Examkin

Tüm alıştırma soruları

976 soru

Tüm türler976Çoktan seçmeli502Çoklu seçim450Sıralama24
Soru 421Soru →

A SysOps Administrator is configuring a private subnet containing Amazon EC2 instances that need to access files in an Amazon S3 bucket within the same AWS Region. To prevent data transfer charges and keep the traffic private, the administrator creates an Amazon S3 Gateway VPC Endpoint. However, when trying to access S3 from the EC2 instances, the connection times out. What configuration step must the administrator perform to resolve this connection issue?

Cevabı ve açıklamayı göster

Cevap: Associate the Gateway VPC Endpoint with the route table of the private subnet.

Cevap

Associate the Gateway VPC Endpoint with the route table of the private subnet.
The correct action is to associate the S3 Gateway VPC Endpoint with the route table of the private subnet. Unlike Interface VPC Endpoints, Gateway VPC Endpoints do not use security groups or private DNS. Instead, they rely on prefix list routes automatically added to associated route tables.

Adım Adım Çözüm

1
Identify the type of VPC Endpoint being used.
The administrator deployed a Gateway VPC Endpoint for Amazon S3.
Gateway VPC Endpoints require route table updates to direct traffic targeting the S3 prefix list to the endpoint, unlike Interface VPC Endpoints which rely on DNS and security groups.
2
Update the routing configuration for the subnet.
Associate the S3 Gateway VPC Endpoint with the route table of the private subnet where the EC2 instances reside.
This association automatically inserts a route pointing the S3 prefix list (e.g., pl-xxxxxx) to the endpoint (vpce-xxxxxx) as the target.
3
Verify network connectivity.
EC2 instances in the private subnet successfully connect to the S3 bucket privately without timeouts.
Traffic destined for S3 is now matched by the prefix list route and forwarded to the endpoint instead of timing out due to a lack of route.

Anahtar Kavram

Gateway VPC Endpoints (for S3 and DynamoDB) require explicit association with subnet route tables to automatically inject prefix list routes. They do not use security groups.
Soru 422Soru →

A company hosts a data processing workload on Amazon EC2 instances in private subnets across two Availability Zones (`eu-west-1a` and `eu-west-1b`) within a single VPC. The instances download regular updates from the internet and write approximately 12 TB12\text{ TB} of data monthly to Amazon DynamoDB. Currently, all outbound traffic from the private subnets routes through a single NAT Gateway located in a public subnet in `eu-west-1a`.

A SysOps administrator identifies high charges in the monthly bill for both NAT Gateway data processing and cross-Availability Zone data transfer.

Which combination of actions should the SysOps administrator take to minimize the data transfer costs? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route tables of the private subnets.; Deploy a second NAT Gateway in a public subnet in `eu-west-1b` and update the route table of the private subnet in `eu-west-1b` to route internet-bound traffic through the new NAT Gateway.

Cevap

To optimize costs, the administrator should create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet route tables, and deploy a second NAT Gateway in the second Availability Zone to keep internet-bound traffic local to that zone.
The correct combination of actions consists of utilizing a Gateway VPC Endpoint for DynamoDB and deploying a second NAT Gateway. The Gateway Endpoint is free and routes the DynamoDB traffic privately, bypassing the NAT Gateway and eliminating its data processing fees. The second NAT Gateway prevents cross-Availability Zone traffic for internet-bound data from the second zone, reducing cross-AZ transfer costs.

Adım Adım Çözüm

1
Divert high-volume DynamoDB traffic from the NAT Gateway.
Creating a Gateway VPC Endpoint for DynamoDB routes the 12 TB12\text{ TB} of monthly DynamoDB data directly over the AWS private network.
DynamoDB Gateway VPC Endpoints are free of charge, which avoids the NAT Gateway data processing fee ($0.045 per GB in most regions) for this massive volume of data.
2
Address the cross-Availability Zone data transfer charges for remaining internet traffic.
Deploying a second NAT Gateway in the second Availability Zone allows instances in that zone to route outbound internet traffic locally.
This eliminates the cross-AZ data transfer fees ($0.01 per GB in each direction) incurred when instances in one zone route traffic to a NAT Gateway in another zone.

Anahtar Kavram

Data transfer cost optimization in VPC environments involves routing traffic through free Gateway Endpoints for supported services (S3 and DynamoDB) and keeping internet-bound traffic local to the Availability Zone to avoid cross-AZ charges.
Tahmini Süre:2m 0s
Soru 423Soru →

A SysOps Administrator is troubleshooting an internal Application Load Balancer (ALB) that routes HTTPS traffic on port 443 to a fleet of Amazon EC2 instances in a private subnet. The instances are registered with a target group configured for HTTP health checks on port 80 using the path `/status`. The target group reports all EC2 instances as Unhealthy, and clients receive HTTP 502 (Bad Gateway) errors when trying to access the application. The administrator has verified that the web application is running and responding to local HTTPS requests on port 443 on the EC2 instances. Which of the following could be the root causes of the failing health checks? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The target group health check is directed to port 80, but the web application server on the EC2 instances is only listening and responding on HTTPS port 443.; The security group for the EC2 instances allows inbound traffic on TCP port 443 from the ALB security group, but does not allow inbound TCP traffic on port 80.

Cevap

The target group health check is directed to port 80, but the web application server on the EC2 instances is only listening on HTTPS port 443; and the security group for the EC2 instances does not allow inbound TCP traffic on port 80.
The health check configuration specifies HTTP on port 80, but the web application is only running and listening on port 443. Consequently, the load balancer's health check requests to port 80 will fail. Additionally, the security group of the EC2 instances must explicitly permit inbound TCP traffic on port 80 from the ALB security group to allow these health checks to reach the instances.

Adım Adım Çözüm

1
Analyze the health check configuration and port mappings.
The target group sends health check requests to port 80 using HTTP, but the application is only listening and responding on HTTPS port 443.
Health checks fail when the target service does not listen on the designated health check port.
2
Verify security group rules between the ALB and the EC2 instances.
The security group allows inbound traffic on port 443 but blocks inbound traffic on port 80.
The EC2 instances' security group must permit inbound traffic on the specific port configured for health checks (port 80) from the ALB's security group.
3
Evaluate network ACL rules and Route 53 settings.
Route 53 routing policies do not control target group health checks. For stateless network ACLs, outbound rules must permit ephemeral ports for return traffic, rather than inbound rules.
To rule out other factors and confirm the correct root causes.

Anahtar Kavram

Elastic Load Balancing target group health check troubleshooting, including port mapping alignment, security group allowances, and network ACL rules.
Tahmini Süre:2m 0s
Soru 424Soru →

A SysOps administrator is configuring an Amazon S3 Lifecycle policy to optimize storage costs for media archives. The files are uploaded to S3 Standard. The access patterns and requirements are as follows:

* For the first 3030 days, files are accessed frequently.
* From day 3131 to day 6060, files are accessed infrequently but must be available for immediate retrieval.
* After 6060 days, the files are rarely accessed, but any retrieval requests must be completed within 55 minutes.
* The files must be kept for a total of 365365 days before deletion.

Which TWO configuration steps should the administrator include in the lifecycle policy to meet these requirements in a valid and most cost-effective manner? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Transition objects from S3 Standard to S3 Standard-IA after 3030 days; Transition objects from S3 Standard-IA to S3 Glacier Flexible Retrieval after 6060 days

Cevap

Transition objects from S3 Standard to S3 Standard-IA after 3030 days, and transition objects from S3 Standard-IA to S3 Glacier Flexible Retrieval after 6060 days.
To satisfy the requirements cost-effectively, the lifecycle policy must first transition objects to S3 Standard-IA after 3030 days. Since the files must then transition to an archive storage class after 6060 days (which is exactly 3030 days after transitioning to Standard-IA), this meets the S3 Lifecycle policy restriction that requires objects to remain in S3 Standard-IA for at least 3030 days. S3 Glacier Flexible Retrieval is the most cost-effective archive class that meets the retrieval requirement of under 55 minutes because it supports Expedited retrievals (11-55 minutes).

Adım Adım Çözüm

1
Determine the first transition class and timing based on access patterns.
Transition to S3 Standard-IA after 3030 days.
The files are frequently accessed for the first 3030 days and then infrequently accessed but require immediate retrieval, which matches S3 Standard-IA features and minimum duration billing rules.
2
Check the validity of subsequent transition timing under S3 Lifecycle restrictions.
Ensure that any transition from S3 Standard-IA to a Glacier storage class occurs at least 3030 days after the transition to Standard-IA.
S3 Lifecycle policies require objects to spend at least 3030 days in S3 Standard-IA before transitioning to S3 Glacier classes. Since the transition to Standard-IA is at day 3030, the next transition must be at day 6060 or later.
3
Select the appropriate target storage class for the long-term archiving phase based on retrieval SLAs.
Choose S3 Glacier Flexible Retrieval with Expedited retrievals.
Expedited retrievals under S3 Glacier Flexible Retrieval take 11 to 55 minutes, satisfying the 55-minute retrieval SLA. S3 Glacier Deep Archive is incorrect because its fastest retrieval is 1212 hours.

Anahtar Kavram

S3 Lifecycle transition rules and storage class retrieval times
Soru 425Soru →

A SysOps Administrator is configuring a VPC with a private subnet that contains Amazon EC2 instances. The instances must access Amazon DynamoDB and AWS Key Management Service (AWS KMS) securely. The VPC does not have an Internet Gateway or a NAT Gateway. The administrator creates a Gateway VPC Endpoint for DynamoDB and an Interface VPC Endpoint for KMS. Which of the following configurations are required to establish connectivity from the EC2 instances to both services? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate the DynamoDB Gateway VPC Endpoint with the route table of the private subnet.; Configure the security group attached to the KMS Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443443 from the EC2 instances.

Cevap

To enable private access to Amazon DynamoDB and AWS KMS from EC2 instances in a private subnet, the SysOps Administrator must associate the DynamoDB Gateway VPC Endpoint with the subnet's route table and configure the security group of the KMS Interface VPC Endpoint to allow inbound traffic on TCP port 443443 from the EC2 instances.
Associating the DynamoDB Gateway VPC Endpoint with the subnet's route table ensures that traffic destined for DynamoDB is routed internally through the endpoint. Configuring the KMS Interface VPC Endpoint's security group to allow inbound port 443443 traffic from the EC2 instances ensures that the instances can establish a secure connection to the endpoint's elastic network interfaces (ENIs).

Adım Adım Çözüm

1
Associate the DynamoDB Gateway VPC Endpoint with the route table of the private subnet containing the EC2 instances.
A route is automatically added to the subnet's route table targeting the DynamoDB service prefix list via the gateway endpoint.
Gateway VPC Endpoints require route table routing to direct traffic from the subnet to the AWS service privately.
2
Configure the security group attached to the KMS Interface VPC Endpoint to allow inbound HTTPS (TCP port 443443) traffic.
The security group allows network packets from the EC2 instances to reach the endpoint's elastic network interfaces (ENIs).
Interface VPC Endpoints use ENIs which rely on security groups to control inbound traffic from client instances.

Anahtar Kavram

VPC Gateway Endpoints require routing table associations to steer traffic, while VPC Interface Endpoints utilize Elastic Network Interfaces (ENIs) and require security group rules to permit traffic.
Tahmini Süre:2m 0s
Soru 426Soru →

A company collects daily telemetry files from IoT devices and stores them in an Amazon S3 Standard bucket. The telemetry files must be queryable with millisecond latency for the first 30 days. Between day 30 and day 90, the data is accessed occasionally but still requires millisecond retrieval latency. After 90 days, the files are rarely accessed but must be retained for 7 years (25552555 days) for compliance auditing, where a retrieval time of up to 12 hours is acceptable. Which S3 Lifecycle configuration meets these requirements in the most cost-effective manner without violating S3 Lifecycle constraints or incurring premature transition penalties?

Cevabı ve açıklamayı göster

Cevap: Transition objects to S3 Standard-Infrequent Access (Standard-IA) after 30 days, transition them to S3 Glacier Deep Archive after 90 days, and expire them after 2555 days.

Cevap

Create a lifecycle rule to transition objects to S3 Standard-Infrequent Access (Standard-IA) after 30 days, transition them to S3 Glacier Deep Archive after 90 days, and expire them after 2555 days.
The correct configuration transitions objects to S3 Standard-IA after 30 days, transitions them to S3 Glacier Deep Archive after 90 days, and expires them after 2555 days. This satisfies the millisecond latency requirement for the first 90 days (S3 Standard for 30 days, S3 Standard-IA for the next 60 days). It is valid because the transition to S3 Standard-IA occurs at exactly 30 days, satisfying the minimum residency requirement in S3 Standard. Furthermore, transitioning from S3 Standard-IA to S3 Glacier Deep Archive at day 90 means the objects resided in Standard-IA for 60 days, which exceeds the 30-day minimum storage billing period. Lastly, S3 Glacier Deep Archive supports 12-hour retrievals and provides the most cost-effective storage for the remaining duration.

Adım Adım Çözüm

1
Analyze the access pattern and latency requirements for each phase.
The first 30 days require S3 Standard (active access, millisecond latency). Days 30 to 90 require millisecond latency but are accessed occasionally (S3 Standard-IA). Days 91 and beyond require retention for 7 years with up to 12 hours retrieval time (S3 Glacier Deep Archive).
This establishes the target storage classes needed to optimize costs while satisfying performance requirements.
2
Validate the first transition rule constraint.
The transition from S3 Standard to S3 Standard-IA can only happen after objects have been in S3 Standard for at least 30 days. Setting the transition to day 30 is the earliest possible valid time.
Transitioning earlier (e.g., at day 15) violates the S3 Lifecycle minimum duration constraint and causes policy validation failure.
3
Validate the second transition rule and minimum storage duration constraints.
Objects are transitioned to S3 Glacier Deep Archive after 90 days. Because they were transitioned to S3 Standard-IA at day 30, they spend exactly 60 days in Standard-IA. Since S3 Standard-IA has a minimum storage duration charge of 30 days, this transition does not incur any early deletion/transition fees.
Ensuring the minimum storage duration of the intermediate class is met avoids unnecessary billing charges.
4
Ensure transition direction compliance.
Transitions must progress from warmer to colder classes (Standard -> Standard-IA -> Glacier Deep Archive). Colder-to-warmer transitions or transitions from Standard-IA to Intelligent-Tiering are invalid.
Following the one-way progression of S3 storage classes is required to maintain a valid, error-free S3 Lifecycle policy.

Anahtar Kavram

Understanding S3 Lifecycle transition rules, sequence constraints, and minimum storage duration requirements for standard and infrequent access tiers.
Soru 427Soru →

A SysOps administrator is reviewing the AWS Trusted Advisor Cost Optimization reports for a production account and notes that several Amazon RDS DB instances have been flagged by the 'Amazon RDS Idle DB Instances' check for having zero connections over the past 14 days. The administrator must decommission these DB instances to optimize costs while ensuring that the databases can be restored in the future if required. Which two actions should the administrator take to clean up these underutilized resources in the most cost-effective and safe manner? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a final DB snapshot of each idle DB instance.; Delete the idle DB instances.

Cevap

To safely and cost-effectively clean up the idle RDS DB instances, the administrator should create a final DB snapshot of each instance to ensure data durability, and then delete the DB instances to stop all associated compute and storage charges.
To decommission underutilized RDS DB instances safely and cost-effectively, the administrator must stop ongoing charges while preserving the data for potential future use. Creating a final DB snapshot ensures that a backup exists, and deleting the DB instances stops all compute and storage charges.

Adım Adım Çözüm

1
Identify the underutilized RDS DB instances flagged by AWS Trusted Advisor.
A clear list of candidate DB instances to be decommissioned is determined.
Ensures that only the flagged, unused resources are targeted for cleanup.
2
Initiate the deletion process of each DB instance, choosing to capture a final DB snapshot.
A final DB snapshot is created before the instance is terminated.
Provides a reliable backup that can be used to restore the DB instance in the future if needed.
3
Delete the RDS DB instances.
The instances are deleted, stopping all compute and storage charges.
Eliminates ongoing costs for resources that are no longer in use.

Anahtar Kavram

Safely decommissioning underutilized RDS instances involves capturing a final DB snapshot to preserve data before deleting the instance to stop all compute and storage costs.
Soru 428Soru →

A SysOps administrator is troubleshooting an Application Load Balancer (ALB) that has marked all registered Amazon EC2 instances as unhealthy. The instances host a web application that listens on port 80 and is configured to automatically redirect all incoming HTTP traffic to HTTPS (port 443) using an application-level rewrite rule. The ALB is configured for SSL termination on port 443. The target group is configured to perform health checks on port 80 using the HTTP protocol at path `/healthz`, expecting a default response code of 200. Which of the following is the most appropriate action to resolve this issue and mark the targets as healthy?

Cevabı ve açıklamayı göster

Cevap: Update the target group health check configuration to accept HTTP 301 or 302 status codes as successful responses.

Cevap

Update the target group health check configuration to accept HTTP 301 or 302 status codes as successful responses.
The correct answer is to update the target group health check configuration to accept HTTP 301 or 302 status codes. Because the web application redirects all incoming HTTP port 80 traffic to HTTPS, any HTTP health check request to the path `/healthz` on port 80 will return a redirect status code (301 or 302) instead of 200. Since the default ALB target group health check only considers 200 as successful, the instances are marked unhealthy. Adding 301 and 302 to the target group's expected health check response codes resolves this discrepancy.

Adım Adım Çözüm

1
Analyze the architecture and identify that SSL termination occurs at the Application Load Balancer (ALB).
The backend EC2 instances receive unencrypted HTTP traffic on port 80 and do not handle SSL termination.
Knowing where SSL terminates determines whether the backend targets are expected to respond to HTTPS requests.
2
Examine the application-level redirection rule implemented on the EC2 instances.
HTTP requests targeting the instances (including the ALB health checks sent on port 80) are redirected to HTTPS, generating an HTTP 301 or 302 response.
Identifying the response code returned by the backend instances is critical to understanding why the load balancer marks them as unhealthy.
3
Review the target group health check configuration.
The target group expects an HTTP 200 response code by default, but receives HTTP 301 or 302, causing health checks to fail.
Comparing the expected response code with the actual response code isolates the cause of the health check failure.
4
Determine the resolution that allows health checks to succeed without changing the application's redirect logic.
Configure the target group's matcher settings to accept HTTP 301 or 302 codes as healthy.
This updates the load balancer's success criteria to align with the application's redirect behavior.

Anahtar Kavram

Handling application-level HTTP redirects in Application Load Balancer target group health checks
Soru 429Soru →

A company's finance department wants to ensure they are getting maximum value from their newly purchased Compute Savings Plans. A SysOps administrator is tasked with setting up an automated notification that alerts the team if the utilization of these Savings Plans drops below 85%85\% over a daily tracking period. Which configuration should the SysOps administrator use to meet this requirement with the least administrative effort?

Cevabı ve açıklamayı göster

Cevap: Create a Savings Plans utilization budget in AWS Budgets, set the utilization threshold to 85%85\%, specify a daily tracking period, and configure an Amazon SNS topic for notifications.

Cevap

Create a Savings Plans utilization budget in AWS Budgets, set the utilization threshold to 85%85\%, specify a daily tracking period, and configure an Amazon SNS topic for notifications.
AWS Budgets natively supports Savings Plans utilization budgets, which allow administrators to track the percentage of Savings Plans capacity that is being used. Setting a daily tracking period and a threshold of 85%85\% with an Amazon SNS topic satisfies the requirement with minimal overhead.

Adım Adım Çözüm

1
Navigate to the AWS Budgets console and choose to create a new budget.
Accesses the budget creation wizard.
AWS Budgets is the correct native tool for tracking cost, usage, or Savings Plans utilization thresholds.
2
Select the Savings Plans utilization budget type, then set the time period to daily and the threshold to 85%85\%.
Configures the budget to trigger when the average daily utilization of the Savings Plans falls below the target percentage.
Savings Plans utilization budgets are specifically designed to monitor how much of your Savings Plans commitment you are actively using.
3
Configure the alert threshold and associate it with an Amazon SNS topic or email address list for notifications.
Ensures that alerts are delivered immediately to the operations team when utilization drops below the threshold.
SNS integration allows for automated notification delivery when the threshold metric is breached.

Anahtar Kavram

AWS Budgets Savings Plans Utilization tracking
Soru 430Soru →

An organization's AWS Trusted Advisor Cost Optimization report lists several Amazon Elastic Block Store (Amazon EBS) volumes in the 'available' state with a warning status, indicating they are underutilized. A SysOps administrator is tasked with optimizing costs by removing these volumes while ensuring that any existing data can be recovered if needed in the future.

Which action should the administrator take to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a snapshot of each available EBS volume for potential future recovery, and then delete the volumes.

Cevap

Create a snapshot of each available EBS volume for potential future recovery, and then delete the volumes.
The correct action is to create a snapshot of each available EBS volume and then delete the volumes. EBS volumes in the 'available' state are detached from EC2 instances but continue to incur charges. Creating a snapshot preserves the data at a lower cost, and deleting the volumes eliminates the ongoing active volume charges.

Adım Adım Çözüm

1
Identify the unattached EBS volumes.
The volumes are identified as being in the 'available' state with no read/write activity, confirming they are underutilized.
Before performing any deletions, the SysOps administrator must isolate the specific volumes flagged by AWS Trusted Advisor.
2
Create an Amazon EBS snapshot for each identified volume.
A point-in-time backup of the volume's data is safely stored in Amazon S3.
This satisfies the requirement to ensure data can be recovered in the future if needed.
3
Delete the EBS volumes.
The volumes are removed from the account, and active hourly storage charges for these volumes cease.
Deleting the volumes is the only action that stops resource charges and achieves the cost-optimization objective.

Anahtar Kavram

Safely cleaning up underutilized Amazon EBS volumes by creating snapshots for data retention before deleting the unattached volumes.
Soru 431Soru →

A SysOps administrator is configuring a monthly cost budget in AWS Budgets for a sandbox account. The administrator wants to configure an AWS Budgets Action that automatically attaches a restrictive IAM policy to prevent further resource creation when actual spending exceeds 5,0005,000. Which of the following configurations are required to allow AWS Budgets to successfully execute this action? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An IAM execution role with a trust policy that allows the budgets.amazonaws.com service principal to assume the role; The iam:PassRole permission granted to the IAM identity that is creating the budget

Cevap

The configuration requires creating an IAM execution role that trusts the budgets.amazonaws.com service principal, and granting the iam:PassRole permission to the IAM user or role creating the budget.
The correct options require establishing a trust relationship with the budgets.amazonaws.com service principal on the execution role, and granting the iam:PassRole permission to the IAM identity configuring the budget. AWS Budgets assumes the execution role to perform the configured action, such as attaching a policy. The user setting up the budget must be authorized to pass this execution role to AWS Budgets.

Adım Adım Çözüm

1
Create an IAM role with a trust policy that allows the budgets.amazonaws.com service principal to assume it.
An IAM role is created that AWS Budgets can assume to perform operations.
AWS Budgets must assume this role to execute actions like attaching policies.
2
Grant the configuring administrator iam:PassRole permissions for the IAM role.
The administrator can associate the execution role with the budget action.
AWS prevents passing execution roles to services unless explicitly authorized via iam:PassRole.

Anahtar Kavram

AWS Budgets Actions permissions, including service trust relationships and the iam:PassRole permission.
Soru 432Soru →

A global media company uses Amazon Route 53 to manage DNS for its streaming platform. To support a new marketing campaign, the operations team needs to route apex domain traffic (media-stream.com) to a set of resources. The primary endpoint is an Application Load Balancer (ALB) in Europe, and the fallback endpoint is a backup service in the United States. The setup must automatically redirect users to the backup service if the European ALB fails its health checks. Which of the following actions should the SysOps administrator take to configure this routing behavior? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a primary Alias A record for the zone apex pointing to the European Application Load Balancer DNS name, choose a Failover routing policy, and set Evaluate Target Health to Yes.; Create a secondary Alias A record for the zone apex pointing to the United States backup resource, and choose a Failover routing policy.

Cevap

The correct actions are to create a primary Alias A record for the zone apex pointing to the European Application Load Balancer DNS name using a Failover routing policy with 'Evaluate Target Health' set to 'Yes', and to create a secondary Alias A record for the zone apex pointing to the United States backup resource using a Failover routing policy.
To satisfy both the zone apex constraint and the automatic active-passive failover requirement, the SysOps administrator must configure Route 53 Alias A records. The primary record points to the European ALB with a Failover policy and 'Evaluate Target Health' enabled. The secondary record points to the United States backup resource under a Failover policy, which receives traffic only when the primary endpoint is unhealthy.

Adım Adım Çözüm

1
Analyze the domain routing target.
The requirement is to configure routing for the zone apex (media-stream.com).
DNS standards do not permit creating CNAME records at the zone apex because other record types (like SOA and NS) must exist at that level.
2
Select the correct record type.
Alias A records must be used instead of CNAME records.
Route 53 Alias records are a virtual extension of DNS that allow mapping the zone apex directly to AWS resources like Application Load Balancers.
3
Configure the active-passive failover routing policy.
Configure a primary Failover record pointing to the European ALB and set 'Evaluate Target Health' to 'Yes'.
Setting 'Evaluate Target Health' to 'Yes' configures Route 53 to automatically evaluate the health of the ALB using its registered target health status.
4
Configure the backup endpoint.
Configure a secondary Failover record pointing to the United States backup resource.
When Route 53 detects that the primary ALB is unhealthy, it shifts DNS query responses to the secondary Failover endpoint.

Anahtar Kavram

Route 53 active-passive failover at the zone apex requires Alias records with health checking enabled.
Soru 433Soru →

A SysOps Administrator is configuring private connectivity between application servers in a consumer VPC and a third-party database service hosted in a provider VPC. The administrator creates an Interface VPC Endpoint (AWS PrivateLink) in the consumer VPC for the database service and enables the Private DNS option. However, the application servers in the private subnet are experiencing connection timeouts when attempting to reach the database service. Which combination of actions should the SysOps Administrator take to resolve this connectivity issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the security group attached to the Interface VPC Endpoint to allow inbound traffic on the database port from the security group of the application servers.; Verify that both DNS resolution and DNS hostnames are enabled as attributes for the consumer VPC.

Cevap

Configure the security group attached to the Interface VPC Endpoint to allow inbound traffic on the database port from the security group of the application servers, and verify that both DNS resolution and DNS hostnames are enabled as attributes for the consumer VPC.
The correct options target the two mandatory components of configuring an Interface VPC Endpoint: opening the security group of the endpoint's network interface to permit inbound connections from the client instances, and enabling DNS hostnames and DNS support in the consumer VPC attributes so that Private DNS can resolve to the endpoint's private IP addresses.

Adım Adım Çözüm

1
Ensure the endpoint's firewall rules permit the client traffic.
The security group attached to the Interface VPC Endpoint's network interfaces is updated to allow inbound TCP traffic on the database port from the application servers' security group.
Interface VPC Endpoints are represented as network interfaces in the VPC and require explicit inbound security group rules to accept incoming connection requests.
2
Verify VPC DNS settings to allow local name resolution.
The 'enableDnsSupport' and 'enableDnsHostnames' settings on the consumer VPC are set to true.
Private DNS resolution for interface endpoints depends on the VPC's capability to resolve Amazon-provided DNS hostnames privately.

Anahtar Kavram

Interface VPC Endpoints utilize Elastic Network Interfaces (ENIs) inside the customer's subnets and rely on VPC DNS resolution settings and security group rules rather than route table modifications to steer and authorize traffic.
Soru 434Soru →

An organization uploads raw research datasets to an Amazon S3 Standard bucket. The datasets are frequently accessed during the first 1515 days. Access becomes occasional between day 1616 and day 4545, though any retrievals must remain instantaneous. After 4545 days, the data is rarely accessed but must be retained long-term for compliance, where a retrieval time of several hours is acceptable.

A SysOps administrator attempts to configure an Amazon S3 Lifecycle policy with the following transition actions:
* Transition to S3 Standard-Infrequent Access (Standard-IA) after 1515 days.
* Transition to S3 Glacier Flexible Retrieval after 4040 days.

When saving this policy, the administrator receives a validation error. Which of the following explains the reason for this error?

Cevabı ve açıklamayı göster

Cevap: The S3 Lifecycle configuration violates the minimum 3030-day offset requirement between transitioning to S3 Standard-IA and transitioning to S3 Glacier Flexible Retrieval.

Cevap

The S3 Lifecycle configuration violates the minimum 3030-day offset requirement between transitioning to S3 Standard-IA and transitioning to S3 Glacier Flexible Retrieval.
The correct answer is correct because Amazon S3 lifecycle validation prevents configuring a transition from S3 Standard-IA to a Glacier storage class unless there is a minimum of 3030 days difference between the two transition times. In this scenario, transitioning to Standard-IA at day 1515 and Glacier Flexible Retrieval at day 4040 leaves only 2525 days in Standard-IA, which fails validation.

Adım Adım Çözüm

1
Analyze the access patterns and proposed transition timeline.
The proposed timeline transitions objects from S3 Standard to S3 Standard-IA at day 1515, and then from S3 Standard-IA to S3 Glacier Flexible Retrieval at day 4040.
This establishes the exact time frame spent in the S3 Standard-IA storage class as 40−15=2540 - 15 = 25 days.
2
Check Amazon S3 Lifecycle transition rules and constraints.
Amazon S3 requires that the transition to an S3 Glacier storage class (Glacier Flexible Retrieval or Glacier Deep Archive) must be configured to occur at least 3030 days after the transition to S3 Standard-IA or S3 One Zone-IA.
This constraint matches the minimum storage duration billing period of 3030 days for S3 Standard-IA and prevents immediate cost penalties or invalid transition paths.
3
Identify the policy validation failure.
The proposed configuration transitions objects to S3 Glacier Flexible Retrieval only 2525 days after S3 Standard-IA (40−15=2540 - 15 = 25), violating the 3030-day minimum offset requirement.
To fix this, the administrator must change the S3 Glacier Flexible Retrieval transition to day 4545 (15+3015 + 30) or later.

Anahtar Kavram

Amazon S3 Lifecycle transition rules require a minimum of 3030 days between a transition to S3 Standard-IA and a subsequent transition to any S3 Glacier storage class.
Soru 435Soru →

A SysOps Administrator is configuring a monitoring solution for a microservice that publishes system events to an Amazon CloudWatch log group named `/aws/microservices/order-processor`. The application outputs log messages in the following JSON format:

{
"request_id": "req-9481",
"status": "FAILURE",
"error_code": "ERR_PAYMENT_DECLINED",
"processing_time_ms": 1420
}

The administrator needs to monitor for instances where payments are declined and trigger automated notifications. Which two actions must the administrator perform to achieve this requirement?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a CloudWatch Logs metric filter with the filter pattern `{ $.error_code = "ERR_PAYMENT_DECLINED" }` that increments a custom metric by 1 when a match is found.; Create a CloudWatch alarm that monitors the custom metric and is configured to send a notification to an Amazon SNS topic when the metric exceeds the defined threshold.

Cevap

The administrator must create a CloudWatch Logs metric filter with the filter pattern `{ $.error_code = "ERR_PAYMENT_DECLINED" }` to increment a custom metric, and then create a CloudWatch alarm to monitor that custom metric and trigger notifications to an Amazon SNS topic.
To detect specific events in JSON logs and send notifications, a metric filter must be created with the pattern `{ $.error_code = "ERR_PAYMENT_DECLINED" }` to publish data to a custom metric. A CloudWatch alarm is then set up to monitor that custom metric and trigger an action, such as sending a notification to an Amazon SNS topic when the threshold is breached.

Adım Adım Çözüm

1
Define a CloudWatch Logs metric filter on the log group `/aws/microservices/order-processor`.
The metric filter will inspect incoming log events in real-time.
Metric filters scan logs as they are ingested to match specified patterns.
2
Use the filter pattern `{ $.error_code = "ERR_PAYMENT_DECLINED" }` to increment a custom metric.
A custom metric is updated whenever a declined payment is logged.
JSON logs allow querying property values using the `$.property` notation in the filter pattern.
3
Create a CloudWatch alarm linked to the custom metric, configuring its action to notify an Amazon SNS topic.
An alert is dispatched via SNS when the failure rate or count exceeds the specified threshold.
Metric filters do not trigger actions directly; they must publish to a metric, which is then evaluated by an alarm.

Anahtar Kavram

Using CloudWatch Logs metric filters to extract metrics from JSON-formatted log files and triggering alerts using CloudWatch alarms and Amazon SNS.
Tahmini Süre:2m 0s
Soru 436Soru →

A company's compliance policy requires all Amazon RDS DB instances to have automated backups enabled. To monitor this, a SysOps administrator deploys the AWS Config managed rule `rds-backup-enabled`. The administrator wants to establish an automated remediation workflow that triggers when a DB instance is flagged as non-compliant. The remediation must use Amazon EventBridge to invoke an AWS Systems Manager Automation document that modifies the RDS instance to enable backups. Which combination of configuration steps and IAM permissions is required to successfully implement this automated remediation?

Cevabı ve açıklamayı göster

Cevap: Create an EventBridge rule that triggers on AWS Config compliance changes. Configure the rule to target Systems Manager Automation, assigning an IAM role to EventBridge with ssm:StartAutomationExecution permissions. Specify a service role with rds:ModifyDBInstance permissions in the Automation parameters, and ensure iam:PassRole is granted to the configuring principal.

Cevap

Create an EventBridge rule that triggers on AWS Config compliance changes. Configure the rule to target Systems Manager Automation, assigning an IAM role to EventBridge with ssm:StartAutomationExecution permissions. Specify a service role with rds:ModifyDBInstance permissions in the Automation parameters, and ensure iam:PassRole is granted to the configuring principal.
The correct answer configuration properly aligns permissions and targets. An EventBridge rule detects the AWS Config non-compliance event. It uses its execution role to trigger the Systems Manager Automation document via ssm:StartAutomationExecution. To perform the API modification of the RDS instance, the Automation document assumes an explicit service role (AutomationAssumeRole) containing rds:ModifyDBInstance permissions. The user or service creating the remediation rule must have iam:PassRole permission to associate the service role with the Automation document.

Adım Adım Çözüm

1
Configure the EventBridge Rule to match the compliance change event.
EventBridge will intercept compliance change events from AWS Config for the rds-backup-enabled rule when the status changes to NON_COMPLIANT.
To initiate automated remediation, EventBridge must listen to the specific compliance evaluation events generated by AWS Config.
2
Set the target of the EventBridge rule to Systems Manager Automation and assign the required IAM permissions.
EventBridge will have permissions to execute the Systems Manager Automation document, and Systems Manager Automation will run with a service role that has RDS modification permissions.
EventBridge requires ssm:StartAutomationExecution permissions to start the automation. Systems Manager Automation requires a service role (AutomationAssumeRole) with rds:ModifyDBInstance permissions to enable RDS backups on behalf of the user.
3
Configure the iam:PassRole permission on the configuring principal.
The principal configuring the remediation can successfully delegate the service role to Systems Manager Automation.
AWS requires the iam:PassRole permission whenever a service role is passed to another service to prevent privilege escalation.

Anahtar Kavram

Configuring automated remediation using AWS Config compliance events, EventBridge rules, and Systems Manager Automation with appropriate IAM permissions.
Tahmini Süre:1m 30s
Soru 437Soru →

A SysOps Administrator is configuring a monitoring solution for a new microservice that writes JSON-formatted application logs to an Amazon CloudWatch Logs group. A typical log entry has the following structure:

{
"timestamp": "2026-07-15T12:00:00Z",
"level": "ERROR",
"event": {
"service": "database-connector",
"error_code": 504,
"message": "Connection timed out after 10000ms"
}
}

The administrator wants to increment a custom CloudWatch metric whenever the `service` value is "database-connector" and the `error_code` is 504. Which configuration will achieve this requirement?

Cevabı ve açıklamayı göster

Cevap: Create a CloudWatch Logs metric filter with the filter pattern `{ .event.service = "database-connector" && .event.error_code = 504 }` and associate it with a metric transformation.

Cevap

Create a CloudWatch Logs metric filter with the filter pattern `{ .event.service = "database-connector" && .event.error_code = 504 }` and associate it with a metric transformation.
The correct answer is the configuration that creates a CloudWatch Logs metric filter with the filter pattern `{ .event.service = "database-connector" && .event.error_code = 504 }` and associates it with a metric transformation. CloudWatch Logs natively supports parsing JSON log entries. By using dot notation (e.g., `$.event.service`), you can reference nested keys, and the single equals sign (`=`) is the standard comparison operator within JSON filter pattern syntax.

Adım Adım Çözüm

1
Parse the JSON structure in the log event to identify the path to the required fields.
The target fields are nested inside the 'event' object: 'service' is at '.event.service′and′errorcode′isat′.event.service' and 'error_code' is at '.event.error_code'.
CloudWatch Logs JSON metric filters require specifying the full path using dot notation to target nested fields.
2
Use the correct CloudWatch Logs JSON filter pattern syntax to construct the query.
The query is enclosed in curly braces '{ }' and uses standard comparison operators like '=' for matching values, combined with the '&&' logical operator.
CloudWatch Logs metric filters use a single '=' for string and numeric comparisons in JSON documents.
3
Configure the metric filter with the pattern and define a metric transformation.
A metric filter is successfully established on the log group, pointing to a metric transformation that increments the custom metric count by 1.
The metric transformation maps the filtered pattern matches to a custom CloudWatch metric namespace and name.

Anahtar Kavram

Filtering JSON-formatted logs using CloudWatch metric filters and dot notation
Soru 438Soru →

A SysOps administrator is configuring an automated remediation pipeline to stop any Amazon EC2 instance that is flagged as non-compliant by an AWS Config rule named `required-tags`. The remediation must execute the `AWS-StopEC2Instance` AWS Systems Manager Automation document automatically when compliance fails.

Which TWO configuration actions are required to successfully set up this automation pipeline? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon EventBridge rule with an event pattern that filters for AWS Config compliance change events, specifying the rule name `required-tags` and a compliance status of `NON_COMPLIANT`.; Configure an IAM role for the EventBridge rule that includes `ssm:StartAutomationExecution` permissions for the target document and `iam:PassRole` permissions for the Systems Manager Automation service role.

Cevap

Configuring an EventBridge rule that filters for compliance changes with a status of `NON_COMPLIANT` for the `required-tags` rule, and creating an IAM role for the EventBridge rule with `ssm:StartAutomationExecution` and `iam:PassRole` permissions.
The correct actions involve configuring an EventBridge rule with an event pattern that filters for AWS Config compliance change events, specifying the rule name `required-tags` and a compliance status of `NON_COMPLIANT`. Additionally, the EventBridge rule execution role must be configured with `ssm:StartAutomationExecution` permissions to call the Systems Manager target, along with `iam:PassRole` permissions to pass the Systems Manager Automation service role during invocation.

Adım Adım Çözüm

1
Configure the EventBridge rule filtering criteria.
An EventBridge rule is created with an event pattern targeting AWS Config compliance status changes where the rule name matches `required-tags` and the compliance type is `NON_COMPLIANT`.
This establishes the real-time trigger condition for remediation when compliance fails.
2
Grant the necessary execution and role-passing permissions to EventBridge.
An IAM role is created for the EventBridge rule with policies allowing `ssm:StartAutomationExecution` on the remediation document and `iam:PassRole` on the Automation execution role.
EventBridge needs authorization to invoke the target automation document and to pass the role required to run the automation steps.

Anahtar Kavram

Automating resource remediation using EventBridge rules to trigger Systems Manager Automation documents, which requires specific event filtering patterns and IAM permissions (including ssm:StartAutomationExecution and iam:PassRole).
Soru 439Soru →

A SysOps Administrator is tasked with enabling Amazon CloudWatch Container Insights for an existing Amazon ECS cluster that runs tasks on both Amazon EC2 and AWS Fargate. The Administrator must also ensure that any new ECS clusters created in the account in the future will automatically have Container Insights enabled.

Which of the following actions should the Administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Run the aws ecs update-cluster-settings command, specifying the cluster name and setting containerInsights to enabled.; Run the aws ecs put-account-setting-default command, setting the name parameter to containerInsights and the value to enabled.

Cevap

Run the aws ecs update-cluster-settings command to enable Container Insights on the existing cluster, and run the aws ecs put-account-setting-default command to enable it by default for any new clusters.
To enable Container Insights on an existing cluster, the update-cluster-settings command with the containerInsights setting set to enabled must be executed. To ensure that newly created clusters inherit this setting automatically, the put-account-setting-default command should be used with the containerInsights setting set to enabled.

Adım Adım Çözüm

1
Enable Container Insights on the existing Amazon ECS cluster.
The existing cluster starts collecting and reporting Container Insights metrics to CloudWatch.
This is done using the aws ecs update-cluster-settings CLI command with the containerInsights setting set to enabled.
2
Set the default account-level behavior for newly created clusters.
Any new clusters created in the future will automatically inherit the Container Insights enabled setting.
This is done using the aws ecs put-account-setting-default CLI command, which applies a default cluster setting configuration account-wide.

Anahtar Kavram

Configuring Container Insights for Amazon ECS at both the cluster-specific and account-default levels.
Soru 440Soru →

An organization relies on AWS Config to verify that Amazon DynamoDB tables have point-in-time recovery (PITR) enabled. To automate the response for non-compliant tables, a SysOps administrator plans to use an Amazon EventBridge rule to execute the AWS Systems Manager (SSM) Automation document `AWS-EnableDynamoDbPointInTimeRecovery`. The SSM Automation execution requires a specific IAM service role to perform the remediation steps. Which configuration must the administrator implement to ensure the remediation process triggers successfully?

Cevabı ve açıklamayı göster

Cevap: Configure the EventBridge rule to target the SSM Automation document. Associate an IAM role with the EventBridge target that has a trust relationship with events.amazonaws.com and grants permissions for ssm:StartAutomationExecution and iam:PassRole for the SSM Automation service role.

Cevap

Configure the EventBridge rule to target the SSM Automation document. Associate an IAM role with the EventBridge target that has a trust relationship with events.amazonaws.com and grants permissions for ssm:StartAutomationExecution and iam:PassRole for the SSM Automation service role.
The correct configuration targets the Systems Manager Automation document from the EventBridge rule. The IAM role assigned to the EventBridge target must trust the EventBridge service (events.amazonaws.com) to allow assumption of the role. Additionally, the role policy must grant the ssm:StartAutomationExecution permission to run the document and the iam:PassRole permission to pass the Systems Manager Automation service role that executes the underlying remediation commands.

Adım Adım Çözüm

1
Set the EventBridge rule target to the Systems Manager Automation document.
The EventBridge rule is directed to execute the specified remediation document when triggered by the compliance change event.
EventBridge needs to invoke the Automation document directly to initiate the remediation.
2
Configure the IAM role associated with the EventBridge target to trust the EventBridge service principal.
EventBridge is successfully authorized to assume the role to trigger the target.
Without a trust relationship for events.amazonaws.com, EventBridge cannot assume the role to run the target.
3
Attach a policy to the IAM role that allows starting the automation and passing the SSM Automation service role.
EventBridge can execute the SSM document and pass the required execution role to Systems Manager.
ssm:StartAutomationExecution is required to invoke the document, and iam:PassRole is required to delegate the execution role to Systems Manager.

Anahtar Kavram

Configuring Amazon EventBridge rule targets for Systems Manager Automation remediation requires proper IAM trust relationships and permissions, including iam:PassRole to delegate the execution role to Systems Manager.
ÖncekiSayfa 22 / 49Sonraki
Tüm alıştırma soruları — AWS Certified SysOps Administrator - Associate | Examkin