Compute Savings Plans cover EC2, Fargate, and Lambda. EC2 Instance Savings Plans and Reserved Instances only apply to EC2 usage.
This allows filtering out pricing models that cannot apply discounts to containerized tasks running on AWS Fargate.
3
Identify the option that provides the highest level of flexibility for the workload.
Compute Savings Plans automatically apply discounts across EC2 and Fargate regardless of Region, instance family, size, or operating system.
This matches the requirement to cover both services with the greatest flexibility.

Key Concept

Compute Savings Plans automatically apply discounts to Amazon EC2, AWS Fargate, and AWS Lambda usage, providing the greatest flexibility compared to RIs or Instance Savings Plans.
Estimated Time:45s
Question 817Question →

A company manages a multi-account AWS environment using AWS Organizations with consolidated billing enabled.

* Member Account A runs a steady-state workload on Amazon EC2 c5.largec5.large instances in the us−east−1us-east-1 Region. This workload is expected to remain unchanged for the next 1212 months.
* Member Account B runs a containerized microservices application on AWS Fargate in the us−east−1us-east-1 Region and utilizes several AWS Lambda functions for data processing. Within the next 33 months, the company plans to migrate the Fargate application to the us−west−2us-west-2 Region and upgrade the container configurations.

A SysOps administrator must recommend a 11-year cost optimization strategy that maximizes savings for these workloads while accommodating the planned migration.

Which two commitment strategies should the administrator recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Purchase a 11-year Compute Savings Plan to cover the AWS Fargate and AWS Lambda workloads.; Purchase a 11-year EC2 Instance Savings Plan for the c5c5 instance family in us−east−1us-east-1 to cover the EC2 instances in Member Account A.

Answer

The SysOps administrator should recommend purchasing a 1-year Compute Savings Plan to cover the AWS Fargate and AWS Lambda workloads, and a 1-year EC2 Instance Savings Plan for the c5 instance family in us-east-1 to cover the EC2 instances.
The correct strategy combines an EC2 Instance Savings Plan for the stable c5 EC2 instances (maximizing the discount to up to 72% for those specific instances) with a Compute Savings Plan for the Fargate and Lambda workloads (providing the flexibility to apply discounts across regions and serverless configurations as the application migrates).

Step-by-Step Solution

1
Analyze the workload requirements for Member Account A.
Member Account A has EC2 c5.large instances in us-east-1 running steady-state for 12 months. Since the family and region are fixed, an EC2 Instance Savings Plan provides the highest savings (up to 72%) while allowing size changes within the c5 family.
Choosing the most specific plan type for stable workloads maximizes cost savings.
2
Analyze the workload requirements for Member Account B.
Member Account B uses AWS Fargate and AWS Lambda, and plans to migrate Fargate from us-east-1 to us-west-2 with configuration changes. Compute Savings Plans are required here because they are the only Savings Plans that apply to Fargate and Lambda, and they automatically apply across regions and instance changes.
Compute Savings Plans provide the necessary flexibility for serverless workloads and regional migrations.
3
Evaluate the administrative sharing settings.
Ensure Savings Plan sharing remains enabled at the AWS Organizations payer level so that any unutilized commitment can benefit other accounts in the organization.
Disabling sharing is sub-optimal and reduces the flexibility of the organization's total commitment.

Key Concept

Selecting the optimal combination of Compute Savings Plans and EC2 Instance Savings Plans based on workload stability, region flexibility, and service type (EC2 vs. Fargate/Lambda).
Question 818Question →

A SysOps administrator is configuring a secure global content delivery network using Amazon CloudFront and Amazon S3. The S3 bucket contains sensitive assets encrypted using Server-Side Encryption with AWS KMS customer managed keys (SSE-KMS). The administrator sets up a CloudFront distribution and configures Origin Access Control (OAC) to restrict access to the S3 bucket. A bucket policy is applied to the S3 bucket that allows the CloudFront service principal cloudfront.amazonaws.com to perform s3:GetObject on the bucket. However, when test users attempt to download objects via CloudFront, they receive a 403 Forbidden error.

Which of the following configuration changes is required to resolve this error?

Show answer & explanation

Answer: Update the KMS key policy of the customer managed key to grant the CloudFront service principal permission to perform the kms:Decrypt action, using a condition to restrict access to the distribution ARN.

Answer

Update the KMS key policy of the customer managed key to grant the CloudFront service principal permission to perform the kms:Decrypt action, using a condition to restrict access to the distribution ARN.
The correct answer is to update the KMS key policy of the customer managed key to grant the CloudFront service principal permission to perform the kms:Decrypt action, using a condition to restrict access to the distribution ARN. This is because when CloudFront OAC accesses S3 objects encrypted with SSE-KMS, the CloudFront service principal (cloudfront.amazonaws.com) needs the kms:Decrypt permission to decrypt the objects on behalf of the viewer. The permissions must be defined in the KMS key policy of the Customer Managed Key (CMK), restricted to the specific distribution ARN using a condition block for security.

Step-by-Step Solution

1
Identify the cause of the 403 Forbidden error.
Since the bucket policy already grants s3:GetObject to the OAC service principal, the blocker is the decryption step of the SSE-KMS customer managed key.
When S3 objects are encrypted with a customer managed KMS key, the caller must have both s3:GetObject permission on the bucket and kms:Decrypt permission on the KMS key.
2
Determine where the KMS decryption permission must be configured.
It must be configured on the customer managed key's key policy, not the S3 bucket policy.
KMS key policies are the primary authorization mechanism for KMS keys. An S3 bucket policy cannot delegate permissions for KMS resources.
3
Formulate the correct KMS key policy statement.
Grant the cloudfront.amazonaws.com service principal permission for kms:Decrypt with a condition block checking the SourceArn matching the distribution ARN.
This configuration safely allows the CloudFront service principal to decrypt objects only for this specific distribution, preventing unauthorized access.

Key Concept

CloudFront OAC integration with KMS-encrypted S3 origins
Question 819Question →

An organization uses AWS Organizations with consolidated billing enabled. The SysOps administrator is tasked with optimizing costs for the following steady-state resources over the next 12 months using 1-year, No Upfront commitments:

* Account A:
* 10 Linux `m5.2xlarge` EC2 instances in `us-east-1` running 24/7. These instances will be upgraded to `m6i.2xlarge` in 3 months.
* An Amazon ECS on AWS Fargate workload in `us-east-1` with a constant cost of 3.50perhour.∗∗∗AccountB∗∗:∗Abaselineof4Linux‘c5.xlarge‘EC2instancesin‘us−east−1‘running24/7,whichwillremainunchanged.∗AnAWSLambdaworkloadin‘us−west−2‘withaconstantcostof3.50 per hour. * **Account B**: * A baseline of 4 Linux `c5.xlarge` EC2 instances in `us-east-1` running 24/7, which will remain unchanged. * An AWS Lambda workload in `us-west-2` with a constant cost of 1.50 per hour.

Which commitment strategy provides the highest overall cost savings while meeting the operational flexibility requirements?

Show answer & explanation

Answer: Purchase a 1-year EC2 Instance Savings Plan for the c5 family in us-east-1 in Account B, and purchase a 1-year Compute Savings Plan in Account A to cover the m5/m6i instances, Fargate workload, and Lambda workload.

Answer

Purchase a 1-year EC2 Instance Savings Plan for the c5 family in us-east-1 in Account B, and purchase a 1-year Compute Savings Plan in Account A to cover the m5/m6i instances, Fargate workload, and Lambda workload.
The correct strategy leverages the higher discount rates of EC2 Instance Savings Plans for the stable c5 workload that is not expected to change, while using the flexibility of Compute Savings Plans for the m5 workload that will migrate to the m6i family. Furthermore, Fargate and Lambda compute types are only eligible for Compute Savings Plans, and consolidated billing ensures the unused commitment from Account A is shared with Account B's Lambda workload.

Step-by-Step Solution

1
Analyze the flexibility needs of the EC2 instances in Account A.
Determine that since the instances will migrate from m5 to m6i within 3 months, any family-locked commitment (like Standard RIs or EC2 Instance Savings Plans) will become invalid after the migration.
A Compute Savings Plan is required for the Account A instances to ensure the discount applies to both m5 and m6i families.
2
Analyze the workload characteristics of the c5 instances in Account B.
Determine that the baseline of 4 c5.xlarge instances is stable and will not change family or region over the 1-year term.
An EC2 Instance Savings Plan is the most cost-effective choice for stable, single-family workloads because it offers higher discount rates than Compute Savings Plans.
3
Determine the coverage for the Fargate and Lambda workloads.
Fargate and Lambda are only eligible for Compute Savings Plans; they cannot be covered by EC2 Instance Savings Plans or Reserved Instances.
A Compute Savings Plan must be sized to cover the Fargate and Lambda workloads in addition to the migrating EC2 instances.
4
Evaluate consolidated billing sharing dynamics.
Confirm that the Compute Savings Plan purchased in Account A will first apply to Account A's usage, and any remaining commitment will automatically flow to Account B's Lambda workload.
AWS consolidated billing ensures that unused Savings Plans commitments are shared across all linked accounts in the organization, preventing waste.

Key Concept

Reserved Instances and Savings Plans Optimization
Question 820Question →

A SysOps Administrator is implementing Amazon VPC Traffic Mirroring to inspect network packets from a critical production database instance (source) located in subnet A to an Intrusion Detection System (IDS) security appliance (target) located in subnet B. Both subnets are protected by custom Network ACLs, and the security groups for both the database and the IDS allow all traffic. The administrator configures a Traffic Mirror Filter to capture all inbound and outbound TCP traffic. The traffic mirroring session is active, but the IDS appliance is not receiving any mirrored packets.

Which of the following configuration changes or verification steps should the administrator perform to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Verify that the Network ACL associated with subnet B allows inbound UDP traffic on port 47894789, and the Network ACL for subnet A allows outbound UDP traffic on port 47894789.; Ensure that the EC2 instances hosting the database and the IDS appliance are both launched on supported Nitro-based instance types.

Answer

Verify that the Network ACL associated with subnet B allows inbound UDP traffic on port 47894789, and the Network ACL for subnet A allows outbound UDP traffic on port 47894789, and ensure that the EC2 instances hosting the database and the IDS appliance are both launched on supported Nitro-based instance types.
VPC Traffic Mirroring encapsulates mirrored traffic using VXLAN (UDP port 47894789). Since Network ACLs evaluate mirrored packets and are stateless, the source subnet's Network ACL must permit outbound UDP port 47894789 traffic, and the target subnet's Network ACL must permit inbound UDP port 47894789 traffic. Additionally, Traffic Mirroring requires supported instance types, such as Nitro-based instances, to copy traffic from the network interface.

Step-by-Step Solution

1
Identify the protocol used for traffic encapsulation in VPC Traffic Mirroring.
VPC Traffic Mirroring encapsulates packets in VXLAN headers, which use UDP port 47894789.
This determines which ports must be allowed in the network path controls.
2
Review the Network ACL configuration of the source and target subnets.
Verify that the stateless Network ACLs allow outbound UDP port 47894789 from the source subnet and inbound UDP port 47894789 to the target subnet.
Because Network ACLs are stateless and evaluate mirrored traffic, they must explicitly allow this encapsulation traffic.
3
Verify instance type compatibility for the source and target instances.
Confirm that both the database and the IDS appliance run on supported instance types (primarily Nitro-based).
VPC Traffic Mirroring requires specific hardware virtualization capabilities present on Nitro instances.

Key Concept

VPC Traffic Mirroring relies on VXLAN encapsulation (UDP port 47894789) and requires supported instance types. Unlike security groups, Network ACLs are stateless and evaluate mirrored traffic.
PreviousPage 41 / 49Next
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin