Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 941Question →

A SysOps administrator is setting up a nightly automation task using AWS Systems Manager (SSM) Maintenance Windows to run a command on a fleet of Amazon EC2 instances. The maintenance window is configured to use a custom service role named MaintenanceWindowServiceRole to run the task. The administrator has attached an IAM policy to their own IAM user account that contains the following statement:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:RegisterTaskWithMaintenanceWindow",
"ssm:UpdateMaintenanceWindowTask"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::111122223333:role/MaintenanceWindowServiceRole"
}
]
}

When the administrator attempts to register the task with the maintenance window specifying MaintenanceWindowServiceRole as the service role, the operation fails with an 'Access Denied' error. The trust policy of MaintenanceWindowServiceRole correctly trusts ssm.amazonaws.com. What should the administrator do to resolve this issue?

Show answer & explanation

Answer: Replace the sts:AssumeRole permission in the administrator's IAM policy with the iam:PassRole permission for the MaintenanceWindowServiceRole.

Answer

Replace the sts:AssumeRole permission in the administrator's IAM policy with the iam:PassRole permission for the MaintenanceWindowServiceRole.
To associate an IAM service role with an AWS service task, the user executing the operation must have permission to pass that role to the service. This is achieved by granting the iam:PassRole permission in the user's IAM policy, targeting the ARN of the service role. The service then uses its trust policy containing sts:AssumeRole to assume the role at execution time.

Step-by-Step Solution

1
Analyze the error message and the current IAM policies.
Identify that the Access Denied error occurs during task registration because the administrator is attempting to associate an IAM service role with Systems Manager.
When configuring AWS services to act on behalf of a user, the user must have permission to pass the service role to the service.
2
Evaluate the current permissions in the administrator's user policy.
Observe that the policy grants sts:AssumeRole instead of iam:PassRole for the service role.
The administrator confused direct role assumption (sts:AssumeRole) with passing the role to a service (iam:PassRole).
3
Update the administrator's IAM policy to grant the correct permission.
Replace the sts:AssumeRole action with iam:PassRole for the target role ARN.
This allows the administrator to successfully delegate the role to Systems Manager, which then uses its own service trust relationship to assume the role at execution time.

Key Concept

Delegating permissions to AWS services using the iam:PassRole permission and service trust relationships.
Question 942Question →

A SysOps Administrator is managing an infrastructure stack deployed via AWS CloudFormation. After running drift detection on the stack, the administrator notices that an Amazon EC2 instance's type was manually changed from t3.micro to t3.small by another team member using the Amazon EC2 console. The CloudFormation template still specifies the instance type as t3.micro. The administrator wants to return the EC2 instance to the configuration defined in the template without redeploying the entire stack.

Which of the following is the correct method to resolve this drift?

Show answer & explanation

Answer: Manually modify the EC2 instance type back to t3.micro using the Amazon EC2 console or AWS CLI, and then run drift detection on the CloudFormation stack to confirm that the resource status returns to IN_SYNC.

Answer

Manually modify the EC2 instance type back to t3.micro using the Amazon EC2 console or AWS CLI, and then run drift detection on the CloudFormation stack to confirm that the resource status returns to IN_SYNC.
The correct method to remediate manual resource changes and align them back with the CloudFormation stack configuration is to manually change the resource properties back to their original values (e.g., changing the instance type from t3.small back to t3.micro via the EC2 console or CLI) and then re-running drift detection to update the status to IN_SYNC. CloudFormation does not have an automated feature to overwrite manual changes on demand without template modifications.

Step-by-Step Solution

1
Change the instance type manually back to the expected template value.
The instance type is changed from t3.small to t3.micro using the EC2 console or AWS CLI.
CloudFormation does not automatically overwrite drift when no template changes are made, so the resource must be reverted manually.
2
Run drift detection on the CloudFormation stack.
CloudFormation compares the template configuration against the actual resource state.
This updates the drift status of the stack and resources to reflect the new state.
3
Verify that the resource drift status is IN_SYNC.
The status of the EC2 instance in the drift detection results updates from DRIFTED to IN_SYNC.
Confirming the manual remediation was successful and matches the template.

Key Concept

CloudFormation drift detection identifies manual changes to stack resources outside of CloudFormation. Remediation requires manually reverting the resource properties to match the template, or updating the template to match the current resource state.
Question 943Question →

A SysOps Administrator is setting up administrative access to a Windows-based bastion host running on an Amazon EC2 instance. The instance is deployed in a public subnet associated with a custom Network Access Control List (NACL). Administrators need to establish Remote Desktop Protocol (RDP) sessions from the corporate office network (203.0.113.0/24203.0.113.0/24). The instance's security group already allows inbound TCP port 33893389 traffic from the corporate network, but connections are still timing out.

Which of the following rules must be added to the custom NACL to resolve this connectivity issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An inbound rule that allows incoming TCP traffic on port 33893389 from the corporate network range of 203.0.113.0/24203.0.113.0/24; An outbound rule that allows outgoing TCP traffic on port range 1024−655351024-65535 to the corporate network range of 203.0.113.0/24203.0.113.0/24

Answer

To resolve the RDP connectivity issue, the custom NACL must be configured with an inbound rule allowing TCP port 33893389 traffic from the corporate IP range, and an outbound rule allowing TCP port range 1024−655351024-65535 traffic back to the corporate IP range.
Because Network Access Control Lists (NACLs) are stateless, they evaluate inbound and outbound traffic independently. To allow administrators to establish RDP sessions, the NACL must allow inbound RDP traffic on TCP port 33893389 from the corporate IP range, and it must also allow outbound response traffic to the corporate IP range on ephemeral ports (1024−655351024-65535) where the client expects the return packets.

Step-by-Step Solution

1
Analyze the stateless nature of NACLs.
Unlike stateful security groups, custom NACLs require explicit rules for both the inbound request path and the outbound response path.
Without outbound rules matching the response traffic, return packets are dropped by the default outbound deny rule.
2
Identify the ports required for the inbound connection.
The target Windows host listens on TCP port 33893389 for RDP. Therefore, an inbound rule permitting TCP port 33893389 from the client's network block (203.0.113.0/24203.0.113.0/24) is required.
To permit the client's connection request to reach the EC2 instance.
3
Identify the ports required for the outbound response traffic.
The client operating system initiates the connection using a source port from the ephemeral port range (1024−655351024-65535). The host's response is sent back to this client port. An outbound rule permitting TCP ports 1024−655351024-65535 to the client's network block (203.0.113.0/24203.0.113.0/24) is required.
To permit the server's response packets to return to the client's source port.

Key Concept

NACLs are stateless network firewalls that require both inbound rules for request traffic and outbound rules for return traffic using client ephemeral ports.
Question 944Question →

An application running on Amazon EC2 instances in a private subnet (10.0.1.0/2410.0.1.0/24) must consume an internal web service hosted on EC2 instances in a database/services subnet (10.0.2.0/2410.0.2.0/24) on TCP port 8080. The security groups for both tiers are correctly configured. A custom Network Access Control List (NACL) associated with the private subnet (10.0.1.0/2410.0.1.0/24) has an outbound rule allowing TCP port 8080 to 10.0.2.0/2410.0.2.0/24, and an inbound rule allowing TCP port 8080 from 10.0.2.0/2410.0.2.0/24. The default deny rule is active. The instances cannot establish a connection. Which configuration change must be made to the private subnet's NACL to resolve this connectivity issue?

Show answer & explanation

Answer: Modify the inbound rule of the private subnet's NACL to allow TCP traffic from 10.0.2.0/2410.0.2.0/24 on destination ports 1024−655351024-65535.

Answer

Modify the inbound rule of the private subnet's NACL to allow TCP traffic from 10.0.2.0/2410.0.2.0/24 on destination ports 1024−655351024-65535.
The correct option is to modify the inbound rule of the private subnet's NACL to allow TCP traffic from the destination subnet on destination ports in the ephemeral range (1024−655351024-65535). Because NACLs are stateless, they require explicit inbound rules to allow the return traffic of an outbound connection. When a client initiates a connection to a server on port 8080, the return traffic sent by the server will have a source port of 8080 and a destination port within the ephemeral port range (1024−655351024-65535) allocated by the client's operating system.

Step-by-Step Solution

1
Analyze the connection flow and source/destination ports.
The application client in the private subnet initiates a connection to the server in the database subnet. Outbound packet: Source IP 10.0.1.X10.0.1.X, Source Port: Ephemeral (1024−655351024-65535), Destination IP 10.0.2.Y10.0.2.Y, Destination Port: 80808080. Inbound response packet: Source IP 10.0.2.Y10.0.2.Y, Source Port: 80808080, Destination IP 10.0.1.X10.0.1.X, Destination Port: Ephemeral (1024−655351024-65535).
Understanding the stateless nature of NACLs requires verifying the ports for both request and response packets.
2
Evaluate the current NACL rules against the traffic flow.
The current outbound rule allows destination port 8080, which permits the request to exit the private subnet. The current inbound rule only allows destination port 8080. However, the incoming response packet has a destination port in the ephemeral range (1024−655351024-65535), so it is blocked by the default deny rule.
Identifying where the traffic is blocked allows targeted correction of the rules.
3
Determine the necessary change to allow the return path.
Add or modify the inbound NACL rule for the private subnet to allow inbound TCP traffic from the subnet 10.0.2.0/2410.0.2.0/24 on destination ports 1024−655351024-65535.
Since NACLs are stateless, they must explicitly allow the return traffic on the ephemeral port range.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit rules for both inbound and outbound traffic, including allowing return traffic on ephemeral port ranges.
Question 945Question →

A company has deployed a serverless application utilizing Amazon DynamoDB in a production AWS account. The workload has highly variable but predictable weekly patterns, causing daily costs to fluctuate. A SysOps administrator needs to configure a monitoring solution that uses machine learning to detect unexpected cost spikes in DynamoDB usage while minimizing false alerts from normal weekly variations. When an anomaly is detected, the administrator must receive an immediate notification via email and SMS.

Which solution meets these requirements with the least administrative effort?

Show answer & explanation

Answer: Create an AWS Cost Anomaly Monitor using the AWS Service monitor type for Amazon DynamoDB. Create an anomaly subscription with an Amazon SNS topic as the alerting channel, and subscribe the email and SMS endpoints to the SNS topic.

Answer

Create an AWS Cost Anomaly Monitor using the AWS Service monitor type for Amazon DynamoDB. Create an anomaly subscription with an Amazon SNS topic as the alerting channel, and subscribe the email and SMS endpoints to the SNS topic.
The correct solution involves creating an AWS Cost Anomaly Monitor of the AWS Service type to dynamically track Amazon DynamoDB costs using machine learning to account for seasonal variations. An anomaly subscription linked to an Amazon SNS topic allows direct integration for sending email and SMS notifications without relying on static thresholds.

Step-by-Step Solution

1
Create an AWS Cost Anomaly Monitor.
A monitor is established using the AWS Service type specifically targeting Amazon DynamoDB.
This configuration tracks cost fluctuations for the specific service using machine learning algorithms to model baseline patterns, accounting for predictable weekly variations.
2
Create an alert subscription.
An anomaly subscription is configured with a threshold (e.g., $100) and linked to an Amazon Simple Notification Service (SNS) topic.
This establishes the delivery mechanism for anomaly alerts to notify administrators immediately when an anomaly is identified.
3
Subscribe endpoints to the Amazon SNS topic.
Email and SMS endpoints are added as subscriptions to the SNS topic.
This allows the SNS topic to automatically fan out the notification to both communication channels simultaneously.

Key Concept

AWS Cost Anomaly Detection is a machine-learning-driven service that baselines cost patterns to detect unexpected spend spikes, which is more effective than static budgets for variable workloads with seasonal trends.
Estimated Time:1m 30s
Question 946Question →

A SysOps Administrator is configuring a new organizational trail in AWS CloudTrail to deliver log files to a centralized Amazon S3 bucket. The security team has mandated that the log files must be encrypted at rest using an AWS Key Management Service (AWS KMS) customer managed key. Additionally, the administrator must ensure that any post-delivery modification or deletion of the log files can be systematically detected. Which two actions must the SysOps Administrator take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Enable log file integrity validation on the CloudTrail trail configuration.; Add a statement to the AWS KMS key policy that allows the CloudTrail service principal to perform the kms:GenerateDataKey* and kms:DescribeKey actions.

Answer

To meet the requirements, the SysOps Administrator must enable log file integrity validation on the CloudTrail trail and add a statement to the AWS KMS key policy allowing the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey actions.
To satisfy the requirement of detecting log modifications, log file integrity validation must be enabled. This configuration causes CloudTrail to generate digest files containing cryptographic hashes of the logs. To satisfy the encryption requirement using a customer managed key, the KMS key policy must explicitly permit the CloudTrail service principal to generate data keys. S3 bucket policies cannot delegate KMS key access.

Step-by-Step Solution

1
Enable log file integrity validation on the trail.
CloudTrail begins generating digest files that contain cryptographic hashes of the delivered log files.
This allows the SysOps Administrator to verify that the delivered log files have not been modified or tampered with post-delivery.
2
Identify the customer managed KMS key policy.
The key policy controlling access to the KMS key is opened for editing.
Permissions to use a customer managed key for encryption must be explicitly granted within the key policy.
3
Add a statement to the key policy granting kms:GenerateDataKey* and kms:DescribeKey to the cloudtrail.amazonaws.com service principal.
CloudTrail is granted the necessary cryptographic permissions to encrypt the log files as they are written to the target S3 bucket.
S3 bucket policies cannot delegate KMS key access; permissions must be managed at the key policy level.

Key Concept

Configuring AWS CloudTrail security, including log file integrity validation and custom KMS key permissions for secure S3 log delivery.
Question 947Question →

A SysOps administrator is troubleshooting internet connectivity from an Amazon EC2 instance residing in a newly created private subnet of a VPC. A NAT gateway has been provisioned in a public subnet of the same VPC. The private subnet's route table contains a route targeting the NAT gateway for 0.0.0.0/00.0.0.0/0. The security group associated with the EC2 instance allows all outbound traffic. However, the EC2 instance is unable to download software updates from the internet. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The route table associated with the public subnet containing the NAT gateway does not have a route pointing to the Internet Gateway for 0.0.0.0/00.0.0.0/0.

Answer

The route table associated with the public subnet containing the NAT gateway does not have a route pointing to the Internet Gateway for 0.0.0.0/00.0.0.0/0.
For a NAT gateway to function, it must reside in a public subnet. A public subnet is defined as a subnet whose associated route table contains a route pointing to an Internet Gateway (0.0.0.0/0→igw−xxxx0.0.0.0/0 \rightarrow igw-xxxx). Without this route, the NAT gateway cannot send translated outbound packets to the internet or receive corresponding inbound response packets, which prevents the private EC2 instance from establishing internet connections.

Step-by-Step Solution

1
Trace the routing path of the outbound traffic from the private EC2 instance.
Outbound traffic targeting the internet (0.0.0.0/00.0.0.0/0) is successfully directed by the private route table to the NAT gateway's network interface.
To verify that the private subnet is correctly configured to use the NAT gateway as its default gateway.
2
Verify the routing configuration of the public subnet where the NAT gateway resides.
The public subnet's route table must contain a route directing traffic for 0.0.0.0/00.0.0.0/0 to the Internet Gateway.
Since a NAT gateway only performs network address translation, it relies on the route table of its local subnet to forward packets to the internet.
3
Identify the missing route that interrupts the internet connectivity loop.
If the public subnet's route table lacks a route to the Internet Gateway, the NAT gateway cannot reach external internet endpoints, breaking the connection chain for the private instance.
To determine the exact configuration mismatch causing the connectivity failure.

Key Concept

Subnet route table inheritance and NAT gateway internet dependencies
Question 948Question →

A SysOps Administrator is configuring AWS Systems Manager Patch Manager to automate security updates for a fleet of Amazon Linux 2023 EC2 instances. The administrator creates a custom patch baseline and associates it with a patch group named 'Production-AL2023'. The administrator then tags the target EC2 instances with the key 'PatchGroup' and value 'Production-AL2023'. During the next scheduled maintenance window, the administrator notices that the instances were patched using the default AWS-provided patch baseline instead of the custom patch baseline. What should the administrator do to ensure the instances use the custom patch baseline?

Show answer & explanation

Answer: Change the tag key on the EC2 instances from 'PatchGroup' to the case-sensitive 'Patch Group'.

Answer

Change the tag key on the EC2 instances from 'PatchGroup' to the case-sensitive 'Patch Group'.
Changing the tag key on the EC2 instances to the case-sensitive 'Patch Group' correctly registers the instances in the 'Production-AL2023' patch group. AWS Systems Manager Patch Manager relies on this exact tag key to identify which patch baseline should be applied to an instance. If the tag key is incorrect, the association fails, and Patch Manager falls back to the default patch baseline for the operating system.

Step-by-Step Solution

1
Identify the cause of the patch baseline mismatch by checking the tags on the EC2 instances and comparing them with Systems Manager requirements.
The current tag key is 'PatchGroup', which does not match the mandatory Systems Manager Patch Manager key 'Patch Group'.
Systems Manager uses the specific, case-sensitive tag key 'Patch Group' to assign instances to patch groups.
2
Update the tags on the target EC2 instances to use 'Patch Group' as the key and keep 'Production-AL2023' as the value.
The instances are now correctly mapped to the 'Production-AL2023' patch group.
This establishes the association between the instances and the patch group.
3
Verify that Patch Manager correctly associates the instances with the custom patch baseline during the next run.
The instances are patched according to the rules defined in the custom patch baseline.
With the correct patch group tag, Patch Manager overrides the default baseline and applies the custom one.

Key Concept

Systems Manager Patch Manager uses a case-sensitive tag key named 'Patch Group' to associate EC2 instances with patch groups, which are then mapped to specific patch baselines.
Question 949Question →

A SysOps Administrator is tasked with automating security updates for a fleet of production Amazon EC2 instances running Red Hat Enterprise Linux (RHEL). The updates must be applied during a weekly maintenance window using a custom patch baseline. The administrator wants to use a patch group named 'Production-RHEL' to map these instances to the baseline. Arrange the steps in the correct chronological order to configure this automated patch management workflow.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure automated patching, first create the custom patch baseline. Next, associate the patch group 'Production-RHEL' with the baseline. Then, tag the RHEL EC2 instances with the case-sensitive key 'Patch Group' and value 'Production-RHEL' to map them to the baseline. Afterward, create a Systems Manager Maintenance Window and register the target instances. Finally, register the 'AWS-RunPatchBaseline' task under the Maintenance Window with the 'Install' operation.
The correct order begins with creating the custom baseline to define patch rules, followed by associating the patch group 'Production-RHEL' with it. Instances must then be tagged with the case-sensitive key 'Patch Group' to associate them with the patch group and custom baseline. Next, the Maintenance Window is created, and targets are registered. Finally, the task is registered to run the 'AWS-RunPatchBaseline' document against these targets.

Step-by-Step Solution

1
Create the custom patch baseline.
A patch baseline is established with custom approval rules for RHEL.
You must have a baseline defined first to establish the patching rules.
2
Associate the patch group with the baseline.
The patch group name 'Production-RHEL' is registered to the custom baseline.
This links the patch group to the custom rules instead of the default baseline.
3
Tag the EC2 instances.
Instances are assigned the tag Key 'Patch Group' and Value 'Production-RHEL'.
Systems Manager uses this specific case-sensitive tag to resolve which baseline to apply to each instance.
4
Create a Maintenance Window and register targets.
A scheduled maintenance window is created with targets selected by the 'Patch Group' tag.
This establishes the timeline and groups the resources that will undergo patching.
5
Register the task in the Maintenance Window.
The 'AWS-RunPatchBaseline' task is registered with the 'Install' operation.
This orchestrates the actual patch execution during the scheduled window.

Key Concept

Configuring AWS Systems Manager Patch Manager and Maintenance Windows requires a precise sequence where baselines are created and associated with patch groups, target instances are tagged with the case-sensitive 'Patch Group' key, and then a maintenance window orchestrates the 'AWS-RunPatchBaseline' task execution.
Question 950Question →

A SysOps administrator is troubleshooting connectivity between an Amazon EC2 instance in Subnet A (10.0.3.0/2410.0.3.0/24) within VPC A (10.0.0.0/1610.0.0.0/16) and an Amazon RDS MySQL DB instance in Subnet B (172.16.4.0/24172.16.4.0/24) within VPC B (172.16.0.0/16172.16.0.0/16). A VPC peering connection (`pcx-99998888`) has been established and is active. However, the EC2 instance cannot connect to the database. Which of the following configuration changes must be performed to allow traffic between the EC2 instance and the database? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add a route to the route table associated with Subnet B with a destination of 10.0.3.0/2410.0.3.0/24 and a target of `pcx-99998888`.; Configure the security group of the RDS DB instance to allow inbound traffic on TCP port 3306 from the CIDR block 10.0.3.0/2410.0.3.0/24.

Answer

To establish connectivity across the VPC peering connection, the administrator must add a route in Subnet B's route table pointing the destination CIDR 10.0.3.0/2410.0.3.0/24 to the peering connection key `pcx-99998888`, and configure the RDS DB instance's security group to allow inbound traffic on TCP port 3306 from the EC2 instance's subnet CIDR 10.0.3.0/2410.0.3.0/24.
The correct options involve configuring the routing table for Subnet B to include a route targeting the EC2 subnet range via the peering connection, and modifying the RDS security group to allow inbound database connections from that range. Because VPC peering requires bidirectional routing config, adding the route in Subnet B completes the routing loop. Modifying the security group allows the connection to pass through the instance's stateful firewall.

Step-by-Step Solution

1
Verify and configure routing tables in both VPCs.
Adding a route in Subnet B's route table targeting the peered CIDR 10.0.3.0/2410.0.3.0/24 via `pcx-99998888` ensures that traffic can flow symmetrically.
VPC peering requires explicit route table entries in both VPCs to direct traffic destined for the peer network over the peering connection.
2
Update security group rules.
The RDS DB instance's security group is configured to allow inbound traffic on port 3306 from the CIDR block 10.0.3.0/2410.0.3.0/24.
Since security groups are stateful and default to blocking inbound traffic, the target resource must explicitly allow the incoming database connection.

Key Concept

VPC Peering Routing and Security Group Configuration
Question 951Question →

A SysOps administrator is troubleshooting an Application Load Balancer (ALB) that is failing to route traffic to a target group of Amazon EC2 instances located in a private subnet. The web application on the instances is configured to listen on port 80808080, and the target group is configured to perform health checks on the same port. The ALB health checks are consistently failing with a timeout status. The ALB is in a public subnet, and its security group allows inbound traffic on ports 8080 and 443443 from `0.0.0.0/0`. Which of the following actions should the SysOps administrator take to resolve the unhealthy target status?

Show answer & explanation

Answer: Modify the security group associated with the EC2 instances to allow inbound TCP traffic on port 80808080 from the security group of the ALB.

Answer

Modify the security group associated with the EC2 instances to allow inbound TCP traffic on port 80808080 from the security group of the ALB.
The Application Load Balancer (ALB) must be able to establish a TCP connection to the EC2 instances on the configured health check port, which is port 80808080 in this scenario. Since the targets are reporting a timeout status rather than an HTTP error code (like 403 or 404), this indicates that the network packets are being dropped. To resolve this, the security group associated with the EC2 instances must be updated to allow inbound TCP traffic on port 80808080 from the source security group of the ALB. This allows the health check traffic to reach the application.

Step-by-Step Solution

1
Analyze the health check failure status, which is 'HealthCheck.Timeout'. This indicates that the load balancer can send a request but does not receive a response within the timeout period.
Identify that a network path block (e.g., security group, network ACL, or host firewall) is the most likely cause of the packet drop.
Health check timeouts are typically caused by network connectivity issues preventing the request from reaching the instance or the response from getting back to the load balancer.
2
Examine the security group configuration of the EC2 instances relative to the load balancer.
Determine that the EC2 instances are listening on port 80808080 and the target group performs health checks on that port, so the instances' security group must allow inbound traffic on port 80808080 from the ALB.
If the security group of the EC2 instances does not explicitly permit traffic on port 80808080 from the ALB's security group, the health check requests will be silently dropped, causing a timeout.
3
Evaluate the distractors to rule out incorrect architectures.
Confirm that changing the health check port to 8080 fails because the application listens on 80808080; adding an Internet Gateway route is incorrect for private instances; and Route 5353 failover does not fix the target group health.
Troubleshooting requires identifying the root cause of the target health failure rather than applying unrelated changes or workarounds.

Key Concept

Target group health checks require proper security group configurations allowing the ALB to communicate with the instances on the health check port.
Question 952Question →

A SysOps administrator needs to configure AWS WAF logging for an Application Load Balancer to store all web request logs in an Amazon S3 bucket for compliance auditing. The administrator creates a bucket named web-application-waf-logs and attempts to enable WAF logging to this bucket, but receives an error stating that the destination is invalid. Which of the following is the reason for this error?

Show answer & explanation

Answer: The S3 bucket name must begin with the prefix aws-waf-logs- for AWS WAF to be able to publish logs to it.

Answer

The S3 bucket name must begin with the prefix aws-waf-logs- for AWS WAF to be able to publish logs to it.
AWS WAF requires that any Amazon S3 bucket used as a logging destination must have a name starting with the prefix 'aws-waf-logs-'. Without this prefix, the AWS WAF service will not recognize the bucket as a valid destination, and attempts to enable logging will fail with an invalid destination error.

Step-by-Step Solution

1
Analyze the configuration failure when enabling AWS WAF logging to the S3 bucket.
The target bucket name is web-application-waf-logs.
Identify the destination resource properties that may violate service requirements.
2
Evaluate the naming constraints imposed by AWS WAF on its logging destinations.
AWS WAF mandates that the S3 bucket name must start with the prefix 'aws-waf-logs-'.
Check if the bucket prefix meets the AWS WAF requirements.
3
Determine the corrective action to successfully enable logging.
Rename or create a new S3 bucket with the prefix 'aws-waf-logs-', such as 'aws-waf-logs-web-application'.
Ensures compliance with the required naming convention so that AWS WAF can identify and write to the destination.

Key Concept

AWS WAF Logging Destinations and Naming Conventions
Question 953Question →

A company wants to implement a solution to monitor their AWS account for unexpected, machine-learning-driven spend spikes that deviate from their historical baseline. The SysOps Administrator must configure the system to send alerts to a specific Amazon Simple Notification Service (Amazon SNS) topic on a daily basis. Which solution meets these requirements with the minimum administrative effort?

Show answer & explanation

Answer: Create an AWS Cost Anomaly Monitor using the AWS Service monitor type, and configure an Alert Subscription with a daily frequency targeting the Amazon SNS topic.

Answer

Create an AWS Cost Anomaly Monitor using the AWS Service monitor type, and configure an Alert Subscription with a daily frequency targeting the Amazon SNS topic.
The correct solution uses AWS Cost Anomaly Detection with an AWS Service monitor, which uses machine learning to detect spend changes, combined with an Alert Subscription pointing to the Amazon SNS topic configured for daily alerts. This meets all constraints with minimal administrative effort.

Step-by-Step Solution

1
Identify the anomaly detection requirement.
Confirm that AWS Cost Anomaly Detection is the only AWS native billing service that uses machine learning to detect unexpected spikes in spending.
The requirement specifies machine-learning-driven anomaly detection rather than static threshold alerting.
2
Determine the configuration scope.
Define an AWS Service cost monitor to evaluate all AWS services in the account.
A Service-level monitor automatically analyzes all services without needing tag-based filters.
3
Configure the alert subscription destination and frequency.
Create an alert subscription, link it to the monitor, select a daily alerting frequency, and configure the target as the Amazon SNS topic.
This setup automates daily notifications to the SNS topic whenever anomalies are detected.

Key Concept

AWS Cost Anomaly Detection integrates machine learning to evaluate historical baselines and automatically notify users of cost anomalies using Amazon SNS or AWS Chatbot.
Question 954Question →

A company hosts a web application on Amazon EC2 instances located in a private subnet. The instances are registered in a target group for an Application Load Balancer (ALB) that is deployed in the public subnets of the same VPC. The target group is configured for HTTP health checks on port 8080.

A SysOps administrator observes that all EC2 instances in the target group are marked as unhealthy. The administrator confirms that the web application is actively listening on TCP port 8080 on the EC2 instances. The security group for the EC2 instances allows inbound TCP traffic on port 8080 from the ALB security group.

The custom Network Access Control List (NACL) for the private subnet has an inbound rule allowing TCP traffic on port 8080 from the public subnets. However, the outbound rules for the private subnet's NACL only allow TCP traffic on ports 80 and 443 to the public subnets.

Which modification should the administrator make to resolve the failing health checks?

Show answer & explanation

Answer: Add an outbound rule to the private subnet's Network ACL that allows TCP traffic on ephemeral ports (10241024-6553565535) to the public subnets.

Answer

Add an outbound rule to the private subnet's Network ACL that allows TCP traffic on ephemeral ports (10241024-6553565535) to the public subnets.
The correct answer is to add an outbound rule to the private subnet's Network ACL that allows TCP traffic on ephemeral ports (10241024-6553565535) to the public subnets. This is because Network ACLs are stateless. When the ALB initiates a health check request to the EC2 instances, it uses an ephemeral port (10241024-6553565535) as the source port. The response from the EC2 instance is sent back to this ephemeral port, so the private subnet's outbound NACL rules must allow traffic to these ephemeral ports.

Step-by-Step Solution

1
Analyze the network path and stateless nature of Network ACLs (NACLs).
NACLs are stateless, meaning return traffic must be explicitly allowed by an outbound rule.
Since the ALB is initiating connections to the EC2 instances, the return traffic from the EC2 instances back to the ALB must match an outbound NACL rule.
2
Identify the source and destination ports for the return traffic.
The request is sent from the ALB (using an ephemeral source port in the range 10241024-6553565535) to the EC2 instance (destination port 8080). Therefore, the return response from the EC2 instance goes from source port 8080 to the destination ephemeral port (10241024-6553565535).
To allow this response traffic through the private subnet's NACL, an outbound rule must allow traffic to ephemeral ports (10241024-6553565535).
3
Select the option that allows outbound traffic on the destination ephemeral ports to the public subnets.
Adding an outbound rule allowing TCP traffic on ephemeral ports (10241024-6553565535) to the public subnets allows the health check response to return to the ALB.
This fixes the blocked response traffic and allows health checks to succeed.

Key Concept

NACLs are stateless network security controls, meaning both inbound request traffic and outbound return traffic must be explicitly allowed. When an ALB initiates an HTTP request (like a health check) to a target, the return traffic from the target is sent to the ALB's ephemeral port, which requires outbound NACL rules to allow ephemeral ports (10241024-6553565535).
Question 955Question →

A SysOps administrator configures an Application Load Balancer (ALB) to route traffic to Amazon EC2 instances hosting a web application. The target group is configured to perform HTTP health checks on port 80 using the default path `/`. To meet security requirements, the administrator implements Basic Authentication at the web server level across the entire website. Shortly after, the ALB target group marks all EC2 instances as unhealthy. Which configuration change will resolve the target group health check failures?

Show answer & explanation

Answer: Configure a dedicated, unauthenticated path such as `/health` on the web server, and update the target group health check path to point to this new path.

Answer

Configure a dedicated, unauthenticated path such as `/health` on the web server, and update the target group health check path to point to this new path.
The correct option is to configure a dedicated, unauthenticated path such as `/health` on the web server, and update the target group health check path to point to this new path. Application Load Balancer health checks do not support sending authentication credentials. By creating an unauthenticated path specifically for health checks, the ALB can verify the web server is running and responding with an HTTP 200 OK without triggering the Basic Authentication prompt.

Step-by-Step Solution

1
Identify the cause of the target group marking the instances as unhealthy.
The web server returns an HTTP 401 Unauthorized status code to the health check request because of the newly implemented Basic Authentication on the default `/` path.
The default successful response matcher for ALB health checks is HTTP 200, so a 401 response is interpreted as a health check failure.
2
Create a dedicated health check endpoint on the web server that bypasses Basic Authentication.
An unauthenticated path, such as `/health`, is configured to return an HTTP 200 OK status code when the web server is operational.
ALB health checks do not support passing authentication credentials or headers, so the path must be publicly accessible to the ALB nodes.
3
Update the Target Group health check path configuration in AWS.
The Target Group now sends health check requests to the dedicated `/health` path.
This allows the ALB to verify the web server's health status without being blocked by Basic Authentication rules.

Key Concept

Elastic Load Balancing Health Checks and Authentication
Estimated Time:1m 30s
Question 956Question →

An organization has deployed a set of backend application servers inside a private subnet (10.0.2.0/2410.0.2.0/24) of a VPC. The application servers must access the internet to download critical package updates and must also query files from an Amazon S3 bucket. A NAT Gateway is deployed in the public subnet (10.0.1.0/2410.0.1.0/24) to facilitate egress internet access, and a Gateway VPC endpoint is configured for Amazon S3. However, the application servers are currently unable to download packages from the internet or read objects from Amazon S3.

Which configuration checks should a SysOps administrator perform to resolve these connectivity issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Verify that the route table associated with the private subnet contains a route for the Amazon S3 service prefix list (pl−xxxxxxpl-xxxxxx) targeting the Gateway VPC endpoint (vpce−xxxxxxvpce-xxxxxx).; Verify that the route table associated with the public subnet contains a default route (0.0.0.0/00.0.0.0/0) targeting the Internet Gateway (igw−xxxxxxigw-xxxxxx).

Answer

The correct configurations are to verify that the route table associated with the private subnet contains a route for the Amazon S3 service prefix list targeting the Gateway VPC endpoint, and verify that the route table associated with the public subnet contains a default route targeting the Internet Gateway.
Verifying that the private subnet's route table contains a route for the Amazon S3 service prefix list targeting the Gateway VPC endpoint ensures S3 traffic is routed correctly. Verifying that the public subnet's route table has a default route targeting the Internet Gateway ensures the NAT Gateway can forward traffic to the internet.

Step-by-Step Solution

1
Inspect the route table associated with the private subnet for S3 endpoint configuration.
Ensure there is a route with the destination of the S3 prefix list (pl−xxxxxxpl-xxxxxx) and the target of the S3 Gateway VPC endpoint (vpce−xxxxxxvpce-xxxxxx).
Gateway VPC endpoints require route table entries matching the service prefix list to route traffic privately to S3.
2
Inspect the route table associated with the public subnet where the NAT Gateway resides.
Verify that a default route (0.0.0.0/00.0.0.0/0) targets the Internet Gateway (igw−xxxxxxigw-xxxxxx).
The NAT Gateway cannot route traffic to the internet if the public subnet's route table lacks a path to the Internet Gateway.
3
Verify stateless security rules such as Network ACLs.
Confirm that outbound ephemeral ports (10241024-6553565535) are allowed to enable connection completion.
Stateless rules require explicit allowance of outbound ephemeral ports for connection requests and return traffic.

Key Concept

VPC Connectivity and Routing Troubleshooting
Estimated Time:2m 30s
Question 957Question →

A SysOps Administrator is optimizing a fleet of Amazon EC2 instances hosting a distributed file-indexing service. The instances currently show high CPU utilization spikes, and AWS Compute Optimizer recommends upgrading to a larger instance type. However, the administrator suspects that the workload is memory-constrained and wants to ensure that memory utilization metrics are included in the recommendation analysis.

Which actions should the administrator perform to achieve this goal? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the unified CloudWatch agent on the instances to collect and transmit memory utilization metrics.; Associate an IAM role with the instances that has the CloudWatchAgentServerPolicy policy attached.

Answer

Deploy the unified CloudWatch agent on the instances to collect and transmit memory utilization metrics, and associate an IAM role with the instances that has the CloudWatchAgentServerPolicy policy attached.
To make memory utilization metrics available to AWS Compute Optimizer, the unified CloudWatch agent must be deployed on the EC2 instances to collect and publish OS-level memory metrics to CloudWatch. Additionally, the EC2 instances must be associated with an IAM role that grants permissions to write these metrics to CloudWatch, which is provided by the CloudWatchAgentServerPolicy managed policy.

Step-by-Step Solution

1
Deploy the unified CloudWatch agent on the target EC2 instances.
The agent starts collecting OS-level memory metrics that are not natively captured by the hypervisor.
AWS Compute Optimizer requires the unified CloudWatch agent to retrieve EC2 memory metrics.
2
Attach an IAM role with CloudWatch write permissions (such as CloudWatchAgentServerPolicy) to the EC2 instances.
The unified CloudWatch agent has the necessary permissions to publish the collected memory metrics to Amazon CloudWatch.
Without these permissions, the agent cannot send metric data to CloudWatch, preventing Compute Optimizer from accessing it.

Key Concept

AWS Compute Optimizer relies on the unified CloudWatch agent and appropriate IAM permissions to ingest and analyze memory utilization metrics for EC2 right-sizing recommendations.
Question 958Question →

A SysOps Administrator is setting up automated security monitoring for an AWS environment. The administrator has enabled Amazon GuardDuty and wants to implement automated remediation for EC2 instances that are flagged with a finding type of 'UnauthorizedAccess:EC2/MaliciousIPCaller.Custom'. The remediation must isolate the affected EC2 instance by attaching a security group that denies all inbound and outbound traffic.

Which combination of actions must the administrator perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon EventBridge rule with an event pattern that filters for Amazon GuardDuty findings where the 'detail.type' matches 'UnauthorizedAccess:EC2/MaliciousIPCaller.Custom', and set the target to an AWS Systems Manager Automation document.; Ensure the Systems Manager Automation execution role has an IAM policy allowing the 'ec2:ModifyInstanceAttribute' action, and grant the administrator configuring the rule the 'iam:PassRole' permission for this execution role.

Answer

To implement this monitoring and automated remediation, the administrator must create an Amazon EventBridge rule that filters for the specific GuardDuty finding type and targets a Systems Manager Automation document, and ensure the execution role has the required EC2 modification permissions and is passed to the service with 'iam:PassRole' permissions.
Automating remediation of GuardDuty findings requires capturing the finding via Amazon EventBridge, which receives all GuardDuty findings natively. An EventBridge rule must be created with a pattern matching the finding type and targeted at a Systems Manager Automation document. To perform the isolation, the Systems Manager execution role requires the 'ec2:ModifyInstanceAttribute' action to change the instance's associated security groups. The administrator configuring this target must have 'iam:PassRole' permissions to grant EventBridge the ability to pass the execution role to Systems Manager.

Step-by-Step Solution

1
Set up EventBridge routing for the GuardDuty threat event.
An Amazon EventBridge rule is created to capture GuardDuty findings and filter specifically for the 'UnauthorizedAccess:EC2/MaliciousIPCaller.Custom' finding type.
Amazon GuardDuty automatically publishes finding events to EventBridge in near real-time, allowing event-driven workflows to trigger.
2
Configure the remediation target.
The EventBridge rule is configured to target an AWS Systems Manager Automation document that isolates the EC2 instance.
Systems Manager Automation provides pre-built and custom runbooks to perform operational tasks such as modifying EC2 configuration.
3
Configure the necessary IAM execution and PassRole permissions.
The Systems Manager execution role is granted 'ec2:ModifyInstanceAttribute' to change the instance security group, and the administrator is granted the 'iam:PassRole' permission.
The execution role needs API permissions to modify the instance, and the configuring administrator must have permission to pass this IAM execution role to the Systems Manager service.

Key Concept

Centralized threat detection and automated remediation using Amazon GuardDuty, Amazon EventBridge, and AWS Systems Manager Automation with appropriate IAM execution roles.
Estimated Time:2m 0s
Question 959Question →

A SysOps Administrator is configuring an Application Load Balancer (ALB) to distribute traffic to a fleet of Amazon EC2 instances. The EC2 instances run a web application that listens on port 3000. The Administrator creates a target group, sets the port to 3000, and registers the EC2 instances. After deployment, the load balancer reports that all registered instances are unhealthy. A direct curl request from a test instance to one of the application servers on http://<private-ip>:3000/api/status returns an HTTP 200 status code, but a request to http://<private-ip>:3000/ returns an HTTP 404 status code.

Which action will resolve this health check issue?

Show answer & explanation

Answer: Update the target group health check settings to use /api/status as the health check path.

Answer

Update the target group health check settings to use /api/status as the health check path.
Updating the target group health check path to a valid path that returns a 200 OK status code, such as /api/status, allows the load balancer to receive a successful response and mark the instances as healthy. By default, target groups perform health checks on the root path (/), which in this case returns an HTTP 404 response, causing the target group to classify the instances as unhealthy.

Step-by-Step Solution

1
Analyze the symptoms and test results provided in the scenario.
The target group health checks are failing (reporting instances as unhealthy). Direct access to port 3000 at the / path returns an HTTP 404 status code, whereas accessing the /api/status endpoint returns an HTTP 200 status code.
By default, Application Load Balancer target groups perform health checks on the root path (/) using the traffic port. An HTTP 404 response is treated as unhealthy by default.
2
Determine the necessary change to make the health check pass.
Update the health check path configuration in the target group to point to the valid /api/status endpoint.
This configuration change ensures that the ALB queries an endpoint that returns a successful HTTP 200 status code, indicating the backend application is functioning correctly.

Key Concept

Target group health check path configuration and response codes
Question 960Question →

A SysOps Administrator is managing an application running on an Amazon EC2 instance. The application has been experiencing performance degradation, and AWS Compute Optimizer categorizes the instance as underprovisioned. The administrator observes that the CPU utilization regularly peaks at 95%95\%, while the memory utilization remains below 30%30\%. The memory utilization metrics are currently visible in Compute Optimizer because the Unified CloudWatch Agent is installed on the instance. Which actions should the SysOps Administrator take to right-size the instance and ensure future memory utilization metrics continue to be collected? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Resize the EC2 instance to a compute-optimized instance family, such as c5, or a larger instance size in the same family.; Verify that the IAM role attached to the EC2 instance includes the CloudWatchAgentServerPolicy managed policy.

Answer

Resize the EC2 instance to a compute-optimized instance family (such as c5) or a larger instance size in the same family, and verify that the IAM role attached to the EC2 instance includes the CloudWatchAgentServerPolicy managed policy.
The correct options are resizing the EC2 instance to a compute-optimized instance family (such as c5) or a larger instance size in the same family, and verifying that the IAM role attached to the EC2 instance includes the CloudWatchAgentServerPolicy managed policy. The high CPU utilization (95%95\%) combined with low memory utilization (30%30\%) indicates that the instance is CPU-bound, making a compute-optimized instance family the correct right-sizing choice. Because memory is an OS-level metric, AWS Compute Optimizer requires the Unified CloudWatch Agent to report these metrics. For the agent to successfully send metrics to CloudWatch, the EC2 instance's IAM role must contain the CloudWatchAgentServerPolicy policy.

Step-by-Step Solution

1
Analyze the resource utilization metrics reported by AWS Compute Optimizer.
Identify that the CPU utilization is at 95%95\% (underprovisioned) and memory utilization is at 30%30\% (overprovisioned).
This determines that the workload is CPU-bound, meaning a compute-optimized instance type (c5) or a larger size is required to resolve the bottleneck.
2
Determine the requirement for memory metrics collection by AWS Compute Optimizer.
Identify that memory utilization is an OS-level metric not collected by default EC2 metrics, requiring the Unified CloudWatch Agent.
AWS Compute Optimizer needs these memory metrics to make accurate right-sizing recommendations.
3
Verify IAM permissions for the Unified CloudWatch Agent.
Ensure the IAM role attached to the EC2 instance includes the CloudWatchAgentServerPolicy managed policy.
Without this policy, the agent cannot write the custom memory metrics to CloudWatch, causing Compute Optimizer to lose visibility into memory utilization after the resize.

Key Concept

AWS Compute Optimizer rightsizing recommendations for EC2 instances require memory metrics from the Unified CloudWatch Agent, which relies on the CloudWatchAgentServerPolicy IAM policy. The instance type must match the specific bottleneck (CPU-bound vs. memory-bound).
Estimated Time:1m 30s
PreviousPage 48 / 49Next