Examkin

Tüm alıştırma soruları

976 soru

Tüm türler976Çoktan seçmeli502Çoklu seçim450Sıralama24
Soru 621Soru →

A company runs a web application on an Amazon EC2 instance within a VPC. The instance is launched in a public subnet with a CIDR block of 172.31.10.0/24172.31.10.0/24 and has an associated Elastic IP address. The application must accept incoming HTTPS requests from clients on the internet on port 443, and the instance must also initiate outbound HTTPS connections on port 443 to download software updates from an external repository.

Currently, the EC2 instance cannot be reached from the internet, and it cannot access the external update repository. A SysOps administrator confirms the following configurations:
- The EC2 instance's Security Group allows inbound and outbound TCP traffic on port 443.
- The subnet is associated with a custom Network ACL (NACL) that allows inbound and outbound TCP traffic on port 443, but blocks all other traffic.
- The subnet's route table has a route for the local VPC CIDR block, but no route for the destination 0.0.0.0/00.0.0.0/0.

Which of the following actions should the SysOps administrator take to resolve these connectivity issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a route to the subnet's route table with a destination of 0.0.0.0/00.0.0.0/0 and the Internet Gateway as the target.; Update the custom Network ACL rules to allow inbound and outbound traffic on the ephemeral port range of 1024−655351024-65535.

Cevap

To restore internet connectivity and resolve the routing issues, the SysOps administrator must add a default route (0.0.0.0/00.0.0.0/0) targeting the Internet Gateway in the subnet's route table, and update the custom Network ACL rules to allow traffic on the ephemeral port range (1024−655351024-65535) in both directions.
The correct options are the actions to add a route to the subnet's route table with a destination of 0.0.0.0/00.0.0.0/0 targeting the Internet Gateway, and to update the custom Network ACL rules to allow traffic on the ephemeral port range of 1024−655351024-65535. These address the missing route to the internet and ensure that return traffic is not blocked by the stateless Network ACL.

Adım Adım Çözüm

1
Verify and update the subnet's route table configuration.
Adding a route with destination 0.0.0.0/00.0.0.0/0 targeting the Internet Gateway allows the instance's outbound traffic to reach the internet and inbound traffic to be routed to the subnet.
Without a default route to an Internet Gateway, the subnet behaves as a private subnet, preventing any direct internet communication despite having an Elastic IP address.
2
Analyze the Network ACL (NACL) rules for stateless traffic flow.
Allowing inbound and outbound traffic on ephemeral ports (1024−655351024-65535) enables return traffic for both client-initiated and instance-initiated connections.
Because NACLs are stateless, they do not automatically allow return traffic. Since the current custom NACL only allows port 443 in both directions, return traffic directed at ephemeral ports is blocked.

Anahtar Kavram

VPC public routing requires an Internet Gateway route in the route table, and stateless Network ACLs require explicit rules for both request ports and response (ephemeral) ports.
Soru 622Soru →

A company uses an automated CI/CD pipeline to deploy utility servers into a designated subnet within a custom VPC. After a recent deployment, the utility servers are assigned public IPv4 addresses, but administrators are unable to establish SSH connections (2222) or ping the servers from the internet. The security group and Network ACL associated with the subnet both explicitly allow SSH traffic.

Which of the following routing issues is preventing external access to these utility servers?

Cevabı ve açıklamayı göster

Cevap: A default route (0.0.0.0/00.0.0.0/0) targeting the VPC's Internet Gateway is missing from the subnet's route table.

Cevap

A default route (0.0.0.0/00.0.0.0/0) targeting the VPC's Internet Gateway is missing from the subnet's route table.
A public subnet must have a route table containing a default route (0.0.0.0/00.0.0.0/0) pointing to the Internet Gateway. If this route is missing, instances in the subnet cannot communicate with resources outside the VPC, causing external connection attempts to time out.

Adım Adım Çözüm

1
Analyze the subnet configuration and connectivity type.
The utility servers have public IPv4 addresses and need to receive incoming SSH connections from the internet, which means they must reside in a public subnet.
To determine why traffic from the internet is timing out despite security groups and Network ACLs being open.
2
Check the routing path from the subnet to the internet.
A subnet is only public if its route table explicitly routes internet-bound traffic (0.0.0.0/00.0.0.0/0) to the VPC's Internet Gateway.
Without this route, the VPC router does not know how to forward traffic to the internet, and incoming packets cannot be returned, leading to connection timeouts.

Anahtar Kavram

VPC Route Table Configuration for Public Subnets
Soru 623Soru →

A company has migrated a web application to an Amazon EC2 instance in a VPC. The instance is assigned a public IPv4 address and is placed in a subnet with a CIDR block of 172.16.1.0/24172.16.1.0/24. The security group associated with the instance allows all inbound traffic on port 8080 and port 443443, and the network ACL allows all inbound and outbound traffic. However, users are reporting that they receive connection timeouts when trying to access the application. The SysOps Administrator confirms that the application is running locally on the instance. Which of the following troubleshooting steps should the administrator perform next to resolve the connectivity issue?

Cevabı ve açıklamayı göster

Cevap: Configure a route for 0.0.0.0/00.0.0.0/0 targeting an Internet Gateway (igw-xxxxxx) in the route table associated with the subnet.

Cevap

Configure a route for 0.0.0.0/00.0.0.0/0 targeting an Internet Gateway (igw-xxxxxx) in the route table associated with the subnet.
For an EC2 instance in a VPC to be reachable from the internet, it must have a public IPv4 address and its subnet's route table must route internet-bound traffic (0.0.0.0/00.0.0.0/0) to an Internet Gateway. Although the security group and network ACL are configured correctly, the absence of this route prevents response packets from leaving the VPC, causing connection timeouts for external users.

Adım Adım Çözüm

1
Analyze the network configuration: the instance has a public IP, and both security groups and network ACLs are configured to allow HTTP and HTTPS traffic.
Since security group and network ACL rules are permissive, traffic filtering is not the cause of the connection timeout.
This isolates the problem to the routing configuration rather than firewall rules.
2
Examine the route table associated with the subnet of the EC2 instance to check for an outbound route to the internet.
Identify that the subnet does not have a route directing traffic destination 0.0.0.0/00.0.0.0/0 to the VPC's Internet Gateway.
An instance in a public subnet cannot communicate with the internet without a default route pointing to an Internet Gateway.
3
Add a route in the subnet's route table for destination 0.0.0.0/00.0.0.0/0 with the target set to the Internet Gateway.
The routing path is established, enabling the instance to reply to incoming internet traffic.
This configuration makes the subnet a public subnet, enabling bidirectionally successful connectivity.

Anahtar Kavram

VPC Route Table Configuration and Internet Gateway Association
Soru 624Soru →

A SysOps Administrator has deployed an Amazon EC2 instance in a newly created subnet. The instance has been assigned a public IPv4 address, and its security group is configured to allow all outbound traffic and inbound SSH traffic from the administrator's IP address. However, the administrator is unable to establish an SSH connection to the instance, and the instance cannot reach external internet-based repositories. Which two configurations should the administrator verify to resolve this connectivity issue?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Confirm that the subnet's route table contains a route for 0.0.0.0/00.0.0.0/0 targeting the Internet Gateway.; Confirm that the subnet's network access control list (network ACL) allows outbound traffic on ephemeral ports 1024−655351024-65535.

Cevap

Verify that the subnet's route table contains a route for 0.0.0.0/00.0.0.0/0 targeting the Internet Gateway, and verify that the subnet's network ACL allows outbound traffic on ephemeral ports 1024−655351024-65535.
For an EC2 instance in a VPC to communicate with the internet, it must be located in a public subnet, which is defined by having a route table entry pointing 0.0.0.0/00.0.0.0/0 to an Internet Gateway. Additionally, because Network ACLs are stateless, outbound rules must explicitly permit return traffic to client connections on ephemeral ports (1024−655351024-65535).

Adım Adım Çözüm

1
Check the routing configuration for the subnet.
Ensure there is a route for 0.0.0.0/00.0.0.0/0 that has a target of the Internet Gateway attached to the VPC, making it a public subnet.
Without a route targeting the Internet Gateway, the VPC routing table does not know where to send traffic destined for external internet-based repositories or how to route response traffic back to external clients.
2
Examine the Network Access Control List (NACL) rules associated with the subnet.
Ensure the inbound rules allow traffic on port 2222 and outbound rules allow return traffic on ephemeral ports (1024−655351024-65535).
Since Network ACLs are stateless, they evaluate inbound and outbound traffic independently. A missing outbound rule for ephemeral ports will drop return packets, causing connection timeouts even if the route table and security groups are configured correctly.

Anahtar Kavram

VPC public routing requires a route to an Internet Gateway, and stateless Network ACLs require explicit configuration of outbound ephemeral ports to allow response traffic.
Soru 625Soru →

A SysOps Administrator is managing an application on a standalone Amazon EC2 instance. The administrator configures a custom script on the instance to publish a custom metric named ActiveConnections to Amazon CloudWatch every 10 seconds. The administrator then creates a CloudWatch alarm with a period of 10 seconds and an evaluation period of 3 to monitor this metric. The goal is to automatically trigger an AWS Systems Manager (SSM) Automation runbook to reboot the instance if active connections exceed 500.

During a traffic spike, the active connections exceeded 500 for several minutes, but the alarm remained in the INSUFFICIENT_DATA state and the instance did not reboot.

Which two of the following configuration changes will resolve these issues and ensure the automated reboot executes successfully? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the custom script to publish the metric with the StorageResolution parameter set to 1.; Configure an Amazon EventBridge rule that intercepts the CloudWatch alarm state change and targets the Systems Manager Automation runbook.

Cevap

The issues can be resolved by modifying the script to publish the custom metric with a StorageResolution of 1, and configuring an Amazon EventBridge rule to intercept the alarm state change and trigger the Systems Manager Automation runbook.
To support a CloudWatch alarm with a sub-minute period (like 10 seconds), the underlying metric must be published with a StorageResolution of 1, indicating high resolution. Standard resolution metrics are aggregated at 1-minute intervals, which causes shorter-period alarms to evaluate with insufficient data. Additionally, CloudWatch alarms do not support executing Systems Manager Automation runbooks as a direct alarm action. The state transition must be intercepted by Amazon EventBridge to invoke the Automation runbook.

Adım Adım Çözüm

1
Analyze the cause of the INSUFFICIENT_DATA state for a 10-second period alarm.
By default, custom metrics are stored with standard resolution (1-minute intervals). Publishing data every 10 seconds without specifying high-resolution storage causes CloudWatch to aggregate data at 1-minute intervals, leaving the 10-second periods empty and resulting in INSUFFICIENT_DATA.
To fix this, the metric must be published as a high-resolution metric by setting the StorageResolution parameter to 1.
2
Analyze the cause of the failed automated reboot execution.
CloudWatch alarms cannot directly invoke Systems Manager Automation runbooks from their native alarm actions list.
To remediate this, you must configure an Amazon EventBridge rule that detects when the alarm enters the ALARM state and executes the Systems Manager Automation runbook as its target.

Anahtar Kavram

CloudWatch High-Resolution Alarms and Systems Manager Remediation Integration
Tahmini Süre:2m 30s
Soru 626Soru →

A SysOps Administrator is configuring an Amazon CloudWatch alarm to automatically reboot a critical standalone Amazon EC2 instance if its CPU utilization remains above 90% for three consecutive minutes. The administrator configures the alarm with the following settings:

* Metric: CPUUtilization in the AWS/EC2 namespace
* Period: 1 minute
* Evaluation Periods: 3
* Action: EC2 Reboot action (arn:aws:automate:us-east-1:ec2:reboot) when the alarm is in the ALARM state

During testing, the administrator notices two issues: the alarm remains in the INSUFFICIENT_DATA state even when the instance is under heavy load, and the console displays a validation error stating that the EC2 reboot action cannot be associated with the alarm.

Which of the following actions must the administrator take to resolve these issues and ensure the reboot action executes successfully? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable detailed monitoring on the target EC2 instance.; Modify the alarm configuration to include the InstanceId dimension specifying the target instance.

Cevap

To resolve these issues, the administrator must enable detailed monitoring on the EC2 instance to supply 1-minute metric data points, and modify the alarm configuration to include the InstanceId dimension specifying the target instance, which is required for EC2 alarm actions.
The correct options are to enable detailed monitoring on the EC2 instance and to modify the alarm configuration to include the InstanceId dimension. Enabling detailed monitoring is necessary because the alarm uses a 1-minute period, but standard monitoring only publishes EC2 metrics every 5 minutes, leading to an insufficient data state. Specifying the InstanceId dimension is required because Amazon EC2 alarm actions (such as reboot, stop, terminate, or recover) are only supported on alarms targeting metrics in the AWS/EC2 namespace that contain the InstanceId dimension.

Adım Adım Çözüm

1
Enable detailed monitoring on the target EC2 instance.
The CPUUtilization metric is published to CloudWatch every 1 minute instead of the default 5-minute standard monitoring interval.
This satisfies the alarm's 1-minute period configuration and prevents the alarm from entering the INSUFFICIENT_DATA state.
2
Configure the CloudWatch alarm to filter by the InstanceId dimension.
The alarm is associated with a single EC2 instance, resolving the dimension configuration validation error.
Amazon EC2 alarm actions such as reboot are only supported for metrics in the AWS/EC2 namespace when configured with the InstanceId dimension.

Anahtar Kavram

Configuring CloudWatch alarms with EC2 actions requires detailed monitoring for short evaluation periods and the InstanceId dimension for target identification.
Soru 627Soru →

A SysOps Administrator is configuring an Amazon EC2 Auto Scaling group (ASG) to dynamically scale out. The ASG is currently using standard monitoring. The administrator needs to configure a CloudWatch alarm that will trigger the scale-out policy when the average CPU utilization exceeds 80%80\% for two consecutive 1-minute periods. Which two configurations or actions must the administrator perform to achieve this?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable detailed monitoring in the Auto Scaling group launch template to ensure metric data is available at 1-minute granularity; Configure the CloudWatch alarm with a period of 6060 seconds and evaluation periods of 22

Cevap

To configure the alarm to trigger on two consecutive 1-minute CPU utilization periods, the administrator must enable detailed monitoring on the Auto Scaling group launch template to get 1-minute metric granularity, and configure the CloudWatch alarm with a period of 60 seconds and an evaluation period of 2.
To resolve this requirement, the administrator must ensure that CPU utilization metrics are reported to CloudWatch at 1-minute intervals by enabling detailed monitoring. Then, they must configure the CloudWatch alarm with a period of 60 seconds and an evaluation period of 2 so that it evaluates two consecutive 1-minute datapoints before triggering the scaling policy.

Adım Adım Çözüm

1
Enable detailed monitoring for the EC2 instances in the Auto Scaling group launch template.
EC2 metric data (including CPU utilization) is sent to CloudWatch at 1-minute intervals instead of the default 5-minute intervals.
Standard monitoring does not support the 1-minute granularity required for this alarm.
2
Configure the CloudWatch alarm with a period of 60 seconds (1 minute) and evaluation periods set to 2.
The alarm will evaluate the CPU utilization metric over two consecutive 1-minute windows.
This satisfies the requirement to trigger the alarm when CPU utilization exceeds the threshold for two consecutive 1-minute periods.

Anahtar Kavram

Enabling detailed monitoring is required to monitor EC2 metrics at 1-minute granularity, and the alarm period and evaluation periods must be configured to match the desired window of observation.
Soru 628Soru →

A CPU-intensive data analysis application runs on Amazon EC2 instances within an Auto Scaling group. The group uses a target tracking scaling policy based on average CPU utilization. The workload arrives in unpredictable batches. The operations team notices two problems:

1. When a new batch of workload arrives, it takes up to 10 minutes before the Auto Scaling group begins to launch new instances, causing a temporary performance bottleneck.
2. Once scaling begins, the group frequently launches more instances than are needed to handle the load, resulting in underutilized resources and unnecessary costs.

Which two actions should the administrator take to address these problems? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable detailed monitoring for the EC2 instances in the launch template used by the Auto Scaling group.; Increase the estimated instance warmup time in the target tracking scaling policy configuration.

Cevap

Enable detailed monitoring for the EC2 instances in the launch template, and increase the estimated instance warmup time in the target tracking scaling policy.
Enabling detailed monitoring on the EC2 instances in the launch template changes the CPU utilization reporting frequency from 5 minutes to 1 minute, which reduces the time required for CloudWatch to trigger scaling actions. Increasing the estimated instance warmup time ensures that newly launched instances are not included in the average metric calculations until they are ready to handle the load, preventing the Auto Scaling group from launching unnecessary additional instances.

Adım Adım Çözüm

1
Identify the cause of the scale-out delay.
The 10-minute delay is caused by CloudWatch receiving CPU utilization metrics at the default 5-minute interval (standard monitoring).
By enabling detailed monitoring in the launch template, EC2 instances will report CPU metrics every 1 minute, allowing CloudWatch to detect load spikes and trigger scaling much faster.
2
Identify the cause of the overprovisioning.
The Auto Scaling group launches too many instances because the scaling policy assumes the group still lacks capacity before the new instances are fully warmed up and processing load.
Increasing the estimated instance warmup time ensures that newly launched instances are excluded from the average CPU utilization calculation until they are ready, preventing redundant scale-out actions.

Anahtar Kavram

Auto Scaling responsiveness and overprovisioning prevention using detailed monitoring and instance warmup settings.
Tahmini Süre:2m 0s
Soru 629Soru →

A SysOps Administrator is monitoring a web application hosted on Amazon EC2 instances. The application writes structured JSON logs to an Amazon CloudWatch Logs log group. A representative log event is shown below:

{
"environment": "production",
"http_details": {
"status_code": 502,
"duration_ms": 420
}
}

The Administrator needs to create a custom metric named `BackendLatency` in the `App/Monitoring` namespace. This metric must record the `duration_ms` value only for production environment requests that result in an HTTP 5xx server error (status code 500500 to 599599). Additionally, if the latency exceeds 500500 ms, the Administrator wants to trigger an automated workflow to restart the application service on the EC2 instances. Which configuration should the Administrator implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a CloudWatch Logs metric filter with the filter pattern `{ (.environment = "production") && (.http_details.status_code >= 500) && (.http_details.status_code < 600) }` and set the metric value to `.http_details.duration_ms`. Create a CloudWatch alarm based on this metric, and configure an Amazon EventBridge rule that reacts to the alarm state change to trigger an AWS Systems Manager Automation document.

Cevap

Create a CloudWatch Logs metric filter using the pattern `{ (.environment = "production") && (.http_details.status_code >= 500) && (.http_details.status_code < 600) }` and set the metric value to `.http_details.duration_ms`. Create a CloudWatch alarm based on this metric, and use an Amazon EventBridge rule triggered by the alarm state change to run an AWS Systems Manager Automation document that restarts the service.
The correct option correctly uses JSON comparison operators (`>= 500` and `< 600`) to capture the numeric 5xx status codes, extracts the correct nested property (`$.http_details.duration_ms`) as the metric value, and uses a standard CloudWatch alarm coupled with an Amazon EventBridge rule to execute the Systems Manager Automation document. This properly decouples log metric extraction from resource remediation.

Adım Adım Çözüm

1
Define the CloudWatch Logs metric filter pattern to match JSON structure and numeric ranges.
The pattern `{ (.environment = "production") && (.http_details.status_code >= 500) && (.http_details.status_code < 600) }` is configured. This matches events where the status code is a number between 500 and and 599$ inclusive, and the environment is 'production'.
CloudWatch Logs JSON metric filters require explicit comparison operators for numeric fields. Wildcards are only supported for string values.
2
Specify the metric value to extract from the log event structure.
The metric value is set to `$.http_details.duration_ms`.
This extracts the value of the duration_ms field from the matched log events to populate the metric data points.
3
Configure the automated remediation trigger workflow.
A CloudWatch alarm is created on the custom metric. An Amazon EventBridge rule is set up to listen for the alarm state transition to ALARM and targets an AWS Systems Manager Automation document to perform the restart.
Metric filters themselves cannot perform remediation actions. CloudWatch alarms must be paired with EventBridge or SNS to invoke automation tools like Systems Manager.

Anahtar Kavram

CloudWatch Logs JSON metric filters require numeric range operators rather than wildcards, and automation must flow from alarms via EventBridge or SNS rather than directly from metric filters.
Soru 630Soru →

A SysOps Administrator is configuring VPC Flow Logs to monitor network traffic for security compliance. The flow logs must be published to a new Amazon CloudWatch Logs log group. Any high-frequency network rejections should trigger an automated system teardown via an AWS Systems Manager (SSM) Automation runbook. The administrator attempts to configure the workflow but encounters two issues: they receive an access denied error when attempting to create the flow log, and the SSM Automation runbook is not being triggered during simulated network rejection events. Which of the following actions should the SysOps Administrator take to successfully configure the flow log delivery and the automated remediation path? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to the SysOps Administrator's identity that grants the iam:PassRole permission for the IAM role associated with the flow log.; Configure a CloudWatch metric filter to extract REJECT patterns, associate it with a CloudWatch alarm, and create an Amazon EventBridge rule that triggers the Systems Manager Automation runbook when the alarm changes to the ALARM state.

Cevap

Attach an IAM policy to the SysOps Administrator's identity that grants the iam:PassRole permission for the IAM role associated with the flow log, and configure a CloudWatch metric filter to extract REJECT patterns, associate it with a CloudWatch alarm, and create an Amazon EventBridge rule that triggers the Systems Manager Automation runbook when the alarm changes to the ALARM state.
To create a VPC Flow Log targeting CloudWatch Logs, the IAM identity performing the configuration must be granted the 'iam:PassRole' permission on the role that VPC Flow Logs will assume to deliver the logs. To establish the remediation workflow, raw log data must first be transformed into metrics via a CloudWatch Logs metric filter, which is then mapped to a CloudWatch alarm. An EventBridge rule is then configured to listen for the alarm state changes and trigger the Systems Manager Automation runbook.

Adım Adım Çözüm

1
Add the iam:PassRole permission to the administrator's IAM identity.
The SysOps Administrator is authorized to associate the flow logs service role with the new flow log configuration, resolving the access denied error.
When creating a resource that requires a service role, AWS checks if the calling identity is permitted to pass that role to the service.
2
Create a metric filter on the CloudWatch log group searching for the term 'REJECT'.
A custom metric tracking the number of rejected packets is generated.
A metric filter must extract data from the raw text stream of VPC Flow Logs before alarms can be configured.
3
Create a CloudWatch alarm on the custom metric and route its state changes through EventBridge to target the SSM Automation runbook.
The EventBridge rule successfully intercepts the transition to the ALARM state and executes the remediation runbook.
Metric filters cannot directly execute remediation targets; they require an alarm state change event captured by Amazon EventBridge to invoke Systems Manager Automation.

Anahtar Kavram

VPC Flow Logs publishing to CloudWatch Logs requires appropriate iam:PassRole permissions for the configuring administrator, and automated remediation requires routing log-derived metrics through CloudWatch Alarms and EventBridge.
Soru 631Soru →

A SysOps Administrator is setting up VPC Flow Logs to capture traffic for a critical application and stream it to an Amazon CloudWatch Logs log group. The administrator creates an IAM role named FlowLogDeliveryRole with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role. The role has an attached IAM policy granting logs:CreateLogStream and logs:PutLogEvents permissions. When the administrator attempts to create the flow log using the AWS CLI command 'aws ec2 create-flow-logs', the command returns an AccessDenied error. Which of the following is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: The administrator's IAM identity does not have the iam:PassRole permission for the FlowLogDeliveryRole resource.

Cevap

The administrator's IAM identity does not have the iam:PassRole permission for the FlowLogDeliveryRole resource.
The correct answer is the option stating that the administrator's IAM identity does not have the iam:PassRole permission. When configuring an AWS service like VPC Flow Logs to run actions on your behalf, you must pass an IAM role to the service. To do this, your IAM user or role must have the iam:PassRole permission for that specific target role. Without this permission, the create-flow-logs API call fails with an AccessDenied error.

Adım Adım Çözüm

1
Analyze the IAM configuration of the administrator's identity and the service delivery role.
The service delivery role is configured correctly with the vpc-flow-logs.amazonaws.com service principal and the necessary logs actions, but the CLI command execution fails with AccessDenied.
When passing an IAM role to an AWS service, the user executing the call must be authorized to perform the iam:PassRole action on that role.
2
Differentiate between service-linked roles, trust policies, and pass-role permissions.
The trust policy enables the service to assume the role, but the iam:PassRole permission enables the administrator to associate that role with the flow log resource.
This prevents unauthorized users from assigning high-privilege roles to AWS services.

Anahtar Kavram

IAM PassRole requirement for AWS service configuration
Tahmini Süre:2m 30s
Soru 632Soru →

A SysOps administrator must establish a disaster recovery and backup strategy for an application hosted in us-east-1. The application uses an Amazon S3 bucket for object storage and an Amazon RDS for MySQL DB instance. The architecture must satisfy the following criteria:
1. All objects uploaded to the S3 bucket must be replicated to a bucket in us-west-2 while preserving their version history.
2. The database must achieve a Recovery Time Objective (RTO) of less than 2 minutes during an Availability Zone outage in us-east-1 without manual intervention or DNS endpoint updates.
3. Database backups must be copied to us-west-2 daily.

Which two actions should the SysOps administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable S3 Versioning on both the source S3 bucket in us-east-1 and the destination S3 bucket in us-west-2, and configure an S3 Cross-Region Replication (CRR) rule.; Modify the primary RDS MySQL DB instance to a Multi-AZ deployment, and configure the automated backups to copy snapshots to us-west-2 daily.

Cevap

Enable S3 Versioning on both the source and destination buckets, configure S3 Cross-Region Replication, modify the primary RDS instance to a Multi-AZ deployment, and configure automated snapshot copies to the destination Region.
Enabling versioning on both source and destination S3 buckets is a prerequisite for Cross-Region Replication (CRR). Multi-AZ deployment for Amazon RDS provides synchronous replication and automated DNS failover during an AZ outage, meeting the RTO requirement without manual DNS updates.

Adım Adım Çözüm

1
Verify S3 replication requirements.
Determine that versioning must be enabled on both source and destination buckets before setting up Cross-Region Replication (CRR).
S3 replication relies on version IDs to track and copy objects accurately across buckets.
2
Evaluate DB failover mechanisms for RTO and automation.
Select Multi-AZ deployment over Read Replicas for automatic DNS redirection and synchronous replication.
Multi-AZ deployments automate the failover process within minutes using DNS updates managed by AWS, whereas Read Replicas require manual promotion and endpoint updates.
3
Identify the snapshot copy strategy.
Configure automated DB snapshot copies to the target Region.
This satisfies the requirement for daily copies to the destination Region for disaster recovery.

Anahtar Kavram

Implementing cross-Region replication for Amazon S3 and configuring high availability with automated cross-Region backup copying for Amazon RDS.
Soru 633Soru →

A company hosts a production web application in the us-east-1 Region. The application uses Amazon EC2 instances behind an Application Load Balancer (ALB) and an Amazon RDS for PostgreSQL DB instance. The SysOps Administrator needs to design a disaster recovery (DR) strategy to the us-west-2 Region. The business requires a Recovery Point Objective (RPO) of 1515 minutes and a Recovery Time Objective (RTO) of 44 hours. The strategy must minimize ongoing infrastructure costs in the secondary region.

Which configuration meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Enable Amazon RDS cross-region automated backups from us-east-1 to us-west-2. Store the application deployment templates in AWS CloudFormation. In the event of a disaster, restore the RDS DB instance from the replicated backups in us-west-2, and provision the application infrastructure using the CloudFormation templates.

Cevap

Enable Amazon RDS cross-region automated backups from us-east-1 to us-west-2. Store the application deployment templates in AWS CloudFormation. In the event of a disaster, restore the RDS DB instance from the replicated backups in us-west-2, and provision the application infrastructure using the CloudFormation templates.
The correct configuration is to enable Amazon RDS cross-region automated backups, which continuously replicates transaction logs to the secondary region. This satisfies the 15-minute RPO. Restoring the database from these backups and deploying the application tier using AWS CloudFormation satisfies the 4-hour RTO. This approach is highly cost-effective because it incurs only backup storage costs in the secondary region until a failover is executed.

Adım Adım Çözüm

1
Evaluate the RPO requirement.
An RPO of 15 minutes requires replication of database transaction logs or very frequent backups to the secondary region.
This determines which backup copying or replication mechanism is needed to prevent losing more than 15 minutes of data.
2
Evaluate the RTO and cost requirements.
An RTO of 4 hours allows enough time to restore a database from backups and provision EC2 instances via CloudFormation, which avoids the cost of running active standby instances.
This allows the selection of a cost-effective Backup and Restore disaster recovery pattern rather than an active-passive pilot light or warm standby pattern.
3
Assess the AWS service options against the requirements.
RDS cross-region automated backups replicate transaction logs with minimal lag (typically under 5 minutes) directly to the secondary region. Combining this with CloudFormation for application provisioning meets both RTO and RPO targets at the lowest cost.
This identifies the most optimal, reliable, and cost-effective configuration that fits all constraints.

Anahtar Kavram

Disaster Recovery strategies and the trade-offs between RTO, RPO, and cost efficiency using RDS cross-region backup capabilities.
Soru 634Soru →

A company hosts a document management application in the us-west-2 Region. The application uses Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer for the compute tier, Amazon Aurora PostgreSQL for the database tier, and an Amazon S3 bucket for document storage.

The company needs to establish a disaster recovery (DR) plan in the us-east-1 Region. The DR strategy must achieve a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes, while minimizing idle resource costs.

Which combination of actions should a SysOps Administrator perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. Deploy the Application Load Balancer and the Auto Scaling group with a desired capacity of 0 in us-east-1.; Enable versioning on both the source S3 bucket in us-west-2 and a new destination S3 bucket in us-east-1, and configure Amazon S3 Cross-Region Replication (CRR) between the buckets.

Cevap

Configuring an Amazon Aurora Global Database with a secondary cluster in us-east-1 and an ASG capacity of 0, and enabling versioning to configure Amazon S3 Cross-Region Replication (CRR) between buckets.
The correct combination of actions is configuring an Amazon Aurora Global Database with a secondary cluster in us-east-1 alongside an Auto Scaling group with a desired capacity of 0, and enabling versioning on both buckets to configure Amazon S3 Cross-Region Replication (CRR). Aurora Global Database provides replication with lag typically under a second, meeting the 5-minute RPO. Scale-up of the compute tier from a capacity of 0 (Pilot Light pattern) combined with secondary cluster promotion allows achieving the 15-minute RTO at minimal idle cost. S3 Cross-Region Replication asynchronously mirrors storage contents, satisfying the RPO, but strictly requires versioning to be enabled on both source and destination buckets.

Adım Adım Çözüm

1
Evaluate the database tier requirements for RPO (5 minutes) and cost efficiency.
Select Amazon Aurora Global Database as it offers sub-second cross-region replication lag, easily satisfying the 5-minute RPO.
To meet the tight RTO/RPO requirements while minimizing cost, a pilot light pattern with a secondary cluster is the most efficient choice compared to active-active multi-region deployments.
2
Evaluate the S3 bucket replication configuration requirement.
Enable versioning on both the source bucket and the destination bucket, then enable Cross-Region Replication (CRR).
S3 CRR requires versioning to be enabled on both source and destination buckets. Attempting to configure replication without versioning will result in a configuration error.
3
Evaluate the compute tier configuration for a Pilot Light disaster recovery strategy.
Configure the Auto Scaling group in the recovery region (us-east-1) with a desired capacity of 0.
Setting the desired capacity to 0 minimizes idle compute costs while allowing the instances to be launched quickly during a failover event, meeting the 15-minute RTO.

Anahtar Kavram

Multi-region disaster recovery (DR) strategies (Pilot Light) utilizing Aurora Global Database and S3 Cross-Region Replication (CRR).
Soru 635Soru →

An operations team is deploying a compliance control using AWS Config to ensure all Amazon DynamoDB tables have point-in-time recovery (PITR) enabled. To automatically correct non-compliant tables, the team intends to use an AWS Systems Manager (SSM) Automation runbook. They create a dedicated IAM role named 'SSMExecutionRole' containing the DynamoDB update permissions. During testing, when AWS Config identifies a non-compliant table, the remediation fails to execute. What configuration steps must be performed to allow AWS Config to successfully run the remediation using the specified role?

Cevabı ve açıklamayı göster

Cevap: Modify the trust relationship of the SSMExecutionRole to authorize the ssm.amazonaws.com service principal, and grant the administrator's IAM policy the iam:PassRole privilege for this role.

Cevap

Modify the trust relationship of the SSMExecutionRole to authorize the ssm.amazonaws.com service principal, and grant the administrator's IAM policy the iam:PassRole privilege for this role.
For AWS Config automatic remediation using Systems Manager (SSM) Automation, the remediation role (AutomationAssumeRole) is assumed by the Systems Manager service. Therefore, its trust relationship must allow the ssm.amazonaws.com service principal to perform the sts:AssumeRole operation. Additionally, the administrator who configures the remediation must have the iam:PassRole permission to pass the role to Systems Manager.

Adım Adım Çözüm

1
Analyze the execution flow of AWS Config automatic remediation.
Identify that AWS Config triggers a Systems Manager (SSM) Automation runbook, which must assume the specified 'SSMExecutionRole' (AutomationAssumeRole) to modify resources.
Determines which AWS service principal actually executes the remediation actions and assumes the role.
2
Configure trust relationships for the remediation execution role.
Ensure the trust policy allows ssm.amazonaws.com to perform the sts:AssumeRole action.
Allows Systems Manager to assume the role needed to run the DynamoDB update operations.
3
Ensure appropriate permissions exist for the identity setting up the Config remediation.
Ensure the administrator configuring the Config remediation has iam:PassRole permissions targeting the SSMExecutionRole.
Required because AWS Config needs permission to pass the execution role to the Systems Manager service.

Anahtar Kavram

AWS Config automatic remediation requires configuring a trust relationship allowing Systems Manager to assume the remediation role, and granting iam:PassRole permissions to the user or role setting up the remediation configuration.
Tahmini Süre:2m 0s
Soru 636Soru →

A company hosts a document archiving application on AWS. The application uses a single Amazon EC2 instance to process PDF uploads, stores the files in an Amazon S3 bucket, and writes metadata to a Single-AZ Amazon RDS for PostgreSQL DB instance. A SysOps administrator must configure a cost-effective disaster recovery (DR) strategy in a secondary AWS Region. The DR strategy must meet a Recovery Point Objective (RPO) of 4 hours and a Recovery Time Objective (RTO) of 24 hours. Which combination of actions should the SysOps administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable Amazon S3 Cross-Region Replication (CRR) to replicate documents to a bucket in the secondary Region, ensuring that versioning is enabled on both buckets.; Configure Amazon RDS cross-Region automated backups replication to copy backups of the DB instance to the secondary Region.

Cevap

The correct strategy involves enabling S3 Cross-Region Replication (with versioning active on both buckets) and configuring Amazon RDS cross-Region automated backups replication.
To meet an RPO of 4 hours and an RTO of 24 hours cost-effectively, the administrator should implement a backup-and-restore DR strategy. Enabling S3 Cross-Region Replication (with versioning enabled) ensures that documents are replicated with minimal latency. Replicating Amazon RDS automated backups to the secondary Region ensures that database snapshots and transaction logs are copied asynchronously to the target region. During a disaster, the database can be restored from the replicated backups, and EC2 instances can be launched from AMIs, meeting the 24-hour RTO without incurring the cost of running database or compute instances in the secondary region during normal operations.

Adım Adım Çözüm

1
Evaluate RPO and RTO requirements to select the appropriate DR strategy.
An RPO of 4 hours and RTO of 24 hours allows for a backup-and-restore strategy where no compute or active database instances run in the DR region, maximizing cost-effectiveness.
This avoids unnecessary hourly costs for idle standby infrastructure.
2
Configure database replication for backup-and-restore.
Enabling RDS cross-Region automated backups replication copies snapshots and transaction logs asynchronously to the destination region.
This allows database restoration to the destination region within the 4-hour RPO target.
3
Configure storage replication.
Enabling S3 Versioning on both source and destination S3 buckets allows the configuration of Cross-Region Replication (CRR) to replicate documents.
Versioning is a hard requirement for S3 replication features.

Anahtar Kavram

Selecting and configuring a cost-effective backup-and-restore disaster recovery strategy using RDS cross-Region automated backups replication and S3 Cross-Region Replication with versioning.
Tahmini Süre:2m 0s
Soru 637Soru →

A SysOps Administrator is managing an application that writes JSON-formatted log events to an Amazon CloudWatch Logs group named `/aws/apps/auth-service`. A sample log event is shown below:

{
"timestamp": "2026-07-14T10:00:00Z",
"request_id": "req-98213",
"service": "auth-service",
"event": "LoginFailed",
"user_type": "premium",
"latency_ms": 350
}

The administrator needs to monitor the frequency of failed login events specifically for premium users. Additionally, the administrator must ensure that logs in this log group are kept for only 90 days to avoid indefinite storage costs.

Which two actions should the administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a metric filter on the /aws/apps/auth-service log group with the filter pattern { (.event = "LoginFailed") && (.user_type = "premium") }.; Modify the retention settings of the /aws/apps/auth-service log group and set the retention period to 90 days.

Cevap

Create a metric filter on the /aws/apps/auth-service log group with the filter pattern { (.event = "LoginFailed") && (.user_type = "premium") } and modify the retention settings of the /aws/apps/auth-service log group to set the retention period to 90 days.
To monitor JSON logs, the metric filter pattern must use valid JSON syntax, where individual criteria are prefixed with $. and enclosed in parentheses, combined with logical operators like &&. To limit log storage costs, the SysOps Administrator must configure the retention settings directly on the CloudWatch log group, setting the expiration period to 90 days.

Adım Adım Çözüm

1
Identify the correct JSON filter pattern syntax for CloudWatch Logs metric filters.
The pattern { (.event = "LoginFailed") && (.user_type = "premium") } matches JSON log events where the event field equals LoginFailed and the user_type field equals premium. Each logical condition must be enclosed in parentheses.
This isolates the specific log events of interest using valid AWS CloudWatch Logs JSON filter syntax.
2
Configure the retention settings for the CloudWatch log group to prevent indefinite storage costs.
Modifying the retention setting of the /aws/apps/auth-service log group to 90 days automatically expires logs older than that period.
This satisfies the requirement to keep logs for exactly 90 days to avoid ongoing costs.

Anahtar Kavram

CloudWatch Logs metric filter patterns for JSON log events and configuring log group retention periods.
Tahmini Süre:1m 30s
Soru 638Soru →

A company uses Amazon Route 53 for active-passive failover routing. The primary record is a non-Alias A record with a TTL of 300 seconds pointing to an on-premises application server. The secondary record points to a static maintenance page hosted on Amazon S3. To monitor the primary server, a custom script on-premises publishes a heartbeat metric to Amazon CloudWatch every 60 seconds. A CloudWatch alarm is configured to trigger if the heartbeat is missing for 3 consecutive periods. A Route 53 health check is set up to monitor the state of this CloudWatch alarm and is associated with the primary A record. During a network outage, the on-premises server is disconnected, causing the CloudWatch alarm to enter the INSUFFICIENT_DATA state. Users continue to experience connection timeouts because they are still routed to the primary server. Which of the following is the correct configuration change to resolve this issue and minimize client failover time?

Cevabı ve açıklamayı göster

Cevap: Configure the Route 53 health check to treat INSUFFICIENT_DATA as unhealthy, and reduce the TTL of the primary A record to a lower value such as 60 seconds.

Cevap

Configure the Route 53 health check to treat INSUFFICIENT_DATA as unhealthy, and reduce the TTL of the primary A record to a lower value such as 60 seconds.
The correct response is to configure the Route 53 health check to treat the INSUFFICIENT_DATA state as unhealthy and to reduce the TTL of the primary record. By default, Route 53 health checks configured to monitor CloudWatch alarms consider the INSUFFICIENT_DATA state to be healthy. When the on-premises network fails, the server stops publishing metrics, causing the alarm to have insufficient data. Setting the health check to treat this state as unhealthy triggers the failover. Reducing the TTL to 60 seconds ensures that clients discard cached DNS entries quickly and query Route 53 again to receive the secondary endpoint's IP address.

Adım Adım Çözüm

1
Analyze the state of the CloudWatch alarm during the network outage.
The alarm enters the INSUFFICIENT_DATA state because the metric is no longer being published by the on-premises script.
To understand the input signal the Route 53 health check receives during an outage.
2
Identify the Route 53 health check's behavior for the alarm's state.
By default, Route 53 health checks that monitor CloudWatch alarms treat the INSUFFICIENT_DATA state as healthy, meaning the health check remains green and failover is not triggered.
To determine why the active-passive failover configuration did not transition to the secondary S3 page.
3
Adjust the health check settings and the record caching parameters.
Change the health check to treat insufficient data as unhealthy to trigger the failover. Reduce the primary A record TTL from 300 seconds to 60 seconds to ensure client DNS caches expire quickly.
To minimize both detection time and client cut-over propagation time.

Anahtar Kavram

Route 53 Health Checks monitoring CloudWatch Alarms and the impact of DNS TTL on failover propagation.
Tahmini Süre:2m 30s
Soru 639Soru →

An Auto Scaling group (ASG) uses a step scaling policy based on the `CPUUtilization` metric. The EC2 instances in the ASG require approximately 66 minutes to run bootstrapping scripts and start processing tasks. During traffic spikes, the SysOps administrator observes that the ASG launches additional instances every 55 minutes before the previously launched instances can finish bootstrapping, resulting in over-provisioning. Additionally, the ASG is slow to trigger scaling actions when traffic initially spikes because the CPU utilization data points are evaluated at 55-minute intervals. Which actions should the SysOps administrator take to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable detailed monitoring in the launch template used by the Auto Scaling group.; Increase the estimated instance warmup time in the step scaling policy to 360360 seconds.

Cevap

Enable detailed monitoring in the launch template used by the Auto Scaling group, and increase the estimated instance warmup time in the step scaling policy to 360360 seconds.
The correct solution involves enabling detailed monitoring to get 11-minute EC2 metrics, which allows the CloudWatch alarms to react faster, and increasing the estimated instance warmup time to 360360 seconds (66 minutes) so that the step scaling policy allows newly launched instances to complete bootstrapping before initiating further scaling actions.

Adım Adım Çözüm

1
Analyze the bootstrapping issue.
The instances require 66 minutes to bootstrap, but the ASG launches additional instances every 55 minutes.
Since a step scaling policy is used, the estimated instance warmup must be adjusted to match or exceed the bootstrapping time (360360 seconds) to prevent the policy from launching more instances before the current ones are ready.
2
Analyze the metric latency issue.
Scaling is slow because CPU utilization data points are evaluated at 55-minute intervals.
To resolve this, detailed monitoring must be enabled in the launch template, which changes the metric reporting interval for CPUUtilization from 55 minutes (standard monitoring) to 11 minute.

Anahtar Kavram

Auto Scaling step scaling policies utilize estimated instance warmup to manage scaling frequency during instance bootstrapping, and detailed monitoring enables 11-minute metric granularity to improve scaling responsiveness.
Soru 640Soru →

A SysOps Administrator performs a drift detection operation on an AWS CloudFormation stack containing an Amazon EC2 instance and a Security Group. The drift detection report indicates that the stack is DRIFTED because a new inbound port was manually added to the Security Group. Which two methods can the administrator use to resolve the drift and align the stack's actual configuration with its expected template configuration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Manually remove the inbound port from the Security Group, then run drift detection on the stack again.; Update the CloudFormation stack using a modified template that includes the new inbound port configuration.

Cevap

Manually removing the inbound port from the Security Group and running drift detection again, or updating the CloudFormation stack using a modified template that includes the new inbound port configuration.
To resolve resource drift, a SysOps Administrator can either change the resource manually to match the expected template configuration, or update the template to match the actual resource configuration and perform a stack update. Manually removing the inbound port or updating the template to include the new port both bring the resource and template configurations back into alignment.

Adım Adım Çözüm

1
Analyze the drift detection report to identify the specific drifted property, which is the manually added inbound port on the Security Group.
The target state and current state differences are clearly understood.
This establishes what resource configuration must be corrected or aligned.
2
Decide on the remediation strategy: either revert the manual change out-of-band or update the CloudFormation template to match the current manual state.
Two valid paths identified: manually deleting the security group rule or updating the template with the new rule.
Both methods align the template and resource configurations to resolve drift.
3
Execute the chosen remediation action and run drift detection again to verify the stack status.
The stack drift status returns to IN_SYNC.
Drift detection must be run again to update the stack's recorded status.

Anahtar Kavram

Remediating resource drift in AWS CloudFormation by either reverting out-of-band changes manually or updating the stack template to match the actual configuration.
ÖncekiSayfa 32 / 49Sonraki