All practice questions

976 questions

Question 881Question

An organization is setting up cross-Region replication for an Amazon S3 bucket named corp-data-primary to a destination bucket named corp-data-backup in another AWS Region. The SysOps Administrator has created the replication rule and assigned an IAM role with the necessary permissions. However, the replication status indicates that objects are not copying to the destination bucket. Which of the following configuration changes are required to successfully enable replication? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable bucket versioning on the source S3 bucket.; Enable bucket versioning on the destination S3 bucket.

Answer

Enable bucket versioning on both the source S3 bucket and the destination S3 bucket.
For Amazon S3 replication to work, versioning must be explicitly enabled on both the source bucket and the destination bucket. Without versioning enabled on both ends, S3 cannot track and replicate object versions.

Step-by-Step Solution

1
Verify that bucket versioning is enabled on the source S3 bucket.
Enabling versioning on the source bucket allows Amazon S3 to track object versions, which is a requirement for replication.
Replication relies on versioning to uniquely identify and copy specific versions of objects.
2
Verify that bucket versioning is enabled on the destination S3 bucket.
Enabling versioning on the destination bucket ensures that the copied versions can be stored correctly.
Both the source and destination buckets must have versioning enabled for replication to succeed.

Key Concept

Amazon S3 cross-Region replication requires versioning to be enabled on both the source and destination buckets.
Question 882Question

A SysOps Administrator is managing an infrastructure deployment using an AWS CloudFormation stack. A recent drift detection scan reveals that several resources, including an Amazon EC2 instance and an EC2 security group, are in a MODIFIED state due to manual configuration changes made by the operations team. The administrator is planning to perform a stack update using a modified CloudFormation template.

Which two statements correctly describe how CloudFormation will handle the drifted resources during the stack update? (Select two.)

Select all that apply

Show answer & explanation

Answer: If the stack update template modifies a property of a drifted resource that was manually changed, CloudFormation overwrites the manual change with the value specified in the new template.; If the stack update template does not modify the properties of a drifted resource, the manual changes to those properties are preserved.

Answer

If the stack update template modifies a property of a drifted resource that was manually changed, CloudFormation overwrites the manual change with the value specified in the new template. If the stack update template does not modify the properties of a drifted resource, the manual changes to those properties are preserved.
The correct answers describe the official behavior of AWS CloudFormation during a stack update. Specifically, if a property that has drifted is modified by the new template, CloudFormation updates the property to the value defined in the template, overwriting the manual change. If the properties are not modified by the template, CloudFormation leaves them alone, preserving the manual changes.

Step-by-Step Solution

1
Analyze how AWS CloudFormation processes stack updates in relation to resource drift.
Identify that CloudFormation updates resources according to the configuration specified in the template.
This establishes the fundamental behavior that CloudFormation does not perform automatic drift reconciliation during an update.
2
Evaluate the behavior when the update template modifies a drifted property.
Determine that CloudFormation will apply the template's specified value, overwriting any manual (drifted) change.
This explains the remediation or overwriting mechanism during stack updates.
3
Evaluate the behavior when the update template does not modify the drifted property.
Determine that CloudFormation leaves the resource unchanged, thereby preserving the manual changes.
This confirms that unmodified resources/properties are not touched by the stack update process.

Key Concept

AWS CloudFormation Drift Behavior During Stack Updates
Question 883Question

A SysOps administrator is configuring an Amazon Kinesis Data Firehose delivery stream to stream application logs to an Amazon S3 bucket. The destination S3 bucket is encrypted using a customer managed AWS KMS key. The administrator creates a custom IAM role named FirehoseDeliveryRole to allow the delivery stream to access the S3 bucket and use the KMS key. Which of the following configurations are required to ensure the delivery stream is created successfully and can write encrypted logs? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the trust policy of FirehoseDeliveryRole to allow the firehose.amazonaws.com service principal to perform the sts:AssumeRole action.; Attach an IAM policy to the SysOps administrator's IAM identity that grants the iam:PassRole permission for the FirehoseDeliveryRole resource.

Answer

To configure the delivery stream, the trust policy of FirehoseDeliveryRole must allow the firehose.amazonaws.com service principal to perform the sts:AssumeRole action, and the administrator's IAM identity must be granted the iam:PassRole permission for the FirehoseDeliveryRole resource.
To configure Kinesis Data Firehose to deliver encrypted data, the service must assume the role using sts:AssumeRole, which requires the firehose.amazonaws.com service principal to be trusted in the role's trust policy. Furthermore, the administrator needs the iam:PassRole permission to safely associate the role with the delivery stream.

Step-by-Step Solution

1
Determine how the Kinesis Data Firehose service assumes the role to interact with resources.
The service principal firehose.amazonaws.com must be explicitly allowed to perform sts:AssumeRole in the FirehoseDeliveryRole's trust policy.
Service trust policies are required to delegate permissions to AWS service principals.
2
Determine the permissions needed by the administrator to assign this role to the delivery stream.
The administrator's IAM policy must grant iam:PassRole on the FirehoseDeliveryRole resource.
iam:PassRole is required to ensure users do not elevate their privileges by assigning roles they are not authorized to delegate.
3
Verify KMS key authorization requirements.
The key policy of the customer managed KMS key must explicitly allow the FirehoseDeliveryRole to perform kms:GenerateDataKey and kms:Decrypt.
IAM policies on their own cannot authorize access to a customer managed KMS key unless the key policy explicitly allows delegation to IAM.

Key Concept

Configuring service roles, service trust relationships, iam:PassRole, and KMS key policies for AWS services.
Question 884Question

An Amazon EC2 instance in a private subnet needs to download security patches from an external repository over HTTPS (TCP port 443). The subnet's custom network access control list (NACL) has a rule that allows outbound TCP traffic on port 443 to any destination. However, the connection attempts are timing out. Which modification to the custom NACL will allow the EC2 instance to successfully receive the patches?

Show answer & explanation

Answer: Configure an inbound rule permitting TCP traffic on ports 1024-65535 from the repository's IP address.

Answer

Configure an inbound rule permitting TCP traffic on ports 1024-65535 from the repository's IP address.
The correct configuration is to configure an inbound rule permitting TCP traffic on ports 1024-65535. Network Access Control Lists (NACLs) are stateless, meaning that allowing outbound traffic does not automatically allow the corresponding return traffic. When the EC2 instance initiates a connection to the external repository on port 443, the repository sends the response back to the instance's ephemeral ports, which typically range from 1024 to 65535. Therefore, an inbound rule covering these ephemeral ports is required to allow the response traffic through the NACL.

Step-by-Step Solution

1
Analyze the traffic flow and the security components involved.
The EC2 instance is initiating an outbound connection over HTTPS (destination port 443) through a stateless network access control list (NACL).
Evaluating both Security Groups and NACLs for inbound and outbound traffic determines where the connection is being blocked.
2
Apply the stateless rule behavior of Network Access Control Lists (NACLs).
NACLs are stateless, meaning they do not automatically allow response traffic. Therefore, an outbound connection requires a corresponding inbound rule to allow the return traffic.
Understanding the stateless nature of NACLs is necessary to realize that allowing outbound traffic alone is insufficient for communication.
3
Identify the destination ports for the return traffic.
When a client initiates a connection, it uses a random ephemeral port (typically in the range 1024-65535) as the source port. The return traffic from the server will target this ephemeral port range on the client.
To write the correct inbound rule, you must specify the range of ports the client is listening on for the response.

Key Concept

NACLs are stateless firewalls that control traffic at the subnet level, requiring explicit rules for both inbound and outbound traffic, including ephemeral ports for return traffic.
Question 885Question

A SysOps Administrator is setting up AWS Systems Manager to automate configuration compliance and patch management across a fleet of Amazon EC2 instances. The SSM Agent is confirmed to be running on all instances, and the `AmazonSSMManagedInstanceCore` policy is attached to their IAM instance profiles.

The administrator faces two distinct issues:
1. When creating a State Manager association that uses a custom execution role to run an automation document, the creation fails with an error indicating that the administrator is not authorized to perform the operation.
2. An automated patching window executes successfully, but a subset of instances fails to receive the updates defined in a custom patch baseline. The administrator verifies that the patch baseline has been correctly associated with the patch group named 'Production-Servers' in Patch Manager.

Which combination of actions will resolve these issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add the `iam:PassRole` permission to the SysOps Administrator's IAM user policy, specifying the custom execution role's ARN in the Resource element.; Add a tag to the target EC2 instances with the key `Patch Group` and the value `Production-Servers`.

Answer

Add the `iam:PassRole` permission to the SysOps Administrator's IAM user policy specifying the custom execution role's ARN, and apply a tag with the key `Patch Group` and value `Production-Servers` to the target EC2 instances.
To resolve the association creation failure, the administrator must have the `iam:PassRole` permission for the target role in their IAM policy. To resolve the patching misalignment, the EC2 instances must be tagged with the key `Patch Group` set to the value `Production-Servers`, allowing Patch Manager to match them to the correct patch baseline.

Step-by-Step Solution

1
Analyze the State Manager association authorization failure.
Identify that the administrator lacks the permission to delegate the execution role to the Systems Manager service.
AWS services require explicit delegation via `iam:PassRole` in the user's policy to assume a role and perform actions on their behalf.
2
Analyze the patching failure on the subset of EC2 instances.
Determine that the instances are not correctly mapped to the custom patch baseline.
Systems Manager Patch Manager uses a case-sensitive tag key named `Patch Group` to associate target instances with patch baselines.
3
Select the correct combination of fixes.
Add the `iam:PassRole` permission to the administrator's IAM policy for the role ARN, and apply the tag key `Patch Group` with the value `Production-Servers` to the instances.
These actions address the configuration delegation issue and the baseline mapping mechanism respectively.

Key Concept

Delegating permissions to AWS Systems Manager via IAM PassRole and mapping EC2 instances to patch baselines using case-sensitive Patch Group tags.
Estimated Time:2m 30s
Question 886Question

A SysOps administrator is configuring automatic rotation for an Amazon RDS database credential stored in AWS Secrets Manager. The secret is encrypted using a customer-managed AWS KMS key. The KMS key policy does not delegate permissions to the account's root user and lists specific IAM principals. After enabling rotation, the administrator notices that the rotation fails. The Amazon CloudWatch logs for the Lambda rotation function show an Access Denied error when attempting to retrieve the current secret version via the GetSecretValue call. The Lambda function's IAM execution role is already configured with a policy that allows secretsmanager:GetSecretValue and secretsmanager:PutSecretValue for the secret. Which of the following actions should the administrator take to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add kms:Decrypt and kms:DescribeKey permissions to the IAM policy attached to the Lambda rotation function's execution role.; Modify the key policy of the customer-managed KMS key to grant the Lambda rotation function's execution role permissions for the kms:Decrypt and kms:DescribeKey actions.

Answer

Add kms:Decrypt and kms:DescribeKey permissions to the IAM policy attached to the Lambda rotation function's execution role, and modify the key policy of the customer-managed KMS key to grant the Lambda rotation function's execution role permissions for the kms:Decrypt and kms:DescribeKey actions.
To resolve the Access Denied error during secret rotation, the Lambda rotation function's execution role must be granted permissions to decrypt the secret using the customer-managed KMS key. Because the KMS key is customer-managed and does not delegate permissions to the account's root user, access must be allowed in both the IAM policy attached to the Lambda execution role (granting kms:Decrypt and kms:DescribeKey) and the KMS key policy itself (granting the Lambda role principal permission to use the key). Without both, KMS policy evaluation will result in an implicit deny.

Step-by-Step Solution

1
Analyze the error context.
The Lambda rotation function receives an Access Denied error when attempting to decrypt the secret value using GetSecretValue because the secret is encrypted with a customer-managed KMS key and the function lacks decryption permissions.
Identify the cause of the failure.
2
Configure the IAM policy of the Lambda rotation function's execution role.
Add the kms:Decrypt and kms:DescribeKey permissions to the Lambda function's IAM execution role.
This grants the role permission to make KMS decrypt API calls.
3
Configure the KMS key policy.
Update the key policy to explicitly list the Lambda execution role ARN as an allowed principal for kms:Decrypt and kms:DescribeKey actions.
Since the customer-managed KMS key policy is restrictive and does not delegate permissions to the root user, updating the key policy is required to authorize the role.

Key Concept

KMS key policies have precedence and must explicitly authorize IAM roles to perform cryptographic operations if account-level delegation is not enabled.
Question 887Question

An application stores its static assets in a source Amazon S3 bucket and uses an Amazon RDS for MySQL DB instance. A SysOps Administrator must configure automatic replication of the static assets to a backup S3 bucket in a different Region. The database must also support automatic failover to another Availability Zone without requiring any manual updates to the application configuration. Which configuration satisfies these requirements?

Show answer & explanation

Answer: Enable versioning on both the source and backup S3 buckets, configure S3 Cross-Region Replication (CRR), and configure the RDS DB instance as a Multi-AZ deployment.

Answer

To meet the requirements, enable versioning on both the source and backup S3 buckets, configure S3 Cross-Region Replication (CRR), and configure the RDS DB instance as a Multi-AZ deployment.
The correct configuration enables S3 Versioning on both the source and backup buckets, which is a mandatory prerequisite for S3 Cross-Region Replication (CRR). Additionally, configuring RDS Multi-AZ ensures a synchronous standby instance is available in another Availability Zone, and RDS automatically updates the DNS record to point to this standby during a failover without requiring any endpoint updates in the application.

Step-by-Step Solution

1
Enable S3 Versioning on both the source and backup buckets.
Versioning becomes active on both S3 buckets.
S3 Cross-Region Replication (CRR) requires that both the source and destination buckets have versioning enabled.
2
Create and configure the S3 Cross-Region Replication rule on the source bucket pointing to the backup bucket.
Automatic replication of new objects to the destination bucket in the other Region is established.
This satisfies the requirement to back up static assets automatically across Regions.
3
Configure the RDS DB instance with a Multi-AZ deployment.
AWS RDS provisions a synchronous standby replica in a different Availability Zone and maintains a single DNS endpoint.
Multi-AZ configuration ensures automatic failover to the standby replica during an outage without requiring endpoint changes in the application.

Key Concept

Integrating S3 Cross-Region Replication (which requires versioning) with RDS Multi-AZ deployment (which provides automatic failover without endpoint changes).
Question 888Question

An operations team uses an AWS CloudFormation stack to manage security infrastructure. During a stack update, a resource creation error occurs, triggering an automatic rollback. However, the rollback process fails, and the stack status changes to UPDATE_ROLLBACK_FAILED because an IAM role managed by the stack was previously deleted manually.

Which of the following actions should the SysOps Administrator perform to resolve this issue and return the stack to a stable state?

Show answer & explanation

Answer: Run the aws cloudformation continue-update-rollback command with the --resources-to-skip parameter set to the logical ID of the deleted IAM role.

Answer

Run the aws cloudformation continue-update-rollback command with the --resources-to-skip parameter set to the logical ID of the deleted IAM role.
The correct action is to call the continue-update-rollback operation and skip the resource that caused the failure. When a stack is stuck in UPDATE_ROLLBACK_FAILED, CloudFormation allows you to resume the rollback while skipping specific resources (using the --resources-to-skip option in the CLI or through the console). This marks the skipped resources as rolled back and returns the stack to a stable UPDATE_ROLLBACK_COMPLETE state, allowing further updates or cleanups to be performed.

Step-by-Step Solution

1
Identify the resource that caused the rollback failure.
The stack events indicate that the rollback failed because the IAM role managed by the stack could not be found or updated.
Before continuing the rollback, you must identify which specific logical resource ID caused the UPDATE_ROLLBACK_FAILED state.
2
Execute the continue-update-rollback action and skip the failed resource.
Run the 'aws cloudformation continue-update-rollback' CLI command specifying the logical ID of the deleted IAM role in the '--resources-to-skip' parameter.
Skipping the failed resource allows CloudFormation to bypass the cleanup/rollback steps for that specific resource and successfully complete the rollback process for the rest of the stack.
3
Verify stack stability and perform manual remediation.
The stack status transitions to UPDATE_ROLLBACK_COMPLETE. You can then recreate the IAM role manually or update the template to align with the current state.
Since the resource was skipped, it is not present in AWS. Manual cleanup or synchronization is required to ensure drift is resolved and future updates can proceed.

Key Concept

Remediating CloudFormation stacks in the UPDATE_ROLLBACK_FAILED state by skipping resources during rollback.
Question 889Question

A SysOps Administrator in Account A (111111111111111111111111) needs to share an encrypted Amazon EBS snapshot with Account B (222222222222222222222222). The snapshot is encrypted with a customer managed KMS key in Account A (Key-A). The administrator has successfully shared the snapshot with Account B. In Account B, an IAM user named `CopyAdmin` attempts to copy the shared snapshot to Account B and encrypt the copy using a customer managed KMS key in Account B (Key-B). However, the copy operation fails with a KMS Access Denied error.

Which of the following configurations are required to successfully complete the snapshot copy operation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In Account A, modify the key policy of Key-A to grant Account B (or the CopyAdmin user) the kms:DescribeKey, kms:Decrypt, and kms:CreateGrant permissions.; In Account B, attach an IAM policy to the CopyAdmin user that grants the kms:DescribeKey, kms:Decrypt, and kms:CreateGrant permissions targeting the ARN of Key-A.

Answer

In Account A, modify the key policy of Key-A to grant Account B (or the CopyAdmin user) the kms:DescribeKey, kms:Decrypt, and kms:CreateGrant permissions; and in Account B, attach an IAM policy to the CopyAdmin user that grants the kms:DescribeKey, kms:Decrypt, and kms:CreateGrant permissions targeting the ARN of Key-A.
To successfully copy an encrypted EBS snapshot across AWS accounts, permissions must be explicitly allowed on both sides of the account boundary. First, the key policy of the customer managed key in the source account (Key-A in Account A) must trust the destination account or principal, granting permissions to describe the key, decrypt the data, and create a KMS grant. The kms:CreateGrant permission is essential because the EBS service uses grants to access the KMS key during the copy operation. Second, the copying IAM principal in the destination account (CopyAdmin in Account B) must have an attached IAM policy that permits those same actions on the external key's ARN. Without both configurations, the cross-account copy operation will fail.

Step-by-Step Solution

1
Configure the key policy in the resource-owning account (Account A)
The key policy for Key-A allows Account B (or the CopyAdmin user) to perform kms:DescribeKey, kms:Decrypt, and kms:CreateGrant.
Since the key belongs to Account A, Account A must trust Account B. The kms:CreateGrant permission is required because the Amazon EBS service in Account B will perform the actual decryption asynchronously on behalf of the user using a KMS grant.
2
Configure the IAM policy in the consuming account (Account B)
The CopyAdmin user in Account B is authorized by their local IAM policy to access Key-A in Account A using the specified KMS actions.
For cross-account operations, access must be allowed both by the resource policy in the source account and by the identity policy in the destination account. One-sided configuration results in an Access Denied error.

Key Concept

Cross-account KMS key access requirements and service delegation via grants for EBS snapshot copies
Question 890Question

A SysOps Administrator is managing an infrastructure stack deployed via AWS CloudFormation. The stack contains an Amazon S3 bucket, an Amazon EC2 instance, and an IAM role, and is configured to use a specific IAM service role for stack operations. During a recent update, the deployment failed and the stack is now in the UPDATE_ROLLBACK_FAILED state. Which TWO actions should the administrator take to troubleshoot and successfully complete the rollback? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Verify that the CloudFormation service role has the required permissions to modify or delete the resources that failed during the rollback process.; Execute the Continue Update Rollback operation and choose to skip the specific resources that are preventing the rollback from succeeding.

Answer

Verify that the CloudFormation service role has the required permissions to modify or delete the resources that failed, and execute the Continue Update Rollback operation to skip the specific resources preventing the rollback from succeeding.
To resolve a stack in the UPDATE_ROLLBACK_FAILED state, the administrator must either fix the root cause of the rollback failure or bypass the failing resources. Verifying that the CloudFormation service role has the correct permissions addresses authorization failures. If a resource cannot be rolled back because it was deleted or modified out-of-band, the administrator must run the Continue Update Rollback operation and choose to skip the failing resources, allowing the rest of the stack to reach a stable state.

Step-by-Step Solution

1
Review the stack's events in the AWS CloudFormation console or via the AWS CLI.
Identify the specific resources that failed during the rollback process and the exact error messages.
This pinpoints whether the failure is due to missing permissions (Access Denied) or missing physical resources (Not Found).
2
Inspect the policy attached to the CloudFormation service role assigned to the stack.
Verify that the role contains permissions to delete or modify the failed resources.
If permissions are missing, updating the role allows CloudFormation to proceed with the rollback.
3
Perform a Continue Update Rollback operation and list the drifted/deleted resources to be skipped.
CloudFormation skips the specified resources, rolls back the rest of the stack, and sets the status to UPDATE_ROLLBACK_COMPLETE.
This bypasses the blocking resources to return the stack to a stable state so manual cleanup can occur.

Key Concept

AWS CloudFormation Update Rollback Failure Remediation
Question 891Question

A SysOps administrator is attempting to export historical log data from an Amazon CloudWatch Logs log group in the us-east-1 Region to an Amazon S3 bucket for long-term archiving. The administrator has verified that their IAM identity has the `logs:CreateExportTask` permission. However, when initiating the export task, it immediately fails with the following error:

`An error occurred (InvalidParameterException) when calling the CreateExportTask operation: The S3 bucket owner does not have write permission on the bucket.`

Which of the following actions will resolve this issue?

Show answer & explanation

Answer: Add a bucket policy to the destination Amazon S3 bucket that allows the logs.us-east-1.amazonaws.com service principal to perform the s3:PutObject and s3:GetBucketAcl actions.

Answer

Add a bucket policy to the destination Amazon S3 bucket that allows the logs.us-east-1.amazonaws.com service principal to perform the s3:PutObject and s3:GetBucketAcl actions.
The correct action is to add a bucket policy to the destination Amazon S3 bucket that allows the logs.us-east-1.amazonaws.com service principal to perform the s3:PutObject and s3:GetBucketAcl actions. CloudWatch Logs requires these resource-based permissions on the target S3 bucket to verify ownership and write the exported log data.

Step-by-Step Solution

1
Identify the service principal responsible for performing the log export operation.
The CloudWatch Logs service principal (logs.us-east-1.amazonaws.com for the us-east-1 Region) is identified as the entity performing the write.
AWS services that write data directly to customer-owned resources must be authorized using resource-based policies.
2
Determine the necessary S3 permissions required by the CloudWatch Logs service.
The service requires s3:PutObject to write the log objects and s3:GetBucketAcl to verify ownership of the bucket.
CloudWatch Logs checks the bucket ACL before writing to ensure that the account owner owns the destination bucket.
3
Configure and apply the S3 bucket policy containing these permissions and condition keys for security best practices.
The bucket policy is updated to allow logs.us-east-1.amazonaws.com to write to the bucket, optionally restricted by aws:SourceAccount and aws:SourceArn.
This grants the CloudWatch Logs service the necessary write access to resolve the InvalidParameterException error.

Key Concept

CloudWatch Logs to Amazon S3 Export Permissions
Estimated Time:1m 30s
Question 892Question

An environment is managed using an AWS CloudFormation stack. A SysOps administrator initiates a stack update to modify an Application Load Balancer and its associated security group. The update fails, and the subsequent rollback also fails, leaving the stack in the UPDATE_ROLLBACK_FAILED state. The stack events show that a security group rule cannot be deleted because it is referenced by another resource that was created manually outside the stack. Which action should the administrator take to successfully return the stack to a stable state?

Show answer & explanation

Answer: Execute the ContinueUpdateRollback action while specifying the security group as a resource to skip, and then manually delete the external reference and update the security group configuration to match the template.

Answer

Execute the ContinueUpdateRollback action while specifying the security group as a resource to skip, and then manually delete the external reference and update the security group configuration to match the template.
Executing the ContinueUpdateRollback action and specifying the blocked security group as a resource to skip allows CloudFormation to bypass the dependency block and roll back the remaining resources, bringing the stack to the UPDATE_ROLLBACK_COMPLETE state. The administrator must then manually delete the external dependency and configure the security group to match the template to resolve the configuration drift.

Step-by-Step Solution

1
Analyze the CloudFormation stack events to find the resource causing the rollback failure.
Identify that the security group fails to roll back due to an external dependency created outside the stack.
This determines why the rollback is blocked and helps choose the correct remediation path.
2
Call the ContinueUpdateRollback API or use the console to continue the rollback, specifying the blocked security group in the resources to skip.
The stack successfully rolls back all other resources and transitions to the UPDATE_ROLLBACK_COMPLETE state.
Skipping the blocked resource allows CloudFormation to bypass the error and return the rest of the stack to a stable state.
3
Manually delete the external reference to the security group, and update its configuration to match the template.
The manually modified security group is synchronized with the template, correcting the resource drift.
Skipped resources are left out-of-sync with the stack template and must be manually aligned to resolve configuration drift.

Key Concept

Handling CloudFormation update rollback failures by skipping blocked resources and manually reconciling drift.
Question 893Question

A SysOps Administrator is configuring network access to a Windows Amazon EC2 instance located in a public subnet. The custom Security Group has no rules. The custom NACL has already been configured to allow inbound RDP traffic on TCP port 33893389 from the office IP range of 198.51.100.0/24198.51.100.0/24.

Which two configuration changes are required to allow RDP connections to be established? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the custom Security Group, add an inbound rule allowing TCP port 33893389 from 198.51.100.0/24198.51.100.0/24; In the custom NACL, add an outbound rule allowing TCP ports 10241024-6553565535 to 198.51.100.0/24198.51.100.0/24

Answer

To allow RDP connections, the administrator must add an inbound rule in the custom Security Group allowing TCP port 33893389 from the office IP range, and add an outbound rule in the custom NACL allowing TCP ports 10241024-6553565535 to the office IP range.
To establish an RDP connection, both the Security Group and the NACL must permit the traffic. The custom Security Group has no rules, so an inbound rule allowing TCP port 33893389 from the office IP range (198.51.100.0/24198.51.100.0/24) is required. Because Security Groups are stateful, this inbound rule automatically permits the outbound response traffic. However, NACLs are stateless. Although the inbound NACL rule for TCP port 33893389 is already configured, an outbound NACL rule is required to allow the response traffic. The response traffic will target the client's ephemeral ports (TCP 10241024-6553565535), so the outbound NACL rule must allow TCP ports 10241024-6553565535 to the office IP range.

Step-by-Step Solution

1
Determine the necessary change for the custom Security Group.
Add an inbound rule allowing TCP port 33893389 from 198.51.100.0/24198.51.100.0/24.
Since the Security Group currently has no rules, inbound traffic on port 33893389 must be allowed. Because Security Groups are stateful, the return traffic is automatically permitted, so no outbound Security Group rule is required.
2
Determine the necessary change for the stateless custom NACL.
Add an outbound rule allowing TCP ports 10241024-6553565535 to 198.51.100.0/24198.51.100.0/24.
NACLs are stateless and require explicit rules for both traffic directions. Since the inbound rule on port 33893389 is already configured, the administrator must add an outbound rule to allow the return traffic back to the client's ephemeral ports (10241024-6553565535).

Key Concept

Understanding the difference between stateful Security Groups and stateless Network Access Control Lists (NACLs) when configuring inbound and outbound traffic rules.
Question 894Question

A SysOps administrator is configuring automatic rotation for a database secret in AWS Secrets Manager. The database is an Amazon RDS PostgreSQL instance running in a private subnet. The secret is encrypted with a customer-managed KMS key. The administrator creates a rotation Lambda function in the same VPC and associates it with the secret. During testing, the rotation fails. CloudWatch Logs for the Lambda function show that `GetSecretValue` calls return a `DecryptionException`. The Lambda function's execution role has an IAM policy attached that allows `kms:Decrypt` and `kms:DescribeKey` on the database secret's KMS key ARN.

Which of the following is the most likely cause of this error?

Show answer & explanation

Answer: The key policy of the customer-managed KMS key does not grant access to the Lambda execution role and lacks a statement allowing IAM policies to govern access to the key.

Answer

The key policy of the customer-managed KMS key does not grant access to the Lambda execution role and lacks a statement allowing IAM policies to govern access to the key.
The correct answer is correct because AWS KMS requires that the key policy explicitly allow access to the key, or delegate administration to the account's IAM policies (often done by permitting the root principal). If the key policy does not permit the root user or the specific Lambda execution role, any IAM policies granting access to the key will be ignored, resulting in a DecryptionException when Secrets Manager attempts to decrypt the secret using the Lambda execution role.

Step-by-Step Solution

1
Analyze the error location and details.
The CloudWatch Logs show a DecryptionException generated within the Lambda function execution. This implies the Lambda function was successfully invoked and executed, eliminating invocation and trust policy issues.
We must verify whether the failure occurs at the invocation stage or during the execution of the API calls inside the function.
2
Evaluate network connectivity to AWS KMS.
The error is a DecryptionException (authorization issue) rather than a socket timeout, ruling out VPC security group, route table, or endpoint routing issues.
Network isolation issues prevent reaching the service entirely, whereas authorization issues return a structured API error response.
3
Check Key Policy vs. IAM Policy hierarchy.
In AWS KMS, key policies are the primary authorization mechanism. Without a statement allowing the root principal (delegating control to IAM) or explicitly naming the Lambda execution role, IAM policies granting KMS permissions will be ignored.
KMS key policies take precedence over IAM policies; IAM policies alone cannot grant access to a customer-managed KMS key unless the key policy delegates authority to IAM.

Key Concept

AWS KMS Key Policy Precedence and Secrets Manager Rotation
Question 895Question

A SysOps administrator has the following IAM policy attached to their IAM user:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"backup:CreateBackupSelection",
"backup:GetBackupPlan"
],
"Resource": "*"
}
]
}

The administrator is attempting to configure a new backup selection to assign a custom IAM role (`arn:aws:iam::111122223333:role/CustomBackupRole`) to a backup plan. The custom IAM role's trust policy allows `backup.amazonaws.com` to assume it. When trying to save the selection, the administrator receives an Access Denied error.

Which policy update is required to resolve this error?

Show answer & explanation

Answer: Add a statement to the administrator's IAM policy that allows the iam:PassRole action targeting the CustomBackupRole ARN as the resource.

Answer

Add a statement to the administrator's IAM policy that allows the iam:PassRole action targeting the CustomBackupRole ARN as the resource.
To configure an AWS service (such as AWS Backup) to run tasks using a specific IAM role, the user performing the configuration must have permission to pass that role to the service. This is controlled by the iam:PassRole permission, which must be allowed in the administrator's IAM policy targeting the ARN of the custom backup IAM role. This prevents unauthorized users from passing highly privileged roles to services.

Step-by-Step Solution

1
Analyze the error message and the current permission set of the administrator.
The administrator has permissions to create a backup selection, but the operation fails when attempting to pass the CustomBackupRole to the AWS Backup service.
AWS Backup must run backup tasks using the permissions of the specified custom role. To delegate this role to the service, the user setting up the backup selection must have explicit permission to pass the role.
2
Differentiate between role assumption and role passing.
Identify that sts:AssumeRole is for obtaining temporary security credentials directly, whereas iam:PassRole is required to configure an AWS service to act on behalf of the user using a specific role.
Choosing sts:AssumeRole is a common configuration error; it does not authorize the delegation of permissions to the AWS Backup service principal.
3
Formulate the correct policy statement to resolve the error.
Add a statement to the administrator's policy allowing the iam:PassRole action targeting the specific role ARN.
This grants the administrator the minimum required privilege to pass only the specific role needed for AWS Backup operations, satisfying security best practices.

Key Concept

IAM Role Delegation and the iam:PassRole Permission
Estimated Time:2m 0s
Question 896Question

An organization runs a backend microservice on Amazon Elastic Container Service (Amazon ECS) using AWS Fargate. The container needs to access a third-party API key at startup. A SysOps administrator stores the API key as a SecureString parameter named /prod/payment/api_key in AWS Systems Manager Parameter Store, encrypted with a customer managed AWS KMS key. In the ECS task definition, the parameter is referenced in the container definition's secrets configuration. When Fargate attempts to launch the tasks, they fail to transition to the RUNNING state, displaying a resource provisioning error. Which actions should the SysOps administrator take to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add the ssm:GetParameters permission to the ECS task execution IAM role.; Grant the kms:Decrypt permission for the customer managed KMS key to the ECS task execution IAM role.

Answer

To resolve the container provisioning failure, the ECS task execution IAM role must be granted permissions to retrieve the parameter (ssm:GetParameters) and to decrypt the parameter using the KMS customer managed key (kms:Decrypt).
The correct actions involve configuring the ECS task execution IAM role. This role is assumed by the ECS agent to perform pre-run actions such as pulling images and fetching secrets. It needs the ssm:GetParameters action to read the parameter and the kms:Decrypt action on the KMS key used for the parameter's encryption to successfully decrypt the SecureString.

Step-by-Step Solution

1
Identify the role responsible for retrieving secrets during ECS Fargate container provisioning.
The ECS task execution IAM role is identified as the role used by the ECS container agent to retrieve secrets and pull container images at startup, while the task role is used by application code after startup.
Distinguishing between these two roles ensures permissions are applied to the correct identity.
2
Update the IAM policy of the ECS task execution role.
The role is granted the ssm:GetParameters action targeting the ARN of the /prod/payment/api_key parameter.
This allows the ECS container agent to fetch the secret value from SSM Parameter Store.
3
Update the KMS key policy or attach an IAM policy allowing the ECS task execution role access to decrypt with the KMS key.
The role is granted the kms:Decrypt action targeting the customer managed KMS key used to encrypt the SecureString parameter.
SSM SecureString parameters require decryption at retrieval time, which fails if the calling execution role lacks decrypt permissions.

Key Concept

Distinction between the ECS task execution role and the ECS task role, and the necessary IAM and KMS permissions required for SSM Parameter Store SecureString decryption during container initialization.
Question 897Question

A company's SysOps team is setting up AWS Backup to centralize backup management. A SysOps administrator is configuring a backup plan that must use a custom IAM service role to back up Amazon RDS instances. The administrator needs to grant the AWS Backup service the permissions to assume this role, and also ensure that the administrator has the permissions required to assign this role to the backup plan. Which two configuration steps must be performed to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure the trust policy of the IAM role to allow the backup.amazonaws.com service principal to perform the sts:AssumeRole action.; Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the IAM role's Amazon Resource Name (ARN).

Answer

To establish this access, the trust policy of the IAM role must allow the AWS Backup service principal to perform the sts:AssumeRole action, and the administrator's identity must be granted the iam:PassRole permission for the role's ARN.
To delegate permissions to an AWS service, two parts are required: the service itself must be trusted to assume the role, and the user setting up the configuration must have permission to pass the role to the service. The service trust is established via the trust policy using the sts:AssumeRole action, and user permission to delegate the role is granted via the identity-based policy using the iam:PassRole permission.

Step-by-Step Solution

1
Configure the trust relationship on the target IAM service role.
The AWS Backup service principal (backup.amazonaws.com) is permitted to assume the role to execute the backup plan.
AWS services require a trust policy to assume roles within an account.
2
Configure the administrator's IAM permissions.
The administrator's IAM user or group policy contains a statement granting iam:PassRole for the backup role's ARN.
When an administrator assigns a role to a service, AWS checks if they have permission to pass that specific role.

Key Concept

Delegating permissions to AWS services using service trust policies and iam:PassRole.
Question 898Question

An application connects to an Amazon RDS for PostgreSQL database using credentials stored in AWS Secrets Manager. After enabling automatic rotation for the database credentials, the SysOps administrator notices that the application experiences brief database connection failures and API timeouts during the rotation process. The security team requires that credential rotation must not disrupt active application connections or cause downtime. Which of the following configurations is the most appropriate to resolve this issue?

Show answer & explanation

Answer: Configure the secret to use the alternating users rotation strategy, storing the database manager credentials in a separate secret, and allowing the rotation function to update the password of the alternating application users.

Answer

Configure the secret to use the alternating users rotation strategy, storing the database manager credentials in a separate secret, and allowing the rotation function to update the password of the alternating application users.
The alternating users rotation strategy uses two alternating database users. During rotation, Secrets Manager updates the password for the inactive user, updates the secret to point to that user, and allows the application to transition to the new credentials. The database continues to accept active connections from the other user with its old password, ensuring zero downtime. This requires storing the manager credentials in a separate secret so the rotation Lambda function can modify the alternating users' credentials.

Step-by-Step Solution

1
Identify the root cause of connection downtime during credential rotation.
The database credential uses a single-user rotation strategy, which changes the password for the active database user immediately. This invalidates existing sessions and causes connection errors until the application retrieves the new secret.
Understanding the limitation of the single-user rotation strategy helps isolate the requirement for a multi-user strategy.
2
Select the appropriate AWS Secrets Manager rotation strategy for zero-downtime requirements.
The alternating users rotation strategy utilizes two database users (e.g., user_A and user_B). It updates and rotates the password of the inactive user first, updates the secret pointer, and allows the active user's existing connections to persist until they naturally close.
This strategy is designed specifically for applications that cannot tolerate any downtime during rotation.
3
Configure the necessary resources for alternating users rotation.
Store the database manager credentials (which have permissions to alter user passwords) in a separate secret, link it to the application secret, and enable the alternating users rotation template.
The rotation Lambda function requires the manager user credentials to update the password of the alternating application users in the database.

Key Concept

AWS Secrets Manager Alternating Users Rotation Strategy
Question 899Question

A SysOps Administrator is managing an AWS KMS Customer Managed Key (CMK) that encrypts sensitive finance data. The key policy is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Allow admin access",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::444455556666:role/FinanceSecurityAdmin"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

Due to an administrative error, the `FinanceSecurityAdmin` IAM role in account 444455556666444455556666 is deleted. The administrator quickly recreates the IAM role with the exact same name and path. However, when trying to manage the CMK using the recreated role, the administrator receives an Access Denied error.

Which of the following describes the root cause of this behavior and the correct resolution?

Show answer & explanation

Answer: The KMS key policy stores the unique principal ID of the role, which changed when the role was recreated. Because the key policy does not delegate permissions to the AWS account root user, the key policy cannot be modified by any user in the account, and the administrator must contact AWS Support to restore access.

Answer

The KMS key policy stores the unique principal ID of the role, which changed when the role was recreated. Because the key policy does not delegate permissions to the AWS account root user, the key policy cannot be modified by any user in the account, and the administrator must contact AWS Support to restore access.
The correct answer explains that AWS KMS key policies evaluate permissions using the principal's unique internal ID rather than the friendly ARN name. When the IAM role was deleted and recreated, a new unique ID was generated, which does not match the old ID stored in the KMS key policy. Because the KMS key policy did not include the root account delegation statement (which allows IAM policies to grant access to the key), there is no way for any administrator or even the root user to modify the key policy locally. Therefore, the key is orphaned, and the administrator must contact AWS Support to resolve the issue.

Step-by-Step Solution

1
Analyze the KMS key policy provided in the scenario.
The key policy only grants administrative permissions ('kms:*') to the specific IAM role principal 'arn:aws:iam::444455556666:role/FinanceSecurityAdmin'. It lacks the default root account delegation statement ('arn:aws:iam::444455556666:root').
This determines whether IAM policies or other principals (like root) have any administrative control over the key.
2
Evaluate the impact of deleting and recreating the IAM role.
Although the new role has the same name and ARN, its underlying unique principal ID is different from the original role.
AWS KMS evaluates permissions based on unique principal IDs that are mapped internally when the policy is saved.
3
Determine if the policy can be updated locally.
Since the only authorized principal in the policy (the old role ID) no longer exists, and there is no root account delegation to allow IAM policy overrides, no user in the account can modify the key policy.
Without root account delegation, KMS key policies are the sole authority, and local IAM policies cannot grant access.
4
Identify the required remediation path.
Since the key is locked and unmanageable locally, AWS Support must be contacted to resolve the policy deadlock.
AWS Support is the only entity capable of assisting in recovering or deleting the orphaned key.

Key Concept

KMS Key Policy Precedence and Unique Principal IDs
Question 900Question

To automate package deployment, an operations team uses AWS Systems Manager Run Command to execute the `AWS-RunShellScript` document across multiple Amazon EC2 instances. The SysOps administrator wants to monitor the execution progress by configuring Amazon Simple Notification Service (Amazon SNS) notifications for command status changes. The administrator creates a dedicated IAM role named `SSM-SNS-Notification-Role` that trusts the Systems Manager service principal and has permissions to publish to the target SNS topic. When executing the `aws ssm send-command` CLI command with the `--service-role-arn` parameter set to the `SSM-SNS-Notification-Role` ARN, the command execution fails immediately with an `AccessDenied` exception before running on any targets. The EC2 instances are online in Systems Manager with the SSM Agent running and have a valid instance profile. Which configuration change is required to successfully run the command with SNS notifications enabled?

Show answer & explanation

Answer: Attach an IAM policy to the SysOps administrator's identity that grants the `iam:PassRole` permission for the `SSM-SNS-Notification-Role` resource.

Answer

Attach an IAM policy to the SysOps administrator's identity that grants the `iam:PassRole` permission for the `SSM-SNS-Notification-Role` resource.
To send execution status notifications, the Systems Manager service must assume the specified service role (`SSM-SNS-Notification-Role`) to publish updates to the target SNS topic. To enable this, the IAM identity of the administrator executing the `send-command` API call must have explicit authorization to pass the role. This is achieved by attaching a policy granting the `iam:PassRole` permission targeting the service role to the administrator's IAM user or role.

Step-by-Step Solution

1
Analyze the error context.
The `AccessDenied` exception occurs immediately upon calling `aws ssm send-command` before command dispatch.
This indicates an IAM authorization failure on the API caller (the SysOps administrator) rather than a failure on the EC2 instances or within the Run Command execution itself.
2
Evaluate the role delegation mechanism.
The SysOps administrator passes the `SSM-SNS-Notification-Role` using the `--service-role-arn` parameter so that the AWS Systems Manager service can publish notifications to SNS.
Passing an IAM role to an AWS service requires the calling user to have authorization to pass that role to the specified service principal.
3
Identify the missing permission.
The SysOps administrator's IAM policy must contain the `iam:PassRole` action targeting the `SSM-SNS-Notification-Role` ARN.
Granting `iam:PassRole` ensures the administrator is authorized to delegate permissions to the service role, which resolves the `AccessDenied` exception.

Key Concept

Delegating IAM roles to AWS services using the PassRole permission
PreviousPage 45 / 49Next
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin