Tüm alıştırma soruları

976 soru

Tüm türler976 Çoktan seçmeli502 Çoklu seçim450 Sıralama24

A company uses an AWS Transit Gateway to connect multiple VPCs to its on-premises network. Hybrid connectivity is established using a $1\text{ Gbps}$ AWS Direct Connect connection (via a Transit VIF and a Direct Connect Gateway) as the primary path, and an AWS Site-to-Site VPN connection as the backup path. The administrator configures dynamic BGP routing on the Direct Connect connection, which dynamically propagates the on-premises prefix $192.168.0.0/16$ to the Transit Gateway route table. The Site-to-Site VPN is configured with a static route for $192.168.0.0/16$ pointing to the VPN attachment in the Transit Gateway route table. During a failover test, the administrator observes that all outbound traffic destined for the on-premises network continues to be sent over the backup VPN connection, even though the Direct Connect connection is fully operational. Which of the following actions will ensure that the Transit Gateway routes traffic to the on-premises network via the Direct Connect connection as the primary path under normal operating conditions?

Reconfigure the Site-to-Site VPN connection to use dynamic BGP routing, propagate the on-premises prefix to the Transit Gateway route table, and delete the static route pointing to the VPN attachment.

Update the VPC subnet route tables to direct the

192.168.0.0/16

prefix directly to the Direct Connect Gateway target rather than the Transit Gateway.

Configure BGP path prepending on the customer gateway to increase the AS-Path length of the static VPN connection route advertised to the Transit Gateway.

Deploy an AWS NAT Gateway in a public subnet within each VPC and update the subnet route tables to forward all

192.168.0.0/16

traffic through the NAT Gateway.

Cevabı ve açıklamayı göster

Cevap: Reconfigure the Site-to-Site VPN connection to use dynamic BGP routing, propagate the on-premises prefix to the Transit Gateway route table, and delete the static route pointing to the VPN attachment.

Cevap

AWS Transit Gateway route tables evaluate routes by prioritizing static routes over dynamically propagated routes. Because the Site-to-Site VPN was configured with a static route, it overrode the dynamically propagated Direct Connect route. Reconfiguring the VPN to use dynamic BGP routing and deleting the static route allows both attachments to propagate the prefix dynamically. Transit Gateway then defaults to selecting the Direct Connect gateway attachment over the Site-to-Site VPN attachment for identical propagated prefixes.

Adım Adım Çözüm

Analyze the Transit Gateway route evaluation rules.

AWS Transit Gateway route tables prioritize static routes over dynamically propagated routes for the same destination prefix.

This explains why the static route pointing to the VPN attachment is being preferred over the dynamic BGP route propagated by the Direct Connect connection.

Determine the required configuration change to place both routes on equal evaluation terms.

The Site-to-Site VPN must be converted to use dynamic BGP routing and the static route must be deleted from the Transit Gateway route table.

This allows the Transit Gateway to evaluate both paths as dynamically propagated routes.

Apply the default Transit Gateway route selection behavior for propagated routes.

The Transit Gateway automatically prefers the Direct Connect Gateway path over the Site-to-Site VPN path for the identical propagated prefix.

This ensures the Direct Connect connection serves as the primary path and the VPN automatically serves as the backup path.

Anahtar Kavram

AWS Transit Gateway Route Table Precedence (Static vs. Propagated Routes)

Soru 402Soru →

An organization has several development environments running in AWS. To reduce monthly expenditures, a SysOps administrator is analyzing AWS Trusted Advisor Cost Optimization recommendations. The administrator wants to identify resources that are either idle or underutilized based on the default criteria of Trusted Advisor checks. Which of the following conditions will cause AWS Trusted Advisor to flag resources as cost optimization opportunities? (Select TWO.)

Geçerli olan tümünü seçin

An Amazon RDS DB instance that has had no database connections for the past

7

consecutive days.

An Amazon EBS volume that has been unattached or has had less than

1\text{ IOPS}

of daily activity for the past

7

consecutive days.

An Amazon EC2 instance that has had a daily average CPU utilization below

10\%

and network I/O below

5\text{ MB}

for at least

2

days within a

7

-day window.

An Amazon S3 bucket containing objects that have not been accessed for

30

days and are missing a transition lifecycle rule.

An Elastic Load Balancer that has processed fewer than

100

requests over the last

14

days.

Cevabı ve açıklamayı göster

Cevap: An Amazon RDS DB instance that has had no database connections for the past $7$ consecutive days.; An Amazon EBS volume that has been unattached or has had less than $1\text{ IOPS}$ of daily activity for the past $7$ consecutive days.

Cevap

The options stating that an Amazon RDS DB instance has had no database connections for the past

7

consecutive days, and that an Amazon EBS volume has been unattached or has had less than

1\text{ IOPS}

of daily activity for the past

7

consecutive days are correct.

The correct options are the ones stating that an Amazon RDS DB instance has had no database connections for the past

7

consecutive days, and that an Amazon EBS volume has been unattached or has had less than

1\text{ IOPS}

of daily activity for the past

7

consecutive days. AWS Trusted Advisor evaluates RDS DB instance connections over a

7

-day rolling window to identify idle resources. It also checks EBS volumes over a

7

-day rolling window, flagging those that are unattached or have negligible I/O activity (less than

1\text{ IOPS}

daily) to help reduce storage costs.

Adım Adım Çözüm

Analyze AWS Trusted Advisor Cost Optimization check criteria for Amazon RDS.

Identify that Trusted Advisor monitors active database connections and flags RDS DB instances that have had zero connections for the last

7

days.

This helps determine if the RDS check criteria matches the scenario.

Analyze AWS Trusted Advisor Cost Optimization check criteria for Amazon EBS.

Identify that Trusted Advisor monitors volume attachment and daily read/write IOPS, flagging volumes that are unattached or have less than

1\text{ IOPS}

per day for the last

7

days.

This helps determine if the EBS check criteria matches the scenario.

Evaluate the incorrect options containing EC2 utilization, S3 lifecycle transitions, and load balancer request thresholds.

Identify that the EC2 check requires

4

or more days in the last

14

days, the ELB check evaluates a

7

-day period, and S3 lifecycle rules are not monitored by these specific idle checks.

This rules out the incorrect options based on metrics and evaluation windows.

Anahtar Kavram

AWS Trusted Advisor Cost Optimization Checks

Soru 403Soru →

A company runs a REST API on a fleet of Amazon EC2 instances located in a private subnet. These instances are registered to a target group for an Application Load Balancer (ALB) situated in the public subnets of the same VPC. The target group is configured to send HTTP health checks on port $8080$ with the path `/healthz`.

A SysOps administrator observes that the ALB is reporting all registered targets as unhealthy with the error code `Target.FailedHealthChecks`. Consequently, clients requesting the application receive HTTP $502$ (Bad Gateway) errors.

The administrator verifies the following configuration details:
- Connecting to the EC2 instances directly via AWS Systems Manager Session Manager and running `curl -I http://localhost:8080/healthz` returns HTTP $200$ OK.
- The Security Group for the EC2 instances allows inbound TCP traffic on port $8080$ from the ALB security group, and allows all outbound traffic.
- The Security Group for the ALB allows inbound TCP traffic on ports $80$ and $443$ from `0.0.0.0/0`, and allows all outbound traffic.
- The stateless Network Access Control List (NACL) for the private subnet has the following rules:
- Inbound: Rule $100$ allows TCP traffic on port $8080$ from the public subnets' CIDR block. Rule $32767$ denies all other traffic.
- Outbound: Rule $100$ allows TCP traffic on port $8080$ to the public subnets' CIDR block. Rule $32767$ denies all other traffic.

Which of the following is the most likely cause of the failing health checks?

The outbound Network Access Control List (NACL) for the private subnet blocks response traffic back to the ALB because it does not allow outbound TCP traffic to the public subnets on ephemeral ports (

1024

65535

The target group is configured to perform health checks on port

80

by default, creating a port mismatch because the instances are only listening on port

8080

The Route 53 active-passive failover routing policy is configured without an associated health check, which causes the load balancer health status to be ignored.

The target group's health check is pointing to a path that redirected the ALB to a secure HTTPS URL, leading the target group to mark the instances as unhealthy due to an unsupported redirect.

Cevabı ve açıklamayı göster

Cevap: The outbound Network Access Control List (NACL) for the private subnet blocks response traffic back to the ALB because it does not allow outbound TCP traffic to the public subnets on ephemeral ports ( $1024$ - $65535$ ).

Cevap

1024

65535

The correct answer is correct because Network Access Control Lists (NACLs) in AWS are stateless, meaning that return traffic must be explicitly allowed by rules. When an Application Load Balancer (ALB) performs a health check, it sends a request from a random port in the ephemeral range (

1024

65535

) to the target group port (

8080

). The instance attempts to respond back to the ALB's ephemeral port. Under the current configuration, the private subnet's outbound NACL rule only allows outbound traffic destined for port

8080

. Because the response traffic is destined for an ephemeral port (

1024

65535

), it is blocked by the catch-all deny rule.

Adım Adım Çözüm

Analyze the stateless nature of Network Access Control Lists (NACLs).

Identify that stateless firewalls require rules to explicitly allow both inbound and outbound traffic flows, unlike stateful security groups.

Since security groups are stateful and allow response traffic automatically, the root cause must reside in the stateless NACL configuration.

Trace the health check network request from the Application Load Balancer (ALB) to the EC2 instances.

The ALB sends a request from a random ephemeral source port (

1024

65535

) to the EC2 instance's destination port

8080

. The inbound NACL rule

100

permits this traffic.

This verifies that the request packet successfully reaches the application on the EC2 instances.

Trace the health check response traffic from the EC2 instances back to the ALB.

The EC2 instance sends a response packet from source port

8080

to the ALB's destination port (which is the ephemeral port used to open the connection). The outbound NACL only allows traffic where the destination port is

8080

Since the destination port of the response is an ephemeral port (

1024

65535

) and not

8080

, the outbound response packet is dropped by the default NACL deny rule.

Identify the required modification to resolve the block.

Add an outbound rule to the private subnet's NACL that allows outbound TCP traffic to the public subnets' CIDR block on ports

1024

65535

This allows the response packet to traverse the private subnet boundary and reach the ALB, completing the three-way handshake and validating the health check.

Anahtar Kavram

Stateless Network Access Control Lists (NACLs) and Ephemeral Ports

Tahmini Süre:2m 30s

Soru 404Soru →

A SysOps Administrator creates a Gateway VPC Endpoint for Amazon S3 in a VPC. However, EC2 instances in a private subnet continue to access Amazon S3 through a NAT Gateway, resulting in high NAT Gateway data processing charges. Which configuration issue is the root cause of this behavior?

The private subnet's route table is missing a route targeting the Internet Gateway for the S3 prefix list.

The Gateway VPC Endpoint was not associated with the route table of the private subnet.

The private subnet's route table directs S3 traffic to the NAT Gateway in the public subnet instead of the VPC Endpoint's network interface.

The Network Access Control List (NACL) associated with the private subnet is blocking outbound ephemeral ports to S3.

Cevabı ve açıklamayı göster

Cevap: The Gateway VPC Endpoint was not associated with the route table of the private subnet.

Cevap

The Gateway VPC Endpoint was not associated with the route table of the private subnet.

The correct answer is that the Gateway VPC Endpoint was not associated with the route table of the private subnet. For Gateway VPC Endpoints, AWS automatically updates the associated route tables with a prefix list route pointing to the endpoint. If the route table is not associated, traffic destined for Amazon S3 falls back to the default route, which in this case points to the NAT Gateway.

Adım Adım Çözüm

Analyze how Gateway VPC Endpoints route traffic.

Gateway VPC Endpoints for S3 or DynamoDB require association with one or more VPC route tables.

Associating the endpoint with a route table automatically creates a routing entry with the service prefix list as the destination and the gateway endpoint ID as the target.

Determine the path of traffic when route table association is missing.

If the subnet's route table is not associated with the Gateway VPC Endpoint, traffic destined for S3 will match the default route (

0.0.0.0/0

) which points to the NAT Gateway.

Without the specific prefix list route pointing to the endpoint, the traffic must follow the standard internet path configured for the private subnet.

Identify the configuration fix to stop using the NAT Gateway.

Associate the Gateway VPC Endpoint with the private subnet's route table.

This updates the route table automatically and redirects S3 traffic locally and privately, bypassing the NAT Gateway entirely.

Anahtar Kavram

Gateway VPC Endpoints must be associated with subnet route tables to redirect traffic privately without using a NAT Gateway.

Soru 405Soru →

A SysOps administrator is troubleshooting an issue with an Application Load Balancer (ALB). The ALB routes traffic to a fleet of Amazon EC2 instances running a web application on port 8080. In the AWS Management Console, all instances in the target group are marked as unhealthy with the status reason code 'Health.ResponseMismatch'. When analyzing the application logs on the EC2 instances, the administrator observes that incoming health check requests to the '/healthz' path are returning a '401 Unauthorized' status code because a global authentication middleware is applied. Which of the following actions should the administrator take to resolve this health check issue? (Select two.)

Geçerli olan tümünü seçin

Modify the web application configuration to bypass the authentication middleware for the '/healthz' path.

Configure the target group's health check settings to include '401' in the success codes list.

Update the target group's health check configuration to use HTTP port 80 instead of the traffic-port.

Change the health check protocol to HTTPS to encrypt the request and bypass authentication.

Configure an active-passive Route 53 failover routing policy to route health checks directly to the EC2 instances.

Cevabı ve açıklamayı göster

Cevap: Modify the web application configuration to bypass the authentication middleware for the '/healthz' path.; Configure the target group's health check settings to include '401' in the success codes list.

Cevap

To resolve the health check failure, the administrator must either modify the web application configuration to bypass the authentication middleware for the '/healthz' path, or configure the target group's health check settings to include '401' in the success codes list.

The correct responses are to modify the web application configuration to bypass the authentication middleware for the '/healthz' path, and to configure the target group's health check settings to include '401' in the success codes list. By default, Application Load Balancers expect a 200 OK status code. Since the application blocks unauthorized requests with a 401 status code, the ALB marks the targets as unhealthy due to a response mismatch. Bypassing authentication for the health check endpoint restores the expected 200 OK response. Alternatively, configuring the ALB target group to accept 401 as a success code allows the health checks to pass despite the authentication block.

Adım Adım Çözüm

Analyze the health check failure reason and target group settings.

The target group is configured to expect a default success code of 200, but the targets are returning 401 Unauthorized due to authentication middleware.

This establishes that the network path is open (hence no timeout) but the application response code causes the Health.ResponseMismatch.

Evaluate application-side remediation options.

Excluding the '/healthz' endpoint from the global authentication middleware allows the application to respond with a 200 OK status code.

This is a standard best practice that enables external monitoring and load balancers to assess application health without exposing credentials.

Evaluate load balancer-side remediation options.

Updating the target group configuration to accept 401 in the success codes list allows the health check to pass using the existing application response.

This configuration accepts the 401 Unauthorized status as verification that the web server is running and responding.

Anahtar Kavram

Handling Application Load Balancer health check status code mismatches by either aligning application response codes or load balancer success code expectations.

Soru 406Soru →

A company runs a memory-bound Java application on a fleet of Amazon EC2 m6i.xlarge instances. A SysOps Administrator notices that AWS Compute Optimizer recommendations for these instances only display utilization data for CPU, network, and disk, while memory utilization is listed as 'Unavailable'. Consequently, the tool recommends down-sizing the instances to c6i.xlarge based on low CPU utilization, which would lead to application failures due to insufficient memory. What should the administrator do to enable AWS Compute Optimizer to analyze memory utilization and provide accurate right-sizing recommendations?

Configure AWS Cost Anomaly Detection to monitor EC2 cost anomalies, which automatically exposes historical memory metrics to AWS Compute Optimizer.

Install and configure the Unified CloudWatch Agent on the EC2 instances to publish memory utilization metrics to Amazon CloudWatch.

Enable detailed monitoring in Amazon CloudWatch for the EC2 instances to increase metric granularity to 1-minute intervals.

Define cost allocation tags for the EC2 instances and activate them in the AWS Billing Console to permit memory metadata ingestion.

Cevabı ve açıklamayı göster

Cevap: Install and configure the Unified CloudWatch Agent on the EC2 instances to publish memory utilization metrics to Amazon CloudWatch.

Cevap

Install and configure the Unified CloudWatch Agent on the EC2 instances to publish memory utilization metrics to Amazon CloudWatch.

The correct action is to install and configure the Unified CloudWatch Agent on the EC2 instances. Memory utilization is an operating system-level metric that is not collected by the hypervisor by default. By running the Unified CloudWatch Agent and sending memory metrics to Amazon CloudWatch, AWS Compute Optimizer can automatically ingest this data. This enables Compute Optimizer to make right-sizing recommendations that respect memory requirements, preventing out-of-memory errors on memory-bound workloads.

Adım Adım Çözüm

Identify the metric gap in AWS Compute Optimizer.

Memory utilization is listed as 'Unavailable' because memory is an operating system-level metric that AWS does not collect by default.

Compute Optimizer cannot recommend right-sizing for memory-bound workloads without visibility into memory usage.

Deploy the Unified CloudWatch Agent on the EC2 instances.

The agent collects system-level metrics (specifically memory utilization) and sends them to CloudWatch.

AWS Compute Optimizer integrates with CloudWatch to retrieve memory metrics if they are being published.

Verify recommendations in the AWS Compute Optimizer console.

Compute Optimizer evaluates the memory metrics and adjusts its recommendation, preventing an incorrect down-sizing to a compute-optimized instance class that lacks sufficient memory.

This ensures the application avoids out-of-memory errors by accounting for the true bottleneck.

Anahtar Kavram

AWS Compute Optimizer requires the Unified CloudWatch Agent to analyze EC2 memory utilization for right-sizing recommendations.

Tahmini Süre:2m 0s

Soru 407Soru →

A company runs a batch processing application on a fleet of Amazon EC2 instances within an AWS Organizations structure. A SysOps Administrator wants to use AWS Compute Optimizer to obtain right-sizing recommendations for these instances. Currently, Compute Optimizer only provides recommendations based on CPU and network metrics, and reports that memory metrics are unavailable. Which two actions must the administrator take to enable AWS Compute Optimizer to deliver memory-aware right-sizing recommendations? (Select two.)

Geçerli olan tümünü seçin

Install and configure the Unified CloudWatch Agent on the EC2 instances to publish memory utilization metrics to Amazon CloudWatch.

Associate an IAM instance profile with the EC2 instances that includes the CloudWatchAgentServerPolicy managed policy.

Enable Amazon EC2 detailed monitoring for the instances within the AWS Organizations management account.

Activate the cost allocation tags for memory utilization in the AWS Billing and Cost Management console.

Configure AWS Cost Anomaly Detection to track memory utilization anomalies and forward them to AWS Compute Optimizer.

Cevabı ve açıklamayı göster

Cevap: Install and configure the Unified CloudWatch Agent on the EC2 instances to publish memory utilization metrics to Amazon CloudWatch.; Associate an IAM instance profile with the EC2 instances that includes the CloudWatchAgentServerPolicy managed policy.

Cevap

To enable memory-aware recommendations in AWS Compute Optimizer, the SysOps Administrator must install and configure the Unified CloudWatch Agent on the EC2 instances to publish memory metrics, and associate an IAM instance profile with the instances that includes the CloudWatchAgentServerPolicy managed policy to grant the necessary permissions.

AWS Compute Optimizer relies on OS-level memory metrics to perform memory-based right-sizing analysis. These metrics must be sent to Amazon CloudWatch using the Unified CloudWatch Agent, and the EC2 instances must have an IAM role/instance profile with permissions (such as CloudWatchAgentServerPolicy) to write those metrics to CloudWatch.

Adım Adım Çözüm

Deploy and configure the Unified CloudWatch Agent on the EC2 instances.

The agent collects OS-level memory utilization metrics and publishes them to Amazon CloudWatch under the CWAgent namespace.

AWS Compute Optimizer does not receive memory utilization metrics by default because they are OS-level metrics not visible to the hypervisor.

Ensure the EC2 instances have the required IAM permissions by attaching an instance profile with the CloudWatchAgentServerPolicy.

The CloudWatch Agent on the EC2 instances is authorized to write custom metrics to the CloudWatch service.

Without these permissions, the agent cannot publish the memory metrics, meaning AWS Compute Optimizer will not have the data needed to perform memory-aware analysis.

Anahtar Kavram

AWS Compute Optimizer requires the Unified CloudWatch Agent to analyze EC2 instance memory utilization because memory is an OS-level metric that is not available via default CloudWatch hypervisor metrics.

Soru 408Soru →

An organization is establishing a redundant hybrid network connection by deploying an AWS Site-to-Site VPN to act as a backup for a $1\text{ Gbps}$ AWS Direct Connect connection. Both the Direct Connect connection (via a Direct Connect Gateway) and the VPN connection terminate on an AWS Transit Gateway. The on-premises router advertises the local network prefix $192.168.0.0/16$ via BGP over both paths. The organization wants to ensure that the Direct Connect path is preferred for all traffic sent from AWS to the on-premises network, and that failover to the VPN path is automatic.

Which configuration steps should the SysOps Administrator perform to achieve this design? (Select TWO.)

Geçerli olan tümünü seçin

Confirm that the on-premises network prefix is propagated to the Transit Gateway route table from both the Direct Connect Gateway and the VPN attachments.

Configure the Transit Gateway route table with a static route for

192.168.0.0/16

pointing to the Direct Connect Gateway attachment.

Associate the Direct Connect Gateway attachment and the VPN attachment with separate Transit Gateway route tables that do not share route information.

Trust the default Transit Gateway route evaluation order, which automatically prefers propagated Direct Connect Gateway routes over propagated Site-to-Site VPN routes for identical prefixes.

Advertise a smaller Multi-Exit Discriminator (MED) value from the on-premises router over the VPN connection than over the Direct Connect connection.

Cevabı ve açıklamayı göster

Cevap: Confirm that the on-premises network prefix is propagated to the Transit Gateway route table from both the Direct Connect Gateway and the VPN attachments.; Trust the default Transit Gateway route evaluation order, which automatically prefers propagated Direct Connect Gateway routes over propagated Site-to-Site VPN routes for identical prefixes.

Cevap

Confirm that the on-premises network prefix is propagated to the Transit Gateway route table from both the Direct Connect Gateway and the VPN attachments, and trust the default Transit Gateway route evaluation order, which automatically prefers propagated Direct Connect Gateway routes over propagated Site-to-Site VPN routes for identical prefixes.

To achieve automatic failover while preferring the Direct Connect path, both paths must propagate their routes to the same Transit Gateway route table. Under this configuration, the Transit Gateway automatically applies its default route evaluation preference for identical prefixes. Propagated routes from Direct Connect Gateway attachments are preferred over propagated routes from Site-to-Site VPN attachments. Therefore, the Direct Connect connection will be preferred under normal conditions, and failover to the VPN will occur automatically if the Direct Connect path is withdrawn.

Adım Adım Çözüm

Ensure that route propagation is enabled for both the Direct Connect Gateway attachment and the VPN attachment in the target Transit Gateway route table.

The Transit Gateway dynamically learns the

192.168.0.0/16

route from both paths, enabling dynamic failover capabilities.

Both paths must be registered in the route table so that the backup path can be used automatically if the primary path is withdrawn.

Allow the Transit Gateway to select the path based on its default route evaluation order without adding static routes.

The Transit Gateway automatically directs traffic over the Direct Connect Gateway attachment when it is active, and switches to the VPN attachment if the Direct Connect route is lost.

AWS Transit Gateway evaluates propagated routes by preferring Direct Connect Gateway attachments over Site-to-Site VPN attachments when prefixes are identical.

Anahtar Kavram

AWS Transit Gateway Route Evaluation Preference

Soru 409Soru →

A company hosts a high-traffic web application on a fleet of Amazon EC2 instances managed by an Auto Scaling group. The instances are registered with a target group of an Application Load Balancer (ALB). The target group's health check is configured to request the path `/health` on port 80. The script at `/health` performs a deep health check by querying an Amazon RDS PostgreSQL database to verify connection status.

During a marketing event, a massive traffic spike causes the RDS database CPU utilization to reach 100%, resulting in query queuing. Consequently, the ALB health checks on the EC2 instances begin timing out, and the ALB marks all instances as unhealthy. The Auto Scaling group immediately begins terminating the EC2 instances and launching new ones, which also fail health checks upon initialization, leading to a complete application outage.

Which action should a SysOps administrator take to resolve this issue and prevent future cascading failures?

Change the target group health check path to a shallow endpoint, such as a static page or a simple script that only verifies the web server status without querying the database.

Configure the target group health check protocol to HTTPS and change the port to match the database port to directly monitor database connectivity.

Update the subnet's outbound Network Access Control List (NACL) rules to restrict outbound traffic solely to port 80 and the database port, removing access to the ephemeral port range to prioritize health checks.

Configure an Amazon Route 53 active-passive failover routing policy to route client traffic to a secondary static error page when the primary ALB's health checks fail.

Cevabı ve açıklamayı göster

Cevap: Change the target group health check path to a shallow endpoint, such as a static page or a simple script that only verifies the web server status without querying the database.

Cevap

Change the target group health check path to a shallow endpoint, such as a static page or a simple script that only verifies the web server status without querying the database.

Changing the target group health check path to a shallow endpoint is the correct resolution. A shallow health check only verifies that the web server process (e.g., Apache, Nginx, or a Node.js process) is running and responsive on the designated port. It does not perform deep database queries. This prevents database overload or connection exhaustion from causing a cascading failure, where the Auto Scaling group terminates healthy EC2 instances that are simply waiting on database responses.

Adım Adım Çözüm

Analyze the cause of the health check failures and the cascading outage.

The database CPU utilization spiked to 100%, causing the deep health check script `/health` (which queries the database) to time out. The ALB marked all instances unhealthy, prompting the Auto Scaling group to terminate and replace them, which worsened the outage.

Understanding the interaction between deep health checks, database load, and Auto Scaling group termination behavior is critical to identifying the root cause.

Decouple the application instance health from the backend database health.

Replace the deep health check path with a shallow health check path (e.g., `/ping` or `/health-shallow`) that only validates the web server is running and listening on port 80.

A shallow health check prevents transient database latency or overload from triggering mass instance termination, localizing the database issue without destroying the compute capacity.

Configure separate database monitoring and alerting.

Use Amazon CloudWatch alarms on the RDS database's CPU utilization and DB connections to trigger alerts or Auto Scaling actions on the database tier (like read replicas or scaling up).

Database health should be monitored and managed independently of individual web application instance health to prevent cascading failures.

Anahtar Kavram

Deep vs. Shallow Health Checks in Load Balancing

Soru 410Soru →

A company has a VPC with private subnets in the us-west-2 Region. Amazon EC2 instances in these subnets transfer $15\text{ TB}$ of backup data monthly to an on-premises storage system. To reduce data transfer costs, the company establishes an AWS Direct Connect connection and configures a private virtual interface (VIF) associated with a Virtual Private Gateway (VGW) attached to the VPC. However, the SysOps administrator notices that the monthly bill still reflects high NAT Gateway data processing charges and standard internet data transfer out (DTO) fees for this backup traffic. Which action should the SysOps administrator take to resolve this issue and minimize costs?

Enable route propagation on the private subnets' route tables to dynamically populate the on-premises routes from the Virtual Private Gateway.

Modify the NAT Gateway's route table to add a route for the on-premises network CIDR pointing to the Virtual Private Gateway.

Create an S3 Gateway VPC Endpoint to redirect the transfer traffic, but omit associating it with the private subnets' route tables.

Apply billing tags to the NAT Gateway and activate them as cost allocation tags in the AWS Billing console.

Cevabı ve açıklamayı göster

Cevap: Enable route propagation on the private subnets' route tables to dynamically populate the on-premises routes from the Virtual Private Gateway.

Cevap

Enable route propagation on the private subnets' route tables to dynamically populate the on-premises routes from the Virtual Private Gateway.

Enabling route propagation on the private subnets' route tables automatically updates the route tables with routes advertised by the on-premises network via BGP over the Direct Connect VIF. Because a more specific route now exists for the on-premises network compared to the default route (

0.0.0.0/0

), the EC2 instances bypass the NAT Gateway and send the backup traffic directly to the Virtual Private Gateway. This eliminates the NAT Gateway data processing charges and utilizes the cheaper Direct Connect Data Transfer Out (DTO) rates.

Adım Adım Çözüm

Analyze the current traffic path and routing configuration.

Identify that the private subnet route table only has a default route (

0.0.0.0/0

) pointing to the NAT Gateway, forcing the backup traffic destined for the on-premises network to route through the NAT Gateway and egress over the internet.

To understand why NAT Gateway charges and standard internet DTO fees are still being incurred despite having a Direct Connect connection.

Determine the correct target for the on-premises network traffic.

The Virtual Private Gateway (VGW) attached to the VPC connects to the Direct Connect private virtual interface (VIF), which is the correct destination for routing on-premises traffic privately and cost-effectively.

Direct Connect offers significantly lower Data Transfer Out (DTO) rates and avoids NAT Gateway processing fees when accessed directly.

Implement the routing change using route propagation.

Enable route propagation on the private subnets' route tables. This dynamically adds the BGP-advertised routes from the on-premises network pointing to the VGW.

This ensures the private subnet route table has a more specific route for the on-premises network than the default

0.0.0.0/0

route, causing the traffic to bypass the NAT Gateway and route directly over the Direct Connect connection.

Anahtar Kavram

Routing propagation over Virtual Private Gateway for Direct Connect cost optimization

Tahmini Süre:1m 30s

Soru 411Soru →

A startup is experiencing unexpected cost increases because development teams occasionally leave Amazon EC2 instances running over weekends in a sandbox account. The SysOps administrator must implement a cost control mechanism to enforce a monthly cost limit of $300. If the actual cost reaches this limit, all running EC2 instances in the account must be stopped automatically, and the operations team must receive a notification in their Slack channel.

Which combination of steps should the SysOps administrator perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create a monthly cost budget in AWS Budgets with an actual cost threshold of $300. Define a budget action to stop the EC2 instances, and associate an IAM role that trusts budgets.amazonaws.com and grants permissions for ec2:DescribeInstances and ec2:StopInstances.

Configure the budget alert to send a notification to an Amazon SNS topic. Configure AWS Chatbot to receive messages from the SNS topic and deliver them to the Slack channel.

Create a billing alarm in Amazon CloudWatch that monitors the EstimatedCharges metric. Configure the alarm action to stop the EC2 instances when the metric exceeds $300, and configure an email subscription for the Slack channel.

Create an AWS Cost Anomaly Detection monitor for the sandbox account with a threshold of $300. Configure an anomaly subscription to trigger an AWS Lambda function that stops all running EC2 instances and posts a message to Slack.

Configure a budget in AWS Budgets with an action to attach a Service Control Policy (SCP) that denies ec2:RunInstances. Attach the SCP to the sandbox account when the cost reaches $300, and use Amazon EventBridge to send a notification to Slack.

Cevabı ve açıklamayı göster

Cevap: Create a monthly cost budget in AWS Budgets with an actual cost threshold of $300. Define a budget action to stop the EC2 instances, and associate an IAM role that trusts budgets.amazonaws.com and grants permissions for ec2:DescribeInstances and ec2:StopInstances.; Configure the budget alert to send a notification to an Amazon SNS topic. Configure AWS Chatbot to receive messages from the SNS topic and deliver them to the Slack channel.

Cevap

To meet the requirements, the SysOps administrator should create a monthly cost budget in AWS Budgets with a threshold of $300 and configure a budget action to stop EC2 instances using an IAM role with the correct trust relationship and permissions. Additionally, the budget alert should be configured to publish to an Amazon SNS topic, which triggers an AWS Chatbot configuration connected to the Slack channel.

The correct steps involve setting up an AWS Budgets monthly cost budget with a threshold of $300. To automatically stop instances, a budget action must be defined using an IAM role that permits the budgets service principal to execute stop commands. To send notifications to Slack, the budget alert is published to an Amazon SNS topic, and AWS Chatbot is configured to subscribe to that topic and route the alerts to the Slack channel.

Adım Adım Çözüm

Define a monthly cost budget in AWS Budgets with an actual cost threshold of $300.

A monitoring threshold is established to track the actual cumulative monthly cost of the sandbox account.

The requirement specifies taking action and notifying when the actual monthly cost reaches $300.

Configure a budget action to stop the EC2 instances, and associate an IAM role that trusts budgets.amazonaws.com and grants permissions for ec2:DescribeInstances and ec2:StopInstances.

AWS Budgets is authorized and configured to automatically stop running EC2 instances when the cost threshold is met.

AWS Budgets Actions require an IAM execution role with a trust relationship for the budgets service principal to perform automated mitigation actions like stopping instances.

Configure the budget alert to send a notification to an Amazon SNS topic, and subscribe AWS Chatbot to the SNS topic to forward messages to the Slack channel.

Notifications are routed through the SNS topic and formatted by AWS Chatbot for Slack.

AWS Chatbot integrates with Amazon SNS to natively format and deliver AWS notifications to chat platforms like Slack.

Anahtar Kavram

AWS Budgets supports automated cost-control actions, such as stopping EC2 instances, by assuming a configured service-linked IAM role. Alerts can be integrated with AWS Chatbot via Amazon SNS to notify external chat channels like Slack.

Soru 412Soru →

A SysOps Administrator is migrating hybrid connectivity for a company's AWS environment. Currently, an on-premises data center is connected to a single VPC via an AWS Site-to-Site VPN attached to a Virtual Private Gateway (VGW). To support connectivity to multiple new VPCs, the administrator deploys an AWS Transit Gateway, attaches the existing VPC to the Transit Gateway, and establishes a new Site-to-Site VPN connection terminating on the Transit Gateway. The IPsec tunnels are successfully established and show as UP, but EC2 instances in the VPC are unable to reach the on-premises network. Which of the following is the most likely cause of this issue?

The Security Group associated with the EC2 instances does not contain an outbound rule to allow ephemeral ports (

1024

65535

) for response traffic from the on-premises network.

The customer gateway (CGW) configuration on the AWS side must be deleted and recreated because a CGW can only be associated with one active VPN connection at a time.

The VPC subnet route tables have not been updated to direct traffic destined for the on-premises network to the Transit Gateway attachment.

The Transit Gateway route table lacks a route propagation association for the VPC attachment, preventing the VPC from learning the on-premises routes.

Cevabı ve açıklamayı göster

Cevap: The VPC subnet route tables have not been updated to direct traffic destined for the on-premises network to the Transit Gateway attachment.

Cevap

The VPC subnet route tables have not been updated to direct traffic destined for the on-premises network to the Transit Gateway attachment.

The correct option is correct because when migrating VPN termination from a Virtual Private Gateway (VGW) to an AWS Transit Gateway (TGW), VPC subnet route tables do not automatically update their targets. The static or propagated routes pointing to the VGW (vgw-xxxx) must be manually updated to target the Transit Gateway attachment (tgw-attach-xxxx) to ensure outbound traffic is successfully routed to the Transit Gateway.

Adım Adım Çözüm

Analyze the physical layer and connection status of the VPN.

The VPN tunnels are established and UP, confirming that the physical/tunnel connection between on-premises and AWS is operational.

This rules out direct VPN establishment errors or CGW configuration issues on the physical link.

Examine the VPC routing path to the on-premises network.

The EC2 instances in the subnets rely on the VPC subnet route tables to direct traffic. If these tables still reference the old Virtual Private Gateway (VGW) instead of the new Transit Gateway (TGW) attachment, traffic destinies fail.

Subnet route tables must be explicitly updated to point traffic destined for the on-premises CIDR block to the TGW attachment ID.

Verify return routing from the Transit Gateway back to the VPC.

The Transit Gateway route tables route traffic from the VPN attachment to the VPC attachment, but this only functions if traffic actually reaches the Transit Gateway from the VPC first.

VPC routing takes precedence, and VPC subnet route tables do not automatically propagate routes from the Transit Gateway.

Anahtar Kavram

AWS Transit Gateway VPC routing behavior requires static route additions in VPC subnet route tables to direct traffic to the Transit Gateway attachment.

Soru 413Soru →

A company runs applications on Amazon EC2 instances in a private subnet. The applications must securely retrieve API keys from AWS Secrets Manager. To keep the traffic within the AWS network, a SysOps Administrator deploys an Interface VPC Endpoint for Secrets Manager (com.amazonaws.us-east-1.secretsmanager). However, connection attempts from the EC2 instances to the Secrets Manager service keep timing out. Which of the following actions will resolve this issue?

Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443 from the security group of the EC2 instances.

Add a route to the private subnet's route table with the destination pointing to the AWS Secrets Manager prefix list and the target pointing to the VPC endpoint ID.

Configure the private subnet's route table to direct all Secrets Manager API traffic through a NAT Gateway residing in a public subnet.

Update the subnet's network ACL to allow outbound ephemeral ports to the public internet while blocking all inbound traffic from port 443.

Cevabı ve açıklamayı göster

Cevap: Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443 from the security group of the EC2 instances.

Cevap

Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443 from the security group of the EC2 instances.

The correct action is to modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443 from the security group of the EC2 instances. Interface VPC Endpoints provision Elastic Network Interfaces (ENIs) inside the VPC subnets. These ENIs are secured by security groups. Since the API clients (the EC2 instances) communicate with these ENIs over HTTPS, the security group attached to the endpoint must allow inbound traffic on TCP port 443 from the EC2 instances' security group or subnet.

Adım Adım Çözüm

Identify the type of VPC endpoint being used.

The scenario uses an Interface VPC Endpoint (powered by AWS PrivateLink) for AWS Secrets Manager.

Interface endpoints use Elastic Network Interfaces (ENIs) and security groups, unlike Gateway endpoints which use route tables.

Determine the network protocol and port required for the service API.

AWS Secrets Manager API endpoints accept secure HTTPS traffic over TCP port 443.

EC2 instances must be able to initiate an HTTPS connection to the endpoint's ENI.

Configure the security groups to allow the traffic flow.

Modify the security group attached to the Interface VPC Endpoint to permit inbound HTTPS (port 443) traffic originating from the EC2 instances.

Security groups are stateful and control traffic at the ENI level. The endpoint security group must explicitly allow the incoming request.

Anahtar Kavram

Interface VPC Endpoints rely on security groups to control inbound access to their ENIs, whereas routing is handled via DNS (Private DNS) rather than route table entries.

Soru 414Soru →

An application runs on Amazon EC2 instances in private subnets across two Availability Zones (`us-east-1a` and `us-east-1b`) in a VPC. The instances continuously ingest sensor data and send it to an Amazon Kinesis data stream in the same region, transferring approximately $10\text{ TB}$ of data monthly. Currently, all internet-bound traffic from these subnets routes through a single NAT Gateway located in `us-east-1a`. The monthly AWS bill shows high NAT Gateway data processing charges. Which solution will minimize the data transfer and processing costs while maintaining secure, private connectivity to the Kinesis data stream?

Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon Kinesis in both Availability Zones, and enable Private DNS for the endpoint.

Create a Gateway VPC Endpoint for Amazon Kinesis, and associate it with the route tables of the private subnets in both Availability Zones.

Deploy a second NAT Gateway in `us-east-1b`, and update the route table for the subnet in `us-east-1b` to route traffic through the new NAT Gateway.

Associate an Internet Gateway with the VPC, assign public IP addresses to the EC2 instances, and update the route tables to route Kinesis traffic directly to the Internet Gateway.

Cevabı ve açıklamayı göster

Cevap: Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon Kinesis in both Availability Zones, and enable Private DNS for the endpoint.

Cevap

Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon Kinesis in both Availability Zones, and enable Private DNS for the endpoint.

The correct solution is to use Interface VPC Endpoints (AWS PrivateLink) for Amazon Kinesis with Private DNS enabled. Interface VPC Endpoints route traffic privately over the AWS backbone network, bypassing the NAT Gateway entirely. The data processing rate for Interface VPC Endpoints is

\$0.01\text{ per GB}

, which is much lower than the NAT Gateway processing fee of

\$0.045\text{ per GB}

. In addition, placing an interface endpoint in each Availability Zone eliminates cross-AZ data transfer fees. Enabling Private DNS ensures that the application can query Kinesis using its standard DNS names without code modifications.

Adım Adım Çözüm

Analyze current costs

Current NAT Gateway processing cost is

10,000\text{ GB} \times \$0.045\text{/GB} = \$450\text{/month}

plus cross-AZ data transfer charges for the instances in `us-east-1b` routing to `us-east-1a` (

5,000\text{ GB} \times \$0.01\text{/GB} = \$50\text{/month}

) and the NAT Gateway hourly charge (

\,\sim\!\!\$32.85\text{/month}

), totaling approximately

\$532.85\text{/month}

Establishing a baseline cost helps evaluate the savings of alternative routing configurations.

Identify the endpoint type supported by Amazon Kinesis Data Streams

Kinesis Data Streams supports Interface VPC Endpoints (AWS PrivateLink), which cost

\$0.014\text{ per hour}

per endpoint and

\$0.01\text{ per GB}

for data processing.

Gateway VPC Endpoints are free but are only supported by S3 and DynamoDB; other services require Interface VPC Endpoints.

Calculate the Interface VPC Endpoint solution costs

Deploying Interface Endpoints in two Availability Zones costs

2 \times \$0.014\text{/hour} \times 730\text{ hours} = \$20.44\text{/month}

plus data processing costs of

10,000\text{ GB} \times \$0.01\text{/GB} = \$100\text{/month}

, totaling

\$120.44\text{/month}

Comparing the new cost of

\$120.44\text{/month}

to the current cost of

\$532.85\text{/month}

shows savings of over

\$400\text{/month}

Configure the Interface VPC Endpoint settings

Enable Private DNS to map the default public Kinesis DNS hostnames to the private IP addresses of the endpoint network interfaces.

This allows the application on the EC2 instances to continue writing to Kinesis without code modifications or route table updates.

Anahtar Kavram

Using Interface VPC Endpoints (AWS PrivateLink) to optimize data transfer costs by bypassing NAT Gateways for internal AWS service traffic.

Soru 415Soru →

A SysOps administrator is managing an AWS account for a project team that has a strict monthly spending limit of $10,000$ . The administrator must set up a mechanism that alerts the team via email when the forecasted monthly spend is projected to exceed the budget. Additionally, if the actual spend reaches $100\%$ of the limit, the mechanism must automatically restrict the team's ability to launch new resources by applying a restrictive IAM policy to their development group. Which AWS service and configuration should the administrator use to meet these requirements with the least operational overhead?

Create a monthly cost budget of

10,000

in AWS Budgets. Add an alert rule for when the forecasted spend exceeds

100\%

of the budget to send an email notification. Add an AWS Budgets Action triggered when actual spend reaches

100\%

that attaches the restrictive IAM policy to the target group, using a custom IAM execution role that allows the budgets.amazonaws.com service principal to assume it.

Create an Amazon CloudWatch billing alarm with a threshold of

10,000

based on the EstimatedCharges metric. Configure the alarm to send an email notification via Amazon SNS and use a built-in CloudWatch alarm action to automatically attach the restrictive IAM policy to the IAM group when the alarm enters the ALARM state.

Create an AWS Cost Anomaly Detection monitor for the account. Set up an anomaly subscription with a threshold of

10,000

to send email alerts, and configure the monitor to automatically apply the restrictive IAM policy to the IAM group when an anomaly is detected.

Create a monthly cost budget of

10,000

in AWS Budgets. Add an alert rule for forecasted spend to send an email. Add an AWS Budgets Action to attach the IAM policy to the group, but do not assign a custom IAM execution role, relying on the default AWS Budgets service-linked role to perform the policy attachment.

Cevabı ve açıklamayı göster

Cevap: Create a monthly cost budget of $10,000$ in AWS Budgets. Add an alert rule for when the forecasted spend exceeds $100\%$ of the budget to send an email notification. Add an AWS Budgets Action triggered when actual spend reaches $100\%$ that attaches the restrictive IAM policy to the target group, using a custom IAM execution role that allows the budgets.amazonaws.com service principal to assume it.

Cevap

Create a monthly cost budget of

10,000

in AWS Budgets, configure a forecasted spend alert for email notification, and use AWS Budgets Actions to attach the restrictive IAM policy using a custom IAM execution role.

AWS Budgets is the correct tool because it allows tracking costs against a static monthly threshold (

10,000

) and supports alerts based on forecasted spend. It also natively supports AWS Budgets Actions, which can execute automated tasks such as attaching a restrictive IAM policy to an IAM group. This action requires a custom IAM execution role that grants the AWS Budgets service principal permission to assume it.

Adım Adım Çözüm

Create a monthly cost budget with a limit of

10,000

in AWS Budgets.

Establishes the budget baseline for monitoring the project's monthly spend.

AWS Budgets is the standard tool for setting custom budgets that track actual or forecasted costs.

Create an alert threshold in the budget configured at

100\%

of forecasted spend.

Triggers an email notification if the monthly cost projection exceeds

10,000

Forecasted spend alerts provide early warnings before the actual budget limit is breached.

Define an AWS Budgets Action triggered at

100\%

of actual spend, selecting the IAM policy action type to target the development group, and associate it with a custom IAM execution role.

Automatically attaches the restrictive IAM policy to the development group when the actual budget limit is reached.

AWS Budgets Actions natively support applying IAM policies to restrict permissions, but require a custom execution role with a trust policy allowing the budgets.amazonaws.com service principal to assume it.

Anahtar Kavram

AWS Budgets and Cost Alerts

Tahmini Süre:1m 30s

Soru 416Soru →

A research lab runs data processing workloads on Amazon EC2 instances in a single AWS account. The administrator wants to configure AWS Budgets to automatically stop all EC2 instances tagged with `Environment=Sandbox` when the actual monthly spend reaches $550.

Which TWO configurations are required to implement this control? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM role with a trust policy that allows the AWS Budgets service principal to assume the role, and attach a permissions policy allowing the stopping of EC2 instances.

Grant the administrator who creates the budget the iam:PassRole permission for the IAM role assigned to the budget action.

Create an Amazon CloudWatch billing alarm that monitors estimated charges and configure a metric filter to trigger a Systems Manager Automation document.

Configure an AWS Cost Anomaly Detection monitor with a threshold of $550 and link it to an AWS Lambda function that stops the instances.

Attach a Service Control Policy (SCP) to the AWS account that denies ec2:StartInstances and ec2:RunInstances operations.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that allows the AWS Budgets service principal to assume the role, and attach a permissions policy allowing the stopping of EC2 instances.; Grant the administrator who creates the budget the iam:PassRole permission for the IAM role assigned to the budget action.

Cevap

Creating an IAM role that allows the AWS Budgets service principal to assume the role with permissions to stop EC2 instances, and granting the administrator the iam:PassRole permission for that role.

The correct answer consists of creating an IAM role that the AWS Budgets service principal can assume to execute the stop action, and granting the configuring administrator the iam:PassRole permission. Together, these allow AWS Budgets to stop the EC2 instances securely when the budget threshold is exceeded.

Adım Adım Çözüm

Configure the IAM role for AWS Budgets.

An IAM role is created with a trust relationship allowing 'budgets.amazonaws.com' to assume it, and it contains policy permissions like 'ec2:StopInstances' and 'ec2:DescribeInstances'.

AWS Budgets must be authorized to perform management actions (like stopping instances) on behalf of the account owner.

Configure user permissions for creating the budget action.

The SysOps administrator's IAM policy is updated to include the 'iam:PassRole' permission targeting the AWS Budgets IAM role.

To prevent privilege escalation, AWS requires users to have explicit 'iam:PassRole' permissions when assigning roles to services.

Configure the AWS Budgets action inside the AWS Billing console.

A cost budget is set up with an actual threshold of $550, linking the action type to stop the EC2 instances using the configured IAM role.

This links the budget violation to the automated containment action.

Anahtar Kavram

AWS Budgets Actions allow SysOps administrators to configure automated remediation controls (such as stopping EC2 or RDS instances) when budget thresholds are breached, requiring a service-trusted IAM role and iam:PassRole permissions.

Soru 417Soru →

A financial services company uploads monthly compliance reports as PDF documents to an Amazon S3 Standard bucket. The reports are frequently accessed during the first 30 days. From day 31 to day 60, the reports are accessed occasionally but must be retrieved instantly when needed. After 60 days, access is extremely rare, and a retrieval time of several hours is acceptable for audit purposes. The reports must be deleted after 3 years.

A SysOps administrator attempts to implement the following Amazon S3 Lifecycle configuration:
* Transition to S3 Standard-IA after 30 days
* Transition to S3 Glacier Flexible Retrieval after 45 days
* Expiration after 1095 days

However, the AWS CLI returns a validation error when the administrator tries to apply the lifecycle policy.

Which of the following describes the cause of this error and the action required to successfully implement the cost-optimization strategy?

S3 Lifecycle rules require that the transition to S3 Glacier Flexible Retrieval occur at least 30 days after the transition to S3 Standard-IA. The policy must be modified to transition objects to S3 Glacier Flexible Retrieval after at least 60 days.

S3 Standard-IA has a minimum storage duration constraint of 90 days before objects can be transitioned to any Glacier storage class. The policy must be modified to transition objects to S3 Glacier Flexible Retrieval after at least 120 days.

Transitioning objects from S3 Standard-IA to S3 Glacier Flexible Retrieval is an invalid path. A separate rule must be created to transition objects directly from S3 Standard to S3 Glacier Flexible Retrieval after 60 days.

S3 Lifecycle configurations do not support multiple transition actions within the same rule. The administrator must create two separate rules under different prefixes to transition the objects.

Cevabı ve açıklamayı göster

Cevap: S3 Lifecycle rules require that the transition to S3 Glacier Flexible Retrieval occur at least 30 days after the transition to S3 Standard-IA. The policy must be modified to transition objects to S3 Glacier Flexible Retrieval after at least 60 days.

Cevap

The correct option explains that S3 Lifecycle rules require that the transition to S3 Glacier Flexible Retrieval occur at least 30 days after the transition to S3 Standard-IA. The policy must be modified to transition objects to S3 Glacier Flexible Retrieval after at least 60 days. This is correct because S3 Lifecycle validation enforces that any subsequent transition to a colder storage class (like S3 Glacier Flexible Retrieval) must be scheduled at least 30 days after the transition to S3 Standard-IA. Since the transition to S3 Standard-IA is scheduled for 30 days, the transition to S3 Glacier Flexible Retrieval must be at least 60 days (30 + 30) from the object creation date to avoid a validation error.

Adım Adım Çözüm

Analyze the access patterns and S3 storage class requirements.

Standard-IA is suitable for days 30-60 (instant retrieval needed). S3 Glacier Flexible Retrieval is suitable after day 60 (retrieval time of several hours is acceptable). Deletion at 3 years (1095 days).

Matching access patterns to S3 storage classes optimizes storage cost while meeting availability SLA.

Examine S3 Lifecycle validation constraints for transitions.

S3 Lifecycle rules require that objects must be stored in S3 Standard-IA or S3 One Zone-IA for at least 30 days before they can be transitioned to another storage class (such as S3 Glacier Flexible Retrieval).

This is a mandatory S3 API validation rule; violating it results in a validation error on policy application.

Calculate the valid transition timing for S3 Glacier Flexible Retrieval.

Since transition to Standard-IA occurs at day 30, the transition to Glacier Flexible Retrieval must occur at day 30 + 30 days = day 60 or later.

Adjusting the second transition to 60 days satisfies the 30-day minimum duration requirement in Standard-IA and matches the business requirement to move objects to Glacier after 60 days.

Anahtar Kavram

Amazon S3 Storage Class and Lifecycle Transition Rules

Tahmini Süre:2m 0s

Soru 418Soru →

A SysOps Administrator manages a multi-account environment under AWS Organizations and has enabled AWS Compute Optimizer for the entire organization from the management account. The administrator notices that Compute Optimizer is generating recommendations for EC2 instances based only on CPU and network utilization, but is missing memory-based recommendations for a critical microservices application running on Linux EC2 instances. Which of the following actions must the administrator take to ensure Compute Optimizer can provide recommendations that include memory utilization? (Select two.)

Geçerli olan tümünü seçin

Install and configure the Unified CloudWatch Agent on the EC2 instances to publish memory utilization metrics to Amazon CloudWatch under the standard CWAgent namespace.

Attach an IAM role containing the CloudWatchAgentServerPolicy policy to the EC2 instances to authorize the agent to write metrics to CloudWatch.

Enable Amazon EC2 detailed monitoring on the EC2 instances from the Amazon EC2 console or via the AWS CLI.

Create a Gateway VPC endpoint for Amazon CloudWatch in the VPC of each member account and associate it with the subnet route tables.

Configure an AWS Budgets alert with a target action to run a Systems Manager Run Command that exports memory utilization to AWS Compute Optimizer.

Cevabı ve açıklamayı göster

Cevap: Install and configure the Unified CloudWatch Agent on the EC2 instances to publish memory utilization metrics to Amazon CloudWatch under the standard CWAgent namespace.; Attach an IAM role containing the CloudWatchAgentServerPolicy policy to the EC2 instances to authorize the agent to write metrics to CloudWatch.

Cevap

To enable memory-based recommendations in AWS Compute Optimizer, the Unified CloudWatch Agent must be installed and configured on the EC2 instances to publish memory metrics to the standard CWAgent namespace, and the instances must be associated with an IAM role that grants the CloudWatchAgentServerPolicy permissions to write metrics to CloudWatch.

AWS Compute Optimizer requires guest operating system-level memory metrics to generate recommendations for memory-bound workloads. Because memory is not collected by the hypervisor, the administrator must install the Unified CloudWatch Agent on the EC2 instances and configure it to publish metrics under the default CWAgent namespace. Additionally, the instances must be authorized to upload these metrics to CloudWatch, which is accomplished by attaching an IAM role with the CloudWatchAgentServerPolicy policy to the instances.

Adım Adım Çözüm

Deploy and configure the Unified CloudWatch Agent on the target Linux EC2 instances.

The agent collects operating system-level memory metrics (such as memory utilization) and sends them to CloudWatch under the standard CWAgent namespace.

AWS Compute Optimizer does not receive memory metrics by default from the EC2 hypervisor; it depends on the CloudWatch Agent to publish these metrics.

Attach an IAM instance profile containing the CloudWatchAgentServerPolicy permissions to the EC2 instances.

The EC2 instances are authorized to write the gathered memory metrics to Amazon CloudWatch.

Without proper IAM permissions, the agent running on the EC2 instances will fail to write metric data to CloudWatch, leaving Compute Optimizer without the necessary data.

Anahtar Kavram

AWS Compute Optimizer Memory Metrics Dependency

Tahmini Süre:2m 0s

Soru 419Soru →

A SysOps administrator has configured an Application Load Balancer (ALB) to terminate SSL/TLS traffic and forward requests to a target group of EC2 instances over HTTP on port 80. To ensure all client connections are secure, the administrator added a rewrite rule to the Apache web server configuration on the EC2 instances to redirect all incoming HTTP traffic to HTTPS.

Following this change, users receive a 'Too many redirects' error in their web browsers, and the ALB target group shows all EC2 instances as unhealthy with an HTTP 301 response.

Which action should the administrator take to resolve these issues?

Modify the Apache rewrite rule on the EC2 instances to only redirect traffic if the X-Forwarded-Proto header is 'http'.

Update the target group health check configuration's matcher settings to accept a success code of '301'.

Configure an Amazon Route 53 failover routing policy to route all port 80 traffic to a secondary target group.

Update the target group's port configuration to forward traffic to the EC2 instances over HTTPS on port 443.

Cevabı ve açıklamayı göster

Cevap: Modify the Apache rewrite rule on the EC2 instances to only redirect traffic if the X-Forwarded-Proto header is 'http'.

Cevap

Modify the Apache rewrite rule on the EC2 instances to only redirect traffic if the X-Forwarded-Proto header is 'http'.

Modifying the rewrite rule to check the X-Forwarded-Proto header is the correct solution because it allows the EC2 instances to distinguish between client requests that were already secured (which should not be redirected) and health check or unsecured requests (which do not need redirection or can be handled separately). This stops the infinite redirect loop and allows HTTP health checks on port 80 to return 200 OK.

Adım Adım Çözüm

Analyze the request flow between the client, the ALB, and the backend EC2 instances.

The ALB terminates SSL/TLS and forwards requests to the EC2 instances over HTTP (port 80). The EC2 instances redirect all HTTP traffic to HTTPS (301 redirect), creating a loop for clients and causing health checks to return 301 instead of 200 OK.

To identify why the 'Too many redirects' error occurs and why the target group health checks are failing.

Identify how the ALB communicates the original protocol to the backend EC2 instances.

The ALB appends the X-Forwarded-Proto header (with a value of 'https' for client HTTPS connections and 'http' for client HTTP connections).

To find a header that the EC2 instances can inspect to distinguish between original HTTP and HTTPS client connections.

Modify the rewrite rule on the backend Apache web servers to evaluate the X-Forwarded-Proto header.

Rewrite rules will only trigger a redirect to HTTPS if the header is explicitly set to 'http'. Since ALB health check requests do not include this header, they bypass the redirect and return 200 OK.

To resolve both the infinite redirect loop for clients and the health check failures on port 80.

Anahtar Kavram

Application Load Balancer health checks and request routing header forwarding (X-Forwarded-Proto) during SSL termination.

Tahmini Süre:2m 30s

Soru 420Soru →

A SysOps administrator is managing an API service hosted on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run a secure service that listens on port 8443. The ALB target group is configured to send HTTPS health checks to port 8443 on the path `/api/v1/health`. All EC2 instances in the target group are reported as unhealthy. When the administrator connects to an instance and runs `curl -k https://localhost:8443/api/v1/health`, the response returns a status of `200 OK`. However, the ALB target group console indicates the health check is failing with an HTTP `401 Unauthorized` status code. Which of the following actions will resolve this health check issue?

Configure the API application on the instances to permit anonymous access to the `/api/v1/health` path, or change the target group health check path to an unauthenticated endpoint.

Modify the target group's health check protocol from HTTPS to HTTP on port 8443 to bypass application-level SSL/TLS handshake requirements.

Configure a Route 53 active-passive failover routing policy and link the target group's health check to the primary alias record.

Update the security group of the EC2 instances to allow inbound TCP traffic on port 443 from the security group of the ALB.

Cevabı ve açıklamayı göster

Cevap: Configure the API application on the instances to permit anonymous access to the `/api/v1/health` path, or change the target group health check path to an unauthenticated endpoint.

Cevap

Configure the API application on the instances to permit anonymous access to the `/api/v1/health` path, or change the target group health check path to an unauthenticated endpoint.

The correct answer is to allow unauthenticated access to the health check path or use a different endpoint that does not require authentication. An Application Load Balancer health check probe does not support authentication headers or client certificates. A response status of 401 Unauthorized indicates that the web server or application is prompting for credentials, which results in the ALB marking the target as unhealthy.

Adım Adım Çözüm

Analyze the error message reported by the Application Load Balancer target group.

The target group reports an HTTP 401 status code, which means 'Unauthorized'.

This indicates that the ALB successfully reached the target EC2 instance, but the application demanded authentication credentials which the ALB does not provide.

Verify local service status on the EC2 instance.

Running `curl -k https://localhost:8443/api/v1/health` returns `200 OK`.

This local command may succeed due to bypass rules for localhost, or because the administrator was pre-authenticated, masking the restriction imposed on external clients (like the ALB).

Determine the corrective action to satisfy the ALB health check requirements.

Modify the application configuration to allow unauthenticated access to the health check endpoint, or point the health check to a non-authenticated path.

ELB health checks cannot present authentication tokens or certificates for application-level basic/bearer authentication, so the targeted endpoint must be publicly accessible to the ALB's internal queries.

Anahtar Kavram

Application Load Balancer health checks require a response that matches the configured successful codes (typically 200). If the health check path requires authentication, the ALB will receive a 401/403 response, failing the health check.

Tahmini Süre:2m 30s

ÖncekiSayfa 21 / 49Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram