Tüm alıştırma soruları

An organization runs EC2 instances in a private VPC subnet that must access AWS Secrets Manager. A SysOps Administrator deploys an Interface VPC Endpoint for Secrets Manager inside the subnet to keep the traffic private. However, the EC2 instances are unable to connect to Secrets Manager. Which of the following actions will resolve this connectivity issue?

An organization hosts a proprietary API service in VPC-B behind an Amazon VPC Network Load Balancer (NLB). A SysOps Administrator in a separate AWS account configures an Interface VPC Endpoint in a private subnet of VPC-A to securely access this API service using AWS PrivateLink. The administrator enables Private DNS on the Interface VPC Endpoint. However, when an application running on Amazon EC2 instances in VPC-A attempts to invoke the API service, the connections consistently fail with a network timeout error. Which TWO configuration steps should the SysOps Administrator perform to troubleshoot and resolve this issue? (Select TWO.)

A company has established hybrid connectivity using an AWS Transit Gateway. The Transit Gateway is attached to three VPCs. To connect to the on-premises network (CIDR $172.31.0.0/16$), the company uses a primary $10\text{ Gbps}$ AWS Direct Connect connection with a Transit Virtual Interface (Transit VIF) terminated on a Direct Connect Gateway. As a backup, they have configured an AWS Site-to-Site VPN connection attached directly to the Transit Gateway. Both connections are advertising the $172.31.0.0/16$ prefix via dynamic BGP, and both attachments have route propagation enabled in the Transit Gateway route table. During a maintenance window, a SysOps administrator needs to temporarily force all outbound traffic destined for the on-premises network to use the Site-to-Site VPN backup path. Which action will achieve this goal with the least administrative effort?

A company is reviewing its AWS Trusted Advisor Cost Optimization recommendations to reduce monthly expenditures. The SysOps administrator identifies multiple findings in the dashboard:

- Several Amazon Elastic Block Store (Amazon EBS) volumes are flagged under the `Underutilized Amazon EBS Volumes` check because they have been unattached for more than $14$ days.
- Multiple Amazon Relational Database Service (Amazon RDS) DB instances are flagged under the `Amazon RDS Idle DB Instances` check because they have had $0$ active database connections for the last $7$ days.

The administrator wants to configure an automated solution to remediate these specific findings with minimal administrative effort.

Which of the following remediation workflows should the administrator implement? (Select TWO.)

A company hosts a web application behind an Application Load Balancer (ALB) that serves as the custom origin for an Amazon CloudFront distribution. A SysOps administrator must secure the architecture to ensure that the ALB only processes traffic originating directly from CloudFront. Additionally, during promotional events, the administrator must protect the origin backend from being overwhelmed by duplicate requests originating from different regional cache locations. Which combination of configurations will meet these requirements? (Select TWO.)

A SysOps administrator is setting up a monthly cost budget in AWS Budgets. The administrator wants to use AWS Budgets Actions to automatically apply a restrictive IAM policy to a developer group if the actual monthly spend exceeds a specific threshold.

Which of the following are required to successfully configure and run this budget action? (Select TWO.)

A SysOps Administrator is configuring an Interface VPC Endpoint for Amazon Systems Manager (SSM) to allow Amazon EC2 instances in a private subnet to securely communicate with the SSM API. The network traffic must remain entirely within the AWS network and not traverse the public internet. Which TWO configurations are required to establish this connectivity? (Select TWO.)

A SysOps administrator needs to implement a cost-monitoring solution for an AWS account where developers frequently deploy untagged experimental workloads. The solution must use machine learning to automatically detect unexpected spend spikes on resources that lack the Environment tag and send immediate alerts to an existing Amazon SNS topic. Furthermore, the administrator must be able to perform root-cause analysis in AWS Cost Explorer to identify the specific EC2 instance IDs responsible for any detected anomalies.

Which combination of steps should the administrator perform to meet these requirements?

A SysOps Administrator is troubleshooting a configuration issue in a VPC. EC2 instances in a private subnet must access an Amazon S3 bucket to retrieve datasets. To comply with security policies and avoid data transfer processing costs, the administrator created an Amazon S3 Gateway VPC Endpoint. However, during a traffic analysis, the administrator observes that data transfer charges for the NAT Gateway are still increasing.

An inspection of the VPC Flow Logs for the EC2 instance's elastic network interface (ENI) reveals the following entry:

2 123456789012 eni-08a7b6c5d4e3f2g10 10.0.2.14 52.216.184.147 49320 443 6 40 2400 1781308800 1781308860 ACCEPT OK

Which action must the administrator take to ensure S3 traffic is routed through the S3 Gateway VPC Endpoint?

A SysOps administrator needs to configure a system to monitor AWS account spending and send alerts whenever there is a sudden, unexpected spike in cost. The spending patterns are variable and unpredictable, making static thresholds ineffective. The administrator wants a solution that uses machine learning to dynamically detect these cost anomalies. Which AWS feature should the administrator use to achieve this goal?

A company runs a microservices-based application across multiple member accounts in an AWS Organizations structure. A SysOps Administrator is reviewing AWS Compute Optimizer recommendations in the delegated administrator account. The administrator notices that although the tool provides recommendations for EC2 instances, it flags memory utilization metrics as "Unavailable" for all instances, meaning it cannot verify if an instance is memory-bottlenecked before recommending a smaller instance size. Which TWO configurations or actions must the administrator implement to ensure AWS Compute Optimizer receives and analyzes memory metrics to provide accurate, memory-aware right-sizing recommendations across all accounts? (Select TWO.)

An organization utilizes consolidated billing in AWS Organizations. A SysOps Administrator has deployed an organization-wide Tag Policy to enforce the tag key `BillingID` on all newly created Amazon EC2 instances across all member accounts. The policy is successfully validated, and resources are being launched with the correct tag. However, when the administrator attempts to create a custom cost filter in AWS Cost Explorer to track spending for these instances, the `BillingID` tag key is unavailable. Which action must be taken to resolve this issue?

A SysOps Administrator has deployed an Interface VPC Endpoint for AWS Key Management Service (AWS KMS) to allow Amazon EC2 instances in a private VPC subnet to securely access KMS. The applications on the EC2 instances are configured to use the default service endpoint kms.us-east-1.amazonaws.com. However, they are unable to resolve the hostname to the private IP addresses of the endpoint. Which action will resolve this DNS resolution issue?

An Application Load Balancer (ALB) is configured to distribute traffic to a fleet of Amazon EC2 instances in private subnets. The EC2 instances run a web application that listens on TCP port 8443 (HTTPS) for client traffic. The Target Group configuration specifies a custom health check on TCP port 8080 (HTTP) with the path `/healthz`. Recently, the SysOps Administrator observed that all EC2 instances in the Target Group are marked as unhealthy, with the health status detail displaying: 'Health check failed with HTTP code 401: Unauthorized'. In addition, a recent security group cleanup has caused connection timeouts on port 8080 during target registration. Which of the following actions should the SysOps Administrator take to resolve these issues and restore the target health status to healthy? (Select TWO.)

A SysOps Administrator is investigating malicious outbound HTTP traffic originating from a VPC. Multiple Amazon EC2 instances reside in private subnets and route their outbound traffic to the internet through a NAT Gateway. The administrator has enabled VPC Flow Logs on the public subnet's network interface where the NAT Gateway resides. However, in the default flow logs, the `srcaddr` field for all outbound packets shows the NAT Gateway's private IP address, making it impossible to identify which specific EC2 instance is generating the malicious traffic.

The administrator wants to resolve this issue and successfully configure the logs to be published to a CloudWatch Logs log group.

Which of the following actions should the administrator take to achieve this? (Select TWO.)

An administrator has deployed a web application on several Amazon EC2 instances behind an Application Load Balancer (ALB). After registering the instances with the target group, the administrator notices that all instances are reported as unhealthy by the load balancer. The application is configured to run on port 80. Which two configurations should the administrator verify to troubleshoot the failing health checks? (Select TWO.)

A SysOps Administrator is troubleshooting a connectivity issue between an Application Load Balancer (ALB) in a public subnet ($10.0.1.0/24$) and a fleet of web servers running on Amazon EC2 instances in a private subnet ($10.0.2.0/24$). Users are reporting HTTP $504$ Gateway Timeout errors when attempting to access the application.

The Administrator reviews the VPC Flow Logs for the web servers' subnet and observes the following entries:

What configuration change is required to resolve this connectivity issue?

A batch processing workload runs on Amazon ECS tasks using AWS Fargate. The tasks are distributed across two private subnets in Availability Zones $us-west-2a$ and $us-west-2b$ within a single VPC. Every month, these tasks pull approximately $15\text{ TB}$ of container image layers from Amazon ECR and send $10\text{ TB}$ of log data to Amazon CloudWatch Logs. Currently, a single NAT Gateway located in $us-west-2a$ is used for all outbound traffic from both private subnets. The monthly AWS bill shows high costs for NAT Gateway data processing and cross-AZ data transfer.

Which two actions should a SysOps administrator take to minimize these data transfer costs while maintaining secure, private connectivity to ECR and CloudWatch Logs? (Select TWO.)

A company hosts a static website on Amazon S3. The website's assets are encrypted using server-side encryption with AWS KMS customer managed keys (SSE-KMS). A SysOps administrator is configuring an Amazon CloudFront distribution to serve these assets securely using Origin Access Control (OAC). Which TWO actions must the administrator take to allow CloudFront to retrieve and serve the encrypted assets? (Select TWO.)

A SysOps administrator wants to monitor AWS accounts for unexpected cost spikes using machine learning. The administrator also wants to receive alerts in a Slack channel when an anomaly is detected. Which actions should the administrator take to configure this solution? (Select two.)