Tüm alıştırma soruları

A SysOps administrator has created a new subnet within a VPC and launched a test Amazon EC2 instance inside it. The instance is assigned a public IPv4 address, and its security group allows all outbound traffic. However, the administrator is unable to connect to the internet from the instance. Upon checking the subnet's associated route table, the administrator notices it only contains the default local route.

Which route must be added to the route table to enable internet access from this subnet?

An EC2 instance is located in private Subnet A (CIDR $10.0.1.0/24$) and needs to download software updates from an external repository at IP address $203.0.113.50$ over HTTPS (port $443$). The instance routes all outbound internet traffic through a NAT Gateway located in public Subnet B (CIDR $10.0.2.0/24$). The EC2 instance is associated with a Security Group that allows all outbound traffic but has no inbound rules. Subnet A is associated with a Network Access Control List (NACL-A) that has an inbound rule (Rule $100$) allowing TCP port $443$ from $0.0.0.0/0$ and an outbound rule (Rule $100$) allowing TCP port $443$ to $0.0.0.0/0$. Subnet B is associated with a Network Access Control List (NACL-B) that allows all inbound and outbound traffic. Despite this configuration, the EC2 instance fails to connect to the external repository. Which action will resolve this connectivity issue?

An organization is auditing its KMS key configurations. A SysOps Administrator is reviewing a customer managed key (CMK) in Account $111122223333$. The key is used to encrypt an Amazon S3 bucket containing sensitive compliance logs.

The KMS key policy is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/AdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "Allow S3 Service Access",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "*"
}
]
}

An IAM role in the same account ($111122223333$), `AppExecutionRole`, needs to read objects from this S3 bucket. The administrator attaches the following IAM policy to `AppExecutionRole`:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "S3AndKMSRead",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"kms:Decrypt"
],
"Resource": [
"arn:aws:s3:::compliance-logs-111122223333/*",
"arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
]
}
]
}

However, when an application using the `AppExecutionRole` attempts to retrieve an object from the S3 bucket, it receives an "Access Denied" error from KMS.

Which action should the SysOps Administrator take to resolve this issue?

An enterprise requires a centralized security auditing strategy across its multi-account environment. A SysOps Administrator is tasked with configuring a multi-region trail that delivers logs to a central Amazon S3 bucket located in a dedicated logging account. The logs must be encrypted at rest using an AWS Key Management Service (AWS KMS) customer managed key. Which two configuration steps are required to establish this secure logging and monitoring flow? (Select TWO.)

A SysOps administrator is configuring an AWS Database Migration Service (DMS) replication task to migrate data to an Amazon S3 target bucket. The administrator creates an IAM role named dms-s3-role to grant AWS DMS permissions to write to the S3 bucket. The trust policy of the role is configured to trust the DMS service principal. However, when the administrator attempts to create the S3 endpoint using the AWS Management Console and associates the dms-s3-role with it, the operation fails with an Access Denied error.

Which of the following actions must the SysOps administrator perform to successfully associate the IAM role with the endpoint? (Select TWO.)

A SysOps administrator is troubleshooting connectivity between two VPCs: VPC A ($10.0.0.0/16$) and VPC B ($172.16.0.0/16$) that are connected via an active VPC peering connection. An EC2 instance in VPC A cannot establish a connection with an EC2 instance in VPC B. Which of the following routing table configurations are required to allow communication between the two VPCs? (Select TWO.)

A company's SysOps administrator is updating an AWS CloudFormation stack that manages a three-tier web application. During the update, a failure occurs, and CloudFormation attempts to roll back the stack. However, the rollback also fails, leaving the stack in the `UPDATE_ROLLBACK_FAILED` state. Investigations show that the CloudFormation service role (`RoleARN`) is missing the permissions required to delete an Amazon S3 bucket that was created during the failed update. Which combination of actions will allow the administrator to successfully return the stack to a stable state? (Select TWO.)

An organization manages its AWS accounts using AWS Organizations with all features enabled. A SysOps administrator in a member account is troubleshooting why an IAM user (`arn:aws:iam::111122223333:user/LogOperator`) cannot delete objects from an Amazon S3 bucket named `prod-log-bucket`, despite the user having an identity-based IAM policy that allows `s3:DeleteObject` and `s3:DeleteObjectVersion` on the bucket.

The administrator discovers that the management account has applied the following Service Control Policy (SCP) to the member account:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "RestrictDeletions",
"Effect": "Deny",
"Action": [
"s3:DeleteObject",
"s3:DeleteObjectVersion"
],
"Resource": "arn:aws:s3:::prod-log-bucket/*",
"Condition": {
"ArnNotEquals": {
"aws:PrincipalArn": "arn:aws:iam::111122223333:role/LogCleanupRole"
}
}
}
]
}

Why is the IAM user unable to delete objects from the S3 bucket?

A SysOps administrator configures a new gateway VPC endpoint for Amazon S3 to enable private access for Amazon EC2 instances in a private subnet. After deploying the endpoint, the administrator notices that the EC2 instances are still routing their traffic to Amazon S3 through an existing NAT gateway. Which of the following is the most likely cause of this behavior?

A SysOps administrator is troubleshooting connectivity for an application hosted on Amazon EC2 instances in a private subnet ($Subnet\text{-}A$, CIDR $10.0.1.0/24$). The instances need to download packages from the internet and upload large files to an Amazon S3 bucket in the same Region. Currently, the route table for $Subnet\text{-}A$ has a route for $0.0.0.0/0$ pointing to a NAT Gateway in a public subnet. S3 upload traffic is currently routed through the NAT Gateway, incurring high data processing charges. To eliminate these charges, the administrator creates a Gateway VPC endpoint for Amazon S3 but notices that S3 traffic continues to flow through the NAT Gateway. Additionally, a new security policy is applied to the VPC, and the administrator configures a custom network ACL (NACL) for $Subnet\text{-}A$ that allows outbound TCP traffic to ports $80$ and $443$ and inbound TCP traffic on port $22$ for management. Immediately after applying the NACL, the EC2 instances lose all connectivity to both the internet and S3. Which combination of actions will resolve both the routing issue to S3 and the package download issue?

A SysOps Administrator is setting up an organization-wide AWS CloudTrail trail in Account A ($111122223333$). The trail is configured to deliver log files to an Amazon S3 bucket located in Account B ($444455556666$). The administrator wants to encrypt these log files using a customer managed KMS key that is also located in Account B. The S3 bucket policy in Account B has already been configured to allow the `cloudtrail.amazonaws.com` service principal to write logs. However, when the administrator enables KMS encryption on the trail using the KMS key from Account B, CloudTrail log delivery fails.

Which configuration change must the administrator make to resolve this delivery issue?

A SysOps Administrator is troubleshooting network connectivity between two private subnets in a VPC. Application servers are located in Subnet A ($172.16.1.0/24$) and need to perform secure directory lookups on an LDAP server located in Subnet B ($172.16.2.0/24$) over TCP port $636$.

Both subnets are associated with custom Network Access Control Lists (NACLs). The security groups associated with the application servers and the LDAP server are already configured to allow the required traffic. However, the directory lookups are currently failing.

Which two changes should the SysOps Administrator make to the NACLs to resolve this issue? (Select two.)

An organization uses an AWS Transit Gateway to connect its VPC ($10.100.0.0/16$) to an on-premises network ($192.168.10.0/24$) over an AWS Site-to-Site VPN. An application server running on an Amazon EC2 instance ($10.100.1.55$) in a private subnet ($10.100.1.0/24$) must connect to an on-premises database ($192.168.10.200$) on TCP port $3306$.

The EC2 instance's security group allows all outbound traffic to $0.0.0.0/0$ and has no inbound rules. The private subnet's route table has a default route ($0.0.0.0/0$) targeting a NAT Gateway, and a local route for $10.100.0.0/16$. The private subnet's Network Access Control List (NACL) allows outbound traffic to $0.0.0.0/0$ on all ports, but the inbound NACL only allows traffic from the local VPC range ($10.100.0.0/16$).

The EC2 instance cannot establish a connection to the on-premises database.

Which combination of actions must a SysOps administrator take to resolve this connectivity issue? (Select TWO.)

An enterprise uses AWS Systems Manager State Manager to enforce security configurations across all EC2 instances. Every instance has the SSM Agent running and is assigned an IAM instance profile with the `AmazonSSMManagedInstanceCore` policy. To automate compliance checks, a SysOps administrator is configuring a State Manager association that will execute a custom SSM document using a service role. When creating the association, the administrator receives an 'Access Denied' error. Which of the following IAM configurations is required to successfully create this association?

A company hosts a high-traffic API on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is integrated with an AWS WAF Web ACL that logs all web requests to an Amazon CloudWatch Logs log group. Due to the high volume of traffic, the CloudWatch Logs ingestion and storage costs have exceeded the budget. The security team requires that only requests that are explicitly blocked by the Web ACL be retained for analysis. Which action should the SysOps administrator take to meet these requirements with the least operational effort?

A SysOps Administrator in Account $111111111111$ is troubleshooting a decryption error. An application running on an Amazon EC2 instance with the IAM role `AppExecutionRole` attached is attempting to decrypt a configuration file using a Customer Managed Key (CMK). The IAM policy attached to `AppExecutionRole` contains the following statement:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKmsDecrypt",
"Effect": "Allow",
"Action": "kms:Decrypt",
"Resource": "arn:aws:kms:us-east-1:111111111111:key/12345678-1234-1234-1234-123456789012"
}
]
}

However, the application receives a `KMS.AccessDeniedException` when calling the `Decrypt` API. The Administrator reviews the current KMS key policy for the CMK:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKeyAdmins",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111111111111:role/KmsAdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

Which changes will resolve the decryption error? (Select TWO.)

An application running on an Amazon EC2 instance in Account A (111122223333) uses an IAM role named AppReaderRole. The application needs to read and decrypt files stored in an Amazon S3 bucket in Account B (444455556666). The S3 bucket is configured with server-side encryption using a customer managed key (CMK) in Account B. The AppReaderRole in Account A has been granted s3:GetObject on the S3 bucket and kms:Decrypt on the CMK via its local IAM policy. The S3 bucket policy in Account B allows s3:GetObject to the AppReaderRole. However, when the application attempts to download an encrypted file, it receives an AccessDenied error from KMS. The KMS key policy in Account B contains only the default statement that allows all actions to Account B's root principal. Which action should the SysOps Administrator take to resolve this issue?

An application tier deployed on Amazon EC2 instances in Subnet App ($10.120.10.0/24$) must connect to a MongoDB database cluster running on EC2 instances in Subnet DB ($10.120.20.0/24$) on TCP port $27017$. Both subnets are associated with custom Network Access Control Lists (NACLs) that currently deny all traffic by default. The associated Security Groups are already configured to allow all required database traffic.

Which two NACL rules must be added to the Subnet DB NACL to successfully allow this database communication? (Select two.)

A SysOps Administrator uses an AWS CloudFormation stack to manage an Amazon S3 bucket used for public asset hosting. A developer manually modified the bucket's CORS (Cross-Origin Resource Sharing) configuration directly in the Amazon S3 console to enable access for a new partner domain. The administrator runs drift detection on the stack and identifies that the S3 bucket is in a drifted state. The administrator wants to resolve the drift and align the stack and the S3 bucket configuration.

Which of the following actions can the administrator take to remediate the drift? (Select TWO.)

A SysOps Administrator is configuring automated remediation for non-compliant resources detected by AWS Config. The administrator is using an AWS Systems Manager (SSM) Automation document to remediate non-compliant Amazon S3 buckets. The administrator creates an IAM role named `S3RemediationRole` with the required permissions to modify bucket configurations. When configuring the remediation action in AWS Config, the administrator specifies the Amazon Resource Name (ARN) of `S3RemediationRole` as the `AutomationAssumeRole` parameter. However, when the remediation is triggered, the execution fails to start and indicates that the role cannot be assumed. Which action must the administrator take to resolve this issue?