All practice questions

502 questions

All types976 Multiple choice502 Multiple select450 Ordering24

A SysOps Administrator initiates an update on an AWS CloudFormation stack. During the update, a resource creation fails. CloudFormation attempts to roll back the stack to its previous stable state, but the rollback process fails, leaving the stack in the UPDATE_ROLLBACK_FAILED state. Which of the following is a common cause for this rollback failure?

A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.

The rollback was initiated automatically, but CloudFormation requires a manual rollback trigger to proceed from a failed update.

The update was performed using an in-place deployment strategy instead of a blue/green deployment strategy.

The user initiating the update lacks the iam:PassRole permission required to execute the rollback operation.

Show answer & explanation

Answer: A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.

Answer

A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.

The correct answer is that a resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted. When resources are modified or deleted out-of-band, the stack suffers from drift. During a rollback, CloudFormation attempts to return the resources to their previous configuration. If a resource no longer exists or is in an unexpected state, the rollback operation will fail, placing the stack in the UPDATE_ROLLBACK_FAILED state.

Step-by-Step Solution

Analyze the stack status transitions.

The stack went from UPDATE_IN_PROGRESS to UPDATE_ROLLBACK_IN_PROGRESS and finally to UPDATE_ROLLBACK_FAILED.

Understanding the status flow helps pinpoint where the failure occurred.

Determine why CloudFormation would fail to revert a resource during a rollback.

If the resource state has drifted or if the resource was deleted manually outside of CloudFormation, CloudFormation's internal engine cannot reconcile the expected state.

Identifying the root cause of rollback failures is key to resolving stack update errors.

Key Concept

AWS CloudFormation Rollback Failures and Drift Management

Question 2Question →

A SysOps administrator is configuring an Amazon EC2 Auto Scaling group (ASG) to launch instances using a new launch template. The launch template specifies an IAM instance profile with an associated IAM role for the instances. When the ASG attempts to launch instances to meet the desired capacity, all launch attempts fail with the status message: "You are not authorized to perform this operation." The administrator verified that the administrator's IAM identity has the necessary permissions to create the ASG and the launch template. Which configuration change will resolve the launch failures?

Modify the trust policy of the instance profile's IAM role to allow the Auto Scaling service principal (autoscaling.amazonaws.com) to perform the sts:AssumeRole action.

Create a custom service-linked role for the Auto Scaling group and attach a policy that grants the sts:AssumeRole permission to the Auto Scaling group.

Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.

Enable detailed monitoring in the launch template to authorize the Auto Scaling group to send launch status metrics to Amazon CloudWatch.

Show answer & explanation

Answer: Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.

Answer

Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.

The correct answer is to attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role. AWS requires that any identity configuring an AWS service to act on its behalf must have permission to pass the associated role. Without this permission, the EC2 service cannot associate the IAM role with the newly launched instances, resulting in an authorization error.

Step-by-Step Solution

Analyze the error message 'You are not authorized to perform this operation' in the ASG activity history.

Determine that the failure is caused by an IAM authorization issue when attempting to launch instances with an associated IAM role.

The launch template includes an IAM instance profile, meaning the launching entity must have permission to pass this role to EC2.

Identify the required IAM action for passing roles to AWS services.

The iam:PassRole action is identified as the required permission on the calling identity's policy.

AWS enforces iam:PassRole to prevent users from escalating their privileges by passing roles with greater permissions than they have.

Add the iam:PassRole permission targeting the specific IAM role ARN to the administrator's IAM policy.

The ASG successfully passes the IAM role to EC2, allowing instances to launch without authorization errors.

This completes the required permission chain for the ASG to launch instances with the specified IAM role.

Key Concept

IAM PassRole requirement for EC2 Auto Scaling launches

Question 3Question →

A SysOps Administrator is using AWS CodeDeploy to deploy an update to an application running on a fleet of Amazon EC2 instances. The deployment must guarantee that at least $75\%$ of the instances are healthy and serving traffic at any given time during the deployment. If any instance fails the update, the deployment must automatically revert to the previous working version.

Which configuration will meet these requirements?

Create a custom deployment configuration with the minimum healthy hosts set to

75\%

using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Use the CodeDeployDefault.HalfAtATime predefined deployment configuration, and configure an Amazon CloudWatch alarm to trigger a rollback if any instance goes offline.

Create a custom deployment configuration with the minimum healthy hosts set to

25\%

using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Deploy the application using an AWS CloudFormation stack update, and rely on the CloudFormation rollback execution role to automatically revert the CodeDeploy deployment if a failure is detected.

Show answer & explanation

Answer: Create a custom deployment configuration with the minimum healthy hosts set to $75\%$ using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Answer

Create a custom deployment configuration with the minimum healthy hosts set to

75\%

using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Creating a custom deployment configuration with the minimum healthy hosts set to

75\%

ensures that CodeDeploy updates at most

25\%

of the instances at a time, keeping at least

75\%

of the fleet healthy. Enabling the automatic rollback option on deployment failure in the deployment group ensures that CodeDeploy automatically reverts to the last known good version if any instance fails to deploy successfully.

Step-by-Step Solution

Determine the required minimum healthy host threshold and create a custom CodeDeploy deployment configuration.

A custom configuration is created specifying minimum healthy hosts as

75\%

(percentage type).

Predefined configurations like HalfAtATime (

50\%

) or AllAtOnce (

0\%

) do not guarantee that at least

75\%

of the fleet remains online.

Configure the rollback behavior on the CodeDeploy deployment group.

The deployment group is updated to automatically roll back when a deployment failure occurs.

This fulfills the requirement to automatically revert to the previous working version upon failure without manual intervention.

Execute the deployment specifying the newly created custom deployment configuration.

The deployment runs, updating at most

25\%

of the instances at any time, and automatically rolls back if a failure is encountered.

This maintains the required application capacity and safety during the update process.

Key Concept

AWS CodeDeploy Deployment Configurations and Automatic Rollback Settings

Question 4Question →

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. The company wants to set up an active-passive failover configuration at the zone apex (example.com). If the ALB or the backend instances become unhealthy, Route 53 must automatically redirect traffic to a static maintenance website hosted in an Amazon S3 bucket in the us-west-2 Region. Which configuration will meet these requirements with the fastest failover response and the least configuration overhead?

Create an Alias record at the zone apex using a Failover routing policy. Set the primary record to point to the ALB with Evaluate Target Health set to Yes. Set the secondary record to point to the S3 bucket website endpoint.

Create a CNAME record at the zone apex using a Failover routing policy. Set the primary record to point to the ALB DNS name and associate a Route 53 health check. Set the secondary record to point to the S3 bucket website endpoint.

Create a Weighted routing policy at the zone apex. Set the primary record to point to the ALB with a weight of 100 and associate a Route 53 health check. Set the secondary record to point to the S3 bucket website endpoint with a weight of 0.

Create an Alias record at the zone apex using a Failover routing policy. Set the primary record to point to the ALB. Create a Route 53 health check that monitors a CloudWatch alarm based on standard 5-minute ALB metrics, and associate it with the primary record. Set the secondary record to point to the S3 bucket website endpoint.

Show answer & explanation

Answer: Create an Alias record at the zone apex using a Failover routing policy. Set the primary record to point to the ALB with Evaluate Target Health set to Yes. Set the secondary record to point to the S3 bucket website endpoint.

Answer

Create an Alias record at the zone apex using a Failover routing policy, pointing the primary record to the Application Load Balancer with Evaluate Target Health enabled, and pointing the secondary record to the Amazon S3 bucket website endpoint.

The correct option is the configuration that creates an Alias record at the zone apex using a Failover routing policy, points the primary record to the Application Load Balancer (ALB) with 'Evaluate Target Health' enabled, and points the secondary record to the Amazon S3 bucket website endpoint. This setup is standard, complies with zone apex limitations by using an Alias record instead of a CNAME, and provides rapid failover by having Route 53 directly evaluate the ALB target health without needing a separate health check or a delayed CloudWatch alarm.

Step-by-Step Solution

Select the zone apex record (example.com) and set the routing policy to Failover.

Allows creation of primary and secondary records for active-passive failover.

Failover routing is the standard policy for active-passive disaster recovery setups.

Configure the primary record as an Alias record pointing to the Application Load Balancer, and set 'Evaluate Target Health' to Yes.

Route 53 will automatically check the health of the ALB and its targets without requiring a manual Route 53 health check setup.

Alias records to ALBs can leverage 'Evaluate Target Health' to quickly detect ALB target group health changes.

Configure the secondary record as an Alias record pointing to the S3 bucket website endpoint.

Traffic will failover to the S3 static website when the ALB is determined to be unhealthy.

Provides a cost-effective and highly available passive backup endpoint.

Key Concept

Route 53 active-passive DNS failover using Alias records and target health evaluation.

Question 5Question →

An organization wants to establish an automated response system when an Amazon EC2 instance's CPU utilization exceeds $95\%$ for more than 15 minutes, which indicates a runaway process. A SysOps administrator configures an Amazon EventBridge rule triggered by the corresponding Amazon CloudWatch alarm state change to `ALARM`. The remediation strategy is to trigger a custom AWS Systems Manager Automation runbook named `ResolveRunawayProcess` that will restart the problematic service on the instance. The runbook requires a service role (`SSMAutomationServiceRole`) to execute its steps. Which configuration and permission setup will successfully execute the remediation with the least privilege?

Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission for the document and the iam:PassRole permission for the SSMAutomationServiceRole resource.

Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission, and configure the trust relationship of the SSMAutomationServiceRole to trust the EventBridge service principal (events.amazonaws.com).

Set the EventBridge rule target to Systems Manager Run Command and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:SendCommand permission and the iam:PassRole permission for the instance profile role.

Set the EventBridge rule target to AWS Config, and configure an AWS Config remediation action to execute the ResolveRunawayProcess document. Assign an IAM role to AWS Config containing the ssm:StartAutomationExecution permission.

Show answer & explanation

Answer: Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission for the document and the iam:PassRole permission for the SSMAutomationServiceRole resource.

Answer

The correct configuration establishes a path where EventBridge acts as the caller. It invokes the Systems Manager Automation target (`ResolveRunawayProcess` document) and passes the execution role (`SSMAutomationServiceRole`) to Systems Manager using `iam:PassRole` permissions. Without `iam:PassRole`, Systems Manager cannot execute the Automation runbook steps under the specified service role context.

Step-by-Step Solution

Identify the target orchestration service for the remediation.

The target must be Systems Manager Automation since the action requires executing a custom SSM Automation runbook.

Systems Manager Automation is the correct service for executing workflows/runbooks, unlike Run Command which executes scripts directly on managed instances.

Determine the necessary IAM permissions for EventBridge to invoke Systems Manager Automation.

The EventBridge execution role needs the ssm:StartAutomationExecution permission for the ResolveRunawayProcess document.

EventBridge must have explicit permission to trigger the execution of the target SSM document.

Configure the role-passing capability for the target execution.

Grant the EventBridge execution role iam:PassRole permission targeting the SSMAutomationServiceRole.

Since the Automation workflow executes steps using the SSMAutomationServiceRole, the calling service (EventBridge) must have permission to pass this execution role to Systems Manager.

Key Concept

EventBridge and Systems Manager Automation Remediation IAM Permissions

Question 6Question →

A SysOps administrator is configuring automated remediation to isolate Amazon EC2 instances when Amazon GuardDuty detects command-and-control (C&C) activity. The administrator wants to use Amazon EventBridge to detect the GuardDuty finding and trigger the AWS Systems Manager Automation document AWS-StopEC2Instance to stop the affected instance. Which combination of target configuration and IAM permissions will successfully implement this automated remediation?

Configure the EventBridge rule to forward the GuardDuty findings to AWS Config. Configure an AWS Config custom rule to trigger the Systems Manager Automation document as a remediation action, and attach an IAM policy to AWS Config allowing the config.amazonaws.com service principal to perform the ssm:StartAutomationExecution action.

Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document, relying on the Automation document's default execution permissions without iam:PassRole.

Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.

Configure the EventBridge rule with the Systems Manager Automation document as the target. Modify the IAM trust policy of the Systems Manager Automation execution role to trust events.amazonaws.com directly, and use an EventBridge input transformer to map the EC2 instance ID to the execution role ARN in the target payload.

Show answer & explanation

Answer: Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.

Answer

Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.

The correct option correctly configures the EventBridge rule target to the Systems Manager Automation document, and grants EventBridge the necessary IAM permissions. Specifically, it allows EventBridge to assume a role to call ssm:StartAutomationExecution on the target document and includes the iam:PassRole permission so that EventBridge can pass the Systems Manager Automation execution role to the Systems Manager service, which executes the actions.

Step-by-Step Solution

Configure the Amazon EventBridge rule pattern to match Amazon GuardDuty findings representing command-and-control activity.

GuardDuty finding events will match the rule pattern and trigger the designated targets.

This establishes the detection trigger in the event flow.

Set the EventBridge rule target to the AWS Systems Manager Automation document AWS-StopEC2Instance, specifying the EC2 instance ID from the event as a parameter.

The target document is selected and mapped to the affected resource.

This establishes the remediation action in the event flow.

Create an IAM role for EventBridge with a trust policy allowing events.amazonaws.com and a permissions policy allowing ssm:StartAutomationExecution and iam:PassRole for the execution role.

EventBridge receives permissions to execute the automation and pass the necessary service role to Systems Manager.

EventBridge requires these permissions to initiate the automation run under the context of the automation execution role.

Key Concept

Configuring event-driven automated remediation using Amazon EventBridge and AWS Systems Manager Automation requires setting up an IAM service role for EventBridge with both the ssm:StartAutomationExecution permission and the iam:PassRole permission to securely pass the execution role to Systems Manager.

Estimated Time:3m 0s

Question 7Question →

A company is designing a backup, restore, and high availability strategy for a critical transactional database running on Amazon RDS. The SysOps Administrator must satisfy the following requirements:
1. Automated daily backups must be replicated to a destination bucket in a secondary AWS Region.
2. In the event of an Availability Zone outage, the database must automatically failover to a standby instance in another Availability Zone within 2 minutes without requiring changes to application connection strings.
3. The replicated backups must be encrypted with a Customer Managed Key (CMK) in the destination Region, and access to decrypt these backups must be managed using IAM policies.

Which configuration must the SysOps Administrator implement to satisfy these requirements?

Configure the primary database to use Multi-AZ deployment. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, use IAM policies to grant decrypt permissions on the destination KMS key to authorized users, without modifying the destination KMS key's policy to permit IAM-based access control.

Configure the primary database to use Multi-AZ deployment. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.

Configure the primary database to use Multi-AZ deployment. Configure S3 Cross-Region Replication (CRR) to copy the backups from the source bucket to the destination bucket without enabling S3 versioning on either bucket. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.

Deploy a database Read Replica in a different Availability Zone to handle automatic failover. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.

Show answer & explanation

Answer: Configure the primary database to use Multi-AZ deployment. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.

Answer

Configure the primary database to use Multi-AZ deployment, enable S3 versioning on both the source and destination buckets for CRR, and modify the destination KMS key policy to allow the root principal to delegate key permissions via IAM.

The correct configuration combines Multi-AZ deployment to achieve automated, synchronous failover within 2 minutes without altering connection strings, enables S3 versioning on both buckets to allow S3 Cross-Region Replication (CRR) of the database backups, and configures the destination KMS key policy to permit the root principal to delegate key operations, enabling IAM policies to successfully control decryption access.

Step-by-Step Solution

Select Multi-AZ deployment for Amazon RDS

Synchronous database replication is established across Availability Zones, enabling automatic DNS failover in under 2 minutes without endpoint changes.

Meets the high availability RTO requirement without requiring application configuration changes.

Enable S3 versioning on the source and destination buckets and configure S3 CRR

Automated backups uploaded to the source S3 bucket are successfully replicated to the secondary Region destination S3 bucket.

S3 Cross-Region Replication has a hard prerequisite that versioning must be enabled on both source and destination buckets.

Modify the Customer Managed Key (CMK) policy in the destination Region to enable IAM policy delegation

The KMS key policy includes the default statement allowing the root principal (`arn:aws:iam::ACCOUNT_ID:root`) to perform key actions, which delegates policy control to IAM.

Without this statement in the KMS key policy, IAM policies cannot grant permissions to access or decrypt using the KMS key due to KMS policy evaluation precedence.

Key Concept

Integrating high availability, backup replication prerequisites, and KMS key policy delegation

Question 8Question →

A SysOps administrator needs to configure active-passive DNS failover for a public-facing API. The primary endpoint is hosted in an on-premises datacenter, and the secondary disaster recovery endpoint is hosted on an Amazon EC2 instance in AWS. If the on-premises endpoint becomes unreachable, Route 53 must automatically redirect traffic to the EC2 instance. How should the administrator configure Amazon Route 53 to meet these requirements?

Configure a Route 53 health check for the on-premises endpoint. Create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check. Create a secondary record with a Failover routing policy pointing to the EC2 instance IP address.

Create weighted routing records for both endpoints, setting the weight of the primary record to 100 and the secondary record to 0, and associate a Route 53 health check with both records.

Configure a CloudWatch alarm using standard monitoring metrics to check on-premises health, and use a Simple routing record that automatically redirects traffic to the secondary IP when the alarm triggers.

Create a primary record with a Failover routing policy pointing to the on-premises IP, and configure the secondary record to point directly to an Amazon RDS Read Replica endpoint to handle application traffic during a failover.

Show answer & explanation

Answer: Configure a Route 53 health check for the on-premises endpoint. Create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check. Create a secondary record with a Failover routing policy pointing to the EC2 instance IP address.

Answer

The correct configuration is to configure a Route 53 health check for the on-premises endpoint, then create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check, and finally create a secondary record with a Failover routing policy pointing to the EC2 instance IP address. This properly defines an active-passive failover configuration where DNS queries resolve to the primary endpoint until the associated health check fails, at which point Route 53 begins responding with the secondary endpoint IP address.

Step-by-Step Solution

Create a Route 53 health check that monitors the IP address or domain name of the primary on-premises API endpoint.

Amazon Route 53 will begin actively probing the on-premises endpoint to determine its health status.

Route 53 requires a health check to monitor the primary record's health state before it can execute an automated failover.

Create the primary DNS record in the hosted zone using the Failover routing policy, point it to the on-premises IP, and associate it with the created health check.

A primary failover record is established with an active monitor.

This establishes the default path for client traffic under normal operating conditions.

Create the secondary DNS record with the same record name, select the Failover routing policy, configure it as the secondary record, and point it to the EC2 instance's public IP address.

A secondary failover record is created.

This provides a backup destination for DNS queries when Route 53 detects that the primary endpoint is unhealthy.

Key Concept

Route 53 active-passive DNS failover requires a primary record with a health check and a secondary record, both configured with the Failover routing policy.

Question 9Question →

A SysOps administrator uses AWS CloudFormation to manage a production stack that includes an Amazon EC2 Auto Scaling group (ASG) behind an Application Load Balancer. The administrator attempts to update the application by modifying the CloudFormation template to use a new launch template. The new launch template specifies a new IAM instance profile with a new IAM role. The CloudFormation stack update is initiated using a dedicated IAM execution role.

During the deployment, the update fails on the ASG resource, causing CloudFormation to transition the stack to the UPDATE_ROLLBACK_IN_PROGRESS state. Shortly after, the stack status changes to UPDATE_ROLLBACK_FAILED. The CloudFormation event log shows an access denied error stating that CloudFormation is not authorized to associate the old IAM instance profile's role with the ASG's launch template.

How should the administrator resolve this issue to allow the rollback to complete successfully?

Modify the trust policy of the original IAM role to allow the autoscaling.amazonaws.com service principal to assume the role, and then initiate an UpdateStack API call with the previous template version.

Manually delete the resources that failed to roll back, update the administrator's IAM user policy to include sts:AssumeRole for the Auto Scaling service role, and then recreate the stack from the previous template.

Update the IAM policy attached to the CloudFormation execution role to include the iam:PassRole permission for the original IAM role used in the previous launch template, and then execute the ContinueUpdateRollback action on the stack.

Temporarily detach the Application Load Balancer from the Auto Scaling group to halt traffic, perform a manual in-place deployment of the previous application version to the instances, and then delete the failed CloudFormation stack.

Show answer & explanation

Answer: Update the IAM policy attached to the CloudFormation execution role to include the iam:PassRole permission for the original IAM role used in the previous launch template, and then execute the ContinueUpdateRollback action on the stack.

Answer

The correct solution is to update the CloudFormation execution role's IAM policy to grant the iam:PassRole permission for the original role, and then run ContinueUpdateRollback. This is because CloudFormation needs explicit permission to pass the original role to the Auto Scaling group when rolling back the launch template. When a stack is in the UPDATE_ROLLBACK_FAILED state, the ContinueUpdateRollback action is the standard AWS mechanism to resume the rollback process after the block is resolved.

Step-by-Step Solution

Analyze the CloudFormation event log error details.

Identify that the failure is due to an Access Denied error when CloudFormation attempts to associate the previous launch template's IAM role with the Auto Scaling Group.

To determine the exact permission or resource constraint causing the rollback failure.

Identify the missing IAM permission required for the rollback.

Determine that the CloudFormation execution role requires the iam:PassRole permission for the original IAM role, because CloudFormation is passing that role back to the Auto Scaling Group.

When reverting a resource that uses an IAM role to its previous state, the execution entity must be authorized to pass the original role, not just the newly proposed role.

Update the IAM policy of the CloudFormation execution role.

Add the iam:PassRole permission for the Amazon Resource Name (ARN) of the original IAM role.

To authorize CloudFormation to perform the role assignment required for the rollback.

Execute the ContinueUpdateRollback command on the CloudFormation stack.

CloudFormation resumes the rollback process, successfully configures the ASG back to the previous launch template, and transitions the stack to UPDATE_ROLLBACK_COMPLETE.

A stack in the UPDATE_ROLLBACK_FAILED state must be explicitly instructed to resume rolling back using the ContinueUpdateRollback operation once the blocking issue is resolved.

Key Concept

Troubleshooting CloudFormation stack updates and rollbacks involving IAM PassRole permissions

Question 10Question →

A SysOps Administrator is managing cross-Region disaster recovery using AWS Elastic Disaster Recovery (AWS DRS) to protect a critical business application. The application's EC2 instances in us-east-1 are replicated to a staging area in us-west-2. The instances are configured with an IAM instance profile associated with a role named ApplicationStorageAccessRole that permits access to Amazon S3. During a disaster recovery drill in us-west-2, the administrator attempts to launch recovery instances, but the launch fails. The EC2 launch history shows an authorization error indicating that the administrator is not authorized to perform the action on the resource. Which action must the administrator take to successfully launch the recovery instances during the drill?

Update the trust policy of ApplicationStorageAccessRole to allow the AWS Elastic Disaster Recovery service (drs.amazonaws.com) to assume the role.

Add the iam:PassRole permission for the ApplicationStorageAccessRole to the IAM identity of the administrator initiating the drill.

Configure an Amazon Route 53 active-active failover routing policy to automatically route application traffic to the staging subnet in us-west-2 during the drill.

Modify the administrator's IAM policy to grant kms:Decrypt permissions on the AWS DRS replication key, ignoring the key policy restrictions in the destination Region.

Show answer & explanation

Answer: Add the iam:PassRole permission for the ApplicationStorageAccessRole to the IAM identity of the administrator initiating the drill.

Answer

Add the iam:PassRole permission for the ApplicationStorageAccessRole to the IAM identity of the administrator initiating the drill.

To launch recovery instances with an IAM instance profile, the IAM identity initiating the drill or failover (the SysOps Administrator) must have the iam:PassRole permission for the IAM role associated with the instance profile. This allows the administrator to pass the role to the EC2 service when the instances are created in the target Region.

Step-by-Step Solution

Identify the IAM role specified in the EC2 Launch Template of the source instances, which is ApplicationStorageAccessRole.

Confirming the target role that must be associated with the recovery instances.

AWS Elastic Disaster Recovery uses EC2 Launch Templates to launch target recovery instances with their original configurations, including IAM roles.

Evaluate the IAM permissions of the administrator initiating the disaster recovery drill.

Recognize that the administrator lacks the iam:PassRole permission for the ApplicationStorageAccessRole.

To prevent privilege escalation, AWS requires users who launch EC2 instances with an IAM role to possess the iam:PassRole permission for that specific role.

Add an IAM policy granting the iam:PassRole permission for the ApplicationStorageAccessRole to the administrator's IAM user or role.

The administrator is now authorized to initiate the drill launch with the instance profile.

This permission allows the administrator to pass the role to the EC2 service, enabling the launch of the recovery instances with the required role.

Key Concept

AWS Elastic Disaster Recovery (AWS DRS) utilizes EC2 Launch Templates to deploy target recovery instances. When these instances require an IAM role via an instance profile, the user initiating the recovery or drill must have the iam:PassRole permission for that role to successfully complete the launch.

Question 11Question →

A SysOps Administrator is configuring an AWS Lambda function in AWS Account $555555555555$ to decrypt sensitive application configuration files. The configuration files are encrypted using a customer managed KMS key. The Administrator has attached an IAM policy to the Lambda function's execution role that grants permission for the `kms:Decrypt` action on the KMS key. However, when executing, the Lambda function fails with an AccessDeniedException during the decryption step.

Upon inspecting the KMS key policy, the Administrator finds only the following statement:

{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::555555555555:role/SysOpsAdminRole"
},
"Action": "kms:*",
"Resource": "*"
}

Which modification to the KMS key policy will resolve this issue by allowing the Lambda function's IAM policy to take effect?

Modify the KMS key policy to trust the KMS service principal (`kms.amazonaws.com`) under the Principal element.

Update the Principal in the key policy's existing statement to specify `*` and add a Condition block that restricts access to the Lambda execution role.

Add a statement to the KMS key policy that grants the root user of account

555555555555

(`arn:aws:iam::555555555555:root`) permissions for all KMS actions (`kms:*`).

Add a statement to the KMS key policy that explicitly denies the execution role any administrative actions, forcing evaluation to default to the IAM policy.

Show answer & explanation

Answer: Add a statement to the KMS key policy that grants the root user of account $555555555555$ (`arn:aws:iam::555555555555:root`) permissions for all KMS actions (`kms:*`).

Answer

Add a statement to the KMS key policy that grants the root user of the account (`arn:aws:iam::555555555555:root`) permissions for all KMS actions (`kms:*`).

In AWS KMS, for IAM policies to grant access to a customer managed key, the key policy must contain a statement that delegates authority to the AWS account. This is typically done by granting the root user principal (`arn:aws:iam::account-id:root`) permission to perform actions on the key. Once this statement is present, AWS evaluates both the key policy and the IAM policies. Since the Lambda execution role already has an IAM policy allowing `kms:Decrypt`, adding the account root principal statement to the key policy resolves the AccessDeniedException.

Step-by-Step Solution

Analyze the existing configurations of the Lambda execution role and the KMS key policy.

The Lambda role contains a policy granting `kms:Decrypt`. However, the KMS key policy only lists a specific administrator role (`SysOpsAdminRole`) and does not grant the account root principal permission to manage permissions via IAM.

By default, KMS key policies must explicitly delegate permission authority to the AWS account for any IAM policies within that account to have effect on the key.

Identify the standard delegation statement required in KMS key policies.

The statement must target the AWS account root principal (`arn:aws:iam::555555555555:root`) and grant `kms:*` permissions.

This configuration establishes the link between the key policy and IAM policies, allowing AWS to evaluate IAM policies for roles or users attempting to access the key.

Select the option that implements this configuration.

Adding a statement to the key policy that permits the account root user enables evaluation of the Lambda function's execution role policy, resolving the AccessDeniedException.

Once the root user is added to the key policy, the Lambda execution role's policy is successfully evaluated, granting the necessary decryption permissions.

Key Concept

AWS KMS Key Policy Delegation to IAM

Question 12Question →

An organization has a fleet of Ubuntu Amazon EC2 instances. A SysOps Administrator creates a custom patch baseline in AWS Systems Manager Patch Manager to control which security updates are installed. The administrator registers a patch group named 'ubuntu-prod' with this custom baseline. During a scheduled maintenance window, the administrator observes that the instances are being patched, but they are receiving updates from the default AWS-provided patch baseline rather than the custom baseline.

Which of the following is the most likely cause of this behavior?

The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.

The custom patch baseline has not been set as the default patch baseline for the Ubuntu operating system in Systems Manager Patch Manager.

The IAM role used by the Maintenance Window to run the patch task is missing the 'iam:PassRole' permission.

The EC2 instances do not have the 'AmazonSSMManagedInstanceCore' policy attached to their IAM instance profile.

Show answer & explanation

Answer: The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.

Answer

The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.

For AWS Systems Manager Patch Manager to associate an instance with a patch group, the instance must have a tag with the exact case-sensitive key 'Patch Group' (with a space). If the tag key is 'PatchGroup' (without a space), Systems Manager fails to map the instance to the 'ubuntu-prod' patch group, causing Patch Manager to apply the default AWS-provided patch baseline instead.

Step-by-Step Solution

Analyze the observed behavior where instances are successfully patched but are using the default baseline instead of the custom baseline.

This indicates that the Systems Manager agent is functioning and the maintenance window is executing, but the instances are not being associated with the registered patch group 'ubuntu-prod'.

When an instance is not successfully matched to a patch group, Systems Manager Patch Manager falls back to the default baseline for that operating system.

Verify the requirements for defining and matching patch groups on EC2 instances.

AWS Systems Manager requires managed nodes to be tagged with the exact case-sensitive key 'Patch Group' (with a space) and the value matching the registered patch group name.

Any deviation in the tag key, such as using 'PatchGroup' or 'patch_group', will cause the baseline mapping to fail.

Key Concept

AWS Systems Manager Patch Group Tagging Requirements

Question 13Question →

An organization's Amazon EC2 instances located in a private subnet are experiencing connection timeouts when trying to access Amazon S3. A Gateway VPC Endpoint for Amazon S3 has been deployed and linked to the private subnet's route table. The instances use a security group that permits all egress traffic. The subnet's custom Network ACL has an egress rule allowing port $443$ traffic to the S3 prefix list, but all custom ingress rules have been removed, leaving only the default deny rule. What configuration change is necessary to restore access to Amazon S3?

Update the route table of the private subnet to direct traffic destined for

0.0.0.0/0

to an Internet Gateway.

Dissociate the Gateway VPC Endpoint from the private subnet's route table and associate it with the public subnet's route table.

Configure an inbound rule in the custom Network ACL to allow traffic from the Amazon S3 prefix list on ephemeral ports

1024

65535

Route the S3 traffic through a NAT Gateway located in a different Availability Zone to bypass local subnet routing restrictions.

Show answer & explanation

Answer: Configure an inbound rule in the custom Network ACL to allow traffic from the Amazon S3 prefix list on ephemeral ports $1024$ - $65535$ .

Answer

Configure an inbound rule in the custom Network ACL to allow traffic from the Amazon S3 prefix list on ephemeral ports

1024

65535

Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly permitted. While the security group automatically tracks states, the custom Network ACL requires a return rule. S3 response traffic uses ephemeral ports

1024

65535

, so adding an inbound rule in the Network ACL for this range resolves the connection timeout.

Step-by-Step Solution

Analyze the network route configuration for S3 traffic.

The route table is already associated with the S3 Gateway VPC Endpoint, indicating that the routing layer is correctly configured to redirect S3 traffic through the gateway endpoint.

Before troubleshooting security controls, verifying that a route to the target destination exists ensures routing is correct.

Examine the stateful and stateless security configurations.

The security group is stateful and permits outbound traffic, which automatically allows return traffic. The custom Network ACL is stateless and only contains an outbound rule for port

443

, meaning inbound response traffic is blocked by the default deny rule.

Since Network ACLs are stateless, they evaluate inbound and outbound traffic independently. Ephemeral ports must be opened for return traffic.

Identify the appropriate source and port range for the inbound rule.

Configure the inbound rule with the source as the S3 prefix list and the port range as ephemeral ports

1024

65535

S3 initiates connections back to the client using ephemeral ports, so the stateless return path must permit this range.

Key Concept

Stateless nature of Network Access Control Lists (NACLs) and ephemeral port requirements for return traffic

Estimated Time:2m 30s

Question 14Question →

A SysOps Administrator is reviewing optimization opportunities for a memory-bound Lambda function that processes incoming file uploads. The administrator wants to use AWS Compute Optimizer to determine the most cost-effective memory configuration for the function without sacrificing performance. Currently, the Compute Optimizer console shows no recommendations for this Lambda function. Which of the following requirements must be met before AWS Compute Optimizer can generate memory size recommendations for the Lambda function?

The Lambda function must have been invoked at least 50 times over the past 14 days.

The Unified CloudWatch Agent must be deployed to the function's execution environment to publish memory utilization metrics.

AWS Cost Explorer must be configured with a cost anomaly detection monitor targeting the Lambda function's resource consumption.

The cost allocation tags applied to the Lambda function must be activated in the Billing Console to enable data ingestion.

Show answer & explanation

Answer: The Lambda function must have been invoked at least 50 times over the past 14 days.

Answer

The Lambda function must have been invoked at least 50 times over the past 14 days.

AWS Compute Optimizer natively analyzes the execution history of Lambda functions from CloudWatch Logs. To generate accurate memory recommendations, the service requires a minimum invocation history of at least 50 invocations over a 14-day lookback period.

Step-by-Step Solution

Identify the target resource and metric source for optimization.

The target is an AWS Lambda function, and Compute Optimizer analyzes its memory allocation natively using CloudWatch Logs metadata (such as memory used vs. memory configured in the REPORT lines).

Understanding where Compute Optimizer gathers metrics helps rule out options requiring additional agents or configuration.

Recall the minimum baseline data requirements for AWS Compute Optimizer.

Compute Optimizer needs a minimum history of 50 invocations over the last 14 days to build a baseline for recommending memory adjustments.

A minimum threshold ensures recommendations are statistically valid and accurate.

Key Concept

AWS Compute Optimizer requirements for AWS Lambda memory optimization

Question 15Question →

A SysOps Administrator is optimizing the performance and cost of a transactional database hosted on an Amazon EC2 instance. The database is currently backed by a $1\text{ TiB}$ Amazon EBS $\text{io2}$ volume configured with $10,000$ Provisioned IOPS. Over the past $14$ days, Amazon CloudWatch metrics indicate that the volume's IOPS utilization consistently peaks at $2,200$ IOPS, and throughput peaks at $150\text{ MiB/s}$ . AWS Compute Optimizer flags this volume as 'Overprovisioned'.

Which action should the administrator take to implement Compute Optimizer's recommendation and optimize costs without impacting application performance?

Modify the EBS volume in-place to change the volume type to gp3, configuring the volume with 3,000 IOPS and 150 MiB/s throughput.

Purchase an EC2 Instance Savings Plan to apply discounted rates to the EBS io2 volume while maintaining the current configuration.

Configure an AWS Budgets cost alert to trigger an automation that dynamically scales the provisioned IOPS of the io2 volume.

Activate cost allocation tags on the EBS volume in the AWS Billing Console to automatically apply the rightsizing configuration.

Show answer & explanation

Answer: Modify the EBS volume in-place to change the volume type to gp3, configuring the volume with 3,000 IOPS and 150 MiB/s throughput.

Answer

Modify the EBS volume in-place to change the volume type to gp3, configuring the volume with 3,000 IOPS and 150 MiB/s throughput.

Modifying the EBS volume in-place to change the volume type to gp3 with 3,000 IOPS and 150 MiB/s throughput is correct because it aligns with Compute Optimizer's recommendation. A gp3 volume offers 3,000 baseline IOPS and 125 MiB/s throughput for free. Increasing the throughput to 150 MiB/s satisfies the database's peak performance demands (2,200 IOPS and 150 MiB/s) while significantly reducing provisioned costs compared to the expensive io2 volume.

Step-by-Step Solution

Analyze the peak workload metrics from the past

14

days, identifying that the database requires a maximum of

2,200

IOPS and

150\text{ MiB/s}

throughput.

The requirements are within the capabilities of a gp3 volume, which offers

3,000

baseline IOPS and customizable throughput.

This establishes the minimum performance target needed to maintain database performance without overprovisioning.

Determine the optimal configuration for a gp3 volume to meet these metrics.

A gp3 volume configured with

3,000

baseline IOPS (included) and

150\text{ MiB/s}

throughput (

25\text{ MiB/s}

provisioned above the baseline

125\text{ MiB/s}

This configuration satisfies both the peak IOPS and peak throughput requirements while avoiding excess provisioned resources.

Perform an in-place EBS volume modification to change the volume type from io2 to gp3 with the determined settings.

The volume type is modified online without performance degradation or downtime.

EBS elastic volumes allow live modification of volume types, size, IOPS, and throughput.

Key Concept

AWS Compute Optimizer helps right-size EBS volumes by analyzing performance metrics and suggesting cost-effective alternatives like gp3 for overprovisioned io1/io2 volumes.

Question 16Question →

A SysOps Administrator is configuring an AWS Config rule to monitor whether Amazon EC2 instances have public IP addresses. The administrator sets up automatic remediation using the AWS-StopEC2Instance Systems Manager (SSM) Automation document. The administrator creates an IAM role named ConfigRemediationRole that has a trust relationship with ssm.amazonaws.com and has the necessary permissions to stop EC2 instances. When the administrator attempts to associate this role with the AWS Config remediation configuration, the AWS Config console displays an error: 'Insufficient permissions to pass the remediation role.' Which action will resolve this issue?

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the ConfigRemediationRole resource.

Update the trust policy of ConfigRemediationRole to allow the AWS Config service (config.amazonaws.com) to assume the role.

Add the iam:PassRole permission to the permissions policy of the ConfigRemediationRole itself, specifying the administrator's IAM identity as the resource.

Configure an Amazon EventBridge rule to monitor AWS Config compliance change events and target the Systems Manager Automation document directly.

Show answer & explanation

Answer: Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the ConfigRemediationRole resource.

Answer

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the ConfigRemediationRole resource.

The correct answer is to grant the administrator the iam:PassRole permission. When configuring AWS services to act on your behalf using an IAM role, your IAM identity (user or role) must be authorized to pass that role. Without this permission, the AWS Config console and API prevent you from completing the configuration to protect against unauthorized privilege escalation.

Step-by-Step Solution

Identify the role delegation flow in AWS Config automated remediation.

AWS Config uses AWS Systems Manager (SSM) Automation to execute remediation. The user configuring this setup must pass an IAM execution role to the SSM service.

Understanding the service interaction helps pinpoint which permissions are required for the configuration step.

Analyze the error message 'Insufficient permissions to pass the remediation role'.

The error explicitly indicates a failure in the iam:PassRole authorization check for the administrator's identity.

When an AWS service or user associates an IAM role with a service, the user's IAM identity must be explicitly authorized to pass that role.

Determine the correct policy configuration to authorize role passage.

Attach a policy with iam:PassRole to the administrator's IAM user or role, targeting the ARN of ConfigRemediationRole.

This grants the administrator the necessary privilege to complete the configuration of the automated remediation.

Key Concept

AWS Config automated remediation and IAM role delegation (iam:PassRole requirements)

Question 17Question →

A SysOps Administrator is managing a web application that uses Amazon Route 53 for DNS resolution. The administrator configures Geolocation routing for `app.example.com` to route users in Europe to an Application Load Balancer (ALB) in `eu-west-1` and users in Asia to an ALB in `ap-southeast-1`. Shortly after deployment, users in North America report that they receive DNS resolution errors when trying to access the application. Which configuration change should the administrator implement to resolve the DNS resolution errors for North American users?

Modify the Application Load Balancer's target group health check settings to send health check requests to port

53

of the target instances.

Create a CNAME record for the apex domain `example.com` that points directly to the DNS name of the default Application Load Balancer.

Create a third geolocation routing record for `app.example.com` with the location set to 'Default' and point it to one of the active ALBs.

Change the routing policy for `app.example.com` to Failover routing, setting the European ALB as the primary endpoint and the Asian ALB as the secondary endpoint without configuring Route 53 health checks.

Show answer & explanation

Answer: Create a third geolocation routing record for `app.example.com` with the location set to 'Default' and point it to one of the active ALBs.

Answer

Create a third geolocation routing record for the subdomain with the location set to 'Default' pointing to one of the active Application Load Balancers.

The correct answer is to create a third geolocation routing record with the location set to 'Default' and point it to an active ALB. In Amazon Route 53, if geolocation routing is configured but a query originates from a region not explicitly mapped in any of the records, Route 53 returns a 'no answer' response (NXDOMAIN). Configuring a default record handles queries from all locations that are not explicitly mapped.

Step-by-Step Solution

Analyze the DNS routing configuration and the failure scenario.

Identify that the current Geolocation routing policy only covers Europe and Asia, leaving other regions (like North America) without a matching route rule.

When Route 53 receives a DNS query from a location that does not match any existing geolocation record, it will return a DNS resolution error if no default fallback is configured.

Determine the appropriate Route 53 configuration to handle unmapped locations.

A geolocation record with the location set to 'Default' must be added to route unmatched queries.

The 'Default' location record matches all queries from locations that are not explicitly covered by another geolocation record in the set.

Map the 'Default' record to an active application endpoint.

Create the record pointing to one of the existing Application Load Balancers to serve traffic for users in North America and other unmapped regions.

This ensures high availability and continuous DNS resolution globally.

Key Concept

Route 53 Geolocation Routing Default Fallback Configuration

Estimated Time:1m 30s

Question 18Question →

A SysOps Administrator is hosting a public website on an Amazon EC2 instance within a VPC. The instance is in a subnet with an associated route table that has a default route ( $0.0.0.0/0$ ) pointing to an Internet Gateway. The Security Group attached to the instance allows inbound TCP port $80$ traffic from all sources ( $0.0.0.0/0$ ) and allows all outbound traffic. The Administrator associates a custom Network Access Control List (NACL) with the subnet. The NACL allows inbound TCP port $80$ traffic from all sources ( $0.0.0.0/0$ ) and outbound TCP port $80$ traffic to all destinations ( $0.0.0.0/0$ ). Users report that they cannot connect to the website. Which of the following is the most likely cause of this issue?

The Security Group associated with the EC2 instance must be updated to allow outbound traffic to ephemeral ports (

1024

65535

) of the clients.

The route table associated with the subnet is missing a route for

0.0.0.0/0

targeting the Internet Gateway.

The custom NACL outbound rules do not allow return traffic to the ephemeral port range (

1024

65535

) of the clients.

The subnet lacks a VPC Gateway Endpoint route configuration to direct return traffic to the clients.

Show answer & explanation

Answer: The custom NACL outbound rules do not allow return traffic to the ephemeral port range ( $1024$ - $65535$ ) of the clients.

Answer

The custom NACL outbound rules do not allow return traffic to the ephemeral port range (

1024

65535

) of the clients.

The correct answer is correct because Network Access Control Lists (NACLs) are stateless. When a client initiates a connection to a web server, the source port on the client is an ephemeral port (typically

1024

65535

). Although the NACL allows inbound traffic on port

80

and outbound traffic on port

80

, the outbound response from the server is sent to the client's ephemeral port. Because the custom NACL does not have an outbound rule allowing traffic to the ephemeral port range, the return traffic is dropped.

Step-by-Step Solution

Identify the statefulness of the firewalls involved.

Security Groups are stateful, meaning return traffic is automatically allowed. Network Access Control Lists (NACLs) are stateless, requiring explicit inbound and outbound rules for traffic flow.

To determine where the return traffic is being blocked in the network path.

Analyze the port requirements for the return traffic.

The client connects to port

80

(destination) from a random source port in the ephemeral range (

1024

65535

). The return traffic from the server will have a source port of

80

and a destination port in the ephemeral range (

1024

65535

To determine which port rules must be configured in the stateless NACL to allow return traffic.

Evaluate the custom NACL configuration against the port requirements.

The custom NACL only allows outbound traffic on TCP port

80

, which blocks the return traffic destined for the client's ephemeral ports.

To identify the root cause of the connection failure.

Key Concept

Stateless firewalls (NACLs) require explicit outbound rules for ephemeral ports to allow return traffic, whereas stateful firewalls (Security Groups) track connection states automatically.

Estimated Time:1m 30s

Question 19Question →

A SysOps Administrator is configuring a monitoring solution for a dynamic fleet of Amazon EC2 instances. The instances run a custom application that reports a custom metric named $ActiveSessions$ to Amazon CloudWatch. To monitor the overall session load, the administrator attempts to create a CloudWatch alarm based on a metric math expression that uses the $SEARCH$ function to dynamically locate and sum the $ActiveSessions$ metric across all instances in the Auto Scaling group. However, the administrator is unable to save the alarm due to a validation error.

Which of the following explains why this configuration failed?

The alarm must be routed through an Amazon EventBridge rule to aggregate the search results before CloudWatch can evaluate the metric threshold.

Detailed monitoring must be enabled on the EC2 instances before custom metrics can be used in metric math expressions.

Amazon CloudWatch alarms do not support metric math expressions that contain a

SEARCH

function.

The metric math expression must specify a standard

5

-minute evaluation period rather than a

1

-minute period to match the default EC2 metric collection interval.

Show answer & explanation

Answer: Amazon CloudWatch alarms do not support metric math expressions that contain a $SEARCH$ function.

Answer

Amazon CloudWatch alarms do not support metric math expressions that contain a SEARCH function because the search query returns a dynamic number of time series that cannot be mapped to a static alarm configuration.

The correct answer states that Amazon CloudWatch alarms do not support metric math expressions containing a SEARCH function. While CloudWatch supports metric math for alarms (e.g., SUM, AVG), any expression containing a SEARCH function cannot be used to create an alarm. This is because search expressions return a dynamic number of time series (which can change as EC2 instances launch or terminate), whereas a CloudWatch alarm requires a stable number of time series to evaluate against a threshold.

Step-by-Step Solution

Identify the configuration details of the CloudWatch alarm.

The alarm uses a metric math expression containing a

SEARCH

function to aggregate a custom metric (

ActiveSessions

) dynamically.

To understand the context of the validation failure when saving the alarm.

Analyze the limitations of CloudWatch alarms with respect to metric math and search functions.

Amazon CloudWatch allows metric math for alarms but explicitly prohibits using the

SEARCH

function in an alarm's expression because the query's output can vary dynamically as instances scale in or out.

To pinpoint the exact reason for the validation error.

Evaluate alternative solutions to achieve the desired monitoring setup.

To aggregate custom metrics across a dynamic fleet, the administrator should publish pre-aggregated metrics at the application level or use CloudWatch Metric Streams / Contributor Insights rather than a dynamic search alarm.

To resolve the monitoring requirement within CloudWatch limits.

Key Concept

CloudWatch Alarm limitations with Metric Math and SEARCH expressions

Question 20Question →

An organization runs an application on Amazon EC2 instances in a private VPC subnet. The application frequently reads and writes data to an Amazon DynamoDB table. A SysOps Administrator notices a significant increase in NAT Gateway data processing charges. To eliminate these charges, the administrator deploys a Gateway VPC Endpoint for Amazon DynamoDB within the VPC. However, monitoring tools reveal that the EC2 instances are still routing all DynamoDB traffic through the NAT Gateway. Which of the following is the most likely cause of this behavior?

The security group associated with the DynamoDB gateway endpoint does not allow inbound HTTPS traffic on port

443

from the EC2 instances.

The administrator did not manually add a route to the private subnet's route table pointing to the gateway endpoint's Elastic Network Interface ID as the target.

Private DNS hostnames were not enabled on the DynamoDB gateway endpoint, preventing the EC2 instances from resolving the DynamoDB endpoint to a private IP address.

The route table associated with the private subnet was not selected during the gateway endpoint configuration, preventing the DynamoDB prefix list route from being automatically added.

Show answer & explanation

Answer: The route table associated with the private subnet was not selected during the gateway endpoint configuration, preventing the DynamoDB prefix list route from being automatically added.

Answer

The route table associated with the private subnet was not selected during the gateway endpoint configuration, preventing the DynamoDB prefix list route from being automatically added.

The correct option is that the private subnet's route table was not selected during the gateway endpoint configuration. Gateway VPC Endpoints function by automatically adding a route to the associated route tables. This route maps the prefix list of the destination service (e.g., DynamoDB) to the VPC endpoint ID. If the private subnet's route table is not selected during creation or update, the route is not added, and traffic continues to route through the default path (the NAT Gateway).

Step-by-Step Solution

Identify the endpoint type required for Amazon DynamoDB.

DynamoDB uses a Gateway VPC Endpoint by default.

This determines how routing and network access controls are applied.

Analyze how Gateway VPC Endpoints modify routing.

They add a route mapping the DynamoDB prefix list (

pl-xxxxxx

) to the gateway endpoint (

vpce-xxxxxx

) in associated route tables.

Traffic to DynamoDB is routed at the subnet level rather than resolving to private IP addresses on interface endpoints.

Diagnose why traffic is still routed to the NAT Gateway.

If the private subnet's route table was not selected during endpoint creation, the prefix list route is missing from that route table.

Without the prefix list route, traffic default-routes to the NAT Gateway.

Key Concept

Gateway VPC Endpoints route traffic using subnet route tables and prefix lists, without utilizing Elastic Network Interfaces, security groups, or private DNS settings.

Page 1 / 26Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept