Tüm alıştırma soruları

976 soru

Tüm türler976 Çoktan seçmeli502 Çoklu seçim450 Sıralama24

A SysOps Administrator is configuring automatic remediation for an AWS Config rule named `s3-bucket-ssl-requests-only` using the `AWS-PublishSNSNotification` Systems Manager (SSM) Automation document. The administrator has created a custom IAM role named `SSMRemediationRole` containing the necessary permissions to publish to the Amazon SNS topic. When the administrator attempts to associate this remediation action with the AWS Config rule in the AWS Management Console, the operation fails with an authorization error. Which of the following actions should the administrator perform to resolve this issue and ensure that the remediation executes successfully? (Select TWO.)

Geçerli olan tümünü seçin

Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the `SSMRemediationRole` ARN.

Configure the trust policy of the `SSMRemediationRole` to allow the `ssm.amazonaws.com` service principal to assume the role.

Attach an IAM policy to the AWS Config service role that grants the `iam:PassRole` permission for the `SSMRemediationRole` ARN.

Configure the trust policy of the `SSMRemediationRole` to allow the `config.amazonaws.com` service principal to assume the role.

Configure an Amazon EventBridge rule to detect AWS Config compliance changes and trigger the Systems Manager Automation document, bypassing the AWS Config remediation configuration.

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the `SSMRemediationRole` ARN.; Configure the trust policy of the `SSMRemediationRole` to allow the `ssm.amazonaws.com` service principal to assume the role.

Cevap

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the SSMRemediationRole ARN, and configure the trust policy of the SSMRemediationRole to allow the ssm.amazonaws.com service principal to assume the role.

To successfully configure and run automatic remediation for an AWS Config rule using a Systems Manager (SSM) Automation document with a custom execution role, two key permissions are required. First, the administrator setting up the remediation in the console or via the API must have the `iam:PassRole` permission on their IAM identity, referencing the ARN of the execution role. This allows the administrator to pass the role to the service. Second, because Systems Manager is the service that assumes the role to run the remediation document, the trust policy of the execution role must trust the `ssm.amazonaws.com` service principal.

Adım Adım Çözüm

Identify the identity attempting to configure the remediation action and verify its permissions.

The identity lacks the iam:PassRole permission on the target role, resulting in an authorization error during configuration.

When configuring AWS Config automatic remediation with an SSM Automation document, the user or role performing the configuration must be authorized to pass the execution role to the service.

Add the iam:PassRole permission to the administrator's IAM policy for the specific SSMRemediationRole ARN.

The authorization error is resolved, allowing the remediation action to be successfully associated with the AWS Config rule.

This grants the administrator the ability to delegate the execution role to the target service.

Configure the trust relationship policy of the SSMRemediationRole.

The trust policy allows ssm.amazonaws.com to assume the role.

When AWS Config triggers the remediation, AWS Systems Manager assumes the specified role to execute the automation document; therefore, the role must trust the Systems Manager service principal.

Anahtar Kavram

Configuring automatic remediation in AWS Config rules requires the configuring administrator to have iam:PassRole permissions for the execution role, and the execution role must trust the ssm.amazonaws.com service principal since Systems Manager executes the automation.

Soru 2Soru →

A SysOps administrator is configuring a blue/green deployment for a microservice hosted on Amazon ECS with AWS Fargate. The deployment pipeline uses AWS CodeDeploy. The administrator wants to route 10% of the production traffic to the new version of the microservice for a duration of 15 minutes before routing the remaining traffic. Additionally, if the new version displays elevated HTTP 5XX error rates during this test period, the deployment must automatically roll back. Which of the following configuration steps should the administrator perform to achieve this? (Select TWO.)

Geçerli olan tümünü seçin

Specify the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration in the CodeDeploy deployment group.

Create an Amazon CloudWatch alarm that monitors the HTTP 5XX metric of the replacement (green) target group, and add it as a rollback trigger in the CodeDeploy deployment group.

Configure an in-place deployment policy on the Amazon ECS service using a minimum healthy percent of 10% and a maximum percent of 110%.

Select the CodeDeployDefault.ECSAllAtOnce deployment configuration and configure Amazon Route 53 weighted routing to manually split the traffic.

Configure a trust relationship that allows the ECS task execution role to assume the CodeDeploy service role, but omit the iam:PassRole permission from the CodeDeploy policy.

Cevabı ve açıklamayı göster

Cevap: Specify the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration in the CodeDeploy deployment group.; Create an Amazon CloudWatch alarm that monitors the HTTP 5XX metric of the replacement (green) target group, and add it as a rollback trigger in the CodeDeploy deployment group.

Cevap

Specify the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration in the CodeDeploy deployment group, and create an Amazon CloudWatch alarm that monitors the HTTP 5XX metric of the replacement (green) target group and add it as a rollback trigger in the CodeDeploy deployment group.

To implement the required canary traffic shifting, the administrator must choose the predefined CodeDeploy deployment configuration for ECS that corresponds to shifting 10% of traffic for 15 minutes, which is CodeDeployDefault.ECSCanary10Percent15Minutes. To automate the rollback based on application errors, the administrator must configure a CloudWatch alarm targeting the green (replacement) target group's HTTP 5XX metrics and add that alarm as a rollback trigger to the CodeDeploy deployment group.

Adım Adım Çözüm

Select the appropriate canary deployment configuration in AWS CodeDeploy.

CodeDeployDefault.ECSCanary10Percent15Minutes is selected, which matches the required traffic shifting behavior (10% traffic shifted to the new task set, followed by the remaining 90% after 15 minutes).

This configuration directly automates the 10% canary traffic allocation for the specified 15-minute duration without requiring manual DNS or routing adjustments.

Configure a monitoring alarm for rollback triggers.

An Amazon CloudWatch alarm is created to track the HTTP 5XX error rate metric specifically for the green (replacement) target group under the Application Load Balancer.

Monitoring the green target group ensures that issues affecting only the new version of the service are detected.

Link the alarm to the CodeDeploy deployment group.

The CloudWatch alarm is designated as a rollback trigger in the CodeDeploy deployment group configuration.

This linkage enables CodeDeploy to automatically abort the deployment and shift 100% of the traffic back to the original (blue) task set if the alarm enters the ALARM state during the deployment process.

Anahtar Kavram

AWS CodeDeploy deployment configurations and rollback triggers for Amazon ECS blue/green deployments.

Soru 3Soru →

A SysOps Administrator is configuring cross-account, cross-region replication for an Amazon S3 bucket. The source bucket is in Account A (us-east-1) and contains objects encrypted with an AWS KMS customer managed key. The destination bucket is in Account B (us-west-2). The administrator has enabled versioning on the source bucket, created the replication configuration in Account A, and specified a new replication IAM role in Account A. However, the replication is failing, and no objects are appearing in the destination bucket. Which two actions must the administrator take to successfully replicate the KMS-encrypted objects?

Geçerli olan tümünü seçin

Enable bucket versioning on the destination bucket in Account B.

Modify the KMS key policy in Account B to grant the replication IAM role from Account A permissions to perform kms:GenerateDataKey and kms:Encrypt actions.

Modify the replication IAM role in Account A to include iam:PassRole permissions targeting the S3 replication service principal.

Associate the destination bucket's subnet route table in Account B with an S3 Gateway Endpoint to authorize cross-account replication traffic.

Configure the replication rule to use the default AWSServiceRoleForS3Replication service-linked role to automatically inherit permissions for cross-account KMS key access.

Cevabı ve açıklamayı göster

Cevap: Enable bucket versioning on the destination bucket in Account B.; Modify the KMS key policy in Account B to grant the replication IAM role from Account A permissions to perform kms:GenerateDataKey and kms:Encrypt actions.

Cevap

Enable bucket versioning on the destination bucket in Account B, and modify the KMS key policy in Account B to grant the replication IAM role from Account A permissions to perform kms:GenerateDataKey and kms:Encrypt actions.

Replicating KMS-encrypted objects across accounts requires S3 versioning to be enabled on both the source and destination buckets, as S3 replication requires versioning to track and sync objects. Additionally, the replication IAM role in Account A must have permissions to encrypt objects in the destination bucket using Account B's KMS key. This is accomplished by updating the KMS key policy in Account B to grant kms:GenerateDataKey and kms:Encrypt permissions to the replication role in Account A.

Adım Adım Çözüm

Enable versioning on the destination bucket in Account B.

Meets the core prerequisite that both source and destination buckets in an S3 replication setup must have versioning enabled.

S3 replication relies on versioning metadata to track and sync object states, so replication will fail if the destination bucket lacks versioning.

Update the KMS key policy for the destination key in Account B.

Grants the replication IAM role (from Account A) permission to encrypt objects at the destination using Account B's KMS key.

Since the replication role resides in Account A, the cross-account KMS key policy in Account B must explicitly permit that role to call kms:Encrypt and kms:GenerateDataKey.

Anahtar Kavram

Amazon S3 Cross-Account Replication with KMS Encryption

Soru 4Soru →

A SysOps Administrator initiates an update on an AWS CloudFormation stack. During the update, a resource creation fails. CloudFormation attempts to roll back the stack to its previous stable state, but the rollback process fails, leaving the stack in the UPDATE_ROLLBACK_FAILED state. Which of the following is a common cause for this rollback failure?

A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.

The rollback was initiated automatically, but CloudFormation requires a manual rollback trigger to proceed from a failed update.

The update was performed using an in-place deployment strategy instead of a blue/green deployment strategy.

The user initiating the update lacks the iam:PassRole permission required to execute the rollback operation.

Cevabı ve açıklamayı göster

Cevap: A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.

Cevap

A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.

The correct answer is that a resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted. When resources are modified or deleted out-of-band, the stack suffers from drift. During a rollback, CloudFormation attempts to return the resources to their previous configuration. If a resource no longer exists or is in an unexpected state, the rollback operation will fail, placing the stack in the UPDATE_ROLLBACK_FAILED state.

Adım Adım Çözüm

Analyze the stack status transitions.

The stack went from UPDATE_IN_PROGRESS to UPDATE_ROLLBACK_IN_PROGRESS and finally to UPDATE_ROLLBACK_FAILED.

Understanding the status flow helps pinpoint where the failure occurred.

Determine why CloudFormation would fail to revert a resource during a rollback.

If the resource state has drifted or if the resource was deleted manually outside of CloudFormation, CloudFormation's internal engine cannot reconcile the expected state.

Identifying the root cause of rollback failures is key to resolving stack update errors.

Anahtar Kavram

AWS CloudFormation Rollback Failures and Drift Management

Soru 5Soru →

A SysOps administrator is configuring an Amazon EC2 Auto Scaling group (ASG) to launch instances using a new launch template. The launch template specifies an IAM instance profile with an associated IAM role for the instances. When the ASG attempts to launch instances to meet the desired capacity, all launch attempts fail with the status message: "You are not authorized to perform this operation." The administrator verified that the administrator's IAM identity has the necessary permissions to create the ASG and the launch template. Which configuration change will resolve the launch failures?

Modify the trust policy of the instance profile's IAM role to allow the Auto Scaling service principal (autoscaling.amazonaws.com) to perform the sts:AssumeRole action.

Create a custom service-linked role for the Auto Scaling group and attach a policy that grants the sts:AssumeRole permission to the Auto Scaling group.

Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.

Enable detailed monitoring in the launch template to authorize the Auto Scaling group to send launch status metrics to Amazon CloudWatch.

Cevabı ve açıklamayı göster

Cevap: Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.

Cevap

Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.

The correct answer is to attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role. AWS requires that any identity configuring an AWS service to act on its behalf must have permission to pass the associated role. Without this permission, the EC2 service cannot associate the IAM role with the newly launched instances, resulting in an authorization error.

Adım Adım Çözüm

Analyze the error message 'You are not authorized to perform this operation' in the ASG activity history.

Determine that the failure is caused by an IAM authorization issue when attempting to launch instances with an associated IAM role.

The launch template includes an IAM instance profile, meaning the launching entity must have permission to pass this role to EC2.

Identify the required IAM action for passing roles to AWS services.

The iam:PassRole action is identified as the required permission on the calling identity's policy.

AWS enforces iam:PassRole to prevent users from escalating their privileges by passing roles with greater permissions than they have.

Add the iam:PassRole permission targeting the specific IAM role ARN to the administrator's IAM policy.

The ASG successfully passes the IAM role to EC2, allowing instances to launch without authorization errors.

This completes the required permission chain for the ASG to launch instances with the specified IAM role.

Anahtar Kavram

IAM PassRole requirement for EC2 Auto Scaling launches

Soru 6Soru →

A SysOps Administrator is using AWS CodeDeploy to deploy an update to an application running on a fleet of Amazon EC2 instances. The deployment must guarantee that at least $75\%$ of the instances are healthy and serving traffic at any given time during the deployment. If any instance fails the update, the deployment must automatically revert to the previous working version.

Which configuration will meet these requirements?

Create a custom deployment configuration with the minimum healthy hosts set to

75\%

using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Use the CodeDeployDefault.HalfAtATime predefined deployment configuration, and configure an Amazon CloudWatch alarm to trigger a rollback if any instance goes offline.

Create a custom deployment configuration with the minimum healthy hosts set to

25\%

using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Deploy the application using an AWS CloudFormation stack update, and rely on the CloudFormation rollback execution role to automatically revert the CodeDeploy deployment if a failure is detected.

Cevabı ve açıklamayı göster

Cevap: Create a custom deployment configuration with the minimum healthy hosts set to $75\%$ using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Cevap

Create a custom deployment configuration with the minimum healthy hosts set to

75\%

using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Creating a custom deployment configuration with the minimum healthy hosts set to

75\%

ensures that CodeDeploy updates at most

25\%

of the instances at a time, keeping at least

75\%

of the fleet healthy. Enabling the automatic rollback option on deployment failure in the deployment group ensures that CodeDeploy automatically reverts to the last known good version if any instance fails to deploy successfully.

Adım Adım Çözüm

Determine the required minimum healthy host threshold and create a custom CodeDeploy deployment configuration.

A custom configuration is created specifying minimum healthy hosts as

75\%

(percentage type).

Predefined configurations like HalfAtATime (

50\%

) or AllAtOnce (

0\%

) do not guarantee that at least

75\%

of the fleet remains online.

Configure the rollback behavior on the CodeDeploy deployment group.

The deployment group is updated to automatically roll back when a deployment failure occurs.

This fulfills the requirement to automatically revert to the previous working version upon failure without manual intervention.

Execute the deployment specifying the newly created custom deployment configuration.

The deployment runs, updating at most

25\%

of the instances at any time, and automatically rolls back if a failure is encountered.

This maintains the required application capacity and safety during the update process.

Anahtar Kavram

AWS CodeDeploy Deployment Configurations and Automatic Rollback Settings

Soru 7Soru →

A SysOps Administrator is configuring VPC Flow Logs to capture traffic from a critical production subnet and deliver the logs to an Amazon CloudWatch Logs log group. After creating the flow log, the administrator notices that the log group remains empty and no log streams are generated. The administrator verifies that the flow log status is active but no logs are being delivered.

Which of the following configuration issues are likely causing this problem? (Select TWO.)

Geçerli olan tümünü seçin

The trust policy of the IAM role assigned to the flow log does not list the vpc-flow-logs.amazonaws.com service principal as a trusted entity.

The IAM policy attached to the flow log's IAM role does not grant the logs:CreateLogStream and logs:PutLogEvents permissions for the destination log group.

The target CloudWatch Logs log group has its retention period set to 'Never expire', which prevents new log streams from initializing.

The trust policy of the IAM role is configured with the iam:PassRole action instead of the sts:AssumeRole action to allow the service to assume the role.

The subnets associated with the monitored resources do not have a route to the CloudWatch Logs interface VPC endpoint in their route tables.

Cevabı ve açıklamayı göster

Cevap: The trust policy of the IAM role assigned to the flow log does not list the vpc-flow-logs.amazonaws.com service principal as a trusted entity.; The IAM policy attached to the flow log's IAM role does not grant the logs:CreateLogStream and logs:PutLogEvents permissions for the destination log group.

Cevap

The correct answers are that the IAM role's trust policy must trust the vpc-flow-logs.amazonaws.com service principal, and the policy attached to the role must grant the logs:CreateLogStream and logs:PutLogEvents permissions.

To successfully publish VPC Flow Logs to CloudWatch Logs, the flow log service requires an IAM role. The trust policy of this IAM role must allow the vpc-flow-logs.amazonaws.com service principal to perform the sts:AssumeRole action. Additionally, the permissions policy attached to the role must grant logs:CreateLogStream and logs:PutLogEvents permissions for the target CloudWatch Logs log group. If either of these is missing, VPC Flow Logs will be unable to deliver logs even if the flow log status is active.

Adım Adım Çözüm

Analyze the IAM role trust policy.

Ensure that the trust relationship allows the VPC Flow Logs service principal (vpc-flow-logs.amazonaws.com) to assume the role.

Without this trust relationship, AWS cannot assume the role to write logs to CloudWatch Logs.

Verify the IAM role permissions policy.

Confirm that the role has permissions to create log streams and put log events (logs:CreateLogStream, logs:PutLogEvents) in the target log group.

Even if the role is trusted, it must have the necessary access permissions to write the log data.

Anahtar Kavram

VPC Flow Logs requires an IAM role with a trust policy allowing the vpc-flow-logs.amazonaws.com service principal to assume the role, and an attached policy allowing logs:CreateLogStream and logs:PutLogEvents.

Tahmini Süre:2m 0s

Soru 8Soru →

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. The company wants to set up an active-passive failover configuration at the zone apex (example.com). If the ALB or the backend instances become unhealthy, Route 53 must automatically redirect traffic to a static maintenance website hosted in an Amazon S3 bucket in the us-west-2 Region. Which configuration will meet these requirements with the fastest failover response and the least configuration overhead?

Create an Alias record at the zone apex using a Failover routing policy. Set the primary record to point to the ALB with Evaluate Target Health set to Yes. Set the secondary record to point to the S3 bucket website endpoint.

Create a CNAME record at the zone apex using a Failover routing policy. Set the primary record to point to the ALB DNS name and associate a Route 53 health check. Set the secondary record to point to the S3 bucket website endpoint.

Create a Weighted routing policy at the zone apex. Set the primary record to point to the ALB with a weight of 100 and associate a Route 53 health check. Set the secondary record to point to the S3 bucket website endpoint with a weight of 0.

Create an Alias record at the zone apex using a Failover routing policy. Set the primary record to point to the ALB. Create a Route 53 health check that monitors a CloudWatch alarm based on standard 5-minute ALB metrics, and associate it with the primary record. Set the secondary record to point to the S3 bucket website endpoint.

Cevabı ve açıklamayı göster

Cevap: Create an Alias record at the zone apex using a Failover routing policy. Set the primary record to point to the ALB with Evaluate Target Health set to Yes. Set the secondary record to point to the S3 bucket website endpoint.

Cevap

Create an Alias record at the zone apex using a Failover routing policy, pointing the primary record to the Application Load Balancer with Evaluate Target Health enabled, and pointing the secondary record to the Amazon S3 bucket website endpoint.

The correct option is the configuration that creates an Alias record at the zone apex using a Failover routing policy, points the primary record to the Application Load Balancer (ALB) with 'Evaluate Target Health' enabled, and points the secondary record to the Amazon S3 bucket website endpoint. This setup is standard, complies with zone apex limitations by using an Alias record instead of a CNAME, and provides rapid failover by having Route 53 directly evaluate the ALB target health without needing a separate health check or a delayed CloudWatch alarm.

Adım Adım Çözüm

Select the zone apex record (example.com) and set the routing policy to Failover.

Allows creation of primary and secondary records for active-passive failover.

Failover routing is the standard policy for active-passive disaster recovery setups.

Configure the primary record as an Alias record pointing to the Application Load Balancer, and set 'Evaluate Target Health' to Yes.

Route 53 will automatically check the health of the ALB and its targets without requiring a manual Route 53 health check setup.

Alias records to ALBs can leverage 'Evaluate Target Health' to quickly detect ALB target group health changes.

Configure the secondary record as an Alias record pointing to the S3 bucket website endpoint.

Traffic will failover to the S3 static website when the ALB is determined to be unhealthy.

Provides a cost-effective and highly available passive backup endpoint.

Anahtar Kavram

Route 53 active-passive DNS failover using Alias records and target health evaluation.

Soru 9Soru →

A SysOps Administrator is using AWS CloudFormation to update a production application hosted on an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The administrator is updating the launch template inside the CloudFormation template. The deployment must maintain full capacity at all times during the update to prevent performance degradation. Additionally, if the new instances fail application health checks during deployment, the stack must automatically roll back to its previous state.

Which two configurations should the administrator implement to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Configure the AutoScalingRollingUpdate policy's MinInstancesInService parameter to match the desired capacity of the Auto Scaling group.

Set up CloudFormation rollback triggers in the RollbackConfiguration parameter to monitor CloudWatch alarms associated with the Application Load Balancer target group's health.

Set the MinInstancesInService parameter to

0

in the AutoScalingRollingUpdate policy to speed up the update process and minimize temporary EC2 running costs.

Monitor the CloudFormation console and manually transition the stack state from UPDATE_IN_PROGRESS to UPDATE_ROLLBACK_FAILED if the health checks fail.

Rely on the CloudFormation service role's default trust relationship to launch the instances, omitting the iam:PassRole permission from the IAM policy since the role has administrative access.

Cevabı ve açıklamayı göster

Cevap: Configure the AutoScalingRollingUpdate policy's MinInstancesInService parameter to match the desired capacity of the Auto Scaling group.; Set up CloudFormation rollback triggers in the RollbackConfiguration parameter to monitor CloudWatch alarms associated with the Application Load Balancer target group's health.

Cevap

Configure the AutoScalingRollingUpdate policy's MinInstancesInService parameter to match the desired capacity of the Auto Scaling group, and set up CloudFormation rollback triggers in the RollbackConfiguration parameter to monitor CloudWatch alarms associated with the Application Load Balancer target group's health.

To maintain full capacity during a rolling update, the AutoScalingRollingUpdate policy's MinInstancesInService parameter must equal the desired capacity. This forces CloudFormation to launch new instances before terminating old ones. To automate rollback based on health checks, CloudFormation rollback triggers (RollbackConfiguration) must monitor CloudWatch alarms. If the alarms are triggered due to unhealthy instances, CloudFormation automatically rolls back the stack.

Adım Adım Çözüm

Configure the AutoScalingRollingUpdate policy on the Auto Scaling group in the CloudFormation template.

The MinInstancesInService parameter matches the desired capacity of the group.

This guarantees that CloudFormation launches new instances first before terminating any old instances, maintaining

100\%

capacity during the update.

Create CloudWatch alarms that monitor the Application Load Balancer target group's health metrics.

A configured alarm transitions into the ALARM state if the new deployment fails application-level health checks.

CloudWatch alarms are required to detect operational failures during the deployment process.

Associate the CloudWatch alarms with the CloudFormation stack's RollbackConfiguration triggers.

Automated monitoring of the alarms during and for a specified time after the stack update.

If any alarm breaches, CloudFormation detects it via the rollback triggers and automatically rolls back the stack to the last stable state.

Anahtar Kavram

Using CloudFormation AutoScalingRollingUpdate policies to preserve capacity combined with RollbackConfiguration to automate rollback on health check failure.

Tahmini Süre:2m 0s

Soru 10Soru →

A SysOps Administrator is setting up an active-passive disaster recovery solution using Amazon Route 53 for a public web application. The primary infrastructure runs in the us-west-2 Region behind an Application Load Balancer (ALB), and the backup infrastructure runs in the us-east-1 Region behind another ALB. The administrator wants to route all user traffic to us-west-2 under normal conditions, and automatically redirect traffic to us-east-1 if the primary application becomes unavailable. Which combination of actions must the administrator perform to configure this failover mechanism? (Select TWO.)

Geçerli olan tümünü seçin

Create an Alias record pointing to the primary Application Load Balancer in us-west-2, select the Failover routing policy, set the Failover Record Type to Primary, and set Evaluate Target Health to Yes.

Create an Alias record pointing to the backup Application Load Balancer in us-east-1, select the Failover routing policy, set the Failover Record Type to Secondary, and set Evaluate Target Health to Yes.

Create a primary record using the Weighted routing policy with a weight of 100, and a secondary record using the Weighted routing policy with a weight of 0.

Enable detailed monitoring on the primary Application Load Balancer to configure a Route 53 health check that monitors a CloudWatch alarm for target response times.

Associate the primary Route 53 record with a custom health check that monitors the replication lag metric of an RDS Read Replica in the backup region.

Cevabı ve açıklamayı göster

Cevap: Create an Alias record pointing to the primary Application Load Balancer in us-west-2, select the Failover routing policy, set the Failover Record Type to Primary, and set Evaluate Target Health to Yes.; Create an Alias record pointing to the backup Application Load Balancer in us-east-1, select the Failover routing policy, set the Failover Record Type to Secondary, and set Evaluate Target Health to Yes.

Cevap

The correct configuration requires creating a primary Failover Alias record pointing to the primary Application Load Balancer in us-west-2 with Evaluate Target Health set to Yes, and a secondary Failover Alias record pointing to the backup Application Load Balancer in us-east-1 with Evaluate Target Health set to Yes.

To configure an active-passive failover in Amazon Route 53 using Alias records pointing to Application Load Balancers, the administrator must create a primary record for the active endpoint and a secondary record for the standby endpoint. Setting the routing policy to Failover and configuring the Failover Record Type to Primary and Secondary respectively aligns with active-passive design. Enabling 'Evaluate Target Health' on both Alias records allows Route 53 to automatically evaluate the health of the load balancers based on the health of their registered targets, triggering the failover when the primary ALB's targets become unhealthy.

Adım Adım Çözüm

Identify the routing policy and record type required for the primary endpoint.

A Failover routing policy with the Failover Record Type set to Primary pointing to the primary Application Load Balancer.

Active-passive disaster recovery setups in Route 53 require a Failover routing policy where the primary record represents the main active resource.

Determine how to monitor the health of the Application Load Balancer without extra cost or configuration.

Enable the 'Evaluate Target Health' setting on the Alias record.

When Evaluate Target Health is set to Yes, Route 53 inherits the health status of the Application Load Balancer from the backend EC2 targets registered with the ALB's target groups.

Configure the standby endpoint for failover.

A Failover routing policy with the Failover Record Type set to Secondary pointing to the backup ALB in the us-east-1 Region, with Evaluate Target Health set to Yes.

This ensures Route 53 will route DNS queries to the standby ALB when the primary ALB's health checks fail.

Anahtar Kavram

Active-passive Route 53 DNS failover configuration using Alias records and the Evaluate Target Health feature.

Soru 11Soru →

A company is designing a backup and disaster recovery strategy for a critical multi-tier application. The application stores transaction logs in an Amazon S3 bucket and uses an Amazon RDS for PostgreSQL DB instance. The backup policy requires all database backups to be replicated to a secondary AWS Region to enable point-in-time recovery (PITR) with a minimum recovery time. Additionally, the S3 transaction logs must be replicated to the secondary Region while retaining full version history. Which combination of actions should the SysOps Administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable versioning on both the source S3 bucket and the destination S3 bucket, and configure S3 Cross-Region Replication (CRR).

Enable cross-Region automated backups replication for the Amazon RDS DB instance to replicate automated backups to the secondary Region.

Configure Amazon S3 Cross-Region Replication (CRR) on the source S3 bucket without enabling versioning on the destination S3 bucket.

Configure an Amazon RDS Read Replica in the secondary Region to serve as the automatic failover target for point-in-time recovery if the primary DB instance fails.

Create an S3 lifecycle rule to transition replicated objects directly to the S3 Glacier Flexible Retrieval storage class within 15 days of creation.

Cevabı ve açıklamayı göster

Cevap: Enable versioning on both the source S3 bucket and the destination S3 bucket, and configure S3 Cross-Region Replication (CRR).; Enable cross-Region automated backups replication for the Amazon RDS DB instance to replicate automated backups to the secondary Region.

Cevap

To meet the requirements, the SysOps Administrator must enable versioning on both the source and destination S3 buckets and configure S3 Cross-Region Replication (CRR), and enable cross-Region automated backups replication for the Amazon RDS DB instance.

Enabling versioning on both the source and destination S3 buckets is a prerequisite for configuring Cross-Region Replication (CRR). Replicating RDS automated backups to a secondary Region provides the capability to restore the DB instance to any point in time within the backup retention window in the destination Region.

Adım Adım Çözüm

Enable versioning on both S3 buckets.

Both source and destination S3 buckets are versioning-enabled.

S3 Cross-Region Replication (CRR) requires versioning to be enabled on both the source and destination buckets to function properly.

Configure Cross-Region Replication.

S3 objects and version history are automatically copied to the secondary Region.

This configuration satisfies the S3 replication requirements while maintaining version history.

Configure Amazon RDS cross-Region automated backup replication.

RDS automated backups are replicated to the secondary Region.

This allows the administrator to perform point-in-time recovery (PITR) in the secondary Region directly from the replicated automated backups.

Anahtar Kavram

Configuring S3 Cross-Region Replication with versioning and RDS cross-Region automated backup replication for disaster recovery.

Soru 12Soru →

An organization wants to establish an automated response system when an Amazon EC2 instance's CPU utilization exceeds $95\%$ for more than 15 minutes, which indicates a runaway process. A SysOps administrator configures an Amazon EventBridge rule triggered by the corresponding Amazon CloudWatch alarm state change to `ALARM`. The remediation strategy is to trigger a custom AWS Systems Manager Automation runbook named `ResolveRunawayProcess` that will restart the problematic service on the instance. The runbook requires a service role (`SSMAutomationServiceRole`) to execute its steps. Which configuration and permission setup will successfully execute the remediation with the least privilege?

Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission for the document and the iam:PassRole permission for the SSMAutomationServiceRole resource.

Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission, and configure the trust relationship of the SSMAutomationServiceRole to trust the EventBridge service principal (events.amazonaws.com).

Set the EventBridge rule target to Systems Manager Run Command and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:SendCommand permission and the iam:PassRole permission for the instance profile role.

Set the EventBridge rule target to AWS Config, and configure an AWS Config remediation action to execute the ResolveRunawayProcess document. Assign an IAM role to AWS Config containing the ssm:StartAutomationExecution permission.

Cevabı ve açıklamayı göster

Cevap: Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission for the document and the iam:PassRole permission for the SSMAutomationServiceRole resource.

Cevap

The correct configuration establishes a path where EventBridge acts as the caller. It invokes the Systems Manager Automation target (`ResolveRunawayProcess` document) and passes the execution role (`SSMAutomationServiceRole`) to Systems Manager using `iam:PassRole` permissions. Without `iam:PassRole`, Systems Manager cannot execute the Automation runbook steps under the specified service role context.

Adım Adım Çözüm

Identify the target orchestration service for the remediation.

The target must be Systems Manager Automation since the action requires executing a custom SSM Automation runbook.

Systems Manager Automation is the correct service for executing workflows/runbooks, unlike Run Command which executes scripts directly on managed instances.

Determine the necessary IAM permissions for EventBridge to invoke Systems Manager Automation.

The EventBridge execution role needs the ssm:StartAutomationExecution permission for the ResolveRunawayProcess document.

EventBridge must have explicit permission to trigger the execution of the target SSM document.

Configure the role-passing capability for the target execution.

Grant the EventBridge execution role iam:PassRole permission targeting the SSMAutomationServiceRole.

Since the Automation workflow executes steps using the SSMAutomationServiceRole, the calling service (EventBridge) must have permission to pass this execution role to Systems Manager.

Anahtar Kavram

EventBridge and Systems Manager Automation Remediation IAM Permissions

Soru 13Soru →

A company hosts a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the eu-central-1 (Frankfurt) region. The company wants to implement an active-passive disaster recovery strategy using Amazon Route 53. If the application's response latency exceeds 5 seconds, traffic must fail over to a static maintenance page hosted on an Amazon S3 bucket configured for website hosting in the eu-west-1 (Ireland) region. The latency metric is monitored via a custom CloudWatch metric. Which two configuration steps must the SysOps Administrator perform to set up this Route 53 DNS failover configuration? (Select TWO.)

Geçerli olan tümünü seçin

Create the CloudWatch alarm for the latency metric in the us-east-1 (N. Virginia) Region, and associate the Route 53 health check with this alarm.

Create the CloudWatch alarm for the latency metric in the eu-central-1 Region, and link the Route 53 health check directly to this local alarm.

Create a primary Route 53 Failover record pointing to the ALB with the custom health check associated, and a secondary Route 53 Failover record pointing to the S3 bucket website endpoint.

Configure the secondary Failover record to point to an Amazon RDS Read Replica endpoint in eu-west-1 to handle database write availability during a failover event.

Enable Detailed Monitoring on the Application Load Balancer to retrieve sub-minute metrics, allowing the Route 53 health check to query the load balancer latency directly without an associated alarm.

Cevabı ve açıklamayı göster

Cevap: Create the CloudWatch alarm for the latency metric in the us-east-1 (N. Virginia) Region, and associate the Route 53 health check with this alarm.; Create a primary Route 53 Failover record pointing to the ALB with the custom health check associated, and a secondary Route 53 Failover record pointing to the S3 bucket website endpoint.

Cevap

Creating the CloudWatch alarm for the latency metric in the us-east-1 Region to link with the Route 53 health check, and creating a primary Route 53 Failover record pointing to the ALB alongside a secondary Route 53 Failover record pointing to the S3 website endpoint.

To set up Route 53 active-passive failover based on custom metrics like latency, the SysOps Administrator must use a CloudWatch alarm. Route 53 can only integrate with CloudWatch alarms residing in the us-east-1 region, meaning the alarm must be created there even if the metric data originates elsewhere. Additionally, the DNS configuration requires defining a primary Failover record associated with the health check and a secondary Failover record pointing to the passive destination (the S3 bucket website hosting endpoint).

Adım Adım Çözüm

Configure metric publishing to the us-east-1 region, or configure a cross-region CloudWatch alarm in us-east-1 that evaluates the custom metric data coming from the eu-central-1 region.

A CloudWatch alarm monitoring the response latency is created in the us-east-1 Region.

Amazon Route 53 health checks are global and only integrate with CloudWatch alarms created in the us-east-1 region.

Create a Route 53 health check that monitors the state of the newly created CloudWatch alarm in us-east-1.

A Route 53 health check is established that reports unhealthy status when the CloudWatch alarm transitions to the ALARM state.

This links the application-layer latency metric directly to the DNS failover logic.

Create a primary routing record (e.g., an Alias A record for the zone apex or a standard CNAME) pointing to the ALB in eu-central-1, configure it with the Failover routing policy, and associate it with the created Route 53 health check.

The primary record will route traffic to the ALB as long as the health check reports healthy.

Associating the health check ensures that Route 53 will detect latency spikes and stop resolving queries to the primary ALB.

Create a secondary routing record with the same name, configure it with the Failover routing policy, and point it to the S3 bucket website endpoint in eu-west-1.

The secondary record will serve traffic to the maintenance page when the primary endpoint is unhealthy.

Completes the active-passive failover configuration.

Anahtar Kavram

Amazon Route 53 DNS Active-Passive Failover with CloudWatch Alarms

Tahmini Süre:2m 30s

Soru 14Soru →

A SysOps administrator is configuring automated remediation to isolate Amazon EC2 instances when Amazon GuardDuty detects command-and-control (C&C) activity. The administrator wants to use Amazon EventBridge to detect the GuardDuty finding and trigger the AWS Systems Manager Automation document AWS-StopEC2Instance to stop the affected instance. Which combination of target configuration and IAM permissions will successfully implement this automated remediation?

Configure the EventBridge rule to forward the GuardDuty findings to AWS Config. Configure an AWS Config custom rule to trigger the Systems Manager Automation document as a remediation action, and attach an IAM policy to AWS Config allowing the config.amazonaws.com service principal to perform the ssm:StartAutomationExecution action.

Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document, relying on the Automation document's default execution permissions without iam:PassRole.

Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.

Configure the EventBridge rule with the Systems Manager Automation document as the target. Modify the IAM trust policy of the Systems Manager Automation execution role to trust events.amazonaws.com directly, and use an EventBridge input transformer to map the EC2 instance ID to the execution role ARN in the target payload.

Cevabı ve açıklamayı göster

Cevap: Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.

Cevap

Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.

The correct option correctly configures the EventBridge rule target to the Systems Manager Automation document, and grants EventBridge the necessary IAM permissions. Specifically, it allows EventBridge to assume a role to call ssm:StartAutomationExecution on the target document and includes the iam:PassRole permission so that EventBridge can pass the Systems Manager Automation execution role to the Systems Manager service, which executes the actions.

Adım Adım Çözüm

Configure the Amazon EventBridge rule pattern to match Amazon GuardDuty findings representing command-and-control activity.

GuardDuty finding events will match the rule pattern and trigger the designated targets.

This establishes the detection trigger in the event flow.

Set the EventBridge rule target to the AWS Systems Manager Automation document AWS-StopEC2Instance, specifying the EC2 instance ID from the event as a parameter.

The target document is selected and mapped to the affected resource.

This establishes the remediation action in the event flow.

Create an IAM role for EventBridge with a trust policy allowing events.amazonaws.com and a permissions policy allowing ssm:StartAutomationExecution and iam:PassRole for the execution role.

EventBridge receives permissions to execute the automation and pass the necessary service role to Systems Manager.

EventBridge requires these permissions to initiate the automation run under the context of the automation execution role.

Anahtar Kavram

Configuring event-driven automated remediation using Amazon EventBridge and AWS Systems Manager Automation requires setting up an IAM service role for EventBridge with both the ssm:StartAutomationExecution permission and the iam:PassRole permission to securely pass the execution role to Systems Manager.

Tahmini Süre:3m 0s

Soru 15Soru →

An organization configures Amazon CloudWatch Logs subscription filters to stream log events to an Amazon Kinesis Data Firehose delivery stream. The delivery stream writes the log data to a destination Amazon S3 bucket. Both the delivery stream and the destination S3 bucket are encrypted using a Customer Managed Key (CMK) managed by AWS Key Management Service (AWS KMS). The SysOps Administrator observes that the S3 bucket is empty and log delivery has failed. Which of the following troubleshooting steps should the administrator perform to resolve this issue? (Select TWO.)

Geçerli olan tümünü seçin

Configure the KMS key policy of the S3 bucket's encryption key to grant the Kinesis Data Firehose delivery role permissions to perform the kms:GenerateDataKey and kms:Encrypt actions.

Change the log group retention settings to Never Expire to prevent log events from being deleted before Kinesis Data Firehose can pull them from the log group.

Enable detailed monitoring on the instances generating the log data to increase the delivery frequency of the subscription filter from 5 minutes to 1 minute.

Add iam:PassRole permissions to the Kinesis Data Firehose delivery role trust policy to allow the S3 service principal to assume the role.

Cevabı ve açıklamayı göster

Cevap: Configure the IAM policy attached to the CloudWatch Logs role to allow the firehose:PutRecord action on the delivery stream and the kms:GenerateDataKey action on the KMS key used by Kinesis Data Firehose.; Configure the KMS key policy of the S3 bucket's encryption key to grant the Kinesis Data Firehose delivery role permissions to perform the kms:GenerateDataKey and kms:Encrypt actions.

Cevap

Configure the IAM policy attached to the CloudWatch Logs role to allow the firehose:PutRecord action on the delivery stream and the kms:GenerateDataKey action on the KMS key used by Kinesis Data Firehose, and configure the KMS key policy of the S3 bucket's encryption key to grant the Kinesis Data Firehose delivery role permissions to perform the kms:GenerateDataKey and kms:Encrypt actions.

The correct troubleshooting actions involve ensuring that CloudWatch Logs has permissions to write to the encrypted Kinesis Data Firehose stream (which requires both the firehose:PutRecord action and the kms:GenerateDataKey action on the stream's encryption key), and ensuring that the Firehose delivery role has permissions to write to the encrypted S3 bucket (which requires the kms:GenerateDataKey and kms:Encrypt actions on the bucket's KMS key policy).

Adım Adım Çözüm

Verify CloudWatch Logs permissions to write to Kinesis Data Firehose.

Ensure the CloudWatch Logs subscription role includes firehose:PutRecord permissions.

CloudWatch Logs needs direct write permissions to deliver log records into the Kinesis Data Firehose stream.

Analyze KMS permissions for Kinesis Data Firehose ingestion.

Ensure the CloudWatch Logs role is granted kms:GenerateDataKey on the Customer Managed Key (CMK) encrypting Kinesis Data Firehose.

Since the stream is encrypted, writing to it requires generating data keys using the stream's KMS key.

Analyze KMS permissions for Kinesis Data Firehose S3 delivery.

Update the S3 bucket's KMS key policy to permit the Kinesis Data Firehose delivery role to perform kms:GenerateDataKey and kms:Encrypt.

Firehose must be able to generate encryption keys and encrypt data objects before uploading them to the encrypted S3 bucket.

Anahtar Kavram

Troubleshooting CloudWatch Logs subscription filter delivery issues involving AWS KMS key policies and IAM service permissions.

Soru 16Soru →

A SysOps Administrator is configuring a blue/green deployment strategy for a containerized application running on Amazon Elastic Container Service (Amazon ECS) behind an Application Load Balancer (ALB). The updates must be deployed using AWS CodeDeploy. The administrator needs to ensure that the deployment automatically rolls back if the new tasks fail to launch or fail target group health checks, or if application performance degradation (such as elevated error rates) occurs during traffic shifting. Which two configuration steps must the administrator perform to meet these requirements? (Choose two.)

Geçerli olan tümünü seçin

Update the ECS service definition to set the deployment controller type to CodeDeploy, and associate the deployment group with two target groups: one for the active traffic environment and one for the standby environment.

Create Amazon CloudWatch alarms that monitor application metrics, and add these alarms to the CodeDeploy deployment group's automatic rollback configuration.

Enable the ECS deployment circuit breaker with the rollback option enabled within the ECS service definition.

Configure an Amazon EventBridge rule that detects a CodeDeploy deployment failure event and triggers an AWS Systems Manager (SSM) Automation workflow to redeploy the previous task definition.

Attach an IAM policy to the CodeDeploy service role that permits the sts:AssumeRole action but excludes the iam:PassRole permission for the ECS task execution role.

Cevabı ve açıklamayı göster

Cevap: Update the ECS service definition to set the deployment controller type to CodeDeploy, and associate the deployment group with two target groups: one for the active traffic environment and one for the standby environment.; Create Amazon CloudWatch alarms that monitor application metrics, and add these alarms to the CodeDeploy deployment group's automatic rollback configuration.

Cevap

To configure the blue/green deployment for Amazon ECS using AWS CodeDeploy with automatic rollback capabilities, the administrator must configure the ECS service deployment controller type to CodeDeploy, associate the deployment group with blue and green target groups, and configure Amazon CloudWatch alarms to trigger automatic rollbacks in the CodeDeploy deployment group.

The correct options specify configuring the ECS service to use the CodeDeploy deployment controller with two target groups (blue and green) to enable the blue/green deployment pattern, and configuring CloudWatch alarms in the CodeDeploy deployment group's automatic rollback settings to monitor metrics during deployment and trigger a rollback if needed.

Adım Adım Çözüm

Configure the deployment controller on the ECS service definition.

The ECS service is set to use the CodeDeploy deployment controller type instead of the default ECS rolling update controller.

This allows AWS CodeDeploy to manage the tasks, traffic shifting, and lifecycle hooks of the deployment.

Associate two target groups with the CodeDeploy deployment group.

CodeDeploy can direct traffic between the active target group (blue) and the target group running the new task version (green).

Two target groups are required in a blue/green deployment configuration to allow isolated testing and seamless traffic shifting.

Add CloudWatch alarms to the CodeDeploy rollback configuration.

If the metrics (like 5XX errors or response times) exceed limits, CodeDeploy detects the alarm and automatically reverts the traffic back to the original target group.

This meets the requirement to automatically roll back the deployment upon detecting application performance degradation.

Anahtar Kavram

AWS CodeDeploy manages ECS blue/green deployments by shifting traffic between two target groups and can automate rollbacks using native CloudWatch alarm integration.

Soru 17Soru →

A SysOps administrator is configuring an automated remediation workflow to enable Amazon S3 Block Public Access on any S3 bucket when a PutBucketPolicy API call is detected. The administrator creates an Amazon EventBridge rule that filters CloudTrail API events for PutBucketPolicy and targets the AWS Systems Manager Automation document AWS-ConfigureS3BucketPublicAccessBlock. The Automation document requires an execution role (AutomationAssumeRole) to perform the configuration changes. However, the execution fails to start when a policy changes.

Which of the following configuration steps must the SysOps administrator perform to successfully implement this automated remediation? (Select TWO.)

Geçerli olan tümünü seçin

Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document.

Grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.

Modify the trust relationship of the Systems Manager Automation execution role to allow the EventBridge service role to call sts:AssumeRole directly instead of passing the role.

Create a CloudWatch metric filter for PutBucketPolicy events and configure it to trigger the Systems Manager Automation document as a CloudWatch alarm action.

Enable detailed monitoring on the S3 buckets to reduce event delivery latency and trigger the EventBridge rule.

Cevabı ve açıklamayı göster

Cevap: Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document.; Grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.

Cevap

Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document, and grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.

To successfully execute automated remediation using Amazon EventBridge and AWS Systems Manager Automation, two authorization steps are necessary: first, the EventBridge rule must assume a role that permits starting the automation execution (ssm:StartAutomationExecution). Second, because Systems Manager must assume an execution role to perform the S3 bucket configuration change, the EventBridge role must be permitted to pass this execution role (iam:PassRole) to Systems Manager.

Adım Adım Çözüm

Ensure EventBridge is authorized to trigger the Systems Manager execution.

EventBridge target is associated with an IAM service role containing the ssm:StartAutomationExecution action for the AWS-ConfigureS3BucketPublicAccessBlock document.

By default, EventBridge does not have permissions to execute Systems Manager Automation documents unless explicitly granted via a service role.

Ensure the Systems Manager Automation execution role can be passed to the Systems Manager service.

The EventBridge target execution role has iam:PassRole permissions targeting the SSM Automation execution role (AutomationAssumeRole).

When a target service executes using a specified role, the calling service (EventBridge) must have permission to pass that role to the target service.

Anahtar Kavram

Configuring correct IAM permissions and service integration targets for event-driven Systems Manager Automation via Amazon EventBridge.

Soru 18Soru →

A company is designing a backup, restore, and high availability strategy for a critical transactional database running on Amazon RDS. The SysOps Administrator must satisfy the following requirements:
1. Automated daily backups must be replicated to a destination bucket in a secondary AWS Region.
2. In the event of an Availability Zone outage, the database must automatically failover to a standby instance in another Availability Zone within 2 minutes without requiring changes to application connection strings.
3. The replicated backups must be encrypted with a Customer Managed Key (CMK) in the destination Region, and access to decrypt these backups must be managed using IAM policies.

Which configuration must the SysOps Administrator implement to satisfy these requirements?

Configure the primary database to use Multi-AZ deployment. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, use IAM policies to grant decrypt permissions on the destination KMS key to authorized users, without modifying the destination KMS key's policy to permit IAM-based access control.

Configure the primary database to use Multi-AZ deployment. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.

Configure the primary database to use Multi-AZ deployment. Configure S3 Cross-Region Replication (CRR) to copy the backups from the source bucket to the destination bucket without enabling S3 versioning on either bucket. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.

Deploy a database Read Replica in a different Availability Zone to handle automatic failover. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.

Cevabı ve açıklamayı göster

Cevap: Configure the primary database to use Multi-AZ deployment. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.

Cevap

Configure the primary database to use Multi-AZ deployment, enable S3 versioning on both the source and destination buckets for CRR, and modify the destination KMS key policy to allow the root principal to delegate key permissions via IAM.

The correct configuration combines Multi-AZ deployment to achieve automated, synchronous failover within 2 minutes without altering connection strings, enables S3 versioning on both buckets to allow S3 Cross-Region Replication (CRR) of the database backups, and configures the destination KMS key policy to permit the root principal to delegate key operations, enabling IAM policies to successfully control decryption access.

Adım Adım Çözüm

Select Multi-AZ deployment for Amazon RDS

Synchronous database replication is established across Availability Zones, enabling automatic DNS failover in under 2 minutes without endpoint changes.

Meets the high availability RTO requirement without requiring application configuration changes.

Enable S3 versioning on the source and destination buckets and configure S3 CRR

Automated backups uploaded to the source S3 bucket are successfully replicated to the secondary Region destination S3 bucket.

S3 Cross-Region Replication has a hard prerequisite that versioning must be enabled on both source and destination buckets.

Modify the Customer Managed Key (CMK) policy in the destination Region to enable IAM policy delegation

The KMS key policy includes the default statement allowing the root principal (`arn:aws:iam::ACCOUNT_ID:root`) to perform key actions, which delegates policy control to IAM.

Without this statement in the KMS key policy, IAM policies cannot grant permissions to access or decrypt using the KMS key due to KMS policy evaluation precedence.

Anahtar Kavram

Integrating high availability, backup replication prerequisites, and KMS key policy delegation

Soru 19Soru →

A SysOps administrator needs to configure active-passive DNS failover for a public-facing API. The primary endpoint is hosted in an on-premises datacenter, and the secondary disaster recovery endpoint is hosted on an Amazon EC2 instance in AWS. If the on-premises endpoint becomes unreachable, Route 53 must automatically redirect traffic to the EC2 instance. How should the administrator configure Amazon Route 53 to meet these requirements?

Configure a Route 53 health check for the on-premises endpoint. Create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check. Create a secondary record with a Failover routing policy pointing to the EC2 instance IP address.

Create weighted routing records for both endpoints, setting the weight of the primary record to 100 and the secondary record to 0, and associate a Route 53 health check with both records.

Configure a CloudWatch alarm using standard monitoring metrics to check on-premises health, and use a Simple routing record that automatically redirects traffic to the secondary IP when the alarm triggers.

Create a primary record with a Failover routing policy pointing to the on-premises IP, and configure the secondary record to point directly to an Amazon RDS Read Replica endpoint to handle application traffic during a failover.

Cevabı ve açıklamayı göster

Cevap: Configure a Route 53 health check for the on-premises endpoint. Create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check. Create a secondary record with a Failover routing policy pointing to the EC2 instance IP address.

Cevap

The correct configuration is to configure a Route 53 health check for the on-premises endpoint, then create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check, and finally create a secondary record with a Failover routing policy pointing to the EC2 instance IP address. This properly defines an active-passive failover configuration where DNS queries resolve to the primary endpoint until the associated health check fails, at which point Route 53 begins responding with the secondary endpoint IP address.

Adım Adım Çözüm

Create a Route 53 health check that monitors the IP address or domain name of the primary on-premises API endpoint.

Amazon Route 53 will begin actively probing the on-premises endpoint to determine its health status.

Route 53 requires a health check to monitor the primary record's health state before it can execute an automated failover.

Create the primary DNS record in the hosted zone using the Failover routing policy, point it to the on-premises IP, and associate it with the created health check.

A primary failover record is established with an active monitor.

This establishes the default path for client traffic under normal operating conditions.

Create the secondary DNS record with the same record name, select the Failover routing policy, configure it as the secondary record, and point it to the EC2 instance's public IP address.

A secondary failover record is created.

This provides a backup destination for DNS queries when Route 53 detects that the primary endpoint is unhealthy.

Anahtar Kavram

Route 53 active-passive DNS failover requires a primary record with a health check and a secondary record, both configured with the Failover routing policy.

Soru 20Soru →

A SysOps administrator is launching a new Amazon EC2 instance that must run an application that accesses an Amazon S3 bucket. An IAM role with the necessary S3 permissions has already been created. The administrator needs to configure the EC2 instance to run the application using this role.

Which two actions are required to successfully complete this configuration? (Select TWO.)

Geçerli olan tümünü seçin

Associate the IAM role with an instance profile, and attach the instance profile to the EC2 instance.

Ensure the administrator's IAM user identity is granted the iam:PassRole permission for the specific IAM role.

Ensure the administrator's IAM user identity is granted the sts:AssumeRole permission for the specific IAM role.

Update the trust policy of the IAM role to allow the administrator's IAM user identity to assume the role.

Cevabı ve açıklamayı göster

Cevap: Associate the IAM role with an instance profile, and attach the instance profile to the EC2 instance.; Ensure the administrator's IAM user identity is granted the iam:PassRole permission for the specific IAM role.

Cevap

The correct actions are associating the IAM role with an instance profile to attach it to the EC2 instance, and ensuring the administrator's IAM user identity has the iam:PassRole permission.

To configure an EC2 instance to run an application with specific IAM permissions, you must wrap the IAM role inside an instance profile and attach it to the EC2 instance. Furthermore, the administrator who performs this attachment must possess the iam:PassRole permission to authorize passing the role to the EC2 service.

Adım Adım Çözüm

Determine how roles are attached to EC2 instances.

EC2 instances require an instance profile wrapper to hold the IAM role.

The EC2 service uses instance profiles to pass role credentials to the instance's metadata service.

Determine the required user permissions for delegating the role.

The user launching or configuring the instance must have the iam:PassRole permission.

To prevent unauthorized delegation of administrative privileges, AWS requires that users have explicit permission to pass roles to services.

Anahtar Kavram

Delegating AWS permissions to EC2 instances using Instance Profiles and the iam:PassRole permission

Sayfa 1 / 49Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram