All practice questions
976 questions
An organization is setting up cross-Region replication for an Amazon S3 bucket named corp-data-primary to a destination bucket named corp-data-backup in another AWS Region. The SysOps Administrator has created the replication rule and assigned an IAM role with the necessary permissions. However, the replication status indicates that objects are not copying to the destination bucket. Which of the following configuration changes are required to successfully enable replication? (Select TWO.)
Select all that apply
A SysOps Administrator is managing an infrastructure deployment using an AWS CloudFormation stack. A recent drift detection scan reveals that several resources, including an Amazon EC2 instance and an EC2 security group, are in a MODIFIED state due to manual configuration changes made by the operations team. The administrator is planning to perform a stack update using a modified CloudFormation template.
Which two statements correctly describe how CloudFormation will handle the drifted resources during the stack update? (Select two.)
Select all that apply
A SysOps administrator is configuring an Amazon Kinesis Data Firehose delivery stream to stream application logs to an Amazon S3 bucket. The destination S3 bucket is encrypted using a customer managed AWS KMS key. The administrator creates a custom IAM role named FirehoseDeliveryRole to allow the delivery stream to access the S3 bucket and use the KMS key. Which of the following configurations are required to ensure the delivery stream is created successfully and can write encrypted logs? (Select TWO.)
Select all that apply
An Amazon EC2 instance in a private subnet needs to download security patches from an external repository over HTTPS (TCP port 443). The subnet's custom network access control list (NACL) has a rule that allows outbound TCP traffic on port 443 to any destination. However, the connection attempts are timing out. Which modification to the custom NACL will allow the EC2 instance to successfully receive the patches?
A SysOps Administrator is setting up AWS Systems Manager to automate configuration compliance and patch management across a fleet of Amazon EC2 instances. The SSM Agent is confirmed to be running on all instances, and the `AmazonSSMManagedInstanceCore` policy is attached to their IAM instance profiles.
The administrator faces two distinct issues:
1. When creating a State Manager association that uses a custom execution role to run an automation document, the creation fails with an error indicating that the administrator is not authorized to perform the operation.
2. An automated patching window executes successfully, but a subset of instances fails to receive the updates defined in a custom patch baseline. The administrator verifies that the patch baseline has been correctly associated with the patch group named 'Production-Servers' in Patch Manager.
Which combination of actions will resolve these issues? (Select TWO.)
Select all that apply
A SysOps administrator is configuring automatic rotation for an Amazon RDS database credential stored in AWS Secrets Manager. The secret is encrypted using a customer-managed AWS KMS key. The KMS key policy does not delegate permissions to the account's root user and lists specific IAM principals. After enabling rotation, the administrator notices that the rotation fails. The Amazon CloudWatch logs for the Lambda rotation function show an Access Denied error when attempting to retrieve the current secret version via the GetSecretValue call. The Lambda function's IAM execution role is already configured with a policy that allows secretsmanager:GetSecretValue and secretsmanager:PutSecretValue for the secret. Which of the following actions should the administrator take to resolve this issue? (Select TWO.)
Select all that apply
An application stores its static assets in a source Amazon S3 bucket and uses an Amazon RDS for MySQL DB instance. A SysOps Administrator must configure automatic replication of the static assets to a backup S3 bucket in a different Region. The database must also support automatic failover to another Availability Zone without requiring any manual updates to the application configuration. Which configuration satisfies these requirements?
An operations team uses an AWS CloudFormation stack to manage security infrastructure. During a stack update, a resource creation error occurs, triggering an automatic rollback. However, the rollback process fails, and the stack status changes to UPDATE_ROLLBACK_FAILED because an IAM role managed by the stack was previously deleted manually.
Which of the following actions should the SysOps Administrator perform to resolve this issue and return the stack to a stable state?
A SysOps Administrator in Account A () needs to share an encrypted Amazon EBS snapshot with Account B (). The snapshot is encrypted with a customer managed KMS key in Account A (Key-A). The administrator has successfully shared the snapshot with Account B. In Account B, an IAM user named `CopyAdmin` attempts to copy the shared snapshot to Account B and encrypt the copy using a customer managed KMS key in Account B (Key-B). However, the copy operation fails with a KMS Access Denied error.
Which of the following configurations are required to successfully complete the snapshot copy operation? (Select TWO.)
Select all that apply
A SysOps Administrator is managing an infrastructure stack deployed via AWS CloudFormation. The stack contains an Amazon S3 bucket, an Amazon EC2 instance, and an IAM role, and is configured to use a specific IAM service role for stack operations. During a recent update, the deployment failed and the stack is now in the UPDATE_ROLLBACK_FAILED state. Which TWO actions should the administrator take to troubleshoot and successfully complete the rollback? (Select TWO.)
Select all that apply
A SysOps administrator is attempting to export historical log data from an Amazon CloudWatch Logs log group in the us-east-1 Region to an Amazon S3 bucket for long-term archiving. The administrator has verified that their IAM identity has the `logs:CreateExportTask` permission. However, when initiating the export task, it immediately fails with the following error:
`An error occurred (InvalidParameterException) when calling the CreateExportTask operation: The S3 bucket owner does not have write permission on the bucket.`
Which of the following actions will resolve this issue?
An environment is managed using an AWS CloudFormation stack. A SysOps administrator initiates a stack update to modify an Application Load Balancer and its associated security group. The update fails, and the subsequent rollback also fails, leaving the stack in the UPDATE_ROLLBACK_FAILED state. The stack events show that a security group rule cannot be deleted because it is referenced by another resource that was created manually outside the stack. Which action should the administrator take to successfully return the stack to a stable state?
A SysOps Administrator is configuring network access to a Windows Amazon EC2 instance located in a public subnet. The custom Security Group has no rules. The custom NACL has already been configured to allow inbound RDP traffic on TCP port from the office IP range of .
Which two configuration changes are required to allow RDP connections to be established? (Select TWO.)
Select all that apply
A SysOps administrator is configuring automatic rotation for a database secret in AWS Secrets Manager. The database is an Amazon RDS PostgreSQL instance running in a private subnet. The secret is encrypted with a customer-managed KMS key. The administrator creates a rotation Lambda function in the same VPC and associates it with the secret. During testing, the rotation fails. CloudWatch Logs for the Lambda function show that `GetSecretValue` calls return a `DecryptionException`. The Lambda function's execution role has an IAM policy attached that allows `kms:Decrypt` and `kms:DescribeKey` on the database secret's KMS key ARN.
Which of the following is the most likely cause of this error?
A SysOps administrator has the following IAM policy attached to their IAM user:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"backup:CreateBackupSelection",
"backup:GetBackupPlan"
],
"Resource": "*"
}
]
}
The administrator is attempting to configure a new backup selection to assign a custom IAM role (`arn:aws:iam::111122223333:role/CustomBackupRole`) to a backup plan. The custom IAM role's trust policy allows `backup.amazonaws.com` to assume it. When trying to save the selection, the administrator receives an Access Denied error.
Which policy update is required to resolve this error?
An organization runs a backend microservice on Amazon Elastic Container Service (Amazon ECS) using AWS Fargate. The container needs to access a third-party API key at startup. A SysOps administrator stores the API key as a SecureString parameter named /prod/payment/api_key in AWS Systems Manager Parameter Store, encrypted with a customer managed AWS KMS key. In the ECS task definition, the parameter is referenced in the container definition's secrets configuration. When Fargate attempts to launch the tasks, they fail to transition to the RUNNING state, displaying a resource provisioning error. Which actions should the SysOps administrator take to resolve this issue? (Select TWO.)
Select all that apply
A company's SysOps team is setting up AWS Backup to centralize backup management. A SysOps administrator is configuring a backup plan that must use a custom IAM service role to back up Amazon RDS instances. The administrator needs to grant the AWS Backup service the permissions to assume this role, and also ensure that the administrator has the permissions required to assign this role to the backup plan. Which two configuration steps must be performed to meet these requirements?
Select all that apply
An application connects to an Amazon RDS for PostgreSQL database using credentials stored in AWS Secrets Manager. After enabling automatic rotation for the database credentials, the SysOps administrator notices that the application experiences brief database connection failures and API timeouts during the rotation process. The security team requires that credential rotation must not disrupt active application connections or cause downtime. Which of the following configurations is the most appropriate to resolve this issue?
A SysOps Administrator is managing an AWS KMS Customer Managed Key (CMK) that encrypts sensitive finance data. The key policy is configured as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Allow admin access",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::444455556666:role/FinanceSecurityAdmin"
},
"Action": "kms:*",
"Resource": "*"
}
]
}
Due to an administrative error, the `FinanceSecurityAdmin` IAM role in account is deleted. The administrator quickly recreates the IAM role with the exact same name and path. However, when trying to manage the CMK using the recreated role, the administrator receives an Access Denied error.
Which of the following describes the root cause of this behavior and the correct resolution?
To automate package deployment, an operations team uses AWS Systems Manager Run Command to execute the `AWS-RunShellScript` document across multiple Amazon EC2 instances. The SysOps administrator wants to monitor the execution progress by configuring Amazon Simple Notification Service (Amazon SNS) notifications for command status changes. The administrator creates a dedicated IAM role named `SSM-SNS-Notification-Role` that trusts the Systems Manager service principal and has permissions to publish to the target SNS topic. When executing the `aws ssm send-command` CLI command with the `--service-role-arn` parameter set to the `SSM-SNS-Notification-Role` ARN, the command execution fails immediately with an `AccessDenied` exception before running on any targets. The EC2 instances are online in Systems Manager with the SSM Agent running and have a valid instance profile. Which configuration change is required to successfully run the command with SNS notifications enabled?