Tüm alıştırma soruları

A SysOps Administrator is setting up Same-Region Replication (SRR) between two Amazon S3 buckets within the same AWS account using the AWS CLI. The administrator has successfully enabled bucket versioning on both the source and destination S3 buckets. Additionally, they created an IAM service role named S3ReplicationServiceRole with a trust policy allowing the s3.amazonaws.com service principal to assume the role. The role's permissions policy grants all necessary S3 permissions to access the source bucket and write replicas to the destination bucket.

When the administrator attempts to apply the replication configuration using the command:

aws s3api put-bucket-replication --bucket source-bucket --replication-configuration file://replication.json

the command fails with an AccessDenied error. The administrator is currently logged in with an IAM user account that has the AWS managed AmazonS3FullAccess policy attached, but no other IAM permissions. Which modification is required to resolve this error and successfully apply the replication configuration?

An organization uses AWS Service Catalog to distribute standardized infrastructure templates. The central hub account shares a portfolio with several spoke accounts. In one of the spoke accounts, the SysOps administrator creates a local launch constraint for a product in the shared portfolio. This launch constraint specifies a local IAM role named CustomProvisioningRole that possesses all necessary permissions to create the required resources. When a developer in the spoke account tries to launch the product, the deployment immediately fails, and the developer receives an error indicating that they do not have permission to perform the action. Which action must the administrator take to resolve this issue?

An organization hosting a web application on AWS uses an Amazon EC2 Auto Scaling group (ASG). A SysOps administrator is configuring a scale-in lifecycle hook to back up application logs to an Amazon S3 bucket before any instance is terminated. A target tracking policy has just triggered a scale-in event.

Order the steps to show the sequence of events that occurs when an instance is terminated using this lifecycle hook, from the start of the scale-in process to the final termination.

A company runs a critical database on Amazon EC2 instances with Amazon EBS volumes in the us-east-1 Region. To meet a low Recovery Time Objective (RTO) during disaster recovery drills, a SysOps Administrator enables Fast Snapshot Restore (FSR) on the EBS snapshots in us-east-1. The EBS snapshots are copied to the us-west-2 Region daily using an AWS Backup plan. During a disaster recovery drill in us-west-2, the administrator restores an EBS volume from the copied snapshot into the us-west-2a Availability Zone. However, the database experiences high initial I/O latency, and the restored volume does not perform at its provisioned limit immediately.

Which of the following is the most likely cause of this performance degradation?

A SysOps administrator is configuring event-driven remediation for non-compliant resources. When an AWS Config rule detects a non-compliant Amazon S3 bucket, an Amazon EventBridge rule triggers. The EventBridge rule is configured to target an AWS Systems Manager (SSM) Automation runbook to enable bucket encryption. The administrator has created an IAM role named SSMAutomationServiceRole that SSM will assume to perform the S3 configuration, which has a trust relationship with ssm.amazonaws.com. The administrator also created an IAM role named EventBridgeExecutionRole with a trust relationship for events.amazonaws.com and a policy granting ssm:StartAutomationExecution. When the EventBridge rule triggers, the SSM Automation execution fails to start due to an authorization error. Which of the following explains why the automation execution failed to start?

An organization has configured an automated remediation workflow to manage costs for underutilized resources. A CloudWatch alarm is set to trigger when the CPU utilization of an Amazon EC2 instance falls below $10\%$ for three consecutive monitoring periods. The alarm is integrated with an Amazon EventBridge rule that targets the `AWS-StopEC2Instance` Systems Manager (SSM) Automation runbook. During a testing phase, the alarm changes to the `ALARM` state, but the EC2 instance continues to run. The administrator checks the EventBridge metrics and notices that the `FailedInvocations` metric for the rule is incrementing, while the `TriggeredRules` metric is also active. No execution history is visible in the Systems Manager Automation console. Which of the following troubleshooting steps should the administrator perform to resolve this issue? (Select TWO.)

A SysOps Administrator is setting up AWS Systems Manager Patch Manager to automate operating system updates for a fleet of Amazon Linux 2 instances. The administrator has created a custom patch baseline for development environments. However, during testing, the administrator notices that the development instances are still being patched using the default AWS-managed patch baseline instead of the custom one. Which action must the administrator take to ensure the development instances are associated with the custom patch baseline?

A SysOps Administrator is using AWS Elastic Disaster Recovery (AWS DRS) to replicate an on-premises database server to AWS. The administrator has configured the default EC2 Launch Template in AWS DRS to attach a specific IAM instance profile to the recovery instance upon launch. However, when the administrator attempts to launch a recovery drill, the launch fail status is returned immediately. A review of AWS CloudTrail logs reveals an authorization error related to the IAM role assignment during the EC2 RunInstances API call. Which action will resolve this issue?

A SysOps Administrator is deploying a conformance pack containing an AWS Config rule to evaluate EBS volume encryption. The administrator configures automatic remediation for the rule using an AWS Systems Manager (SSM) Automation document. The remediation is configured to encrypt non-compliant volumes using a customer managed key (CMK) in AWS Key Management Service (AWS KMS).

Although the administrator has attached an IAM policy to the SSM Automation service role that allows all KMS actions (kms:*), the automatic remediation fails. The execution history indicates a 'KMS Access Denied' error.

Which of the following explains the cause of this issue?

A SysOps administrator is creating an Amazon Kinesis Data Firehose delivery stream that must write log data to an Amazon S3 bucket. The administrator has already created an IAM role with the necessary S3 permissions and a trust policy that allows Kinesis Firehose to assume the role. However, when the administrator attempts to create the delivery stream using this role, the operation fails with an authorization error.

Which IAM permission must be granted to the SysOps administrator's IAM policy to resolve this issue?

A company hosts its primary web application using an Amazon Route 53 Alias record at the zone apex pointing to an Amazon CloudFront distribution. The company wants to configure an active-passive disaster recovery solution that automatically routes traffic to a secondary static backup website hosted on an Amazon S3 bucket if the primary CloudFront distribution becomes unavailable. During configuration, the SysOps Administrator observes that the 'Evaluate Target Health' option is not supported for the CloudFront Alias record.

Which two configuration steps must the SysOps Administrator perform to establish this failover mechanism? (Select TWO.)

A company runs a critical microservice on Amazon ECS using the AWS Fargate launch type behind an Application Load Balancer (ALB). A SysOps administrator is configuring a Blue/Green deployment using AWS CodeDeploy. The deployment must satisfy the following conditions:
- The new task definition version must be deployed and validated using a dedicated test listener port before routing production traffic.
- Production traffic must be shifted to the new version gradually over 10 minutes, with 10% shifted every minute.
- CodeDeploy must have the authority to update the ECS service and run tasks with the required task execution role.

Which combination of actions must the SysOps administrator take to meet these requirements? (Select TWO.)

A SysOps administrator is configuring automated, event-driven remediation for non-compliant Amazon S3 buckets using AWS Config. The administrator sets up the AWS Config rule 's3-bucket-public-read-prohibited' and configures the AWS Systems Manager (SSM) Automation runbook 'AWS-ConfigureS3BucketPublicAccessBlock' as the remediation action. However, when the Config rule identifies a non-compliant bucket, the automatic remediation fails to execute with an access denied error. Which combination of configuration actions is required to resolve this issue and ensure the remediation executes successfully? (Select TWO.)

A SysOps Administrator is configuring monitoring for a database backup process. The backup application streams JSON-formatted logs to an Amazon CloudWatch Logs group. A typical log event has the following structure:

{
"backupId": "backup-98234",
"status": "Failed",
"durationSeconds": 1450,
"database": "prod-db-01"
}

The administrator needs to monitor the duration of failed backups. Specifically, they want to create a custom CloudWatch metric that records the value of `durationSeconds` only when `status` is equal to `"Failed"`. To avoid alarm flapping and false alerts when no failures occur, the custom metric must report a value of `0` during periods with no matching log events.

Which configuration should the administrator use to achieve this?

A SysOps Administrator is managing an Amazon S3 Cross-Region Replication (CRR) setup between a source bucket in us-east-1 and a destination bucket in us-west-2. The buckets store critical application logs encrypted with AWS KMS customer managed keys (CMKs) in both regions. The administrator notes two issues: existing logs uploaded before replication was enabled are missing from the destination bucket, and when users delete logs in the source bucket, the corresponding delete markers are not appearing in the destination bucket. Which combination of actions should the administrator take to resolve these issues? (Select TWO.)

A SysOps Administrator is monitoring a message-processing application that publishes execution logs to an Amazon CloudWatch Logs group. The log events are formatted in JSON as shown in the following example:

{
"queue": "task-worker",
"msg_id": "m-9941",
"duration": 6.2,
"status": "DLQ_REDIRECT"
}

The Administrator wants to extract the message processing duration as a custom CloudWatch metric named `DLQProcessingTime` under the namespace `CustomWorker`, but only for messages that are redirected to the dead-letter queue where the `status` field equals `"DLQ_REDIRECT"`.

Which TWO configuration steps must the Administrator perform to extract this metric?

A SysOps administrator is configuring automatic rotation for a database credential stored as a secret in AWS Secrets Manager. The database is an Amazon Aurora PostgreSQL DB cluster running in a private VPC subnet. The secret is encrypted using a customer managed AWS KMS key. The administrator configures a custom AWS Lambda function to handle the rotation, deploying it within the same VPC. During testing, the rotation fails, and the CloudWatch Logs for the Lambda rotation function indicate that it is unable to decrypt the current database credential to perform the login test. Which two actions should the SysOps administrator take to resolve this issue? (Select TWO.)

An organization implements a multi-account structure where database credentials are centralized in a security account (Account B) using AWS Secrets Manager. A microservice running on an Amazon EC2 instance in a production account (Account A) requires access to one of these secrets. The secret is encrypted using the default AWS managed key `aws/secretsmanager`. The SysOps administrator configures a resource-based policy on the secret in Account B to allow the EC2 instance's IAM role in Account A to call `secretsmanager:GetSecretValue`. The IAM role in Account A has also been granted permissions to call `secretsmanager:GetSecretValue` on the secret's ARN. However, the EC2 instance receives an `AccessDeniedException` when attempting to retrieve the credential.

Which configuration adjustment will resolve this access issue?

A company's SysOps administrator is reviewing the data transfer costs for a workload running on Amazon EC2 instances in private subnets across two Availability Zones. The instances perform the following tasks:

* Retrieve $20\text{ TB}$ of configuration files and static assets monthly from an Amazon S3 bucket in the same AWS Region.
* Publish $15\text{ TB}$ of transactional telemetry data monthly to Amazon Kinesis Data Streams in the same AWS Region.

Currently, all traffic to these services is routed through NAT Gateways located in each Availability Zone. Which combination of actions should the SysOps administrator take to achieve the maximum cost savings? (Select TWO.)

A company manages a multi-account AWS environment using AWS Organizations with consolidated billing. A SysOps Administrator has deployed a Tag Policy across the organization to enforce the use of EnvType and CostCenterID tags on all newly created resources. Although the administrator has verified that resources in the member accounts are successfully tagged, these tags are not available as filters or grouping options in AWS Cost Explorer or AWS Budgets. Which two actions must the SysOps Administrator perform to resolve this issue and start tracking costs using these tags? (Select TWO.)