Examkin

Tüm alıştırma soruları

976 soru

Tüm türler976Çoktan seçmeli502Çoklu seçim450Sıralama24
Soru 601Soru →

A SysOps Administrator is configuring Amazon Route 53 to route traffic for a company's apex domain (example.com) to a REST API. The API is deployed as regional API Gateway endpoints in both the us-east-1 and us-west-2 Regions. The administrator wants to route client requests to the region that provides the lowest network latency. Which two configurations must the SysOps Administrator implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Alias A record for example.com using the Latency routing policy, specifying the us-east-1 Region, and pointing to the API Gateway regional custom domain name in us-east-1.; Create an Alias A record for example.com using the Latency routing policy, specifying the us-west-2 Region, and pointing to the API Gateway regional custom domain name in us-west-2.

Cevap

Create an Alias A record for example.com using the Latency routing policy, specifying the us-east-1 Region, and pointing to the API Gateway regional custom domain name in us-east-1; and create an Alias A record for example.com using the Latency routing policy, specifying the us-west-2 Region, and pointing to the API Gateway regional custom domain name in us-west-2.
To route requests to the nearest API Gateway endpoint for the zone apex (example.com), you must create Route 53 Alias A records using the Latency routing policy. Standard CNAME records cannot be configured at the zone apex because the apex requires SOA and NS records, which cannot coexist with a CNAME record under DNS standards. Alias records solve this by mapping the apex directly to the regional API Gateway endpoints without violating DNS specs.

Adım Adım Çözüm

1
Determine the DNS record requirements for the zone apex (example.com).
Identify that a CNAME record cannot be used at the zone apex due to DNS RFC limitations.
The zone apex must possess SOA and NS records, and standard DNS rules dictate that a CNAME record cannot share the same name as other record types.
2
Select the correct Route 53 record type to bypass this limitation.
Choose Route 53 Alias A records.
Alias records allow you to map the zone apex to select AWS resources, such as regional API Gateway endpoints, while presenting them as A records to DNS clients.
3
Apply the required routing policy for network performance.
Configure Latency-based routing for both regions.
This configuration allows Route 53 to measure round-trip times from users to each region and resolve queries to the endpoint offering the shortest latency.

Anahtar Kavram

Routing zone apex traffic using Route 53 Alias records and Latency routing policies.
Tahmini Süre:2m 0s
Soru 602Soru →

A SysOps Administrator is troubleshooting connectivity issues for an Amazon EC2 instance deployed in Subnet-A of a VPC. The instance is assigned a public IPv4 address but is unable to access the internet to download package updates. Additionally, a Gateway VPC endpoint for Amazon S3 has been provisioned in the VPC, but the instance is unable to access Amazon S3 buckets privately. Which combination of actions will resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a route in the route table associated with Subnet-A that maps 0.0.0.0/00.0.0.0/0 to the Internet Gateway (IGW) attached to the VPC.; Update the route table associated with Subnet-A to include a route targeting the S3 Gateway VPC endpoint for the S3 prefix list.

Cevap

Add a route in the route table associated with Subnet-A that maps 0.0.0.0/00.0.0.0/0 to the Internet Gateway (IGW) attached to the VPC, and update the route table associated with Subnet-A to include a route targeting the S3 Gateway VPC endpoint for the S3 prefix list.
To restore internet access for the EC2 instance, the subnet's route table must include a route directing 0.0.0.0/00.0.0.0/0 to the Internet Gateway (IGW). To allow private access to S3, the route table must also include a route for the S3 prefix list pointing to the S3 Gateway VPC endpoint. These two steps configure the correct routing pathways for both destinations.

Adım Adım Çözüm

1
Analyze the internet connectivity failure.
Since the EC2 instance has a public IP but cannot reach the internet, the subnet's route table is missing a route to the Internet Gateway.
An instance with a public IP requires a route to an Internet Gateway to send and receive traffic from the internet.
2
Analyze the S3 connectivity failure.
The Gateway VPC Endpoint was provisioned, but the instance cannot access S3 buckets privately, indicating the route table for Subnet-A has not been updated with the endpoint route.
Gateway VPC endpoints require a prefix list route in the associated subnet route tables to direct traffic directly to the endpoint.
3
Select the two correct configuration steps.
Adding the 0.0.0.0/00.0.0.0/0 route to the Internet Gateway and adding the S3 prefix list route pointing to the Gateway VPC endpoint resolves both issues.
These steps address the routing gaps for both public internet and private S3 access.

Anahtar Kavram

Troubleshooting routing in AWS VPCs for both internet access (using an Internet Gateway) and AWS service access (using a Gateway VPC Endpoint).
Soru 603Soru →

A company stores weekly database transaction logs in an Amazon S3 Standard bucket. The logs are accessed frequently for the first 14 days after creation. After 14 days, the logs are rarely accessed but must remain immediately accessible for troubleshooting. After 90 days, the logs must be retained for 7 years to meet compliance requirements, and a retrieval time of up to 12 hours is acceptable.

A SysOps administrator attempts to configure an S3 Lifecycle policy with the following rules:
- Transition to S3 Standard-Infrequent Access (S3 Standard-IA) after 14 days.
- Transition to S3 Glacier Deep Archive after 90 days.

What is the result of attempting to apply this policy?

Cevabı ve açıklamayı göster

Cevap: The lifecycle policy will fail validation and cannot be applied because S3 Lifecycle rules require objects to be stored in S3 Standard for at least 30 days before transitioning to S3 Standard-IA.

Cevap

The lifecycle policy will fail validation and cannot be applied because S3 Lifecycle rules require objects to be stored in S3 Standard for at least 30 days before transitioning to S3 Standard-IA.
The lifecycle policy fails validation because Amazon S3 requires objects to be stored in S3 Standard for at least 30 days before they can be transitioned to S3 Standard-IA or S3 One Zone-IA. Since the administrator attempted to set the transition period to 14 days, the S3 API will reject the configuration with a MalformedXML error.

Adım Adım Çözüm

1
Analyze the proposed lifecycle transition rule from S3 Standard to S3 Standard-IA.
The rule attempts to transition objects to S3 Standard-IA 14 days after creation.
To verify if the transition timing complies with Amazon S3 Lifecycle transition constraints.
2
Check Amazon S3 constraints for S3 Standard-IA transition timing.
Amazon S3 requires objects to be stored in S3 Standard for a minimum of 30 days before they can transition to S3 Standard-IA or S3 One Zone-IA.
To identify if the 14-day transition threshold violates S3 API validation rules.
3
Determine the behavior of the S3 API when receiving an invalid lifecycle configuration.
Amazon S3 returns a MalformedXML validation error (400 Bad Request) and rejects the entire configuration.
To conclude the outcome of attempting to apply this policy.

Anahtar Kavram

Amazon S3 Lifecycle rules enforce a strict minimum requirement of 30 days in the S3 Standard storage class before objects can be transitioned to S3 Standard-IA or S3 One Zone-IA. Configurations violating this constraint are rejected with a validation error.
Tahmini Süre:1m 30s
Soru 604Soru →

A SysOps administrator is troubleshooting a connectivity issue between two VPCs: VPC A (10.100.0.0/1610.100.0.0/16) and VPC B (10.200.0.0/1610.200.0.0/16). The VPCs were previously communicating successfully via a VPC peering connection. After a recent configuration cleanup, instances in VPC A can no longer reach instances in VPC B. The administrator checks the route table for VPC A's subnet and finds the following entry:

DestinationTargetStatus
10.100.0.0/1610.100.0.0/16localActive
10.200.0.0/1610.200.0.0/16pcx-0a1b2c3d4e5f6g7h8Blackhole

Which action must the administrator take to restore connectivity?

Cevabı ve açıklamayı göster

Cevap: Update the route table for VPC A to target the active VPC peering connection ID, and ensure that the route table in VPC B is also updated to target the active peering connection.

Cevap

Update the route table for VPC A to target the active VPC peering connection ID, and ensure that the route table in VPC B is also updated to target the active peering connection.
The correct answer is to update the route tables in both VPCs to target the active VPC peering connection ID. A route status of Blackhole indicates that the target of the route (such as a deleted peering connection or network interface) is no longer available. Updating the route table with the correct, active peering connection ID restores the route's status to Active. Because VPC peering requires bidirectional routing, the route table in the peer VPC must also be updated.

Adım Adım Çözüm

1
Analyze the route table status in VPC A.
The destination route for VPC B (10.200.0.0/1610.200.0.0/16) points to pcx-0a1b2c3d4e5f6g7h8 and has a status of Blackhole.
This status indicates the specified target VPC peering connection was deleted or is inactive.
2
Identify the active VPC peering connection ID.
A new VPC peering connection should be active or needs to be established between VPC A and VPC B.
Since the old peering connection was deleted during the cleanup, a new connection must be targeted to restore routing.
3
Update the route tables in both VPC A and VPC B.
Replace the target in VPC A's route table with the new active peering ID, and perform the corresponding route update in VPC B's route table.
VPC peering is bidirectional, so both route tables must have active routes pointing to the active peering connection ID for traffic to flow.

Anahtar Kavram

VPC Peering Routing and Blackhole Route Status
Soru 605Soru →

A company stores scanned contract documents in an Amazon S3 Standard bucket. The documents are accessed frequently during the first 45 days after creation. After 45 days, access frequency drops significantly, but the documents must be retained for 3 years. The company requires immediate, millisecond-level access to any document throughout the entire retention period.

Which TWO S3 Lifecycle transitions should a SysOps administrator configure to meet these requirements in the most cost-effective manner?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Transition objects from S3 Standard to S3 Standard-IA after 45 days; Transition objects from S3 Standard-IA to S3 Glacier Instant Retrieval after 90 days

Cevap

Transition objects from S3 Standard to S3 Standard-IA after 45 days, and transition objects from S3 Standard-IA to S3 Glacier Instant Retrieval after 90 days.
Transitioning to S3 Standard-IA after 45 days aligns with the drop in access frequency and satisfies the minimum residency constraint. Transitioning from S3 Standard-IA to S3 Glacier Instant Retrieval after 90 days is a valid sequence because the objects spend 45 days in S3 Standard-IA (exceeding the 30-day minimum) and S3 Glacier Instant Retrieval maintains the required millisecond retrieval latency.

Adım Adım Çözüm

1
Analyze the access pattern and latency requirements of the document storage lifecycle.
The documents require S3 Standard for the first 45 days, followed by a lower-cost tier that still supports millisecond-level access for the remainder of the 3-year compliance period.
This establishes the constraints: we cannot use Glacier Flexible Retrieval or Glacier Deep Archive due to their retrieval latencies (minutes to hours).
2
Evaluate the first transition from S3 Standard.
Transitioning from S3 Standard to S3 Standard-IA after 45 days matches the frequent access period and meets the S3 lifecycle requirement that objects must reside in S3 Standard for at least 30 days before transitioning to S3 Standard-IA.
This ensures the transition is cost-optimal and avoids early transition penalties.
3
Evaluate the second transition to a colder class that still supports millisecond-level retrieval.
Transitioning from S3 Standard-IA to S3 Glacier Instant Retrieval after 90 days is valid. Since the object transitioned to S3 Standard-IA at 45 days and then to S3 Glacier Instant Retrieval at 90 days, it spent 45 days in S3 Standard-IA, which meets the 30-day minimum storage duration for S3 Standard-IA.
This minimizes ongoing storage costs while adhering to all S3 storage class constraints and compliance access speeds.

Anahtar Kavram

Designing S3 Lifecycle transitions that respect minimum storage durations, transition directions, and access latency requirements.
Soru 606Soru →

An administrator is configuring an Amazon S3 Lifecycle policy for a bucket containing high-resolution LIDAR sensor data logs. The logs, which average 1.5 GB1.5\text{ GB} in size, are frequently accessed for the first 1515 days after upload. After 1515 days, they are rarely accessed but must remain available with millisecond retrieval times. The administrator creates a lifecycle rule to transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) 1515 days after creation, and then to S3 Glacier Deep Archive 9090 days after creation.

What will happen when the administrator attempts to apply this S3 Lifecycle policy?

Cevabı ve açıklamayı göster

Cevap: The configuration will fail validation and reject the policy because S3 Lifecycle rules require a minimum of 3030 days to elapse before transitioning objects to S3 Standard-IA.

Cevap

The configuration will fail validation and reject the policy because S3 Lifecycle rules require a minimum of 3030 days to elapse before transitioning objects to S3 Standard-IA.
The correct option is correct because Amazon S3 Lifecycle rules enforce a validation constraint that prevents transitioning objects from S3 Standard to S3 Standard-IA (or S3 One Zone-IA) earlier than 3030 days after object creation. Since the policy specifies a transition to S3 Standard-IA after 1515 days, it violates this sequence restriction and will be rejected with a validation error upon application.

Adım Adım Çözüm

1
Check the minimum storage duration requirements for S3 Standard-IA transitions within S3 Lifecycle configurations.
Identify that S3 Lifecycle requires objects to spend a minimum of 3030 days in S3 Standard or S3 Intelligent-Tiering before they are eligible to transition to S3 Standard-IA or S3 One Zone-IA.
This establishes the validation baseline for the proposed 1515-day transition.
2
Compare the administrator's proposed lifecycle timeline against the S3 transition constraints.
The proposed timeline attempts to transition files to S3 Standard-IA at day 1515, which is less than the 3030-day minimum requirement.
This identifies the direct cause of the validation failure in the policy.
3
Verify downstream lifecycle transition rules.
The transition from S3 Standard-IA to S3 Glacier Deep Archive at day 9090 is valid, as it flows to a colder tier and exceeds the required minimum elapsed time.
This confirms that the primary transition rule at day 1515 is the sole blocker preventing successful policy validation.

Anahtar Kavram

S3 Lifecycle transition rules enforce strict timing validation constraints, including a mandatory minimum of 3030 days in a warmer tier before transitioning to S3 Standard-IA or S3 One Zone-IA. Configurations violating this constraint will fail API validation during deployment.
Soru 607Soru →

A company hosts its web application at the zone apex (`example.com`). The application is deployed behind Application Load Balancers (ALBs) in two AWS Regions: `us-east-1` and `eu-west-1`. A SysOps Administrator must configure Amazon Route 53 to route user traffic to the region that provides the lowest network latency. The solution must support automated failover to the other region if the local ALB becomes unhealthy. Which two Route 53 configurations should the SysOps Administrator implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create Latency routing Alias A records for `example.com` pointing to the ALB DNS name in each AWS Region.; Configure the Evaluate Target Health setting to Yes on the created Alias records.

Cevap

Create Latency routing Alias A records for the zone apex pointing to the ALB DNS names, and configure the Evaluate Target Health setting to Yes on these Alias records.
To route traffic based on network latency for a zone apex domain, the administrator must use Latency routing Alias A records. Unlike CNAME records, Alias records can be used at the zone apex. Additionally, to support automatic failover, the Evaluate Target Health property must be set to Yes on these Alias records, which leverages ALB health checks to determine resource availability.

Adım Adım Çözüm

1
Identify the record type required for the zone apex
Determine that a CNAME record cannot be used at the zone apex (`example.com`), which requires the use of Route 53 Alias A records pointing to the ALBs.
DNS RFC standards prohibit CNAME records at the zone apex.
2
Select the appropriate routing policy for lowest network latency
Choose Latency routing to route users to the region with the lowest round-trip network time.
Latency routing directly measures and optimizes for network latency between the client and AWS Regions.
3
Configure the health checking and failover mechanism
Enable 'Evaluate Target Health' on the Alias records.
Enabling 'Evaluate Target Health' allows Route 53 to check the health of the ALB using its target groups, automatically failing over to the other region if the primary region's ALB becomes unhealthy.

Anahtar Kavram

Route 53 Latency routing combined with Alias records and Evaluate Target Health at the zone apex.
Tahmini Süre:1m 30s
Soru 608Soru →

A company stores application logs in an Amazon S3 Standard bucket. The logs are accessed frequently during the first 30 days. From day 31 to day 90, the logs are accessed infrequently but must be available with millisecond retrieval latency. After 90 days, the logs are rarely accessed but must be retained for another 180 days for compliance audits. The compliance audits can tolerate a retrieval time of up to 5 hours. Which configuration of Amazon S3 Lifecycle rules meets these requirements in the most cost-effective manner?

Cevabı ve açıklamayı göster

Cevap: Transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days, and transition them to Amazon S3 Glacier Flexible Retrieval after 90 days.

Cevap

Transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days, and transition them to Amazon S3 Glacier Flexible Retrieval after 90 days.
The correct configuration transitions objects to S3 Standard-IA after 30 days and to S3 Glacier Flexible Retrieval after 90 days. This matches the access pattern requirements because S3 Standard-IA offers millisecond retrieval latency for the infrequent access phase, and S3 Glacier Flexible Retrieval supports standard retrievals within 3–5 hours, which satisfies the 5-hour compliance retrieval SLA at a highly optimized cost point.

Adım Adım Çözüm

1
Analyze the access and performance requirements for each phase of the lifecycle.
Phase 1 (Days 1–30): Frequent access, millisecond retrieval. Phase 2 (Days 31–90): Infrequent access, millisecond retrieval. Phase 3 (Days 91–270): Rare access, retrieval tolerance up to 5 hours.
This establishes the baseline requirements that any compliant S3 storage class configuration must satisfy.
2
Select the appropriate storage class for each phase.
Phase 1 requires S3 Standard. Phase 2 requires S3 Standard-IA because it provides millisecond retrieval latency. Phase 3 requires Amazon S3 Glacier Flexible Retrieval, as its standard retrieval time is 3–5 hours, meeting the 5-hour audit SLA at a lower cost than Glacier Instant Retrieval.
Choosing the correct storage classes ensures all performance, retrieval latency, and compliance SLAs are satisfied.
3
Validate the S3 Lifecycle transition rules and timelines for the selected classes.
Transitioning from S3 Standard to S3 Standard-IA after 30 days is valid. Transitioning from S3 Standard-IA to S3 Glacier Flexible Retrieval after 90 days (60 days spent in Standard-IA) is valid and avoids any early deletion or transition minimum storage duration fees since the object stayed in S3 Standard-IA for more than the 30-day minimum.
Validating rules prevents configuration errors and unexpected charges due to S3 minimum storage duration policies.

Anahtar Kavram

Amazon S3 Storage Class and Lifecycle Transition Rules
Soru 609Soru →

A SysOps Administrator is configuring active-passive DNS failover in Amazon Route 53 for a serverless application. The application is hosted on Amazon API Gateway (regional endpoint) under the zone apex domain name (example.com). The primary API is deployed in the us-east-1 region, and the standby API is deployed in the us-west-2 region. If the primary API becomes unavailable, traffic must automatically fail over to the standby API. Which two actions must the administrator take to configure this routing? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Route 53 health check to monitor the health of the primary API Gateway regional endpoint.; Create an Alias A record for example.com using the Failover routing policy, set the failover type to Primary, point it to the us-east-1 API Gateway custom domain, and associate it with the created Route 53 health check.

Cevap

Create a Route 53 health check to monitor the health of the primary API Gateway regional endpoint, and create an Alias A record for example.com using the Failover routing policy, set the failover type to Primary, point it to the us-east-1 API Gateway custom domain, and associate it with the created Route 53 health check.
To set up active-passive failover at the zone apex (example.com) for API Gateway, the administrator must use Alias A records because CNAME records are not permitted at the zone apex. Because Route 53 does not support the 'Evaluate Target Health' option for API Gateway custom domains, a separate Route 53 health check must be created to monitor the primary endpoint. The primary Failover record is then associated with this health check to enable automatic failover. The secondary record does not require this health check.

Adım Adım Çözüm

1
Identify the domain requirement and choose the record type.
Since the domain is at the zone apex (example.com), a CNAME record cannot be used. An Alias A record must be configured to point to the API Gateway custom regional domain.
DNS RFCs prohibit CNAME records at the zone apex.
2
Determine how Route 53 monitors API Gateway health.
Route 53's 'Evaluate Target Health' is not supported for API Gateway alias targets. A custom Route 53 health check must be created to monitor the availability of the primary endpoint.
API Gateway does not natively integrate with Route 53's automatic target health evaluation.
3
Configure the primary and secondary Failover records.
Create the primary Alias A record pointing to the primary API and associate it with the custom health check. Create the secondary Alias A record pointing to the standby API without associating the primary's health check.
This establishes the active-passive failover mechanism, ensuring traffic is redirected to the standby API only when the primary fails.

Anahtar Kavram

Amazon Route 53 Failover Routing with API Gateway Alias Targets at the Zone Apex
Soru 610Soru →

An operations team has deployed an application server on an Amazon EC2 instance in a newly configured subnet within a VPC. The instance is assigned a public IP address, and its security group is configured to allow all outbound traffic. However, the server cannot connect to any external internet resources.

Which two troubleshooting steps should a SysOps Administrator perform to identify the root cause of this connectivity issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Verify that the subnet's route table contains a route for 0.0.0.0/00.0.0.0/0 targeting the VPC's Internet Gateway (IGW).; Confirm that the subnet's network ACL inbound rules allow response traffic from the internet on ephemeral ports (10241024-6553565535).

Cevap

The correct troubleshooting steps are to verify that the subnet's route table contains a route for 0.0.0.0/00.0.0.0/0 targeting the VPC's Internet Gateway (IGW), and to confirm that the subnet's network ACL inbound rules allow response traffic from the internet on ephemeral ports (10241024-6553565535).
For an EC2 instance to connect to the internet directly, it must reside in a public subnet. A subnet is public if its route table has a route for 0.0.0.0/00.0.0.0/0 pointing to an Internet Gateway (IGW). Additionally, because network ACLs are stateless, they evaluate inbound and outbound traffic independently. When an instance initiates an outbound connection (e.g., HTTP/HTTPS), the response from the server returns on a random ephemeral port (10241024-6553565535). Thus, the inbound network ACL rules must allow traffic on these ephemeral ports for the connection to succeed.

Adım Adım Çözüm

1
Check the routing configuration of the subnet.
Ensure there is a route for 0.0.0.0/00.0.0.0/0 pointing to the Internet Gateway (IGW).
An EC2 instance in a public subnet needs a route in its associated route table pointing to the IGW to route outbound internet traffic.
2
Check the network ACL configuration of the subnet.
Ensure the inbound rules allow traffic on ephemeral ports (10241024-6553565535) from source 0.0.0.0/00.0.0.0/0.
Since Network ACLs are stateless, return traffic from the internet (which uses ephemeral ports) must be explicitly allowed inbound.

Anahtar Kavram

Troubleshooting internet connectivity for EC2 instances in a public subnet by validating route tables and stateless Network ACL rules.
Soru 611Soru →

A SysOps Administrator is troubleshooting a connectivity issue between two VPCs in the us-east-1 Region. VPC A has a CIDR block of 10.10.0.0/1610.10.0.0/16, and VPC B has a CIDR block of 10.20.0.0/1610.20.0.0/16. Both VPCs are attached to an AWS Transit Gateway. Amazon EC2 instances in VPC A are unable to communicate with EC2 instances in VPC B. The security groups and network ACLs in both VPCs allow all traffic. Which of the following routing configuration steps must the SysOps Administrator perform to resolve this connectivity issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a route in the VPC A subnet route tables with a destination of 10.20.0.0/1610.20.0.0/16 targeting the Transit Gateway, and a route in the VPC B subnet route tables with a destination of 10.10.0.0/1610.10.0.0/16 targeting the Transit Gateway.; Ensure the Transit Gateway route table contains routes for 10.10.0.0/1610.10.0.0/16 pointing to the VPC A attachment and 10.20.0.0/1610.20.0.0/16 pointing to the VPC B attachment.

Cevap

Add a route in the subnet route tables of both VPCs targeting the Transit Gateway, and ensure the Transit Gateway route table has routes for both VPC CIDR blocks pointing to their respective attachments.
To establish two-way communication between two VPCs attached to a Transit Gateway, you must update routing at both layers: the VPC subnet route tables and the Transit Gateway route table. First, each VPC subnet route table needs a route for the remote VPC CIDR block targeting the Transit Gateway. Second, the Transit Gateway route table must have routes mapping each VPC CIDR block to its respective Transit Gateway attachment.

Adım Adım Çözüm

1
Analyze the VPC subnet route tables.
Determine if routes exist for the remote VPC CIDR blocks targeting the Transit Gateway.
For traffic to leave a VPC towards a Transit Gateway, the subnet route table must have a specific route directing that traffic to the Transit Gateway resource.
2
Analyze the Transit Gateway route tables.
Ensure the Transit Gateway route table has associations and routes pointing to the destination VPC attachments.
The Transit Gateway needs to know how to route the traffic it receives to the correct destination attachment.

Anahtar Kavram

VPC routing via Transit Gateway requires updating both the VPC subnet route tables and the Transit Gateway route tables.
Soru 612Soru →

A company hosts its main website at the zone apex (example.com). The website is served by regional Application Load Balancers (ALBs) located in the us-east-1 (United States), eu-west-1 (Europe), and ap-southeast-1 (Singapore) regions. The SysOps Administrator has configured Amazon Route 53 Geolocation routing records for the zone apex pointing to each regional ALB. However, users in South America and Africa report that they receive DNS resolution errors when trying to access the website, while users in the United States, Europe, and Singapore can access it successfully. Which configuration change should the SysOps Administrator make to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Create an Alias A record for example.com with a Geolocation routing policy set to 'Default' pointing to the ALB in us-east-1.

Cevap

Create an Alias A record for example.com with a Geolocation routing policy set to 'Default' pointing to the ALB in us-east-1.
The correct answer is to create an Alias A record for the zone apex pointing to the us-east-1 ALB with a Geolocation routing policy set to 'Default'. Geolocation routing requires a default record to handle queries from any location that is not explicitly defined in other records (such as South America and Africa in this scenario). Furthermore, because the target domain is at the zone apex (example.com), standard CNAME records cannot be used. An Alias A record successfully maps the zone apex to the ALB.

Adım Adım Çözüm

1
Identify the cause of DNS resolution failure for users in South America and Africa.
Since geolocation routing is used and there are only specific regional records for North America, Europe, and Asia, queries from other locations receive a DNS resolution error because no matching record exists.
Route 53 Geolocation routing requires a default record to handle requests originating from locations that are not explicitly mapped.
2
Select the correct DNS record type for the zone apex (example.com).
An Alias A record must be used because CNAME records are not permitted at the zone apex by standard DNS specifications.
Alias records allow routing traffic for zone apex domains directly to AWS resources like Application Load Balancers.
3
Configure the fallback record.
An Alias A record for example.com is created with the Geolocation routing policy set to 'Default', pointing to the us-east-1 ALB.
This configuration catches all unmapped geolocation queries and routes them to the default regional ALB.

Anahtar Kavram

Route 53 Geolocation Routing Default Record and Zone Apex Alias Constraints
Soru 613Soru →

An organization serves its backend API at api.service.com using Application Load Balancers (ALBs) deployed in the us-east-1 and eu-west-1 AWS regions. A SysOps Administrator must configure Amazon Route 53 to route client traffic to the nearest regional ALB based on the client's geographic location. If a regional ALB becomes unhealthy, traffic from that region must fail over to a default backup endpoint. Which combination of configuration steps will satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create Geolocation Alias A records for api.service.com mapped to the ALBs in their respective regions, and set Evaluate Target Health to Yes.; Create a Geolocation Alias A record for api.service.com with the location set to Default, mapped to the backup endpoint.

Cevap

The correct configuration requires creating Geolocation Alias A records for the specific regions with Evaluate Target Health enabled, alongside a Default Geolocation Alias A record mapped to the backup endpoint.
To route users based on their geographic location, Geolocation routing records must be created for the respective regions. By using Alias A records pointing to the Application Load Balancers (ALBs) and enabling 'Evaluate Target Health', Amazon Route 53 automatically monitors the health of the ALBs. Creating a 'Default' geolocation record ensures that if an ALB in a specific region is unhealthy, or if a user accesses the API from an unmapped location, Route 53 will fail over and route the traffic to the specified default backup endpoint.

Adım Adım Çözüm

1
Configure regional Geolocation records.
Create Geolocation Alias A records for api.service.com pointing to the respective ALBs in us-east-1 and eu-west-1, enabling Evaluate Target Health.
This routes users from those geographic regions to the nearest ALB and allows Route 53 to monitor the health of each ALB automatically.
2
Configure the default fallback record.
Create a Geolocation Alias A record for api.service.com with the location set to Default, pointing to the backup endpoint.
This serves as the destination for users from locations not explicitly mapped, and functions as the failover target if the regional ALBs are unhealthy.

Anahtar Kavram

Amazon Route 53 Geolocation routing with health checks and default fallback behavior.
Tahmini Süre:1m 30s
Soru 614Soru →

An organization has set up a VPC with a public subnet (10.0.1.0/2410.0.1.0/24) and a private subnet (10.0.2.0/2410.0.2.0/24). A NAT gateway is deployed in the public subnet to grant internet access to resources in the private subnet. An Amazon EC2 instance is launched in the private subnet, but it cannot connect to any external internet repositories to download updates. Which of the following routing configuration steps are required to establish this connectivity? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a route to 0.0.0.0/00.0.0.0/0 in the private subnet's route table that targets the NAT gateway.; Add a route to 0.0.0.0/00.0.0.0/0 in the public subnet's route table that targets the Internet Gateway.

Cevap

To resolve the internet connectivity issue for the EC2 instance in the private subnet, you must add a route to 0.0.0.0/00.0.0.0/0 in the private subnet's route table targeting the NAT gateway, and ensure the public subnet's route table has a route to 0.0.0.0/00.0.0.0/0 targeting the Internet Gateway.
The correct configuration requires two routing entries: first, the private subnet's route table must route all non-local traffic (0.0.0.0/00.0.0.0/0) to the NAT gateway; second, the public subnet's route table (where the NAT gateway resides) must route all non-local traffic (0.0.0.0/00.0.0.0/0) to the Internet Gateway. Together, these routes form the complete outbound path to the internet.

Adım Adım Çözüm

1
Inspect the route table associated with the private subnet containing the EC2 instance.
Identify that the private subnet lacks a route to send internet-bound traffic (0.0.0.0/00.0.0.0/0) to the NAT gateway.
Traffic destined for the internet from the private subnet must be explicitly routed to the NAT gateway.
2
Add a default route to the private subnet's route table targeting the NAT gateway.
Traffic from the EC2 instance is now successfully sent to the NAT gateway's elastic network interface.
This establishes the first leg of the route from the private resource to the NAT gateway.
3
Inspect the route table associated with the public subnet where the NAT gateway is deployed.
Verify if the public subnet has a route to the Internet Gateway.
The NAT gateway resides in the public subnet and requires a route targeting the Internet Gateway to communicate with external endpoints.
4
Add a route to 0.0.0.0/00.0.0.0/0 targeting the Internet Gateway in the public subnet's route table if it is missing.
The NAT gateway can successfully send translated traffic to the internet and receive return traffic.
This completes the end-to-end path for outbound internet access.

Anahtar Kavram

Two-tier routing architecture with NAT Gateway and Internet Gateway
Soru 615Soru →

A SysOps Administrator is troubleshooting a connectivity issue where Amazon EC2 instances in a private subnet cannot access Amazon S3. The administrator has created a Gateway VPC Endpoint for Amazon S3 in the VPC. However, when inspecting the VPC Flow Logs, the administrator notices that S3 traffic from the instances is still being routed through a NAT gateway in a public subnet, resulting in unexpected data transfer charges. The private subnet's route table contains a default route (0.0.0.0/00.0.0.0/0) targeting the NAT gateway. How should the administrator resolve this routing issue to ensure S3 traffic uses the Gateway VPC Endpoint?

Cevabı ve açıklamayı göster

Cevap: Associate the S3 Gateway VPC Endpoint with the route table of the private subnet.

Cevap

Associate the S3 Gateway VPC Endpoint with the route table of the private subnet.
Associating the S3 Gateway VPC Endpoint with the private subnet's route table adds a specific route for the S3 prefix list targeting the endpoint. Because prefix list routes are more specific than a default route (0.0.0.0/00.0.0.0/0), S3-bound traffic will bypass the NAT gateway and route through the private endpoint.

Adım Adım Çözüm

1
Identify the route table currently associated with the private subnet containing the EC2 instances.
The private subnet route table is identified, which currently directs all non-VPC traffic (0.0.0.0/00.0.0.0/0) to the NAT gateway.
Routing in a VPC is subnet-specific, so the correct route table must be modified to alter the traffic path for S3.
2
Associate the S3 Gateway VPC Endpoint with the identified route table of the private subnet.
A new route is automatically added to the route table with the S3 prefix list as the destination and the Gateway VPC Endpoint ID as the target.
Gateway VPC Endpoints require explicit association with subnet route tables to inject prefix list routing entries.
3
Verify that traffic destined for Amazon S3 now uses the Gateway VPC Endpoint instead of the NAT gateway.
VPC Flow Logs or routing verification tools confirm that traffic to S3 IPs is routed through the endpoint, eliminating NAT gateway processing charges.
AWS route tables prioritize the most specific route. The prefix list for S3 is more specific than the default route (0.0.0.0/00.0.0.0/0), causing S3 traffic to bypass the NAT gateway.

Anahtar Kavram

Gateway VPC Endpoints require manual route table association to redirect traffic from default routes.
Tahmini Süre:1m 30s
Soru 616Soru →

A SysOps administrator is reviewing AWS Trusted Advisor cost optimization reports and identifies several underutilized resources, including stopped Amazon Elastic Block Store (Amazon EBS) volumes and unassociated Elastic IP addresses. The administrator wants to reduce account costs by cleaning up these resources without impacting active workloads.

Which of the following actions should the administrator take? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Delete the unassociated Elastic IP addresses to stop incurring hourly charges for unused public IPv4 addresses.; Create Amazon EBS snapshots of the stopped EBS volumes for backup, and then delete the idle volumes to stop paying for volume storage.

Cevap

The correct actions are to delete the unassociated Elastic IP addresses and to create Amazon EBS snapshots of the stopped EBS volumes before deleting the volumes.
Deleting unassociated Elastic IP addresses stops the hourly charges AWS applies to unused public IPv4 allocations. Creating EBS snapshots of stopped EBS volumes preserves their data cost-effectively in Amazon S3 before the active volumes are deleted, which eliminates active EBS storage charges.

Adım Adım Çözüm

1
Identify underutilized and idle resources using AWS Trusted Advisor cost optimization checks, which flag unassociated Elastic IPs and stopped EBS volumes.
A list of unused public IPs and stopped volumes that are incurring charges.
Trusted Advisor provides a centralized view of cost-saving opportunities.
2
Release or delete the unassociated Elastic IP addresses.
The unused public IPv4 addresses are returned to the AWS pool, stopping the hourly allocation charges.
AWS charges for unassociated Elastic IP addresses to encourage efficient usage of IPv4 addresses.
3
Create snapshots of the stopped EBS volumes and then delete the volumes.
The data is backed up to Amazon S3 as snapshots, and the active EBS volumes are removed, stopping active volume storage charges.
Stopped EBS volumes still incur standard storage charges until they are deleted. Snapshots store data more cost-effectively.

Anahtar Kavram

Cleaning up idle and underutilized resources, specifically unassociated Elastic IPs and stopped EBS volumes, is a primary AWS cost optimization practice.
Soru 617Soru →

A company has a multi-account organization managed by AWS Organizations. A SysOps administrator needs to enforce strict cost controls in a development sandbox account. If the monthly forecasted cost for the sandbox account exceeds $5,000, all running Amazon EC2 instances in that account must be stopped automatically. The administrator wants to implement this solution with minimal custom code and administrative overhead. Which configuration will meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create an AWS Budget with a monthly cost budget for the sandbox account, set to trigger a budget action when the forecasted spend exceeds $5,000. Create a custom IAM role with a trust policy for the budgets.amazonaws.com service principal and an execution policy allowing ec2:StopInstances and ec2:DescribeInstances actions. Grant the administrator iam:PassRole permissions for this custom role in their IAM policy.

Cevap

Create an AWS Budget with a monthly cost budget configured to trigger a budget action based on forecasted spend. Associate this action with a custom IAM role that trusts budgets.amazonaws.com and has ec2:StopInstances permissions, ensuring the administrator has iam:PassRole permissions for that role.
The correct configuration uses AWS Budgets to alert on monthly forecasted costs and leverages native Budget Actions to stop the EC2 instances. To allow AWS Budgets to act on the administrator's behalf, a custom IAM role trusting the budgets.amazonaws.com service principal must be created with ec2:StopInstances permissions, and the administrator must have iam:PassRole permissions to associate that role with the budget action.

Adım Adım Çözüm

1
Determine the type of cost trigger needed.
The requirement is to trigger based on 'forecasted' cost. AWS Budgets supports forecasted triggers, whereas CloudWatch billing alarms only support actual metrics.
This rules out CloudWatch billing alarms as a primary mechanism.
2
Identify the service suited for enforcing static thresholds with automated actions.
AWS Budgets offers Budget Actions to automatically stop EC2 or RDS instances. AWS Cost Anomaly Detection is designed for machine-learning-driven pattern anomaly detection rather than static limits.
This rules out Cost Anomaly Detection.
3
Configure the required IAM permissions for AWS Budgets Actions.
Create a custom IAM role that trusts budgets.amazonaws.com and has the policy to perform ec2:StopInstances. Grant iam:PassRole permissions to the administrator's policy so they can assign the role to the budget.
AWS Budgets Actions does not use service-linked roles for target instance control, and configuring it requires iam:PassRole, not sts:AssumeRole.

Anahtar Kavram

AWS Budgets Actions IAM Requirements and Cost Monitoring Differentiation
Soru 618Soru →

A company's production AWS account recently experienced a sudden, unexpected spike in data transfer costs due to a misconfigured third-party application. A SysOps administrator is tasked with implementing a solution that automatically detects these types of anomalous, variable cost spikes using machine learning and immediately triggers an AWS Systems Manager Automation runbook to restrict outbound network traffic. Which solution will meet these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Create an AWS Cost Anomaly Monitor using the AWS services monitor type. Create an Amazon EventBridge rule that filters for events originating from the AWS Cost Anomaly Detection service, and configure the rule to target the AWS Systems Manager Automation runbook.

Cevap

Create an AWS Cost Anomaly Monitor using the AWS services monitor type, create an Amazon EventBridge rule that filters for events originating from the AWS Cost Anomaly Detection service, and configure the rule to target the AWS Systems Manager Automation runbook.
The correct solution uses AWS Cost Anomaly Detection to monitor costs dynamically using machine learning baselines. When a cost anomaly is detected, the service automatically publishes an event to Amazon EventBridge (source: `aws.cost-anomaly-detection`). An EventBridge rule can match these events and directly invoke the AWS Systems Manager Automation runbook to remediate the network issue immediately with no custom polling code or intermediary components, satisfying the requirement for minimal operational overhead.

Adım Adım Çözüm

1
Select the appropriate cost monitoring tool that uses machine learning for anomaly detection.
Identify AWS Cost Anomaly Detection as the correct tool because it uses machine learning to dynamically baseline and identify unexpected cost spikes.
AWS Budgets and CloudWatch EstimatedCharges use static thresholds rather than machine learning.
2
Determine the event source for automating remediation upon detection of a cost anomaly.
Identify that AWS Cost Anomaly Detection integrates with Amazon EventBridge, sending events with the source 'aws.cost-anomaly-detection'.
This integration allows EventBridge rules to match cost anomalies without polling APIs or writing custom detection logic.
3
Configure the target of the EventBridge rule to execute the required remediation action.
Set the AWS Systems Manager Automation runbook as the direct target of the EventBridge rule.
EventBridge can target Systems Manager Automation directly, minimizing operational overhead and removing the need for intermediary custom Lambda functions.

Anahtar Kavram

AWS Cost Anomaly Detection ML-driven alerting and EventBridge integration
Soru 619Soru →

A SysOps Administrator is configuring private connectivity from Amazon EC2 instances in a private subnet to a partner's service hosted in a different AWS account. The partner has shared their service using an AWS PrivateLink endpoint service, and the administrator has created a corresponding Interface VPC Endpoint in the consumer VPC. Although the EC2 instances can resolve the service's Private DNS name to the private IP addresses of the endpoint, all application connection requests to the service end in a connection timeout.

Which of the following actions should the administrator take to resolve this connectivity issue?

Cevabı ve açıklamayı göster

Cevap: Update the security group associated with the Interface VPC Endpoint to allow inbound traffic on the service port from the security group of the EC2 instances.

Cevap

Update the security group associated with the Interface VPC Endpoint to allow inbound traffic on the service port from the security group of the EC2 instances.
The correct action is to update the security group associated with the Interface VPC Endpoint. Interface VPC Endpoints place Elastic Network Interfaces (ENIs) inside the customer's VPC subnets. Access to these ENIs is controlled by their associated security groups. A connection timeout indicates that the request packets are being dropped, which is solved by permitting inbound traffic from the EC2 instances' security group on the required port.

Adım Adım Çözüm

1
Analyze the connection timeout symptom.
Connection timeouts indicate that network packets are being silently dropped, rather than actively refused or failing DNS resolution.
This narrows down the cause to firewall or access control mechanisms (security groups or NACLs) rather than routing or DNS naming issues.
2
Evaluate the architecture of Interface VPC Endpoints.
Interface VPC Endpoints deploy Elastic Network Interfaces (ENIs) within the specified subnets, which receive security groups to control network traffic.
Understanding that Interface Endpoints rely on security groups on their ENIs is critical for troubleshooting traffic flow.
3
Identify the missing security rule configuration.
The endpoint's security group must permit inbound traffic from the EC2 instances. Allowing inbound traffic from the EC2 security group on the target service port establishes connectivity.
This permits the traffic to flow through the endpoint ENI and reach the partner's service provider endpoint.

Anahtar Kavram

Interface VPC Endpoints rely on security groups to control inbound access, and do not use route table entries unlike Gateway VPC Endpoints.
Tahmini Süre:2m 30s
Soru 620Soru →

A SysOps Administrator is setting up an organization trail in AWS CloudTrail to log all API activity across all accounts in an AWS Organization. The trail is created in the management account (account ID 111122223333111122223333) and is configured to deliver logs to an Amazon S3 bucket named `org-audit-logs` located in a dedicated security tooling account (account ID 444455556666444455556666). The administrator also configures the trail to encrypt all log files using a customer managed KMS key, which is also located in the security tooling account (444455556666444455556666). However, after configuring the trail, the administrator detects that log files are not appearing in the S3 bucket, and CloudTrail reports delivery errors. Which of the following configuration steps must be performed in the security tooling account (444455556666444455556666) to resolve this issue and enable successful log delivery? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the S3 bucket policy on `org-audit-logs` to grant the `cloudtrail.amazonaws.com` service principal the `s3:GetBucketAcl` permission on the bucket resource and the `s3:PutObject` permission on the prefix `arn:aws:s3:::org-audit-logs/AWSLogs/o-exampleorgid/*`.; Configure the KMS key policy in the security tooling account to allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:Decrypt` actions, with a condition restricting `aws:SourceArn` to the trail ARN in the management account.

Cevap

Configure the S3 bucket policy on the destination bucket to grant `cloudtrail.amazonaws.com` service principal permissions to `s3:GetBucketAcl` and `s3:PutObject` on the organization path prefix, and configure the KMS key policy in the security tooling account to grant the same principal `kms:GenerateDataKey*` and `kms:Decrypt` permissions constrained by the trail's source ARN.
To enable cross-account CloudTrail log delivery for an organization trail, the S3 bucket policy in the destination account must explicitly allow the CloudTrail service principal (`cloudtrail.amazonaws.com`) to write log files using the `s3:PutObject` action. Because it is an organization trail, the prefix structure must target the organization ID (`o-exampleorgid`) rather than a single account ID. Additionally, the bucket policy must grant `s3:GetBucketAcl` to allow CloudTrail to verify ownership of the bucket. Since the logs are encrypted with a customer managed KMS key in the destination account, the KMS key policy must also explicitly allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:Decrypt` actions, and this should be secured using the `aws:SourceArn` condition pointing to the trail in the management account.

Adım Adım Çözüm

1
Verify the S3 bucket policy permissions for CloudTrail log delivery.
Ensure the S3 bucket policy allows `cloudtrail.amazonaws.com` to call `s3:GetBucketAcl` on the bucket and `s3:PutObject` on the path prefix `AWSLogs/o-organizationId/*`.
CloudTrail requires ownership checks and permission to write logs across all member accounts under the organization prefix.
2
Configure the customer managed KMS key policy for encryption.
Ensure the KMS key policy allows `cloudtrail.amazonaws.com` to perform `kms:GenerateDataKey*` and `kms:Decrypt`.
Because the customer managed key is in a different account, the key policy must explicitly authorize the CloudTrail service principal to generate data keys and decrypt logs.
3
Apply condition keys to secure the KMS key policy.
Restrict the KMS key policy statement using `aws:SourceArn` pointing to the trail in the management account.
Secures the KMS key so that only the specified organizational trail can request key operations.

Anahtar Kavram

Cross-account AWS CloudTrail organization trail delivery to an S3 bucket encrypted with a customer managed KMS key requires configuring both the S3 bucket policy and the KMS key policy to trust the CloudTrail service principal (`cloudtrail.amazonaws.com`) with the appropriate action permissions and path/ARN constraints.
ÖncekiSayfa 31 / 49Sonraki
Tüm alıştırma soruları — AWS Certified SysOps Administrator - Associate | Examkin