Examkin

All practice questions

976 questions

All types976Multiple choice502Multiple select450Ordering24
Question 961Question →

A SysOps Administrator is reviewing optimization recommendations in AWS Compute Optimizer for a fleet of EC2 instances hosting a memory-intensive batch processing application. The dashboard lists these instances as over-provisioned based on CPU utilization, but memory metrics are missing from the analysis, leading to potentially inaccurate right-sizing recommendations. Which action must the administrator take to enable AWS Compute Optimizer to ingest memory utilization metrics for these EC2 instances?

Show answer & explanation

Answer: Install and configure the unified CloudWatch agent on the EC2 instances to publish OS-level memory metrics to Amazon CloudWatch under the CWAgent namespace.

Answer

Install and configure the unified CloudWatch agent on the EC2 instances to publish OS-level memory metrics to Amazon CloudWatch under the CWAgent namespace.
The correct answer is to install and configure the unified CloudWatch agent on the EC2 instances to publish memory metrics to the default CWAgent namespace. Because memory utilization is an operating system-level metric, the underlying AWS hypervisor does not have visibility into it. The unified CloudWatch agent must be installed to collect memory metrics and send them to CloudWatch, where AWS Compute Optimizer can retrieve and ingest them to deliver memory-aware right-sizing recommendations.

Step-by-Step Solution

1
Deploy the unified CloudWatch agent on the target EC2 instances.
The agent is installed on the instances' operating systems.
Memory utilization is an OS-level metric that the hypervisor cannot access directly; an agent is required to collect this data.
2
Configure the CloudWatch agent configuration file to collect memory metrics and send them to the default namespace.
Memory metrics such as mem_used_percent are published to the CWAgent namespace in Amazon CloudWatch.
AWS Compute Optimizer automatically looks for memory metrics published under the default CWAgent namespace to generate recommendations.
3
Allow AWS Compute Optimizer up to 30 hours to ingest the new metrics and update the right-sizing recommendations.
Compute Optimizer includes memory utilization in its optimization analysis.
Compute Optimizer requires a minimum duration of metric history to update its recommendations.

Key Concept

AWS Compute Optimizer relies on the unified CloudWatch agent to analyze memory metrics because memory is an operating system-level metric not visible to the hypervisor by default.
Estimated Time:1m 30s
Question 962Question →

A SysOps Administrator is configuring a customer managed KMS key in AWS account 111122223333. The key is used to encrypt backups. The administrator configures a custom key policy that grants permissions to a backup role but removes the default statement that delegates key permissions to the account's root user. Later, an administrator with the AdministratorAccess IAM policy attached to their user attempts to modify the key policy but receives an AccessDeniedException. Which of the following statements correctly explain this behavior or identify the configurations required to resolve the issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Without the root principal delegation statement in the key policy, IAM policies alone cannot grant access to the customer managed KMS key.; The key policy must be modified to explicitly list the administrator's IAM principal or restore the default policy statement delegating control to the account's IAM policies.

Answer

Without the root principal delegation statement in the key policy, IAM policies alone cannot grant access to the customer managed KMS key. To resolve the issue, the key policy must be modified to explicitly list the administrator's IAM principal or restore the default policy statement delegating control to the account's IAM policies.
In AWS KMS, key policies are the primary way to control access to keys. If a customer managed key's policy does not delegate control to the account's root principal (which allows the account to use IAM policies), then IAM policies alone are insufficient to grant access. To fix the AccessDeniedException, the administrator must either be explicitly permitted in the key policy, or the root principal delegation statement must be restored to allow IAM policies (like AdministratorAccess) to govern access to the key.

Step-by-Step Solution

1
Analyze the policy evaluation path for AWS KMS.
Identify that AWS KMS key policies are resource-based and always evaluated. If the default statement delegating control to the account's root user is missing, IAM policies have no effect on the KMS key.
This explains why the administrator with AdministratorAccess still receives an AccessDeniedException.
2
Determine the required modifications to the KMS key policy.
The administrator must either add their specific IAM principal to the KMS key policy's Principal element or restore the default delegation statement ('arn:aws:iam::111122223333:root').
This establishes a valid permission path from either the key policy directly or via IAM delegation.

Key Concept

AWS KMS Key Policy Precedence and IAM Delegation
Question 963Question →

A SysOps Administrator needs to aggregate compliance status data from AWS Config rules across all member accounts within an AWS Organization. The administrator wants to view the compliance details of all accounts and regions in a single dashboard within the organization's management account with the least administrative effort. Which solution will meet these requirements?

Show answer & explanation

Answer: Set up an AWS Config aggregator in the management account, and configure it to collect compliance data from the entire AWS Organization.

Answer

Set up an AWS Config aggregator in the management account, and configure it to collect compliance data from the entire AWS Organization.
An AWS Config aggregator is an AWS Config resource type that collects configuration history and compliance data from multiple accounts and regions. Creating an aggregator in the management account of an AWS Organization allows the administrator to view compliance status across all accounts and regions in a single dashboard with minimal effort, making this the correct and most efficient solution.

Step-by-Step Solution

1
Identify the requirement to aggregate compliance data across all AWS accounts and regions in an AWS Organization.
Confirming AWS Config supports multi-account multi-region data aggregation.
This determines that a native aggregation capability is the preferred path to minimize administrative overhead.
2
Create an aggregator resource in the AWS Config console of the organization's management account.
The aggregator is configured to collect data from the entire AWS Organization, utilizing the organization's service-linked role.
This authorizes AWS Config to gather data from all member accounts without manual configuration in each individual account.
3
Verify compliance status from the central dashboard.
The management account dashboard displays the aggregated compliance status of all Config rules.
This fulfills the compliance monitoring requirement with the least effort.

Key Concept

AWS Config Multi-Account Multi-Region Data Aggregation
Question 964Question →

A SysOps administrator is designing an Amazon S3 Lifecycle policy to manage storage costs for weekly database backup files. The backups are stored in an S3 Standard bucket and accessed frequently for the first 3030 days. Between day 3131 and day 6060, the backups are accessed occasionally but must remain available for immediate retrieval. After 6060 days, the backups are rarely accessed but must be retained for compliance for a total of 365365 days, with a retrieval time of up to 55 hours being acceptable. Which of the following lifecycle rule configurations meets these requirements in the most cost-effective manner without causing a lifecycle policy validation error?

Show answer & explanation

Answer: A lifecycle rule to transition objects to S3 Standard-IA after 3030 days, and to S3 Glacier Flexible Retrieval after 6060 days.

Answer

The lifecycle rule that transitions objects to S3 Standard-IA after 3030 days and to S3 Glacier Flexible Retrieval after 6060 days meets all access, retrieval, and cost requirements while respecting the mandatory 3030-day transition interval.
The correct answer configuration transitions the backups to S3 Standard-IA on day 3030 and to S3 Glacier Flexible Retrieval on day 6060. This aligns perfectly with the storage tier requirements, and the 3030-day gap between transitions meets the S3 lifecycle validation requirement (which requires the colder class transition day to be at least 3030 days after the warmer class transition day).

Step-by-Step Solution

1
Analyze the access pattern and retrieval requirements for each phase of the file lifecycle.
Files are accessed frequently for the first 3030 days (requires S3 Standard), accessed occasionally with immediate retrieval from day 3131 to 6060 (requires S3 Standard-IA), and accessed rarely after 6060 days with a retrieval SLA of up to 55 hours (requires S3 Glacier Flexible Retrieval).
This establishes the appropriate S3 storage classes for each phase of the retention cycle.
2
Calculate the required transition times and check for lifecycle rule validation constraints.
Transition to S3 Standard-IA should occur at day 3030, and transition to S3 Glacier Flexible Retrieval should occur at day 6060. The difference between the two transition days is 60−30=3060 - 30 = 30 days.
Amazon S3 lifecycle validation requires that the transition to S3 Glacier must be scheduled at least 3030 days after the transition to S3 Standard-IA.
3
Evaluate the proposed options against the lifecycle validation rule and selection criteria.
Only the configuration with transition to S3 Standard-IA at day 3030 and S3 Glacier Flexible Retrieval at day 6060 satisfies the minimum 3030-day interval constraint while correctly mapping to the required storage classes.
This guarantees the policy is accepted by Amazon S3 and achieves optimal cost-efficiency.

Key Concept

Amazon S3 Lifecycle transition rules require that the transition day specified for a colder storage class (like S3 Glacier) must be at least 3030 days greater than the transition day specified for the preceding warmer storage class (like S3 Standard-IA) in the same rule.
Question 965Question →

A SysOps Administrator is configuring AWS CloudTrail to deliver logs from a production account to a centralized Amazon S3 bucket located in a dedicated security account. The trail is created in the production AWS account, but logs are not appearing in the destination S3 bucket. What must the administrator do to resolve this issue?

Show answer & explanation

Answer: Update the destination S3 bucket policy in the security account to grant write permissions (s3:PutObject) to the AWS CloudTrail service principal.

Answer

Update the destination S3 bucket policy in the security account to grant write permissions (s3:PutObject) to the AWS CloudTrail service principal.
For CloudTrail to deliver logs to an S3 bucket in a different AWS account, the S3 bucket policy in the destination account must explicitly grant permissions to the CloudTrail service principal ('cloudtrail.amazonaws.com'). The minimum required permissions are 's3:PutObject' to write the logs and 's3:GetBucketAcl' to verify ownership of the bucket.

Step-by-Step Solution

1
Analyze cross-account log delivery mechanics.
Identify that the resource (S3 bucket) is owned by the security account, whereas the service generator (CloudTrail) resides in the production account.
Cross-account resource access is denied by default in AWS unless explicitly permitted by a resource-based policy.
2
Configure the destination resource policy.
Add an S3 bucket policy that permits 's3:PutObject' (and 's3:GetBucketAcl') with the principal set to 'cloudtrail.amazonaws.com'.
This grants the CloudTrail service running in the production account permission to write objects directly into the destination bucket.

Key Concept

Cross-account log delivery to an S3 bucket requires resource-based access permissions (S3 bucket policy) to authorize the AWS service principal.
Question 966Question →

A company stores application logs in an Amazon S3 bucket. The logs are stored in the S3 Standard storage class by default. The logs are frequently accessed for the first 30 days. After 30 days, they are rarely accessed but must be available immediately if a security audit occurs. After 180 days, the logs are only needed for annual compliance reviews where a retrieval time of up to 12 hours is acceptable. The total retention period is 365 days, after which the logs must be deleted. A SysOps administrator is configuring an S3 Lifecycle policy to minimize storage costs. Which actions should the SysOps administrator configure in the S3 Lifecycle rules to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Transition objects from S3 Standard to S3 Standard-IA after 30 days; Transition objects from S3 Standard-IA to S3 Glacier Deep Archive after 180 days

Answer

The SysOps administrator should configure the S3 Lifecycle policy to transition objects from S3 Standard to S3 Standard-IA after 30 days, and transition objects from S3 Standard-IA to S3 Glacier Deep Archive after 180 days.
The correct configuration consists of transitioning objects from S3 Standard to S3 Standard-IA after 30 days, and then from S3 Standard-IA to S3 Glacier Deep Archive after 180 days. This sequence aligns with the requirements of frequent access for 30 days, rare but immediate access up to day 180, and annual compliance access (up to 12 hours retrieval) afterwards, while minimizing costs.

Step-by-Step Solution

1
Analyze the access and retrieval requirements for the first phase (0-30 days).
The logs are frequently accessed for the first 30 days, so they should remain in the default S3 Standard storage class during this period.
S3 Standard is optimized for active, frequently accessed data.
2
Analyze the access and retrieval requirements for the second phase (30-180 days).
After 30 days, access becomes rare but must remain immediate. Transitioning to S3 Standard-IA at day 30 satisfies this.
S3 Standard-IA has a minimum storage duration of 30 days and provides rapid millisecond access at lower storage costs.
3
Analyze the access and retrieval requirements for the third phase (after 180 days).
After 180 days, logs are only needed for annual reviews where a 12-hour retrieval is acceptable. Transitioning from S3 Standard-IA to S3 Glacier Deep Archive at day 180 meets this requirement at the lowest cost.
S3 Glacier Deep Archive supports 12-hour Bulk retrievals and is the most cost-effective storage class for long-term archiving.

Key Concept

Amazon S3 Lifecycle rules allow you to transition objects to cost-effective storage classes based on access patterns, complying with unidirectional transition constraints (e.g., from Standard to Standard-IA, and Standard-IA to Glacier Deep Archive).
Question 967Question →

A company stores media source files in an Amazon S3 Standard bucket. The files are frequently accessed during the first 30 days after upload. Between day 31 and day 90, the files are rarely accessed but must be available for immediate retrieval if requested. After 90 days, the files are rarely accessed and can tolerate a retrieval time of up to 12 hours for compliance auditing.

Which Amazon S3 Lifecycle configuration will meet these requirements most cost-effectively?

Show answer & explanation

Answer: Configure a lifecycle rule to transition the objects to S3 Standard-Infrequent Access (Standard-IA) after 30 days, and transition the objects to S3 Glacier Deep Archive after 90 days.

Answer

Configure a lifecycle rule to transition the objects to S3 Standard-Infrequent Access (Standard-IA) after 30 days, and transition the objects to S3 Glacier Deep Archive after 90 days.
The correct configuration transitions objects to S3 Standard-IA after 30 days and then to S3 Glacier Deep Archive after 90 days. This meets the immediate retrieval requirement up to day 90, satisfies the 30-day minimum storage period in S3 Standard before transitioning to S3 Standard-IA, and satisfies the 30-day minimum storage duration for S3 Standard-IA (since objects spend 60 days in Standard-IA before moving to Glacier Deep Archive at day 90). Finally, S3 Glacier Deep Archive offers retrieval within 12 hours, satisfying the compliance retrieval requirement.

Step-by-Step Solution

1
Analyze the access and retrieval requirements for the files over time.
The files require immediate access for 90 days (S3 Standard for 30 days, then a cheaper tier with immediate retrieval like S3 Standard-IA for the next 60 days). After 90 days, retrieval can take up to 12 hours, which allows for S3 Glacier Deep Archive.
This establishes the target storage classes based on access patterns and retrieval time needs.
2
Evaluate S3 Lifecycle transition constraints and minimum storage durations.
Transition from S3 Standard to S3 Standard-IA requires a minimum of 30 days. Transition from S3 Standard-IA to S3 Glacier Deep Archive requires the objects to remain in S3 Standard-IA for at least 30 days.
This ensures the lifecycle policy is valid and does not cause a validation error.
3
Select the policy that conforms to all S3 Lifecycle rules.
Transitioning to S3 Standard-IA at 30 days is valid. Transitioning to S3 Glacier Deep Archive at 90 days means the object spends 60 days in S3 Standard-IA, which is greater than the 30-day minimum limit.
This represents the most cost-effective and valid configuration.

Key Concept

Amazon S3 Lifecycle transition rules and minimum storage duration constraints.
Estimated Time:1m 30s
Question 968Question →

A SysOps administrator is configuring a private subnet in a VPC to host backend instances. To allow these instances to download software updates from the internet, the administrator deploys a NAT gateway in a public subnet. The administrator updates the route table of the private subnet to direct 0.0.0.0/00.0.0.0/0 traffic to the NAT gateway. However, the backend instances are still unable to establish any connections to the internet.

Which of the following troubleshooting steps will resolve this connectivity issue?

Show answer & explanation

Answer: Verify that the route table associated with the public subnet containing the NAT gateway has a route for 0.0.0.0/00.0.0.0/0 pointing to the Internet Gateway.

Answer

Verify that the route table associated with the public subnet containing the NAT gateway has a route for 0.0.0.0/00.0.0.0/0 pointing to the Internet Gateway.
For backend instances in a private subnet to access the internet via a NAT gateway, the NAT gateway itself must reside in a public subnet. A subnet is defined as public if its associated route table contains a route targeting the Internet Gateway (typically 0.0.0.0/00.0.0.0/0 targeting an `igw-xxxxxx` ID). If this route is missing from the public subnet's route table, the NAT gateway cannot send or receive traffic to and from the internet, resulting in timeouts for the backend instances.

Step-by-Step Solution

1
Analyze the network path from the private subnet to the internet.
The path goes from the backend instances to the private subnet's route table, which correctly routes internet-bound traffic (0.0.0.0/00.0.0.0/0) to the NAT gateway.
This confirms that the first hop from the private subnet to the NAT gateway is configured correctly.
2
Check the public subnet where the NAT gateway is located.
Identify that the NAT gateway's subnet (the public subnet) must have a valid route to the Internet Gateway to forward the translated traffic.
A NAT gateway acts as a proxy; it needs its own route table to have a route pointing to the Internet Gateway (0.0.0.0/00.0.0.0/0 targeting `igw-xxxxxx`) to send packets to the public internet.
3
Verify if other options resolve the issue.
Other options either introduce stateless network ACL issues, use incorrect endpoints (Gateway Endpoints instead of NAT), or propose invalid internal routing configurations that break VPC communication.
This confirms that verifying and adding the route to the Internet Gateway in the public subnet's route table is the correct solution.

Key Concept

For a NAT gateway to function, it must be deployed in a public subnet whose associated route table contains a default route (0.0.0.0/00.0.0.0/0) pointing to an Internet Gateway.
Question 969Question →

A SysOps administrator is configuring an Amazon S3 Lifecycle policy for daily application logs. The logs are stored in an S3 Standard bucket and must be retained for 365 days. The logs have the following access requirements:

* Day 0 to Day 30: Accessed frequently with millisecond latency.
* Day 30 to Day 60: Accessed infrequently but require millisecond retrieval.
* After Day 60: Accessed only for annual compliance audits, where a retrieval time of 3 to 5 hours is acceptable.

Which TWO configurations must the administrator include in the S3 Lifecycle policy to achieve the lowest cost while meeting all requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Transition objects from S3 Standard to S3 Standard-IA after 30 days.; Transition objects from S3 Standard-IA to S3 Glacier Flexible Retrieval after 60 days.

Answer

To optimize costs according to S3 Lifecycle rules, the administrator should transition objects from S3 Standard to S3 Standard-IA after 30 days, and transition objects from S3 Standard-IA to S3 Glacier Flexible Retrieval after 60 days.
Transitioning objects from S3 Standard to S3 Standard-IA after 30 days perfectly matches the requirement for infrequent, low-latency access between Day 30 and Day 60. Transitioning these objects from S3 Standard-IA to S3 Glacier Flexible Retrieval after 60 days satisfies the 3-5 hour retrieval latency requirement for audits. This second transition is valid because the objects will have resided in S3 Standard-IA for exactly 30 days (from Day 30 to Day 60), which meets the S3 Lifecycle policy constraint requiring a minimum of 30 days in S3 Standard-IA before transitioning to another class.

Step-by-Step Solution

1
Analyze the access pattern and latency requirements for each time window.
From Day 0 to Day 30, high-frequency access requires S3 Standard. From Day 30 to Day 60, infrequent access with millisecond latency fits S3 Standard-IA. After Day 60, audit access with 3-5 hour retrieval fits S3 Glacier Flexible Retrieval.
Matching access patterns to the correct storage class ensures cost optimization while satisfying performance requirements.
2
Validate the lifecycle transition timeline against AWS S3 minimum storage duration and sequence restrictions.
Transitioning to S3 Standard-IA occurs at Day 30. Transitioning to S3 Glacier Flexible Retrieval occurs at Day 60. The duration spent in S3 Standard-IA is 30 days (60−30=3060 - 30 = 30 days).
AWS S3 Lifecycle rules enforce that objects must spend a minimum of 30 days in S3 Standard-IA before they can transition to another Glacier class. A transition at Day 60 satisfies this 30-day constraint.
3
Eliminate invalid transition configurations.
Transitions to S3 Glacier Flexible Retrieval or S3 Glacier Instant Retrieval at Day 45 or Day 50 would limit the time in S3 Standard-IA to 15 or 20 days, which violates the 30-day constraint. Reverse transitions from colder to warmer tiers (e.g., Glacier Flexible Retrieval to Standard-IA) are not allowed in S3 Lifecycle policies.
Any rule violating minimum duration constraints or sequence directions results in a lifecycle policy validation error.

Key Concept

S3 Lifecycle policies require a minimum of 30 days in S3 Standard-IA before transitioning to any S3 Glacier storage class, and only support transitions from warmer to colder storage classes.
Question 970Question →

A company is migrating its primary website at the zone apex (example.com) from an on-premises web server to an Amazon CloudFront distribution. A SysOps Administrator needs to configure Amazon Route 53 to gradually shift 10% of the traffic to the CloudFront distribution, while keeping 90% of the traffic routed to the on-premises web server's public IP address. Which two configurations should the administrator use to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Weighted A record for the zone apex (example.com) with a weight of 90, targeting the on-premises web server's public IP address.; Create a Weighted Alias A record for the zone apex (example.com) with a weight of 10, targeting the CloudFront distribution domain name.

Answer

To gradually shift traffic at the zone apex, create a Weighted A record targeting the on-premises server's IP address with a weight of 90, and a Weighted Alias A record targeting the CloudFront distribution with a weight of 10.
To route traffic to the zone apex (example.com) while splitting traffic, the administrator must use A records. Since the CloudFront distribution uses a domain name, Route 53 Alias A records must be used for the zone apex because CNAME records are not allowed at the zone apex. The on-premises server uses a static IP address, so a standard A record is appropriate. By setting both as Weighted records with weights of 90 and 10, the traffic is split accordingly.

Step-by-Step Solution

1
Analyze the DNS routing target and limitations of the zone apex.
Identify that the zone apex (example.com) cannot use CNAME records due to DNS protocol specifications, meaning any target using a domain name (like CloudFront) must be routed using an Alias A record.
Ensures the configuration conforms to DNS RFC standards.
2
Determine the appropriate routing policy for percentage-based traffic shifting.
Select Weighted routing rather than Failover routing to achieve the active traffic split (90/10).
Allows gradual migration and testing of the new CloudFront distribution.
3
Configure the two Route 53 resource record sets.
Create one Weighted A record for the on-premises IP address (weight 90) and one Weighted Alias A record for CloudFront (weight 10).
Completes the migration setup while routing traffic correctly across mixed target types.

Key Concept

Using Weighted Routing Policies and Alias Records at the Zone Apex
Estimated Time:1m 30s
Question 971Question →

A company hosts an application on Amazon EC2 instances in a private subnet of a VPC. The instances are configured with IPv6 CIDR blocks and must be able to initiate outbound connections to the internet to download security updates. However, any inbound connections from the internet to these instances must be completely blocked. A SysOps administrator discovers that the instances currently cannot reach any external IPv6 addresses. Which combination of actions must the SysOps administrator take to resolve this connectivity issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an egress-only internet gateway for the VPC.; Add a route in the private subnet's route table with a destination of `::/0` pointing to the egress-only internet gateway.

Answer

Create an egress-only internet gateway for the VPC, and add a route in the private subnet's route table with a destination of `::/0` pointing to the egress-only internet gateway.
To support outbound-only IPv6 traffic, AWS provides the Egress-Only Internet Gateway. Creating this gateway and pointing the private subnet's `::/0` route to it fulfills the requirement of allowing internet access for downloads while completely preventing inbound connections at the routing layer.

Step-by-Step Solution

1
Determine the protocol requirement and restrictions.
The instances require outbound-only IPv6 connectivity to the internet while preventing inbound-initiated connections.
This protocol and behavioral constraint rule out NAT gateways (which support IPv4) and standard internet gateways (which permit bidirectional traffic).
2
Provision the appropriate gateway component.
Create an egress-only internet gateway and attach it to the VPC.
Egress-only internet gateways specifically allow IPv6 egress while blocking ingress traffic.
3
Configure routing table rules.
Add a route for `::/0` pointing to the egress-only internet gateway in the route table associated with the private subnet.
This updates the route table to direct all outbound IPv6 traffic to the newly created egress-only gateway.

Key Concept

Egress-Only Internet Gateway routing configuration for IPv6 private subnets
Question 972Question →

A company has deployed Amazon EC2 instances in a private subnet of a VPC. The instances need to write data to Amazon Kinesis Data Streams. To prevent the data from traversing the public internet, a SysOps administrator creates an interface VPC endpoint for Kinesis Data Streams in the VPC and enables the private DNS option. However, the EC2 instances are still unable to connect to the Kinesis service using the default service name kinesis.us-east-1.amazonaws.com. Which of the following configuration changes will resolve this connectivity issue?

Show answer & explanation

Answer: Enable DNS hostnames and DNS resolution attributes for the VPC.

Answer

Enable DNS hostnames and DNS resolution attributes for the VPC.
To resolve the hostnames of interface VPC endpoints using private DNS, the VPC must have both 'enableDnsHostnames' and 'enableDnsSupport' set to true. When these attributes are enabled, the public DNS hostname of the AWS service (such as kinesis.us-east-1.amazonaws.com) resolves to the private IP addresses of the endpoint network interfaces (ENIs) inside the VPC. Without these settings, the hostname resolves to public IP addresses, which are unreachable from a private subnet without internet access.

Step-by-Step Solution

1
Check the DNS configuration attributes of the VPC.
Identify that the 'enableDnsHostnames' or 'enableDnsSupport' attributes are set to false.
Interface VPC endpoints require both DNS hostnames and DNS support to be enabled in order for private DNS hostnames to resolve correctly.
2
Enable 'enableDnsHostnames' and 'enableDnsSupport' in the VPC settings.
The public service hostname resolves to the private IP address of the endpoint's network interface (ENI).
Enabling these attributes allows the Route 53 Resolver to intercept the DNS queries and return the private endpoint IPs instead of public IPs.

Key Concept

Interface VPC Endpoints and Private DNS resolution requirements
Estimated Time:1m 30s
Question 973Question →

A SysOps Administrator is configuring Amazon Route 53 for a company's new corporate landing page. The landing page is hosted on an Amazon S3 bucket configured for static website hosting. The company wants the landing page to be accessible directly via the apex domain (example.com). Which configuration should the administrator use to map the apex domain to the Amazon S3 website endpoint?

Show answer & explanation

Answer: Create an Alias A record for the apex domain (example.com) that points to the S3 bucket website endpoint.

Answer

Create an Alias A record for the apex domain (example.com) that points to the S3 bucket website endpoint.
The correct configuration is to create an Alias A record for the apex domain pointing to the S3 bucket website endpoint. Route 53 Alias records are a proprietary extension that allows mapping apex domains directly to specific AWS resources, such as S3 buckets, CloudFront distributions, and ELBs. Unlike standard CNAME records, Alias records resolve to A records during DNS queries, satisfying the requirement that the zone apex must have an A record (or similar address records) and avoiding conflicts with mandatory zone-level records like SOA and NS.

Step-by-Step Solution

1
Analyze the requirements for routing traffic for the apex domain (example.com) to a static website hosted on Amazon S3.
The target domain is the zone apex, and the destination is an Amazon S3 website endpoint.
Routing rules at the zone apex level have specific DNS specification constraints that dictate which record types are permitted.
2
Determine the viability of CNAME records at the zone apex.
According to DNS standards (RFC 1034), CNAME records cannot coexist with other records (such as SOA and NS) that must exist at the zone apex.
Using a CNAME record at the zone apex would break DNS resolution for mandatory root-level records.
3
Select the correct AWS Route 53 specific feature that bypasses the zone apex limitation.
Create an Alias record pointing directly to the S3 website endpoint.
Route 53 Alias records act like a CNAME but are resolved internally to IP addresses and presented as A records, allowing them to safely exist at the zone apex.

Key Concept

Route 53 Alias records resolve zone apex limitations by mapping directly to AWS resources.
Estimated Time:1m 30s
Question 974Question →

A SysOps Administrator is configuring DNS resolution for a service endpoint at app.example.com. The service is hosted behind three Application Load Balancers (ALBs) located in different AWS Regions. The administrator wants to use DNS-based routing that returns the IP addresses of all healthy ALBs in response to DNS queries, while automatically removing any ALB that fails its health checks from DNS responses.

Which Route 53 configuration will meet these requirements?

Show answer & explanation

Answer: Create three Alias A records using the Multivalue Answer routing policy, targeting the DNS names of the respective ALBs, and enable Evaluate Target Health on each record.

Answer

Create three Alias A records using the Multivalue Answer routing policy, targeting the DNS names of the respective ALBs, and enable Evaluate Target Health on each record.
The correct configuration uses Alias A records configured with the Multivalue Answer routing policy. Alias A records are natively integrated with Application Load Balancers (ALBs) and allow Route 53 to check their health using the 'Evaluate Target Health' setting. The Multivalue Answer routing policy returns multiple healthy records (up to eight) in response to a single DNS query, distributing traffic across all three healthy ALBs and removing any ALB that fails its health checks.

Step-by-Step Solution

1
Determine the appropriate record type to interface with Application Load Balancers.
Alias A records are selected instead of CNAME records.
Alias A records allow Route 53 to map the domain name directly to the load balancer's IP addresses and enable native health evaluation.
2
Select the routing policy that supports returning multiple healthy endpoints.
Multivalue Answer routing is selected.
Multivalue Answer routing allows Route 53 to return up to eight healthy IP addresses in response to a DNS query, providing DNS-based load balancing.
3
Configure health checking for the endpoints.
Set Evaluate Target Health to Yes on all three Alias A records.
This configuration allows Route 53 to query the target group health checks of the ALBs and automatically filter out unhealthy endpoints from the DNS responses.

Key Concept

Multivalue Answer routing combined with Alias A records and 'Evaluate Target Health' allows Route 53 to act as a basic load balancer by returning multiple IP addresses and automatically filtering out unhealthy resources.

Alternative Method

As an alternative, a Weighted routing policy could be configured with equal weights on each Alias A record. However, Weighted routing only returns a single record per DNS query, whereas Multivalue Answer routing returns multiple records, allowing client applications to retry alternative IP addresses if one becomes unreachable.
Estimated Time:1m 30s
Question 975Question →

A SysOps Administrator is configuring a new VPC environment where Amazon EC2 instances in a private subnet must regularly upload large datasets to an Amazon S3 bucket. To avoid NAT Gateway data processing charges, the administrator deploys a VPC gateway endpoint for Amazon S3. However, monitoring reveals that S3 traffic from the private subnet is still traversing the NAT Gateway, resulting in high data transfer costs. Which configuration change should the administrator make to resolve this issue?

Show answer & explanation

Answer: Associate the S3 gateway endpoint with the route table used by the private subnet.

Answer

Associate the S3 gateway endpoint with the route table used by the private subnet.
Associating the S3 gateway endpoint with the private subnet's route table is the correct solution. Gateway endpoints work by automatically adding a prefix list route pointing to the endpoint (e.g., `pl-xxxxxx` -> `vpce-xxxxxx`) in the selected route tables. If the private subnet's route table is not associated with the endpoint, traffic to Amazon S3 falls back to the next best route, which is the default route (0.0.0.0/00.0.0.0/0) pointing to the NAT Gateway.

Step-by-Step Solution

1
Analyze the traffic flow path for the private subnet instances.
Currently, traffic destined for S3 matches the default route (0.0.0.0/00.0.0.0/0) pointing to the NAT Gateway because there is no specific route for S3.
Before a gateway endpoint can intercept traffic, a route directing traffic to the endpoint must exist in the subnet's route table.
2
Associate the S3 gateway endpoint with the route table of the private subnet.
AWS automatically adds a route with the destination set to the S3 prefix list (e.g., `pl-63a5400a`) and the target set to the gateway endpoint ID (e.g., `vpce-xxxxxxxx`).
This association ensures that any traffic destined for S3 matches the prefix list route and bypasses the NAT Gateway route entirely.

Key Concept

VPC Gateway Endpoints require route table associations to dynamically inject prefix list routes, which direct traffic directly to the AWS service instead of using default routes like a NAT Gateway.
Estimated Time:1m 30s
Question 976Question →

A SysOps Administrator launches an Amazon EC2 instance in a newly created subnet within a VPC. The instance is assigned a public IPv4 address, and the associated security group is configured to allow inbound SSH traffic on port 22 from the administrator's public IP address. The default network ACL (NACL) is associated with the subnet. However, the administrator is unable to establish an SSH connection to the instance, resulting in a connection timeout. Which of the following is the most likely cause of this routing and connectivity issue?

Show answer & explanation

Answer: The route table associated with the subnet does not contain a route pointing to the Internet Gateway.

Answer

The route table associated with the subnet does not contain a route pointing to the Internet Gateway.
For an EC2 instance to receive traffic from the internet, it must be in a public subnet. A public subnet is defined by having a route table containing a default route pointing to an Internet Gateway. In this scenario, although the instance has a public IP address and the security group allows inbound SSH traffic, the lack of a route targeting the Internet Gateway prevents internet-bound traffic from being routed correctly, resulting in a connection timeout.

Step-by-Step Solution

1
Check the status of the EC2 instance to ensure it is running and has passed its status checks.
The instance is running and has a public IPv4 address assigned.
Before troubleshooting routing, confirm that the instance is operational.
2
Verify the route table associated with the instance's subnet.
The route table contains only a local route for the VPC CIDR block.
Without a route directing external traffic (0.0.0.0/0) to an Internet Gateway, the subnet is private and cannot communicate with the internet, leading to connection timeouts.
3
Update the route table to add a route for 0.0.0.0/0 targeting the Internet Gateway attached to the VPC.
SSH connection succeeds.
This establishes internet routing for the public subnet, allowing the workstation to connect to the instance.

Key Concept

Subnets require a route targeting an Internet Gateway in their associated route tables to allow internet communication.
PreviousPage 49 / 49
All practice questions — AWS Certified SysOps Administrator - Associate | Examkin