Examkin

Tüm alıştırma soruları

976 soru

Tüm türler976Çoktan seçmeli502Çoklu seçim450Sıralama24
Soru 581Soru →

A company has a compliance requirement to retain all system logs for exactly 90 days. A SysOps Administrator is auditing the current logging configuration and discovers several Amazon CloudWatch log groups with their retention periods set to 'Never expire'. The administrator wants to ensure that all current and future logs in these log groups are deleted after 90 days. Which action should the administrator take to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Modify the retention settings directly on each CloudWatch log group to 90 days.

Cevap

Modify the retention settings directly on each CloudWatch log group to 90 days.
Modifying the retention settings at the log group level is the standard and most efficient way to manage log expiration in Amazon CloudWatch. CloudWatch Logs automatically deletes log events older than the specified retention period for all streams within that log group.

Adım Adım Çözüm

1
Identify the level at which retention policies are configured in Amazon CloudWatch Logs.
Confirm that retention policies can only be configured at the log group level, not the individual log stream level.
This determines where the configuration change must be applied.
2
Evaluate the native capabilities of CloudWatch Logs compared to external automation tools.
Understand that CloudWatch Logs natively supports automatic deletion of expired log events based on the log group's retention configuration.
This helps select the solution with the least administrative effort and operational complexity.
3
Apply the 90-day retention setting directly to the target CloudWatch log groups.
All existing and future log streams within these log groups will inherit the 90-day retention policy, satisfying the compliance requirement.
This implements the required configuration to resolve the issue.

Anahtar Kavram

CloudWatch Logs retention policy configuration
Soru 582Soru →

A SysOps Administrator is troubleshooting a connectivity issue where Amazon EC2 instances in a private subnet (10.0.1.0/2410.0.1.0/24) are incurring high data transfer charges when downloading large datasets from Amazon S3. The administrator discovers that the traffic is currently routed through a NAT Gateway. To resolve this and keep the traffic private, the administrator creates a Gateway VPC Endpoint for Amazon S3 in the VPC. However, the EC2 instances continue to route traffic to S3 through the NAT Gateway. Which of the following configuration steps must the administrator take to ensure the S3 traffic is routed through the Gateway VPC Endpoint? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate the private subnet's route table with the S3 Gateway VPC Endpoint.; Verify that the outbound rules of the security group attached to the EC2 instances allow traffic to the Amazon S3 prefix list.

Cevap

To resolve the routing issue, the administrator must associate the private subnet's route table with the S3 Gateway VPC Endpoint and verify that the outbound rules of the security group attached to the EC2 instances allow traffic to the Amazon S3 prefix list.
The correct options are associating the private subnet's route table with the S3 Gateway VPC Endpoint and verifying that the outbound rules of the security group attached to the EC2 instances allow traffic to the Amazon S3 prefix list. Route table association is required because AWS automatically adds a route pointing to the VPC endpoint with the destination set to the S3 prefix list. Stateful security groups must also explicitly allow outbound traffic to the S3 prefix list for the instances to successfully establish connections.

Adım Adım Çözüm

1
Associate the private subnet's route table with the S3 Gateway VPC Endpoint.
AWS automatically injects a route into the subnet's route table with the destination set to the Amazon S3 prefix list (e.g., pl-xxxx) and the target pointing to the Gateway VPC Endpoint (e.g., vpce-xxxx).
This updates the VPC router to direct traffic destined for S3 to the gateway endpoint instead of the default route (0.0.0.0/00.0.0.0/0) pointing to the NAT Gateway.
2
Ensure the stateful security group associated with the EC2 instances allows outbound traffic to the S3 prefix list.
The security group authorizes egress traffic to S3 endpoints.
Security groups are stateful and evaluate outbound traffic rules. Even if the route table points to the gateway endpoint, the instance's security group must explicitly permit outbound traffic to the S3 IP prefix list.

Anahtar Kavram

Gateway VPC Endpoints use prefix-list routing in subnet route tables to direct traffic privately to AWS services like S3, and stateful security groups must permit the outbound connection.
Soru 583Soru →

A company has recently added a new business unit to their AWS Organization as a member account. A SysOps Administrator is tasked with configuring cost monitoring for this specific account. The administrator needs to identify unexpected cost spikes that deviate from historical trends using machine learning and send immediate email alerts to the operations team. Additionally, the administrator must view a projection of the member account's total costs for the next three months. Which two actions should the SysOps Administrator take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Linked Account monitor in AWS Cost Anomaly Detection for the member account, and associate it with an alert subscription targeting the operations email address.; Open AWS Cost Explorer, apply a filter for the new member account, and run a forecast with a three-month prediction interval.

Cevap

Create a Linked Account monitor in AWS Cost Anomaly Detection for the member account, associate it with an alert subscription targeting the operations email address, and run a forecast in AWS Cost Explorer filtered by the new member account.
To detect machine learning-driven anomalies for a specific member account, a Linked Account monitor must be configured in AWS Cost Anomaly Detection along with an alert subscription. To project future costs for the next three months, AWS Cost Explorer's forecasting feature must be used with a filter applied to the specific member account. These two actions address both monitoring and forecasting requirements accurately.

Adım Adım Çözüm

1
Navigate to the AWS Cost Anomaly Detection console and create a new monitor.
A Linked Account monitor is configured specifically for the target member account.
This establishes machine learning-driven anomaly detection on the account level to identify unexpected spend spikes.
2
Configure an alert subscription for the newly created Cost Anomaly monitor.
An alert subscription is linked to the monitor with the operations email address as the recipient.
This ensures the operations team receives immediate notifications when an anomaly exceeding the threshold is detected.
3
Navigate to AWS Cost Explorer, filter by the new member account, and select the Forecast option.
A projection graph showing the estimated total costs for the next three months is rendered.
This fulfills the requirement to view a three-month cost projection for the member account.

Anahtar Kavram

Using AWS Cost Anomaly Detection for machine learning-driven spend alerting alongside AWS Cost Explorer for future spend forecasting.
Soru 584Soru →

A SysOps Administrator in Account A is attempting to create an Amazon Elastic Block Store (EBS) volume from an encrypted EBS snapshot shared by Account B. The snapshot was encrypted using the default AWS managed key (aws/ebs) in Account B. The administrator's IAM user in Account A has full administrator permissions (AdministratorAccess), but the attempt to create the volume fails with an access denied error. Which of the following actions must be taken to successfully create the EBS volume in Account A? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In Account B, copy the snapshot and encrypt the copy using a customer managed KMS key.; In Account B, update the key policy of the new customer managed KMS key to grant Account A permissions to perform the kms:Decrypt and kms:CreateGrant actions.

Cevap

To resolve the issue, the snapshot in Account B must be copied and encrypted with a customer managed KMS key. Then, the key policy of that customer managed key in Account B must be updated to grant Account A permissions to perform kms:Decrypt and kms:CreateGrant actions.
Because AWS managed KMS keys cannot be shared across accounts, the snapshot must first be copied in Account B and encrypted using a customer managed KMS key. Once encrypted with a customer managed key, the key policy must be updated to grant Account A access. Specifically, the key policy must allow the kms:Decrypt action to read the snapshot data, and the kms:CreateGrant action to allow the EC2 service in Account A to attach the resulting volume.

Adım Adım Çözüm

1
Identify the key type used to encrypt the source snapshot.
The snapshot is encrypted with the default AWS managed key (aws/ebs).
AWS managed keys cannot be shared across accounts, meaning the snapshot cannot be decrypted by Account A in its current state.
2
Re-encrypt the snapshot with a shareable key in the source account.
A copy of the snapshot is created in Account B, encrypted with a customer managed KMS key.
Customer managed KMS keys support key policy modifications, enabling cross-account sharing.
3
Configure cross-account permissions on the customer managed KMS key.
The KMS key policy in Account B is updated to allow Account A permissions to decrypt and create grants.
Account A needs kms:Decrypt to read the snapshot data and kms:CreateGrant because the Amazon EC2 service in Account A must create a cryptographic grant to attach the volume.

Anahtar Kavram

AWS managed keys cannot be shared across accounts. For cross-account resource sharing (such as EBS snapshots or RDS backups), the resource must be encrypted with a customer managed KMS key, and the key policy must grant permissions (including kms:CreateGrant for EBS/EC2) to the target account.
Soru 585Soru →

A SysOps Administrator is configuring a customer managed KMS key in an AWS account to encrypt sensitive application logs. The administrator attaches an IAM policy to a developer's IAM role that grants `kms:Decrypt` and `kms:GenerateDataKey` permissions for the KMS key. However, when the developer attempts to read the encrypted logs, they receive an 'AccessDenied' error. The administrator inspects the KMS key policy, which contains the following statement:

{
"Version": "2012-10-17",
"Id": "key-default-1",
"Statement": [
{
"Sid": "Allow administration of the key",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/AdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

Which action will resolve this issue and allow the developer to access the logs?

Cevabı ve açıklamayı göster

Cevap: Modify the KMS key policy to grant the AWS account root principal (`arn:aws:iam::123456789012:root`) permissions to perform KMS actions, enabling the IAM policy attached to the developer's role to take effect.

Cevap

Modify the KMS key policy to grant the AWS account root principal (`arn:aws:iam::123456789012:root`) permissions to perform KMS actions, enabling the IAM policy attached to the developer's role to take effect.
The correct answer is to modify the KMS key policy to grant the AWS account root principal (`arn:aws:iam::123456789012:root`) permissions to perform KMS actions. This enables IAM policies in the account to delegate permissions. Without this delegation statement in the key policy, IAM policies attached to users or roles have no authority to grant access to the KMS key.

Adım Adım Çözüm

1
Analyze the KMS key policy and identify the missing statement for IAM policy delegation.
The current key policy only grants access to `AdminRole` and does not grant access to the account root principal.
Without delegating permissions to the account root principal, IAM policies attached to users or roles in that account cannot grant key access.
2
Add the root principal statement to the KMS key policy.
The key policy now permits IAM-based access control.
This delegates the evaluation of key access permissions to the account's IAM policies.
3
Verify that the developer's IAM policy has the correct permissions.
The developer's IAM policy already contains `kms:Decrypt` and `kms:GenerateDataKey` permissions.
Once delegation is enabled in the key policy, the existing IAM policy will allow successful decryption of logs.

Anahtar Kavram

KMS key policy delegation to IAM policies via the account root principal
Soru 586Soru →

A SysOps administrator has deployed an Application Load Balancer (ALB) to distribute traffic to a fleet of Amazon EC2 instances in a private subnet. The web application listens on TCP port 5000. The target group is configured to perform HTTP health checks on port 5000 with the path `/ping`. However, all EC2 instances are showing an `Unhealthy` status with the reason `Health check target response code mismatch [404]`. Upon checking the application server logs, the administrator finds that the application's health endpoint is actually mapped to `/status` on TCP port 5000, and HTTP GET requests to `/ping` return a `404 Not Found` error. Additionally, the instance security group allows inbound traffic only from the ALB's security group on TCP port 443.

Which two changes must the SysOps administrator make to resolve the health check issues and allow the instances to pass health checks? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the target group health check path to /status.; Update the instance security group to allow inbound TCP traffic on port 5000 from the ALB security group.

Cevap

To resolve the health check issues, the SysOps administrator must update the target group health check path to /status and update the instance security group to allow inbound TCP traffic on port 5000 from the ALB security group.
The Application Load Balancer requires both a correct health check endpoint and permissions to reach the target instances on the application port. Since the endpoint is mapped to /status and the application runs on port 5000, updating the path to /status and opening port 5000 on the instance security group allows the ALB health checks to succeed.

Adım Adım Çözüm

1
Analyze the HTTP response code returned by the health check.
The target group shows a 404 response code for the path /ping, indicating the path does not exist on the application server.
Correcting the path to the actual endpoint (/status) is necessary for the health check to find the resource and return a successful 200 OK status.
2
Check the security group rules of the EC2 instances.
The instances only permit inbound traffic on port 443 from the ALB, blocking requests on the application port 5000.
Since the ALB is configured to send traffic and health checks to port 5000, the security group rules must be updated to allow inbound TCP traffic on port 5000 from the ALB security group.

Anahtar Kavram

Successful Application Load Balancer health checks require the correct health check path and permission for the load balancer to access the target group's port in the instance's security group.
Tahmini Süre:2m 0s
Soru 587Soru →

During a security review, an organization requires a SysOps administrator to confirm that all AWS CloudTrail logs stored in a centralized Amazon S3 bucket remain untampered. Although log file integrity validation is active, the administrator must run a manual check to verify the authenticity of the logs delivered over the past week. Which action should the administrator take to perform this verification?

Cevabı ve açıklamayı göster

Cevap: Execute the aws cloudtrail validate-logs command via the AWS CLI to cryptographically verify the signatures of the log files against the digest files.

Cevap

Execute the aws cloudtrail validate-logs command via the AWS CLI to cryptographically verify the signatures of the log files against the digest files.
The correct action is to run the validate-logs command from the AWS CLI. When log file integrity validation is enabled, CloudTrail creates digest files every hour containing the hash of each log file and a digital signature. The command automatically downloads these digests and the corresponding log files, recalculates the hashes, and validates the digital signatures to ensure that the logs have not been tampered with or deleted since creation.

Adım Adım Çözüm

1
Identify the requirement to manually verify the integrity of CloudTrail log files stored in an S3 bucket.
The trail has log file integrity validation enabled, which generates digest files containing hashes of the log files.
Log file integrity validation creates signature digest files that are signed using private keys, allowing authentication of the logs.
2
Determine the appropriate AWS tool or command to perform the verification.
The AWS CLI provides the validate-logs command.
This command downloads the digest files and log files, verifies the signatures, and checks the SHA-256 hashes to detect any tampering or deletion.

Anahtar Kavram

CloudTrail Log File Integrity Validation
Soru 588Soru →

A SysOps Administrator is managing an Amazon S3 bucket containing millions of objects encrypted using Server-Side Encryption with AWS KMS keys (SSE-KMS). Due to a high volume of read and write requests to the bucket, the organization has noticed a significant increase in AWS KMS API costs. The administrator needs to reduce these KMS API charges with minimal operational overhead. Which action should the administrator take to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Enable S3 Bucket Keys on the S3 bucket configuration.

Cevap

Enable S3 Bucket Keys on the S3 bucket configuration.
The correct answer is to enable S3 Bucket Keys. S3 Bucket Keys decrease the request traffic from Amazon S3 to AWS KMS by creating a bucket-level key that is used to derive unique data keys for objects. This reduces the KMS API call volume for GenerateDataKey and Decrypt by up to 99 percent, directly reducing costs with a simple bucket setting change.

Adım Adım Çözüm

1
Analyze the cause of high AWS KMS API costs in the S3 bucket configuration.
The costs are driven by S3 making KMS API calls (GenerateDataKey and Decrypt) for every single read and write request when using standard SSE-KMS.
Understanding the source of the API calls is necessary to identify how to reduce them.
2
Evaluate S3 features designed to minimize KMS interactions.
S3 Bucket Keys create a bucket-level key generated by KMS. S3 uses this bucket-level key to encrypt and decrypt object-level keys locally within S3.
Caching the key within S3 reduces the frequency of outbound API calls from S3 to KMS.
3
Select the option that configures this optimization with minimal operational effort.
Enabling S3 Bucket Keys directly in the S3 bucket settings achieves this without policy or application modifications.
This is the native, AWS-recommended mechanism for S3 KMS cost reduction.

Anahtar Kavram

S3 Bucket Keys reduce KMS API costs by caching a bucket-level key within the S3 service, decreasing call volume to KMS.
Soru 589Soru →

A company runs a specialized API service on Amazon EC2 instances. The API service listens on port 8080. A SysOps Administrator configures an Application Load Balancer (ALB) with a target group that routes traffic to these instances on port 8080. The target group health check is configured with the protocol HTTP, the path `/health`, and the port explicitly set to 80. The security group associated with the EC2 instances allows inbound traffic from the ALB on port 8080. However, all EC2 instances in the target group are reported as unhealthy with the status reason `HealthCheck.Failed`. Which action should the administrator take to resolve this health check issue?

Cevabı ve açıklamayı göster

Cevap: Modify the target group health check configuration to use the traffic-port or port 8080.

Cevap

Modify the target group health check configuration to use the traffic-port or port 8080.
The correct action is to modify the target group health check configuration to use the traffic-port or port 8080. By default, target group health checks are sent to the port on which the targets are registered (the traffic-port). Because the health check port was explicitly overridden to port 80 where no service is listening, the health checks failed. Reverting the health check port to the traffic-port (port 8080) aligns the health checks with the active application port.

Adım Adım Çözüm

1
Analyze the application listening port and security group settings.
The application listens on port 8080, and the security group allows inbound traffic from the ALB on port 8080.
This establishes that port 8080 is the correct path and port for network traffic to reach the application.
2
Identify the misconfiguration in the health check settings.
The health check port is explicitly configured as port 80, which is neither open in the security group nor has any service listening on it on the EC2 instances.
This explains why the health checks are failing with `HealthCheck.Failed`.
3
Select the resolution that aligns the health check port with the active application port.
Updating the health check port to use the traffic-port (port 8080) aligns the health check destination with the active port of the application.
This allows the ALB to successfully connect to the service on port 8080 and receive a valid health response.

Anahtar Kavram

Elastic Load Balancing target groups perform health checks on registered targets. The health check port must align with the port where the backend service is actively listening, and the targets' security groups must permit inbound traffic on that health check port.
Soru 590Soru →

A company hosts a web application on Amazon EC2 instances in private subnets. The instances are registered with a target group of an Application Load Balancer (ALB) and are configured to listen on port 8080. A SysOps Administrator notices that the target group shows all registered instances as unhealthy with the status code HealthCodeMismatch. The Administrator verifies that the application is running and accessible locally on port 8080 on each instance, but the target group's health check is currently configured to use port 80 and the HTTP protocol. At the same time, the team reports that Amazon Route 53 failover is not triggering to the secondary disaster recovery region even when all primary ALB targets are unhealthy. Which two actions should the SysOps Administrator take to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the target group's health check configuration to use port 8080 or the traffic port instead of port 80.; Set the 'Evaluate Target Health' parameter to 'Yes' on the Route 53 alias record pointing to the Application Load Balancer.

Cevap

Modify the target group's health check configuration to use port 8080 or the traffic port instead of port 80, and set the 'Evaluate Target Health' parameter to 'Yes' on the Route 53 alias record pointing to the Application Load Balancer.
To resolve the target group health check failures, the target group's health check port must match the port where the application is listening (port 8080 or the 'traffic-port'). To enable automatic Route 53 DNS failover when target instances become unhealthy, the Route 53 alias record pointing to the Application Load Balancer must have the 'Evaluate Target Health' setting enabled (set to Yes). This allows Route 53 to check the health status of the ALB and its registered targets before routing DNS traffic.

Adım Adım Çözüm

1
Address the target group health check failure.
The target group's health check configuration is updated from port 80 to port 8080 (or the traffic-port) to align with the application listening port.
Since the application listens on port 8080 and nothing is running on port 80, health check queries sent to port 80 will fail. Updating this configuration allows the load balancer to reach the application.
2
Configure Route 53 DNS failover.
The 'Evaluate Target Health' parameter is enabled (set to Yes) on the Route 53 alias record pointing to the primary ALB.
By default, Route 53 does not check target health for alias records unless 'Evaluate Target Health' is set to Yes. Without this, Route 53 will continue routing traffic to the primary ALB even if all backend instances are unhealthy.

Anahtar Kavram

Elastic Load Balancing Health Checks and Route 53 Failover Integration
Tahmini Süre:2m 0s
Soru 591Soru →

A company requires a real-time security monitoring and alerting solution to detect when any IAM user logs in to the AWS Management Console without using Multi-Factor Authentication (MFA). A SysOps Administrator must configure a solution that sends an email notification to the security team immediately upon detection.

Which two actions must the SysOps Administrator perform to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon EventBridge rule in the us-east-1 Region with an event pattern that matches the source aws.signin, the event name ConsoleLogin, and additionalEventData.MFAUsed set to No.; Configure the Amazon EventBridge rule to target an Amazon SNS topic that is subscribed to by the security team.

Cevap

Creating an Amazon EventBridge rule in the us-east-1 Region that matches the ConsoleLogin event with MFAUsed set to No, and configuring the EventBridge rule to target an Amazon SNS topic subscribed to by the security team.
Console login is a global AWS service event, which is always routed to the default EventBridge event bus in the us-east-1 Region. To capture sign-in events without MFA, the EventBridge rule must be created in us-east-1 with a pattern matching ConsoleLogin where MFAUsed is set to No. The rule must target an Amazon SNS topic to immediately notify the security team.

Adım Adım Çözüm

1
Identify the regional scope for AWS console sign-in events.
Console sign-in events are global and are processed in the us-east-1 Region.
Global service events logged by CloudTrail are sent to the default EventBridge event bus in us-east-1, meaning EventBridge rules for these events must reside there.
2
Create the EventBridge pattern to capture console logins without MFA.
Configure a rule matching the source 'aws.signin', event name 'ConsoleLogin', and 'additionalEventData.MFAUsed' set to 'No'.
This specific pattern filters the event stream to identify only insecure console logins.
3
Route the matching events to the security team.
Target the EventBridge rule to an Amazon SNS topic.
This allows immediate delivery of alerts to the email addresses subscribed to the SNS topic.

Anahtar Kavram

Monitoring global authentication events using Amazon EventBridge in the us-east-1 Region and routing them to Amazon SNS for real-time alerting.
Soru 592Soru →

A company runs a CPU-bound data processing workload using an AWS Lambda function. The function is currently configured with 512 MB of memory and is experiencing execution delays, occasionally timing out. A SysOps Administrator reviews AWS Compute Optimizer, which flags the function as under-provisioned and recommends increasing the memory to 1024 MB. The administrator notes that the function's peak memory utilization is only 200 MB. Which action should the administrator take to resolve the performance bottleneck in a cost-effective manner?

Cevabı ve açıklamayı göster

Cevap: Increase the memory configuration of the Lambda function to 1024 MB to allocate more CPU power and decrease execution time.

Cevap

Increase the memory configuration of the Lambda function to 1024 MB to allocate more CPU power and decrease execution time.
The correct option is to increase the memory configuration to 1024 MB. AWS Lambda allocates CPU power proportionally to the configured memory. Since the workload is CPU-bound, increasing the memory allocation will increase the CPU power available to the function, which significantly speeds up the execution and resolves timeouts. Often, this can also reduce the overall cost because the execution finishes much faster.

Adım Adım Çözüm

1
Analyze the workload characteristics and identify the bottleneck.
The workload is CPU-bound, but the Lambda function is currently constrained by its CPU allocation, causing execution delays.
AWS Lambda allocates CPU power proportionally to the configured memory size. At 512 MB, the function has half the CPU share of a 1024 MB configuration.
2
Evaluate AWS Compute Optimizer recommendations.
AWS Compute Optimizer recommends increasing the memory to 1024 MB, despite the low actual memory footprint of 200 MB.
Compute Optimizer models the execution time and costs of the function across different memory sizes to find the optimal point where execution speed increases enough to justify the higher cost per millisecond.
3
Apply the right-sizing recommendation to the function configuration.
The Lambda function memory is updated to 1024 MB, which increases CPU capacity, speeds up execution, resolves the timeouts, and minimizes total cost.
By reducing the total duration of the CPU-bound task, the overall execution cost may remain similar or decrease, while ensuring performance compliance.

Anahtar Kavram

Proportional CPU allocation in AWS Lambda and right-sizing CPU-bound workloads via AWS Compute Optimizer
Tahmini Süre:1m 30s
Soru 593Soru →

An application running on an IAM role in Account A (999988887777) needs to read messages from an encrypted Amazon SQS queue in Account B (555544443333). The queue is encrypted using a customer managed KMS key in Account B. The administrator has attached the following IAM policy to the role in Account A:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSQSandKMS",
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"kms:Decrypt"
],
"Resource": [
"arn:aws:sqs:us-east-1:555544443333:TargetQueue",
"arn:aws:kms:us-east-1:555544443333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
]
}
]
}

The SQS queue policy in Account B allows the IAM role in Account A to perform SQS actions. The KMS key policy in Account B contains the following default statement:

{
"Version": "2012-10-17",
"Id": "key-default-1",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::555544443333:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

When the application in Account A attempts to read messages from the queue, it fails with a KMS access denied error. What must the administrator do to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Modify the KMS key policy in Account B to explicitly allow the IAM role in Account A to perform the kms:Decrypt action.

Cevap

Modify the KMS key policy in Account B to explicitly allow the IAM role in Account A to perform the kms:Decrypt action.
For cross-account access to a customer managed KMS key, permissions must be granted on both sides: the external account's IAM policy and the owning account's KMS key policy. The default key policy statement ('Enable IAM User Permissions') only delegates authorization power to IAM policies within the same account (Account B). Therefore, to allow the IAM role in Account A to decrypt using the key, the key policy in Account B must be modified to explicitly grant the role permission to perform the kms:Decrypt action.

Adım Adım Çözüm

1
Determine the decryption requirements for reading messages from an encrypted SQS queue.
The caller (IAM role in Account A) needs sqs:ReceiveMessage on the SQS queue and kms:Decrypt on the KMS key used to encrypt the queue.
Since the SQS queue is encrypted using server-side encryption (SSE-KMS) with a customer managed key, callers must possess decryption rights on that key to retrieve the plaintext message payload.
2
Examine the default KMS key policy's delegation boundary in Account B.
The default key policy statement only delegates authorization capabilities to IAM policies within Account B.
The statement referencing the root user of Account B enables IAM policies within Account B to define access to the key. It does not grant authorization capabilities to IAM policies defined in Account A.
3
Apply cross-account access control rules for KMS.
Modify the customer managed KMS key policy in Account B to explicitly grant kms:Decrypt permissions to the Account A IAM role.
For cross-account KMS access, the trust must be established on both sides: the caller's IAM policy must allow the action, and the KMS key policy in the owning account must explicitly grant permission to the external identity.

Anahtar Kavram

Cross-account KMS key access and key policy precedence
Soru 594Soru →

A SysOps administrator is managing an Application Load Balancer (ALB) that routes traffic to Amazon EC2 instances in a private subnet. The instances host a web application listening on TCP port 8080. The ALB's target group is configured to perform health checks on HTTP port 8080. All target instances recently transitioned to an Unhealthy status, and the ALB is returning HTTP 502 Bad Gateway errors to clients. Security group rules allow inbound port 8080 traffic to the instances from the ALB, and outbound traffic from the instances is unrestricted. A custom Network Access Control List (NACL) is applied to the instance subnet. The NACL's inbound rules allow TCP port 8080 from the ALB's subnet, but all outbound rules have been removed. Which configuration change will resolve this issue and restore the instances to a healthy state?

Cevabı ve açıklamayı göster

Cevap: Add a rule to the subnet's Network ACL that allows outbound TCP traffic on ephemeral ports 1024-65535 to the ALB's subnet.

Cevap

Add an outbound rule to the subnet's Network Access Control List (NACL) that permits TCP traffic on ephemeral ports 1024-65535 to the Application Load Balancer's subnet.
Because Network ACLs are stateless, outbound traffic must be explicitly allowed. When the Application Load Balancer initiates a health check on port 8080, the instance responds using a destination port from the ephemeral port range (1024-65535). Since the outbound NACL rules were removed, this return traffic is dropped. Adding an outbound rule for the ephemeral port range to the ALB subnet allows the health check requests to be successfully completed.

Adım Adım Çözüm

1
Analyze the components and rule behaviors.
The Security Groups are configured correctly, and the target group is configured to check the correct port (8080). The issue lies with the custom Network Access Control List (NACL) applied to the subnet of the EC2 instances.
Since security groups are stateful and NACLs are stateless, return traffic from a subnet must be explicitly allowed by the NACL outbound rules.
2
Determine the necessary traffic flow for the response.
The ALB initiates health check requests on TCP port 8080 (which is allowed by the inbound NACL rule). The response traffic from the EC2 instances back to the ALB will use the ALB's ephemeral port range.
Outbound NACL rules must permit the return traffic; otherwise, the load balancer will not receive the response, causing a health check timeout.
3
Identify the configuration change that allows the return traffic.
Adding an outbound NACL rule for TCP ports 1024-65535 to the ALB subnet allows the instances to complete the TCP handshake and respond to HTTP health checks.
This resolves the health check failures and restores the target status to healthy.

Anahtar Kavram

Stateless Network Access Control Lists (NACLs) require explicit rules for both inbound request traffic and outbound return traffic (ephemeral ports) to enable communication between the Application Load Balancer and target EC2 instances.
Soru 595Soru →

A SysOps administrator is troubleshooting an Application Load Balancer (ALB) that is serving a web application. The application runs on Amazon EC2 instances in private subnets and listens on port 8081. The target group is configured to route traffic to the instances on port 8081. However, the ALB is returning HTTP 503 Service Unavailable errors to clients, and all instances in the target group are reported as unhealthy with the status description 'Healthcheck.Failed'. The administrator verifies that the target group's health check is configured to perform HTTP checks on port 80. Which of the following actions should the administrator take to resolve this issue and restore the health of the targets? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the security group of the EC2 instances to allow inbound TCP traffic on port 8081 from the security group associated with the ALB.; Modify the target group health check configuration to use port 8081 instead of port 80.

Cevap

Update the security group of the EC2 instances to allow inbound TCP traffic on port 8081 from the security group associated with the ALB, and modify the target group health check configuration to use port 8081 instead of port 80.
To resolve the health check failure, the health check port must be aligned with the application port, and the firewall rules must permit this path. Specifically, the target group's health check configuration must be modified to target port 8081 where the application is listening. Concurrently, the security group of the EC2 instances must allow inbound TCP traffic on port 8081 from the ALB's security group so that the load balancer's health check probes can successfully reach the instances.

Adım Adım Çözüm

1
Identify the port on which the web application is listening on the EC2 instances.
The application listens on port 8081.
Health check requests must be sent to the port where the backend service is actively running.
2
Compare the application port with the configured health check port in the target group settings.
The health check is configured to check port 80, which is incorrect.
No service is listening on port 80, causing the health check requests to fail.
3
Configure the security groups to permit communication between the ALB and the EC2 instances.
The EC2 instances' security group must allow inbound TCP traffic on port 8081 originating from the security group of the ALB.
Security groups are stateful and must explicitly allow inbound traffic from the load balancer on the application's port.

Anahtar Kavram

Elastic Load Balancing Health Check Port and Security Group Alignment
Soru 596Soru →

A SysOps Administrator is configuring an Amazon Simple Notification Service (Amazon SNS) topic in AWS account 123456789012. The topic is encrypted using a customer managed AWS KMS key.

A monitoring application running on an Amazon EC2 instance in the same account must publish alerts to this SNS topic. The EC2 instance is associated with an IAM role named MonitoringAppRole that has an attached policy allowing the sns:Publish action.

Currently, the application fails to publish alerts, receiving an access denied error. The KMS key has the following key policy:

{
"Version": "2012-10-17",
"Id": "key-policy-1",
"Statement": [
{
"Sid": "Allow key administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/SysOpsAdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

The administrator wants to manage permissions for the KMS key using the IAM role's policy.

Which combination of actions must the SysOps Administrator perform to resolve this issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the KMS key policy to add a statement that grants the AWS account root principal (arn:aws:iam::123456789012:root) the kms:* permissions.; Update the IAM policy attached to MonitoringAppRole to allow the kms:GenerateDataKey and kms:Decrypt actions on the KMS key.

Cevap

Modify the KMS key policy to grant the AWS account root principal (arn:aws:iam::123456789012:root) the kms:* permissions, and update the IAM policy attached to MonitoringAppRole to allow the kms:GenerateDataKey and kms:Decrypt actions on the KMS key.
To resolve the Access Denied error, the SysOps Administrator must first enable IAM-based policy delegation for the customer managed KMS key. The current KMS key policy does not delegate permissions to the AWS account root principal, which prevents IAM policies from granting access to the key. Adding a statement to the KMS key policy that allows the root principal (arn:aws:iam::123456789012:root) to perform kms:* actions enables IAM policies to control access to the key. Second, the administrator must modify the IAM role's policy to grant kms:GenerateDataKey and kms:Decrypt permissions on the KMS key. Both actions are required to successfully publish messages to the encrypted SNS topic.

Adım Adım Çözüm

1
Analyze the current KMS key policy to identify why the attached IAM policy permissions are not taking effect.
Determine that the KMS key policy is missing the default statement delegating permissions to the root principal (arn:aws:iam::123456789012:root), which means identity-based IAM policies are ignored for this key.
KMS key policies are the primary authority, and IAM policies can only grant key access if the key policy explicitly delegates that authority to the account's root principal.
2
Modify the KMS key policy to enable IAM policy delegation.
A statement is added allowing the root principal (arn:aws:iam::123456789012:root) to perform kms:* actions.
This delegates key permission management to IAM policies, allowing the administrator to define permissions on individual IAM roles.
3
Update the EC2 instance's IAM role (MonitoringAppRole) policy with the required KMS permissions.
The IAM policy is updated to grant kms:GenerateDataKey and kms:Decrypt permissions on the KMS key ARN.
These actions are required by the publishing client to encrypt payloads before sending them to the SNS topic.

Anahtar Kavram

AWS KMS Key Policy Precedence and Delegation
Soru 597Soru →

A SysOps administrator has launched an Amazon EC2 instance in a new subnet to host a public web server. The instance has been assigned a public IPv4 address, and its associated security group is configured to allow outbound traffic to 0.0.0.0/00.0.0.0/0 and inbound HTTP/HTTPS traffic on ports 8080 and 443443. However, users cannot access the web server from the internet, and the instance is unable to communicate with any external resources. Which of the following troubleshooting steps should the administrator perform to resolve this connectivity issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Verify that the subnet's route table contains a route for 0.0.0.0/00.0.0.0/0 targeting the attached Internet Gateway.; Verify that the Network ACL associated with the subnet has an outbound rule allowing traffic to 0.0.0.0/00.0.0.0/0 and an inbound rule allowing return traffic on ephemeral ports (1024−655351024-65535).

Cevap

Verify that the subnet's route table contains a route for 0.0.0.0/00.0.0.0/0 targeting the attached Internet Gateway, and verify that the Network ACL associated with the subnet has an outbound rule allowing traffic to 0.0.0.0/00.0.0.0/0 and an inbound rule allowing return traffic on ephemeral ports (1024−655351024-65535).
To make a subnet public and allow bidirectional internet communication for an EC2 instance with a public IP, the subnet's route table must have a route for 0.0.0.0/00.0.0.0/0 pointing to an Internet Gateway. Additionally, because Network ACLs are stateless, they must be explicitly configured to allow outbound traffic to 0.0.0.0/00.0.0.0/0 and inbound return traffic on ephemeral ports (1024−655351024-65535) to complete the connection handshake.

Adım Adım Çözüm

1
Examine the route table associated with the subnet where the EC2 instance is deployed.
Ensure that a route for destination 0.0.0.0/00.0.0.0/0 is present and targets the Internet Gateway.
Without this route, the subnet remains private, and internet traffic to and from the public IP address cannot be routed.
2
Examine the Network ACL rules associated with the subnet.
Ensure that outbound rules allow traffic to the internet and inbound rules permit return traffic on ephemeral ports (1024−655351024-65535).
Network ACLs are stateless, meaning return traffic must be explicitly allowed.

Anahtar Kavram

VPC public routing and stateless network filtering troubleshooting
Tahmini Süre:2m 0s
Soru 598Soru →

A company hosts a web application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The application listens on port 8080. The target group is configured to perform health checks using the HTTP protocol on port 8080 with the path `/status`. Following a security update, the application now requires an API key in the HTTP header for all requests under the `/status` path, returning an HTTP 401 Unauthorized response to requests without the key. As a result, the ALB target group marks all instances as unhealthy. Which action should a SysOps administrator take to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Configure a new, unauthenticated endpoint on the application, such as `/health`, that does not require an API key, and update the target group's health check path to `/health`.

Cevap

Configure a new, unauthenticated endpoint on the application, such as `/health`, that does not require an API key, and update the target group's health check path to `/health`.
The correct action is to create a new, unauthenticated endpoint on the application (such as `/health`) that returns a 200 OK status code, and update the target group to use this path. Since Application Load Balancers generate anonymous health check requests without custom headers, any endpoint requiring API keys or basic authentication will fail the health check. A dedicated, unauthenticated health check endpoint allows the target group to verify instance health safely.

Adım Adım Çözüm

1
Identify the cause of the health check failure from the status code.
The target group is receiving an HTTP 401 Unauthorized status code because the `/status` endpoint now requires an API key in the request headers.
Target group health checks are sent as anonymous HTTP requests without custom headers, causing the authentication check to fail on the instances.
2
Evaluate configuration workarounds for the authentication requirement.
Since Application Load Balancers cannot be configured to inject custom headers into target group health checks, and adding 401 to success matchers compromises health check reliability, a separate endpoint must be used.
A clean separation of authenticated business logic and unauthenticated health reporting is required.
3
Create and configure a dedicated health check endpoint.
Create an unauthenticated `/health` endpoint on the web server that returns HTTP 200 OK when the application is functional, and update the target group health check path accordingly.
This allows the target group to verify that the web server is running and responding without requiring authentication credentials.

Anahtar Kavram

ELB Target Group Health Checks and Authentication
Soru 599Soru →

A SysOps administrator is designing an Amazon S3 Lifecycle policy to manage storage costs for weekly generated audit reports stored in an S3 Standard bucket. The reports are frequently accessed during the first 3030 days. After 3030 days, the reports are occasionally accessed but must be available immediately. After 6060 days, the reports are rarely accessed, but they must be retained for 77 years (25552555 days) for compliance purposes. The administrator wants to use S3 Glacier Deep Archive for long-term storage, as retrieval times of up to 1212 hours are acceptable. Which lifecycle configuration is valid and minimizes storage costs?

Cevabı ve açıklamayı göster

Cevap: Transition objects to S3 Standard-IA after 3030 days, transition objects to S3 Glacier Deep Archive after 6060 days, and expire objects after 25552555 days.

Cevap

Transition objects to S3 Standard-IA after 3030 days, transition objects to S3 Glacier Deep Archive after 6060 days, and expire objects after 25552555 days.
The configuration that transitions objects to S3 Standard-IA after 3030 days and then to S3 Glacier Deep Archive after 6060 days is valid and minimizes costs. Amazon S3 Lifecycle rules require that objects spend at least 3030 days in S3 Standard-IA before transitioning to S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive. Since the transition to Glacier Deep Archive occurs at day 6060, the objects spend exactly 3030 days in S3 Standard-IA (60−30=3060 - 30 = 30), satisfying the minimum duration requirement. S3 Glacier Deep Archive is also the most cost-effective storage class for archival data that can tolerate retrieval times of up to 1212 hours.

Adım Adım Çözüm

1
Determine the initial storage duration and the target storage class for occasional immediate access.
The objects must stay in S3 Standard for 3030 days and then transition to S3 Standard-IA.
This matches the requirement for frequent access during the first 3030 days followed by occasional, immediate access.
2
Calculate the earliest valid day to transition objects from S3 Standard-IA to S3 Glacier Deep Archive.
Since S3 Standard-IA requires a minimum storage duration of 3030 days before transitioning to S3 Glacier classes, the transition to S3 Glacier Deep Archive must be scheduled for day 6060 or later (30+30=6030 + 30 = 60).
Transitioning earlier than 3030 days after moving to S3 Standard-IA will cause an S3 Lifecycle rule validation failure.
3
Set the expiration action for the compliance retention period.
Configure the expiration action to execute after 25552555 days.
This satisfies the 77-year compliance retention requirement.

Anahtar Kavram

Amazon S3 Lifecycle transition rules and minimum storage constraints
Tahmini Süre:1m 30s
Soru 600Soru →

A SysOps administrator is managing an Application Load Balancer (ALB) that routes traffic to a Target Group of Amazon EC2 instances. The Target Group is configured to receive HTTPS traffic on port 443443. The health check is configured to use the HTTP protocol on port 8080 targeting the `/health` endpoint. The security group associated with the EC2 instances allows inbound TCP traffic on port 443443 from the ALB's security group, but the ALB marks all instances as unhealthy. Which of the following actions should the administrator take to resolve this issue and allow the health checks to pass?

Cevabı ve açıklamayı göster

Cevap: Add a rule to the security group associated with the EC2 instances that allows inbound TCP traffic on port 8080 from the load balancer's security group.

Cevap

Add a rule to the security group associated with the EC2 instances that allows inbound TCP traffic on port 8080 from the load balancer's security group.
Adding an inbound rule for TCP port 8080 from the load balancer's security group to the EC2 instances' security group resolves the issue because the Application Load Balancer performs health checks using the HTTP protocol on port 8080. Although the instances allow HTTPS traffic on port 443443, the health check requests on port 8080 were being blocked by the instances' security group.

Adım Adım Çözüm

1
Analyze the configuration of the load balancer and the targets.
The target group receives traffic on port 443443, but health checks are configured to use HTTP on port 8080.
Understanding which ports are used for application traffic versus health check traffic is critical to identifying potential network blocks.
2
Review the security group rules applied to the EC2 instances.
The EC2 security group allows traffic on port 443443 from the ALB security group, but does not have any rules allowing inbound traffic on port 8080.
Since the ALB sends health checks on port 8080, the instances' security group must explicitly allow inbound traffic from the ALB on port 8080.
3
Add the missing security group rule.
Inbound TCP port 8080 is allowed from the ALB's security group, causing the health checks to pass.
Allowing the HTTP health check traffic on port 8080 enables the ALB to connect to the target group instances and verify their health status.

Anahtar Kavram

Elastic Load Balancing target group health check security group configuration
Tahmini Süre:2m 0s
ÖncekiSayfa 30 / 49Sonraki
Tüm alıştırma soruları — AWS Certified SysOps Administrator - Associate | Examkin