Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 861Question →

A company requires a centralized disaster recovery strategy for its database workloads. A SysOps Administrator must configure AWS Backup to copy snapshots of Amazon RDS DB instances from a production AWS account to a secure backup vault in a separate disaster recovery AWS account. Both accounts are members of the same organization in AWS Organizations. The copied snapshots must be encrypted using a customer managed key in the disaster recovery account.

Which of the following actions must the SysOps Administrator take to configure this copy operation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable the cross-account backup feature in the AWS Organizations management account.; Configure the backup vault access policy in the disaster recovery account to allow the production account to perform the copy action.

Answer

To configure AWS Backup cross-account copy operations, the SysOps Administrator must enable cross-account backup in the AWS Organizations management account, and configure the destination backup vault's access policy to allow the source account to perform the copy action.
The correct actions are enabling the cross-account backup feature in the AWS Organizations management account, and configuring the destination backup vault's access policy to allow the source account to perform the copy action. Enabling cross-account backup in the organization management account is required to allow AWS Backup to transfer resources across AWS accounts. In addition, the destination backup vault policy must permit the copy action from the source account or organization.

Step-by-Step Solution

1
Enable cross-account backup in the AWS Organizations management account.
Cross-account backup functionality is enabled for all member accounts within the AWS Organization.
This is a prerequisite for AWS Backup to copy backups across different accounts.
2
Configure the backup vault access policy in the disaster recovery account.
The destination vault accepts incoming copy requests from the source account.
The destination vault policy must explicitly allow the source account or organization to perform the copy action.
3
Configure the customer managed key policy in the disaster recovery account.
The source account service role is authorized to use the KMS key in the destination account.
Cross-account access to KMS keys requires the key policy in the destination account to explicitly authorize the IAM principal from the source account.

Key Concept

Centralized cross-account backup management and replication using AWS Backup in AWS Organizations.
Question 862Question →

A SysOps Administrator is managing an infrastructure stack using AWS CloudFormation. The stack contains an Amazon EC2 instance and an Amazon RDS DB instance. During a recent stack update, the update failed, and CloudFormation attempted to roll back the changes. However, the rollback failed because a database administrator had manually deleted the RDS DB instance out-of-band, leaving the stack stuck in the UPDATE_ROLLBACK_FAILED state. The administrator needs to return the stack to a stable, operable state without impacting the running EC2 instance. Which action should the SysOps Administrator take to resolve this issue?

Show answer & explanation

Answer: Run the aws cloudformation continue-update-rollback CLI command and specify the RDS DB instance logical ID in the --resources-to-skip parameter, then manually recreate or import the database to sync with the template.

Answer

Run the aws cloudformation continue-update-rollback CLI command and specify the RDS DB instance logical ID in the --resources-to-skip parameter, then manually recreate or import the database to sync with the template.
The correct action is to run the continue-update-rollback command and specify the RDS DB instance logical ID in the resources to skip parameter. This allows CloudFormation to skip the rollback operations for the deleted resource and transition the stack to the UPDATE_ROLLBACK_COMPLETE state, returning it to a stable, operable state.

Step-by-Step Solution

1
Identify the logical ID of the resource that is causing the rollback to fail from the CloudFormation stack events console.
The resource is identified as the deleted Amazon RDS DB instance.
CloudFormation is failing to roll back because the physical RDS resource no longer exists.
2
Execute the continue-update-rollback command using the AWS CLI or CloudFormation console, passing the RDS DB instance logical ID to the --resources-to-skip parameter.
CloudFormation bypasses attempting to roll back the RDS DB instance and sets the stack status to UPDATE_ROLLBACK_COMPLETE.
Bypassing the failed rollback step allows the rest of the stack to return to a stable, modifiable state.
3
Recreate or import the database instance manually to establish configuration alignment with the template.
The resource is aligned and the stack can now accept new updates.
Since the resource was skipped during rollback, it remains unmanaged or deleted until manual intervention or a template import is performed.

Key Concept

Remediating rollback failures caused by out-of-band resource deletion using ContinueUpdateRollback
Estimated Time:2m 30s
Question 863Question →

Developers in a member account are attempting to deploy a database environment using a newly assigned AWS Service Catalog product. During the deployment, the provisioning status changes to failure, and the underlying resources are terminated. The product is configured to run under a specific launch constraint role. A SysOps administrator is tasked with finding the root cause of the deployment failure and applying the fix.

Which two actions should the SysOps administrator take to troubleshoot and resolve this provisioning issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Inspect the provisioning events under Provisioned Products or the corresponding AWS CloudFormation stack events in the member account.; Ensure that the IAM role specified in the launch constraint has the `iam:PassRole` permission for any IAM roles being created or assigned by the template.

Answer

The correct actions are to inspect the provisioning events in the member account and ensure the launch constraint role has the `iam:PassRole` permission.
The correct actions are to inspect the provisioning events or CloudFormation stack events in the member account to find the root cause, and to ensure that the launch constraint role has the necessary `iam:PassRole` permissions to assign the required roles to the resources. Since AWS Service Catalog performs the deployment using the launch constraint role, that role needs the permission to pass other roles, rather than the end developers who trigger the launch. Also, since deployments are local to the member account, CloudFormation stack details must be inspected there.

Step-by-Step Solution

1
Navigate to the AWS Service Catalog or AWS CloudFormation console in the local member account.
Identify the specific resource failure and error message that triggered the rollback.
Local deployments execute CloudFormation stacks in the local account, so troubleshooting logs must be inspected there rather than in the sharing hub account.
2
Inspect the launch constraint role permissions.
Confirm whether the launch constraint role lacks the `iam:PassRole` permission.
AWS Service Catalog uses the launch constraint role as the execution identity, meaning this role must have permissions to pass other roles to AWS services, whereas the end user's personal IAM policy does not need this permission.

Key Concept

AWS Service Catalog launches products within the target member account using the permissions defined in the launch constraint role, which requires proper IAM policies including `iam:PassRole` to provision service-linked configurations.
Question 864Question →

An organization has a data sharing requirement where users in a secondary AWS account must access encrypted files stored in an Amazon S3 bucket in a primary AWS account. The files are currently encrypted using the default AWS managed key (`aws/s3`) in the primary account.

Which configuration change is required to allow the users in the secondary account to decrypt these files?

Show answer & explanation

Answer: Re-encrypt the files using a customer managed key and allow the secondary account to use the key in its key policy.

Answer

Re-encrypt the files using a customer managed key and allow the secondary account to use the key in its key policy.
The correct answer is to re-encrypt the files using a customer managed key. AWS managed keys (such as `aws/s3`) have default key policies that cannot be modified. Because cross-account access to KMS-encrypted resources requires explicit authorization in the key policy of the owning account, you must use a customer managed key and configure its key policy to delegate access to the secondary account.

Step-by-Step Solution

1
Identify the encryption key type currently in use.
The files are encrypted using the AWS managed key (`aws/s3`).
AWS managed keys have fixed key policies that cannot be edited, making them incompatible with cross-account access requirements.
2
Select a customer managed key (CMK) instead.
Create a new customer managed key or use an existing one in the primary account.
Customer managed key policies can be modified to grant access to other AWS accounts.
3
Configure the key policy and re-encrypt the data.
Update the customer managed key policy to allow the secondary account to perform KMS operations, and re-encrypt the S3 objects with this key.
This establishes the necessary trust relationship and permissions for cross-account decryption.

Key Concept

AWS KMS cross-account sharing requires a customer managed key (CMK) because the policies of AWS managed keys cannot be modified to delegate permissions to external accounts.
Question 865Question →

An enterprise application's infrastructure is deployed using an AWS CloudFormation stack. During a scheduled stack update, the process fails and subsequent rollback attempts fail, leaving the stack stuck in the UPDATE_ROLLBACK_FAILED state. A SysOps Administrator discovers that the rollback failed because an IAM role resource was modified out-of-band and the CloudFormation service role lacks sufficient permissions to revert the changes. Which of the following actions should the administrator take to successfully resolve the UPDATE_ROLLBACK_FAILED state and complete the rollback? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Resolve the permission issue by attaching the required policies to the CloudFormation service role, then run the continue-update-rollback command.; Run the continue-update-rollback command and specify the logical ID of the IAM role in the resources-to-skip parameter to bypass rolling back that resource.

Answer

To resolve a stack in the UPDATE_ROLLBACK_FAILED state, you can either correct the underlying issue (e.g., updating the CloudFormation service role permissions) and execute the continue-update-rollback command, or execute the continue-update-rollback command and specify the failing resources in the resources-to-skip parameter to bypass them during rollback.
To resolve a stack stuck in the UPDATE_ROLLBACK_FAILED state, you must either fix the root cause that blocked the rollback (such as updating IAM service role permissions or resolving external resource dependencies) and run the continue-update-rollback command, or run the continue-update-rollback command while specifying the logical IDs of the failing resources in the resources-to-skip parameter to bypass them and complete the rollback of the rest of the stack.

Step-by-Step Solution

1
Inspect the CloudFormation stack events to identify the resource that failed to roll back and the error message.
The event log reveals that the IAM role failed during rollback due to missing permissions in the CloudFormation service role.
To determine if the rollback block is remediable (like permissions) or if the resource must be skipped.
2
Resolve the permission issue by adding the necessary policy actions to the CloudFormation service role, or identify the logical ID of the IAM role to skip.
The service role is updated with the required permissions, or the logical ID of the IAM role is noted for skipping.
Preparing the state for retrying the rollback process.
3
Run the continue-update-rollback command (either with or without the resources-to-skip option depending on the chosen remediation strategy).
CloudFormation retries the rollback and successfully transitions the stack to a stable UPDATE_ROLLBACK_COMPLETE state.
This command triggers CloudFormation to resume and finish the failed rollback operation.

Key Concept

Resolving CloudFormation update rollback failures using the continue-update-rollback command and addressing underlying resource or permission issues.
Estimated Time:2m 0s
Question 866Question →

A SysOps Administrator is setting up Amazon S3 replication to copy data between two buckets. After configuring the replication rules and applying the configuration, the administrator notices that objects uploaded to the source bucket are not appearing in the destination bucket, and the replication status shows as failed.

Which configuration errors could be causing this replication failure? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The IAM trust policy of the replication role does not list the s3.amazonaws.com service principal as a trusted entity.; S3 versioning is enabled on the source bucket, but it has not been enabled on the destination bucket.

Answer

The correct configurations are to ensure the IAM trust policy of the replication role trusts the Amazon S3 service principal, and S3 versioning is enabled on both the source and destination buckets.
The replication configuration requires both source and destination S3 buckets to have versioning enabled. In addition, the IAM role used by S3 for replication must have a trust policy allowing the Amazon S3 service principal (s3.amazonaws.com) to assume the role via sts:AssumeRole.

Step-by-Step Solution

1
Inspect S3 versioning status on both the source and destination buckets.
Confirm versioning is enabled on both buckets.
S3 replication requires versioning to be active on both the source and destination buckets.
2
Inspect the trust relationship policy of the replication IAM role.
Ensure the service principal s3.amazonaws.com is allowed to assume the role.
Amazon S3 must be allowed to perform sts:AssumeRole to run replication on behalf of the customer.

Key Concept

Amazon S3 replication requires versioning enabled on both buckets and a correct IAM trust policy allowing S3 to assume the replication role.
Question 867Question →

A SysOps Administrator runs drift detection on an AWS CloudFormation stack and finds that the policy of an Amazon S3 bucket managed by the stack has been manually modified, placing the stack in a DRIFTED state. The administrator wants to align the bucket's configuration with the stack template. The administrator attempts to resolve this by initiating a stack update using the original, unmodified template and parameters. Which of the following describes the result of this operation?

Show answer & explanation

Answer: The stack update will fail to execute and return a validation error indicating that no updates are to be performed, leaving the drift unresolved.

Answer

The stack update will fail to execute and return a validation error indicating that no updates are to be performed, leaving the drift unresolved.
The correct answer is that the update will fail to execute with a validation error stating that no updates are to be performed. AWS CloudFormation evaluates stack updates based on changes to the template or parameters, not by comparing the template with the live state of the resources. When the template is identical, no update is triggered, leaving the drift in place.

Step-by-Step Solution

1
Analyze how AWS CloudFormation processes stack updates.
CloudFormation compares the new template and parameter set against the existing stack state in the service database.
To identify which resources need to be created, updated, or deleted.
2
Evaluate the behavior when the template and parameters are unmodified.
CloudFormation detects zero changes between the submitted template and the active stack template, throwing a validation error.
CloudFormation does not check live resource configurations for drift as part of the update comparison unless the template itself has changed.
3
Determine the final status of the drifted resource.
The manual changes remain on the S3 bucket policy, and the drift status of the stack remains DRIFTED.
Since no resource update is triggered, the drift is not remediated.

Key Concept

CloudFormation Drift Remediation and Update Behavior
Question 868Question →

A SysOps administrator with the IAM user name `ManagerUser` in Account A (111122223333111122223333) needs to launch an Amazon EC2 instance that runs automated deployment scripts. The scripts will create IAM roles and attach permissions policies. The instance must run with an IAM instance profile associated with the IAM role named `DeploymentWorkerRole`.

An organization-level Service Control Policy (SCP) is attached to the Organizational Unit (OU) containing Account A:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "RestrictRoleCreation",
"Effect": "Deny",
"Action": [
"iam:CreateRole",
"iam:AttachRolePolicy"
],
"Resource": "*",
"Condition": {
"ArnNotEquals": {
"aws:PrincipalARN": "arn:aws:iam::111122223333:role/DeploymentWorkerRole"
}
}
}
]
}

`ManagerUser` has an IAM policy attached that grants full access to EC2 and Auto Scaling (`ec2:*` and `autoscaling:*`). When `ManagerUser` attempts to launch the EC2 instance using the AWS CLI and specifies the `DeploymentWorkerRole` instance profile, the operation fails with an `UnauthorizedOperation` error.

Which configuration change is required to resolve this issue and successfully launch the EC2 instance?

Show answer & explanation

Answer: The administrator's IAM policy must be updated to grant the iam:PassRole permission for the DeploymentWorkerRole resource.

Answer

The administrator's IAM policy must be updated to grant the iam:PassRole permission for the DeploymentWorkerRole resource.
To successfully launch an Amazon EC2 instance with an IAM instance profile, the IAM identity making the request must have the `iam:PassRole` permission for the associated role resource. This permission allows the user to pass the role to the Amazon EC2 service, which then assumes the role on the instance's behalf. Since `ManagerUser` only had `ec2:*` and `autoscaling:*` permissions, the lack of `iam:PassRole` caused the `RunInstances` API call to fail with an `UnauthorizedOperation` error.

Step-by-Step Solution

1
Analyze the error message and context.
The CLI operation fails with `UnauthorizedOperation` (Access Denied) during the instance launch phase before the instance starts running.
This indicates that the caller, `ManagerUser`, lacks the necessary permissions to execute the API call under the specified parameters (which includes attaching an IAM instance profile).
2
Evaluate the Service Control Policy (SCP) restriction.
The SCP denies `iam:CreateRole` and `iam:AttachRolePolicy` to any principal other than `DeploymentWorkerRole`.
The SCP does not block `ec2:RunInstances` or `iam:PassRole`, meaning the block is not coming from the organization level during the launch process.
3
Determine the role delegation requirements for Amazon EC2.
To associate a role with an EC2 instance, the user launching the instance must be allowed to pass the role to the Amazon EC2 service.
This authorization is governed by the `iam:PassRole` action on the target role resource within the user's IAM permissions policy.

Key Concept

IAM PassRole vs AssumeRole in service authorization
Question 869Question →

A SysOps administrator is managing configuration settings in AWS Systems Manager Parameter Store. A configuration parameter named `/prod/app/config` was created under the Standard parameter tier. The administrator needs to attach an Expiration parameter policy to this parameter to automatically delete it after an upcoming maintenance window. The administrator also wants to ensure that the parameter can be changed back to the Standard tier after the maintenance window to minimize ongoing costs. Which action should the administrator take to meet these requirements?

Show answer & explanation

Answer: Upgrade the parameter to the Advanced tier to apply the Expiration policy, and accept that the parameter cannot be downgraded back to the Standard tier.

Answer

Upgrade the parameter to the Advanced tier to apply the Expiration policy, and accept that the parameter cannot be downgraded back to the Standard tier.
The correct option is the one stating the parameter must be upgraded to the Advanced tier and cannot be downgraded. In AWS Systems Manager Parameter Store, parameter policies (such as Expiration) are only available in the Advanced tier. Upgrading a parameter from the Standard tier to the Advanced tier is a one-way operation; Parameter Store does not support downgrading an Advanced parameter back to the Standard tier.

Step-by-Step Solution

1
Identify the tier requirements for Parameter Store parameter policies.
Parameter policies (such as Expiration) are only supported in the Advanced parameter tier.
Standard parameters do not support parameter policies.
2
Determine the upgrade path from Standard to Advanced tier.
A parameter can be upgraded from the Standard tier to the Advanced tier at any time by updating its configuration.
To apply the Expiration policy, the parameter tier must be changed to Advanced.
3
Evaluate the feasibility of downgrading the parameter tier back to Standard.
AWS Systems Manager Parameter Store does not support downgrading an Advanced parameter to a Standard parameter.
Once upgraded to Advanced, it is a permanent change for that parameter name, meaning the administrator must accept that it cannot be reverted to the Standard tier.

Key Concept

Systems Manager Parameter Store Tiers and Parameter Policies
Estimated Time:1m 30s
Question 870Question →

A SysOps Administrator is configuring Cross-Region Replication (CRR) between two Amazon S3 buckets. The source bucket is in the us-east-1 Region and has S3 Versioning enabled. The destination bucket is in the us-west-2 Region. The administrator creates a replication IAM role and attempts to apply the replication configuration to the source bucket using the AWS CLI. The command fails with a validation error indicating that replication cannot be configured. Which of the following is the most likely cause of this error?

Show answer & explanation

Answer: S3 Versioning is not enabled on the destination S3 bucket.

Answer

S3 Versioning is not enabled on the destination S3 bucket.
Amazon S3 replication requires S3 Versioning to be enabled on both the source and destination buckets. If S3 Versioning is not enabled or is suspended on the destination bucket, S3 will fail to apply the replication configuration and throw a validation error.

Step-by-Step Solution

1
Inspect the replication CLI error logs to identify the validation failure point.
The CLI logs show a validation error indicating that replication targets must have versioning enabled.
This helps locate the specific requirement that was missed during bucket preparation.
2
Enable S3 Versioning on the destination S3 bucket in the us-west-2 Region.
The destination bucket now has active versioning.
Amazon S3 replication requires version IDs to track and sync objects; thus, both buckets must have versioning enabled.
3
Re-run the AWS CLI replication configuration command.
The replication configuration is successfully applied to the source bucket.
Enabling versioning on both buckets satisfies the S3 replication pre-requisite.

Key Concept

S3 Replication Versioning Requirements
Estimated Time:1m 30s
Question 871Question →

A company distributes an AWS Service Catalog product that deploys web application environments. The central operations team releases a new product version to patch a security vulnerability. A SysOps administrator must ensure that all future deployments use the new version and that users can no longer provision new environments using any previous versions. The administrator must also ensure that existing, running provisioned products remain operational. Which action should the administrator take to meet these requirements?

Show answer & explanation

Answer: Set the status of the older product versions to Inactive, and ensure the new version is set to Active.

Answer

Set the status of the older product versions to Inactive, and ensure the new version is set to Active.
Setting a product version's status to Inactive prevents users from selecting it for new provisioning actions, while keeping it available for existing provisioned products. This ensures that current deployments are not disrupted, but all future deployments are forced to use the new Active version.

Step-by-Step Solution

1
Identify the target product in the AWS Service Catalog console.
The product configuration details and version list are accessed.
To manage the versions of the specific product that needs security patching.
2
Locate the older versions of the product, change their status to Inactive, and set the new patched version to Active.
Older versions can no longer be chosen for new provisioning workflows, while existing provisioned products remain operational.
To prevent future vulnerable deployments without terminating or affecting currently running environments.

Key Concept

AWS Service Catalog product version lifecycle management
Estimated Time:1m 30s
Question 872Question →

A SysOps administrator is troubleshooting an automated compliance remediation workflow. An Amazon EventBridge rule is configured to detect non-compliant Amazon S3 buckets reported by AWS Config and trigger an AWS Systems Manager (SSM) Automation runbook to remediate them. The EventBridge rule successfully fires, but the Systems Manager Automation execution fails immediately with an access denied error. Which of the following actions are required to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy to the EventBridge execution role that grants the iam:PassRole permission for the Systems Manager Automation service role.; Configure the trust policy of the Systems Manager Automation service role to allow the ssm.amazonaws.com service principal to assume the role.

Answer

Attach an IAM policy to the EventBridge execution role that grants the iam:PassRole permission for the Systems Manager Automation service role, and configure the trust policy of the Systems Manager Automation service role to allow the ssm.amazonaws.com service principal to assume the role.
To resolve the access denied error when Amazon EventBridge triggers Systems Manager Automation, two permissions must be configured. First, the EventBridge execution role must be granted the iam:PassRole permission for the Systems Manager Automation service role. Second, the Systems Manager Automation service role must trust the ssm.amazonaws.com service principal so that the Systems Manager service can successfully assume the role to run the remediation steps.

Step-by-Step Solution

1
Check the EventBridge execution role permissions.
Confirm that the role has permissions to run SSM Automation (ssm:StartAutomationExecution) and pass the automation service role (iam:PassRole).
EventBridge needs to pass the execution role to Systems Manager to run the remediation workflow on its behalf.
2
Examine the trust policy of the Systems Manager Automation service role.
Ensure that the trust policy allows the ssm.amazonaws.com service principal to perform sts:AssumeRole.
Without this trust relationship, Systems Manager cannot assume the role to run the runbook's steps.

Key Concept

IAM permissions and service trust relationships required for EventBridge to trigger Systems Manager Automation.
Question 873Question →

A SysOps Administrator is running a compliance verification script across a fleet of Amazon EC2 instances in a private subnet using AWS Systems Manager Run Command with the AWS-RunShellScript document. The instances have the SSM Agent installed and running, and they are associated with an IAM instance profile containing the AmazonSSMManagedInstanceCore managed policy. To capture the full script output, the administrator specifies a custom Amazon S3 bucket in the Run Command parameters. The execution completes, but the command status shows as 'Failed' on all instances, and no logs are delivered to the S3 bucket. What should the administrator do to resolve this issue?

Show answer & explanation

Answer: Attach an IAM policy to the EC2 instances' IAM role that grants the s3:PutObject permission for the target S3 bucket.

Answer

Attach an IAM policy to the EC2 instances' IAM role that grants the s3:PutObject permission for the target S3 bucket.
When configuring AWS Systems Manager Run Command to upload output logs to an Amazon S3 bucket, the SSM Agent running locally on each EC2 instance performs the upload. The agent executes within the security context of the instance's IAM instance profile. Since the default AmazonSSMManagedInstanceCore managed policy does not grant permissions to write to arbitrary S3 buckets, you must explicitly attach a policy to the instance profile role that allows the s3:PutObject action on the target S3 bucket.

Step-by-Step Solution

1
Analyze how Systems Manager Run Command uploads logs to Amazon S3.
Identify that the SSM Agent running inside the EC2 instance OS initiates the upload directly to S3.
This establishes that the credentials used for the upload belong to the EC2 instance's IAM instance profile, not a service role.
2
Review the default permissions of the EC2 instance profile.
Determine that the AmazonSSMManagedInstanceCore policy allows communication with Systems Manager but does not grant write access to custom S3 buckets.
This explains why the command fails when attempting to upload logs to a newly specified custom S3 bucket.
3
Determine the necessary IAM policy adjustment.
Conclude that an IAM policy allowing the s3:PutObject action on the target bucket must be attached to the IAM role associated with the EC2 instances.
This provides the required write permission to allow the SSM Agent to successfully deliver the logs and complete the execution status.

Key Concept

EC2 Instance Profile permissions for SSM Run Command S3 log redirection
Estimated Time:2m 0s
Question 874Question →

A SysOps administrator in Account A (111111111111111111111111) is configuring an Amazon EventBridge Scheduler schedule to invoke an AWS Lambda function in Account B (222222222222222222222222) on a daily basis.

The administrator creates an IAM role in Account A named `SchedulerExecutionRole` to be used as the execution role for the schedule. The role has a permissions policy that allows `lambda:InvokeFunction` on the target function `arn:aws:lambda:us-east-1:222222222222:function:DailyAudit`. The trust policy of `SchedulerExecutionRole` allows the `scheduler.amazonaws.com` service principal to assume the role.

When the administrator attempts to create the schedule using the AWS CLI, the command fails with an `AccessDeniedException` error, and the schedule is not created.

Which of the following configuration changes are required to successfully establish this workflow? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add an IAM policy statement to the administrator's IAM identity in Account A that grants the `iam:PassRole` permission for the `SchedulerExecutionRole` resource.; Configure the resource-based policy of the Lambda function in Account B to grant `lambda:InvokeFunction` permissions to the `SchedulerExecutionRole` principal.

Answer

To resolve the issue, the administrator's IAM identity in Account A must be granted the `iam:PassRole` permission for the `SchedulerExecutionRole` resource, and the resource-based policy of the Lambda function in Account B must grant `lambda:InvokeFunction` permissions to the `SchedulerExecutionRole` principal.
The correct answer configuration requires granting the administrator the `iam:PassRole` permission to authorize passing the execution role to the EventBridge Scheduler service, and updating the resource-based policy of the Lambda function in Account B to trust the execution role from Account A. The `AccessDeniedException` encountered during CLI execution indicates that the administrator lacks the `iam:PassRole` permission. Cross-account invocation of a Lambda function requires that the target function itself allows the caller principal via its resource-based policy, which must be configured in Account B.

Step-by-Step Solution

1
Analyze the access denied error encountered during the schedule creation process.
The administrator cannot associate the IAM execution role with the EventBridge Scheduler because the administrator lacks permission to pass the role.
AWS prevents privilege escalation by requiring users to have the `iam:PassRole` permission when configuring AWS services with execution roles.
2
Specify the required identity-based permission in Account A.
An IAM policy statement is added to the administrator's policy allowing `iam:PassRole` on the `SchedulerExecutionRole` ARN.
This grants the administrator the necessary privilege to pass the specific role to the EventBridge Scheduler service principal.
3
Analyze cross-account invocation requirements for AWS Lambda.
Even if the execution role has a permissions policy allowing `lambda:InvokeFunction` on the remote resource, cross-account calls must be explicitly authorized by the resource-owner account.
A resource-based policy on the target Lambda function in Account B must be updated to allow invocation by the execution role in Account A.

Key Concept

Successful cross-account invocation of target services by scheduled execution roles requires the administrator to possess `iam:PassRole` to delegate the role, and the target service in the receiving account to have a resource-based policy allowing invocation by the delegated role principal.
Estimated Time:3m 0s
Question 875Question →

An application running on an Amazon EC2 instance in Account A (111122223333111122223333) must write logs to an Amazon CloudWatch Logs log group in Account B (444455556666444455556666). A SysOps administrator is configuring the application to programmatically assume an IAM role named `CrossAccountLogWriterRole` in Account B to perform this action.

Which of the following configuration steps are required to establish this cross-account access? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy to the EC2 instance's IAM role in Account A that allows the `sts:AssumeRole` action on the `CrossAccountLogWriterRole` ARN in Account B.; Modify the trust policy of `CrossAccountLogWriterRole` in Account B to allow the EC2 instance's IAM role in Account A to perform the `sts:AssumeRole` action.

Answer

To configure cross-account access, the administrator must attach an IAM policy to the EC2 instance's IAM role in Account A to allow the sts:AssumeRole action on the target role, and modify the trust policy of the CrossAccountLogWriterRole in Account B to allow the EC2 instance's IAM role to perform the sts:AssumeRole action.
Establishing cross-account delegation requires configuring both sides of the trust relationship. First, the calling identity (the EC2 instance's IAM role in Account A) must have an IAM policy that permits the sts:AssumeRole action on the destination role's ARN in Account B. Second, the destination role (CrossAccountLogWriterRole in Account B) must have a trust policy that permits the EC2 instance's IAM role to assume it.

Step-by-Step Solution

1
Configure the permission policy in the source account.
The EC2 instance's IAM role in Account A is granted permissions to perform the sts:AssumeRole operation targeting the ARN of the role in Account B.
Before an IAM identity can assume another role, it must be explicitly allowed to perform the sts:AssumeRole action on the target resource.
2
Configure the trust relationship in the target account.
The CrossAccountLogWriterRole trust policy in Account B is updated to list the ARN of the EC2 instance's IAM role from Account A as a trusted Principal.
An IAM role must explicitly define who is trusted to assume it; without this trust relationship, assume role requests will be denied.

Key Concept

Cross-account delegation requires a two-way handshake: the source principal's permission policy must allow calling sts:AssumeRole on the target role, and the target role's trust policy must trust the source principal.
Question 876Question →

A SysOps Administrator is hosting a web application on an Amazon EC2 instance in a public subnet. To allow public HTTP access, the administrator creates a custom Network Access Control List (NACL) associated with the subnet and adds an inbound rule allowing TCP traffic on port 80 from 0.0.0.0/0. The security group associated with the EC2 instance already allows all inbound and outbound traffic. However, external web clients are still unable to load the website. Which configuration change must the administrator make to allow clients to establish HTTP connections?

Show answer & explanation

Answer: Add an outbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 to 0.0.0.0/0.

Answer

Add an outbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 to 0.0.0.0/0.
The correct option is the one stating that an outbound rule must be added to the custom NACL to allow TCP traffic on ports 1024-65535. Network Access Control Lists (NACLs) operate at the subnet level and are stateless, meaning they do not track connection states. Therefore, outbound response traffic must be explicitly permitted. When client browsers send requests to port 80, they expect the return traffic on a randomly allocated ephemeral port (1024-65535). Adding this rule allows the response traffic to flow back to the clients.

Step-by-Step Solution

1
Identify the statefulness of the network security controls in use.
Security groups are stateful, but NACLs are stateless.
Because NACLs are stateless, return traffic is not automatically tracked or allowed; it must be permitted explicitly by outbound rules.
2
Determine the destination port range for the outbound return traffic from the web server back to the clients.
The return traffic from the web server goes to the client's ephemeral ports (1024-65535).
When a client initiates a connection to port 80, its local OS assigns a random high-numbered port (ephemeral port) for the response.
3
Select the correct rule to add to the stateless NACL configuration.
Add an outbound rule allowing TCP on ports 1024-65535 to 0.0.0.0/0.
This allows the return traffic to pass through the subnet boundary to the client.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit outbound rules for ephemeral port ranges to allow response traffic back to clients.
Estimated Time:1m 0s
Question 877Question →

A SysOps administrator is configuring an Amazon EC2 Image Builder pipeline in Account A (123456789012123456789012) to build custom machine images. The pipeline is configured to run using an IAM role named `ImageBuilderPipelineExecutionRole`. During the build process, the pipeline launches an EC2 instance that must run with an IAM instance profile associated with the IAM role `ImageBuilderBuildRole`. When the pipeline is executed, it fails during the build phase with an Access Denied error when attempting to launch the EC2 build instance. The `ImageBuilderPipelineExecutionRole` permissions policy contains permissions for `imagebuilder:*` and `ec2:*` actions but does not contain any other permissions. Which modification to the IAM policies will resolve this error?

Show answer & explanation

Answer: Add `iam:PassRole` permissions for the `ImageBuilderBuildRole` resource to the `ImageBuilderPipelineExecutionRole` permissions policy.

Answer

Add `iam:PassRole` permissions for the `ImageBuilderBuildRole` resource to the `ImageBuilderPipelineExecutionRole` permissions policy.
To launch an Amazon EC2 instance with an IAM role associated, the principal launching the instance (in this case, the EC2 Image Builder pipeline execution role) must have `iam:PassRole` permissions on the role being passed to the instance (`ImageBuilderBuildRole`). This allows the pipeline to safely delegate the role to the EC2 service for the build instance.

Step-by-Step Solution

1
Identify the failing action.
The EC2 Image Builder pipeline fails during the build phase while attempting to launch an EC2 instance associated with the `ImageBuilderBuildRole` role.
This indicates that the identity launching the instance (the pipeline execution role) lacks the authority to delegate the target role to the EC2 instance.
2
Determine the required IAM permission for role delegation.
The `iam:PassRole` permission is required.
When an AWS service or service role launches a resource with an IAM role attached, the calling principal must have the explicit permission to pass that role to the service.
3
Update the execution role policy.
Add `iam:PassRole` on the `ImageBuilderBuildRole` resource to the `ImageBuilderPipelineExecutionRole` permissions policy.
This grants the pipeline execution role the necessary permissions to successfully pass the build role to the EC2 service during the instance launch.

Key Concept

IAM Role Delegation and the PassRole Permission
Estimated Time:2m 0s
Question 878Question →

A SysOps Administrator is configuring an AWS Systems Manager Automation workflow to automate administrative tasks across a fleet of Amazon EC2 instances. The administrator creates a custom IAM role named SSMAutomationServiceRole to grant Systems Manager permissions to perform actions on other AWS resources. When the administrator attempts to start the execution of the Automation workflow using the AWS Command Line Interface (AWS CLI), the execution fails immediately with an access denied error indicating that the user is not authorized to perform iam:PassRole on the service role resource.

The administrator's user account already has the AmazonSSMFullAccess policy attached. The SSM Agent is running on all target EC2 instances, and the AmazonSSMManagedInstanceCore policy is attached to the instance profiles.

Which of the following actions will resolve this failure?

Show answer & explanation

Answer: Attach an IAM policy to the administrator's IAM user that permits the iam:PassRole action on the SSMAutomationServiceRole resource.

Answer

Attach an IAM policy to the administrator's IAM user that permits the iam:PassRole action on the SSMAutomationServiceRole resource.
To resolve the failure, the administrator's IAM user must be granted the iam:PassRole permission. When starting a Systems Manager Automation workflow that uses a service role, AWS requires the initiating user to have permission to pass that IAM role to the Systems Manager service. This prevents users from escalating their privileges by passing roles with more permissions than their own user account.

Step-by-Step Solution

1
Identify the cause of the failure from the error message.
The failure is due to a missing iam:PassRole permission on the administrator's IAM account when attempting to use the service role.
AWS services require a user to have the iam:PassRole permission to pass a service role to the AWS service that will assume it.
2
Locate the target service role ARN.
The service role is arn:aws:iam::111122223333:role/SSMAutomationServiceRole.
The IAM policy must reference this specific role ARN in the resource element.
3
Create and attach an IAM policy to the administrator's IAM user or group.
An IAM policy with Effect: Allow, Action: iam:PassRole, and Resource: arn:aws:iam::111122223333:role/SSMAutomationServiceRole is attached.
This grants the administrator the necessary permission to pass the service role to Systems Manager, allowing the Automation execution to proceed.

Key Concept

AWS Systems Manager service roles and the iam:PassRole permission requirement for service execution.
Question 879Question →

A SysOps administrator is configuring an AWS CloudTrail organizational trail to log events across all accounts in an AWS Organization. The trail is configured to deliver logs to a centralized Amazon S3 bucket in a dedicated log archive account. The S3 bucket is encrypted using a customer managed AWS KMS key. After configuring the trail, the administrator notices that log files are not appearing in the S3 bucket, and CloudTrail shows a log delivery failure status.

Which action should the administrator take to resolve this issue?

Show answer & explanation

Answer: Update the KMS key policy of the customer managed key to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the kms:GenerateDataKey* action.

Answer

Update the KMS key policy of the customer managed key to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the kms:GenerateDataKey* action.
Updating the KMS key policy of the customer managed key to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the kms:GenerateDataKey* action allows CloudTrail to encrypt the logs before writing them to the bucket. Because a customer managed key is used, the key policy must explicitly authorize CloudTrail to use the key.

Step-by-Step Solution

1
Analyze the error condition.
CloudTrail delivery fails to an S3 bucket encrypted with a customer managed KMS key.
CloudTrail needs permission to generate data keys to encrypt logs using the customer managed KMS key before writing them to the bucket.
2
Identify the policy that controls customer managed KMS key access.
The KMS key policy is the primary authority for customer managed keys and must explicitly allow the CloudTrail service principal.
IAM policies alone cannot grant access to a KMS key if the key policy itself does not authorize the principal or delegate access to the IAM account.
3
Configure the required policy modification.
Add a statement to the KMS key policy allowing the 'cloudtrail.amazonaws.com' principal to perform 'kms:GenerateDataKey*'.
This establishes the necessary trust and permission for CloudTrail to encrypt and deliver log files to the S3 bucket.

Key Concept

AWS KMS key policy configuration for CloudTrail log delivery
Question 880Question →

A company enforces a strict security policy that prohibits all internet egress from its production Amazon VPC. A SysOps administrator is configuring automatic credential rotation for an Amazon RDS for PostgreSQL DB instance. The database credentials are stored in AWS Secrets Manager, and the secret is encrypted using the default AWS managed key `aws/secretsmanager`.

The administrator deploys the rotation AWS Lambda function into the same private subnets as the RDS DB instance. However, during testing, the rotation fails. CloudWatch Logs for the rotation Lambda function show that the function times out while attempting to establish a connection to the Secrets Manager service endpoint to retrieve the current version of the secret.

Which action must the administrator take to resolve this network connectivity issue and allow the rotation to complete successfully?

Show answer & explanation

Answer: Create an interface VPC endpoint for AWS Secrets Manager within the VPC. Configure the security group of the interface VPC endpoint to allow inbound HTTPS traffic from the security group of the rotation Lambda function, and ensure that private DNS is enabled.

Answer

The correct action is to create an interface VPC endpoint for AWS Secrets Manager, configure its security group to accept HTTPS traffic from the Lambda function, and enable private DNS.
The correct action is to create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC. Because the VPC has no internet routing (NAT Gateway or Internet Gateway), the Lambda function running in the private subnet cannot reach public AWS endpoints. An interface VPC endpoint places an ENI in the private subnet, allowing the Lambda function to connect privately to Secrets Manager. Enabling private DNS ensures that the standard service hostname resolves to this private IP, and configuring the security group rules allows HTTPS communication between the Lambda function and the endpoint.

Step-by-Step Solution

1
Analyze the log error and network path.
Identify that the Lambda function is deployed in a private subnet with no internet route (no NAT Gateway or Internet Gateway) and times out when attempting to reach the Secrets Manager service endpoint.
Since the VPC lacks public internet access, private subnet resources cannot access public AWS service endpoints directly.
2
Select the correct VPC endpoint type.
Determine that AWS Secrets Manager supports interface VPC endpoints (PrivateLink) and does not support gateway VPC endpoints.
Interface endpoints use elastic network interfaces (ENIs) with private IP addresses to direct traffic to the service.
3
Configure the interface VPC endpoint and security groups.
Create the interface endpoint in the VPC, enable private DNS, and verify that its security group allows inbound HTTPS (port 443) traffic from the Lambda function's security group.
This establishes the local network route and access permissions, allowing the Lambda function to resolve and reach the endpoint securely.

Key Concept

Configuring VPC networking and endpoints for Secrets Manager rotation in isolated environments.
Estimated Time:2m 30s
PreviousPage 44 / 49Next
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin