Tüm alıştırma soruları

A SysOps Administrator is configuring AWS Systems Manager Patch Manager to automate security updates for a fleet of Amazon Linux 2 EC2 instances. The instances run in a private VPC subnet with no internet connectivity. To allow communication with Systems Manager, the administrator successfully creates interface VPC endpoints for ssm, ssmmessages, and ec2messages. However, when the automated patching task runs, the instances fail to download the required OS update packages, and the patching execution fails. Which of the following should the administrator do to resolve this issue?

A SysOps Administrator is configuring cross-account access to a customer managed KMS key in Account A ($123456789012$) to allow an application running on an IAM role in Account B ($987654321098$) to decrypt data.

Currently, the KMS key policy in Account A contains the following default statement:

{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "kms:*",
"Resource": "*"
}

Which combination of actions must the SysOps Administrator perform to grant the application in Account B access to the KMS key? (Select TWO.)

A SysOps Administrator is responsible for managing the OS updates for a fleet of Amazon EC2 instances running Red Hat Enterprise Linux (RHEL). The fleet consists of two environments: development and production. The administrator needs to automate the patching process using AWS Systems Manager Patch Manager so that development instances are patched using a custom baseline named RHEL-Dev-Baseline, and production instances are patched using a custom baseline named RHEL-Prod-Baseline. Patches must be applied automatically during separate weekly maintenance windows. Which two actions must the SysOps Administrator perform to ensure the correct baseline is applied to each environment during their scheduled maintenance windows? (Select TWO.)

An organization's web application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application receives traffic forwarded from a third-party Content Delivery Network (CDN) provider. A SysOps administrator is configuring an AWS WAF Web ACL associated with the ALB to mitigate brute-force attempts on the login portal located at /admin/login. Because the CDN routes all traffic, the source IP of all incoming HTTP requests to the ALB is that of the CDN edge servers. The client's actual IP address is preserved in the X-Forwarded-For HTTP header.

Which of the following configuration steps should the administrator perform on the rate-based rule to block malicious clients while minimizing impact on legitimate traffic? (Select TWO.)

An administrator deploys web servers in a subnet of a new VPC ($10.0.0.0/16$). The servers must host a public website on port $80$ and retrieve updates from a public third-party repository. The instances have public IPv4 addresses. Currently, users on the internet cannot access the website, and the web servers cannot reach the external repository.

The administrator verifies the following configuration details:
- The security group associated with the web servers allows inbound port $80$ from $0.0.0.0/0$ and all outbound traffic.
- The custom Network Access Control List (NACL) associated with the subnet has inbound rules allowing port $80$ from $0.0.0.0/0$ and outbound rules allowing all traffic to $0.0.0.0/0$.
- The subnet's route table contains a local route for $10.0.0.0/16$ but no other routes. An Internet Gateway is attached to the VPC.

Which combination of actions will resolve the connectivity issues? (Select TWO.)

A SysOps Administrator is configuring Amazon EC2 instances in a private subnet with no internet access to retrieve container images from Amazon Elastic Container Registry (Amazon ECR). The administrator creates Interface Endpoints for com.amazonaws.us-east-1.ecr.dkr and com.amazonaws.us-east-1.ecr.api in the VPC and enables private DNS. However, the instances still fail to pull container images, and the pull process times out when trying to download the image layers. Which action should the SysOps Administrator take to resolve this issue?

A company's web application is distributed globally using an Amazon CloudFront distribution protected by an AWS WAF web ACL. The application has recently experienced an HTTP flood attack targeting the feedback submission endpoint at `/submit-feedback`. A SysOps administrator needs to configure AWS WAF to block requests to `/submit-feedback` from any client IP address that exceeds 200 requests within a 5-minute period, while ensuring that legitimate traffic to other pages and endpoints on the website is not rate-limited or blocked.

Which configuration should the SysOps administrator implement to meet these requirements?

A company hosts several testing workloads in a development AWS account. Due to the ad-hoc nature of these tests, resource utilization fluctuates wildly, resulting in highly variable and unpredictable daily spending. The SysOps administrator must set up a solution that uses machine learning to automatically detect unexpected cost anomalies and immediately send alert notifications to the operations team's Slack channel. Which solution will meet these requirements with the least operational overhead?

A SysOps Administrator is configuring a customer managed KMS key to encrypt an Amazon S3 bucket in the same AWS account. An IAM user named DataAuditor needs to decrypt objects in this bucket. The administrator has attached an IAM policy to the DataAuditor user that allows kms:Decrypt on the KMS key's ARN. However, the user still receives an Access Denied error when trying to download and decrypt the objects. The current KMS key policy has been modified and does not contain the default statement that enables IAM policies.

Which of the following actions will resolve this issue? (Select TWO.)

A company runs a web application with endpoints in the `us-east-1` Region, the `us-west-2` Region, and an on-premises data center in Chicago. A SysOps administrator must configure Amazon Route 53 to route client traffic to the closest physical endpoint. During scheduled maintenance of the Chicago data center, the administrator needs to redirect a portion of the traffic that would normally route to Chicago to the `us-east-1` Region instead, without altering the DNS endpoint IP addresses or physical locations.

Which Route 53 configuration should the SysOps administrator use to meet these requirements?

A SysOps Administrator is tasked with automating the deployment of OS patches for a fleet of Amazon Linux 2023 EC2 instances. The administrator wants to use a custom patch baseline to enforce security compliance. The instances are divided into a 'Production' environment, and patches must only be applied during a weekly Saturday night maintenance window. The setup must ensure that the custom baseline is applied rather than the default AWS-managed baseline. Arrange the steps in the correct order to configure this automated patch management workflow.

A company's production e-commerce application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company has subscribed to AWS Shield Advanced to protect its infrastructure from distributed denial of service (DDoS) attacks. A SysOps administrator is tasked with configuring automatic application-layer DDoS mitigation to block traffic from sources identified by AWS Shield.

Which two configuration steps must the administrator perform to enable this automatic mitigation? (Select TWO.)

A SysOps Administrator is configuring an Amazon SQS queue in AWS account `111122223333` to use server-side encryption with a customer managed KMS key. An application running on an Amazon EC2 instance in the same account must send messages to the queue. The administrator has attached an IAM policy to the EC2 instance profile's IAM role that grants `sqs:SendMessage`, `kms:GenerateDataKey`, and `kms:Decrypt` permissions. However, the application logs show an Access Denied error when attempting to send messages to the queue.

The customer managed KMS key's key policy is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:user/SecurityAdmin"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

Which modification must the administrator make to resolve this access issue?

A company manages a fleet of Amazon EC2 instances running SUSE Linux Enterprise Server (SLES) split into Development and Production environments. A SysOps Administrator creates a custom patch baseline for SLES and registers a patch group named 'SLES-Dev' to this baseline. The administrator tags the Development EC2 instances with a tag key of 'Patch_Group' and a value of 'SLES-Dev'. A Systems Manager Maintenance Window is configured to run patch operations targeting these instances. During the next scheduled maintenance window, the administrator notices that the Development instances are patched using the default AWS-managed SLES patch baseline instead of the custom patch baseline. Which of the following explains why the Development instances were patched using the default baseline?

A SysOps administrator is managing a web application's regional REST API hosted on Amazon API Gateway. During peak traffic hours, the API suffers from performance degradation due to a high volume of HTTP flood requests originating from a distributed set of IP addresses. The administrator needs to configure AWS WAF to mitigate these web-layer DDoS attacks. Additionally, to comply with strict storage cost optimization guidelines, only requests that are actively blocked by AWS WAF rules must be logged.

Which TWO configuration steps must the SysOps administrator implement to meet these requirements? (Select TWO.)

A company wants to implement a machine learning-based monitoring solution to identify unexpected cost spikes at the individual AWS service level. Once an anomaly is detected, the SysOps team needs to receive immediate notifications in their Microsoft Teams channel. Which of the following steps are required to implement this solution? (Select TWO.)

An administrator is troubleshooting an application running on an Amazon EC2 instance that needs to decrypt sensitive database backups retrieved from an Amazon S3 bucket. The backups are encrypted using a customer managed KMS key. Although the administrator has attached an IAM policy to the EC2 instance's IAM role that grants `kms:Decrypt` permissions for the key's Amazon Resource Name (ARN), the application still receives an Access Denied error when attempting to decrypt.

Which of the following configuration changes or verifications must the administrator perform to resolve this issue? (Select TWO.)

A company runs large-scale, ad-hoc data processing jobs using Amazon EMR. The run schedule and scale of these jobs vary greatly based on client data delivery, leading to highly variable but legitimate compute costs. A SysOps administrator needs to implement a solution that detects unexpected cost spikes due to configuration errors or orphaned resources, while minimizing false alarms caused by the variable EMR workloads. Which solution meets these requirements with the least operational overhead?

A SysOps administrator is troubleshooting internet connectivity issues for an Amazon EC2 instance in a private subnet with CIDR block $10.0.1.0/24$. The VPC contains a public subnet with CIDR block $10.0.0.0/24$. To save costs, the administrator deployed a custom EC2 NAT instance in the public subnet instead of a NAT Gateway.

The administrator has performed the following configuration steps:
- Configured the private subnet's route table with a route for $0.0.0.0/0$ targeting the network interface (ENI) of the NAT instance.
- Configured the public subnet's route table with a route for $0.0.0.0/0$ targeting the VPC's Internet Gateway.
- Enabled IP forwarding in the operating system of the NAT instance.
- Configured the security groups and Network ACLs to allow all traffic.

Despite these settings, the EC2 instance in the private subnet cannot reach any internet resources. Which of the following actions will resolve this connectivity issue?

An organization's deployment contains an Application Load Balancer (ALB) that routes traffic to a fleet of Amazon EC2 instances. The application operates on port $5000$, and the target group is configured to use port $5000$ for routing. A dedicated health monitoring service runs on the instances on port $9000$, and the target group's health check port is explicitly configured to $9000$. All instances are currently marked as unhealthy with the status code `HealthCheck.Timeout`. The administrator reviews the security rules:

- The security group assigned to the ALB allows inbound HTTPS traffic on port $443$ from $0.0.0.0/0$. Its outbound rules only allow TCP traffic on port $5000$ directed to the EC2 instances' security group.
- The security group assigned to the EC2 instances allows inbound TCP traffic on port $5000$ from the ALB security group. All outbound traffic is permitted.

Which two configuration changes are required to allow the health checks to pass? (Select two.)