Tüm alıştırma soruları

A SysOps Administrator is setting up VPC Flow Logs in Account A to publish network traffic metadata to an Amazon S3 bucket in Account B. The S3 bucket in Account B is configured with default encryption using a customer managed AWS KMS key. The flow logs are failing to deliver to the S3 bucket. Which of the following actions must be taken to successfully deliver the flow logs to the destination S3 bucket? (Select TWO.)

A financial transaction application uses a Multi-AZ Amazon RDS for PostgreSQL DB instance. Following an unplanned failover event, logs indicate that the database successfully transitioned to the standby instance within 40 seconds. However, the application server pool was unable to reconnect to the database for over five minutes, resulting in dropped client requests. A SysOps Administrator discovers that the application servers continued resolving the RDS endpoint to the IP address of the failed primary instance.

Which combination of actions should the SysOps Administrator take to resolve this issue and minimize failover recovery time? (Select TWO.)

A SysOps Administrator is setting up a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must shift 10% of the traffic to the new version initially, wait 10 minutes, and then route the remaining 90% of the traffic to the new version. If the new version fails any health checks or triggers standard error rate alarms during the test period, the deployment must automatically roll back. Which TWO configuration steps should the administrator take to meet these requirements?

An organization uses AWS Config Conformance Packs to evaluate Amazon EBS volume encryption compliance across multiple AWS Regions. After deploying the conformance pack, a SysOps Administrator notices that for one specific region, the AWS Config rules show a compliance status of 'No data available' for all EBS volumes, even though several volumes are present in that region. The conformance pack deployment status itself is 'Completed' in the region.

Which two options would explain why the rules are not evaluating the EBS volumes? (Select TWO.)

A company is designing a disaster recovery (DR) architecture for a critical web application. The application's database runs on an Amazon RDS for MySQL DB instance, and its static backup archives are stored in an Amazon S3 bucket. The SysOps administrator must configure the infrastructure to meet the following requirements:

1. The database must automatically fail over to a standby instance in a different Availability Zone during an outage, achieving a Recovery Time Objective (RTO) of under 2 minutes.
2. The S3 backup archives must be automatically replicated to a secondary AWS Region to protect against regional disasters, achieving a Recovery Point Objective (RPO) of 15 minutes.

Which combination of actions must the SysOps administrator perform to meet these requirements? (Select TWO.)

A SysOps Administrator is setting up VPC Flow Logs to capture traffic from a critical production subnet and deliver the log events to an Amazon CloudWatch Logs log group. When trying to create the VPC Flow Log using an existing IAM role, the AWS Management Console displays an Access Denied error, despite the IAM role having a trust policy that allows the vpc-flow-logs.amazonaws.com service to assume it. Additionally, the administrator must ensure that these security logs do not incur indefinite storage costs.

Which of the following actions should the administrator take to resolve the creation error and manage the storage costs? (Select TWO.)

A SysOps administrator is configuring a VPC Flow Log to publish traffic metadata from a custom VPC to an Amazon CloudWatch Logs log group. The administrator has already created the target log group and an IAM role named VPCFlowLogRole that trusts the vpc-flow-logs.amazonaws.com service principal. The IAM role has a policy that allows it to create log streams and publish log events. When the administrator attempts to create the flow log, the operation fails with an authorization error. Additionally, company security policy requires that flow log data must not be stored indefinitely. Which combination of actions will resolve the creation error and meet the security requirements? (Select TWO.)

A company recently configured consolidated billing using AWS Organizations and completed the migration of several workloads. To track spending across departments, a SysOps Administrator used AWS CloudFormation to provision all resources with the `CostCenter` and `BusinessUnit` tag keys. However, when trying to create a monthly cost report in AWS Cost Explorer, the administrator finds that these tag keys are not available as filtering options. Which of the following steps must the SysOps Administrator take to resolve this issue and make these tags available in AWS Cost Explorer? (Select TWO.)

An organization runs an application on Amazon EC2 instances in a private VPC subnet. The application frequently reads and writes data to an Amazon DynamoDB table. A SysOps Administrator notices a significant increase in NAT Gateway data processing charges. To eliminate these charges, the administrator deploys a Gateway VPC Endpoint for Amazon DynamoDB within the VPC. However, monitoring tools reveal that the EC2 instances are still routing all DynamoDB traffic through the NAT Gateway. Which of the following is the most likely cause of this behavior?

A financial company is auditing its cloud expenditures across several member accounts within an AWS Organization. To track costs associated with a new data analysis project, a SysOps Administrator has written a Python script using AWS Systems Manager to apply a tag with the key `ProjectAnalysis` and value `DataLake` to all active Amazon EBS volumes. However, when the administrator logs into AWS Cost Explorer in the management account, the `ProjectAnalysis` tag is not available as a filtering option. Which action should the SysOps Administrator take to ensure the tag can be used to filter costs?

An organization runs an API service on AWS Fargate tasks registered to an Application Load Balancer (ALB) target group using the 'ip' target type. The API receives client requests over HTTPS on port 8443, but the backend application container exposes an HTTP endpoint on port 8080 specifically for health status monitoring. The SysOps Administrator notices that the target group shows all Fargate tasks as unhealthy with the description 'Health checks failed with a connection timeout'. Which two actions should the administrator take to resolve this health check issue? (Select TWO.)

A SysOps Administrator is configuring Amazon EC2 instances in a private subnet with no internet access to be managed by AWS Systems Manager Session Manager. The Administrator creates the required Interface VPC Endpoints for the `ssm`, `ssmmessages`, and `ec2messages` services within the VPC. The security group for the Interface VPC Endpoints is configured to allow inbound HTTPS traffic from the EC2 instances. However, the SSM Agent on the EC2 instances fails to connect to the Systems Manager service.

Which of the following is the most likely cause of this issue?

A company has deployed a TCP-based application on a fleet of Amazon EC2 instances in a private subnet. The instances are registered as targets in a target group for an internet-facing Network Load Balancer (NLB) using the 'instance' target type. The application listens on port 9000, and the target group is configured with TCP health checks on port 9000. The NLB has client IP preservation enabled. A SysOps Administrator observes that all EC2 instances are marked as unhealthy in the target group, and clients are unable to connect to the application. Which two configurations must the SysOps Administrator verify or apply to resolve this issue? (Select two.)

A SysOps Administrator is configuring automated monthly patching for a fleet of Amazon EC2 instances running Red Hat Enterprise Linux (RHEL). The administrator creates a custom patch baseline named RHEL-Critical-Baseline to approve only critical security updates. The target EC2 instances are tagged with the tag key Patch Group and the value RHEL-Production. The SSM Agent is running on all target instances, and an IAM instance profile with the AmazonSSMManagedInstanceCore policy is attached to all of them. The administrator then configures a Systems Manager State Manager association to run the AWS-RunPatchBaseline document on the instances tagged with Patch Group: RHEL-Production. During execution, the administrator observes that the instances are being patched, but they are receiving all updates from the default AWS-provided RHEL patch baseline rather than the custom RHEL-Critical-Baseline. Which action will resolve this issue?

A SysOps administrator has configured an Amazon CloudWatch alarm to monitor the CPU utilization of an Auto Scaling group. The alarm is configured to send notifications to an Amazon SNS topic when the CPU utilization exceeds $80\%$. The SNS topic is encrypted using a customer managed AWS KMS key. During a load test, the CPU utilization exceeded the threshold, and the alarm state changed to ALARM, but no notifications were sent.

Which TWO actions should the administrator take to resolve this issue? (Select TWO.)

A SysOps administrator is configuring a Python script hosted on an Amazon EC2 instance in Account A ($111111111111$) to automate the provisioning of temporary worker instances. The script uses the AWS SDK to call the `RunInstances` API and associates the new instances with an IAM instance profile that contains an IAM role named `WorkerExecutionRole`.

The EC2 instance running the script is associated with an IAM role named `AutomationAdminRole` which has the following IAM policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:DescribeInstances"
],
"Resource": "*"
}
]
}

When the script execution is triggered, it fails with an `UnauthorizedOperation` error during instance launch.

Which modification to the IAM configuration of `AutomationAdminRole` is required to resolve this error?

A SysOps administrator is configuring a third-party monitoring application running on Amazon EC2 instances in a Shared Services account ($333333333333$). The application needs to analyze logs stored in an Amazon S3 bucket within a Production account ($444444444444$). The S3 bucket is encrypted with an AWS KMS Customer Managed Key (CMK) in the Production account. The application runs under an IAM instance profile associated with a role named `EC2MonitorRole` in the Shared Services account, and it must assume an IAM role named `CrossAccountReaderRole` in the Production account to read the S3 objects. Which of the following configuration steps are required to establish this cross-account access? (Select TWO.)

A SysOps Administrator is setting up automated OS patching for a fleet of Amazon EC2 instances running Ubuntu 22.04 LTS. The organization requires a custom patch baseline that automatically approves security updates with a 'Critical' or 'Important' severity 10 days after release. Patching must occur during a weekly maintenance window, and target instances must be grouped dynamically. Arrange the steps in the correct chronological order to configure this automated patch management workflow, starting with the baseline configuration.

A company is using AWS Config to monitor security compliance. A SysOps administrator needs to automate the remediation of publicly accessible Amazon Redshift clusters. The administrator has verified that the AWS Config rule redshift-cluster-public-access-check is active. An AWS Systems Manager Automation document named AWS-RevokeRedshiftClusterPublicAccess will be used to remediate non-compliant clusters.

Which two configuration actions must the SysOps administrator perform to establish this automated remediation pipeline? (Select TWO.)

A SysOps Administrator is troubleshooting a failed stack update in AWS CloudFormation. The stack was created using a custom IAM service role named `CFNServiceRole` to restrict resource management permissions. During a recent update, a deployment error occurred, and the stack's status transitioned to `UPDATE_ROLLBACK_FAILED`. The administrator attempts to resume the rollback process using the AWS CLI, but receives an `AccessDenied` error when executing the command.

Which combination of actions is required to successfully resume and complete the rollback of the stack? (Select TWO.)