Examkin

Tüm alıştırma soruları

976 soru

Tüm türler976Çoktan seçmeli502Çoklu seçim450Sıralama24
Soru 661Soru →

A company uses AWS Organizations to manage multiple accounts. A SysOps administrator is configuring a monthly cost budget of 1,000foradevelopmentsandboxaccount.TheadministratorwantstosetupanAWSBudgetsactionthatwillautomaticallystopallrunningAmazonEC2instancesinthesandboxaccountassoonasthemonthlyforecastedspendisprojectedtoexceed1201,000 for a development sandbox account. The administrator wants to set up an AWS Budgets action that will automatically stop all running Amazon EC2 instances in the sandbox account as soon as the monthly forecasted spend is projected to exceed 120% ( 1,200) of the budgeted amount. Which of the following configuration steps are required to ensure the budget action executes successfully? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that allows the budgets.amazonaws.com service principal to assume the role, and attach an IAM policy to the role that allows the ec2:StopInstances and ec2:DescribeInstances actions.; Attach an IAM policy to the SysOps administrator's identity that grants the iam:PassRole permission for the specific execution IAM role used by the budget action.

Cevap

To configure the AWS Budgets action successfully, the administrator must create an IAM execution role with a trust policy allowing the budgets.amazonaws.com service principal to assume the role and permissions to stop EC2 instances, and also attach an IAM policy to the administrator's identity granting the iam:PassRole permission for the execution role.
The correct configuration requires creating an IAM role that the AWS Budgets service principal can assume to stop the EC2 instances, and granting the administrator the iam:PassRole permission to pass that role to the Budgets service. This ensures the service has the authority to execute the stop action when the forecasted threshold is exceeded.

Adım Adım Çözüm

1
Identify the target action and trigger requirements.
The requirement is to automatically stop EC2 instances based on a forecasted spend of $1,200 using a native AWS Budgets action.
AWS Budgets Actions allow native integration to stop EC2 or RDS instances when actual or forecasted costs cross a defined threshold.
2
Determine the necessary IAM permissions for the AWS Budgets service principal.
AWS Budgets must be allowed to assume an IAM role that has the ec2:StopInstances and ec2:DescribeInstances permissions.
AWS Budgets requires a trust relationship with budgets.amazonaws.com to assume the execution role and run the API calls on behalf of the user.
3
Determine the user-level permissions required to associate the role with the budget action.
The SysOps administrator must possess the iam:PassRole permission targeting the execution role.
AWS enforces iam:PassRole to ensure that users cannot elevate their privileges by passing a highly privileged role to an AWS service.

Anahtar Kavram

AWS Budgets Actions configuration requirements, specifically the target execution role trust relationships and user PassRole permissions.
Tahmini Süre:2m 0s
Soru 662Soru →

A SysOps Administrator has configured an Interface VPC Endpoint for the Amazon EC2 service (com.amazonaws.us-east-1.ec2) to allow Amazon EC2 instances in a private subnet to call the Amazon EC2 API. The VPC has DNS support and DNS hostnames enabled, and the Interface VPC Endpoint has Private DNS enabled. The EC2 instances are associated with a security group that allows all outbound traffic. However, when attempting to run the command 'aws ec2 describe-instances' from one of the instances, the command hangs and eventually times out. Which of the following is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: The security group associated with the Interface VPC Endpoint does not allow inbound TCP port 443 traffic from the security group of the EC2 instances.

Cevap

The security group associated with the Interface VPC Endpoint does not allow inbound TCP port 443 traffic from the security group of the EC2 instances.
The correct answer is that the security group associated with the Interface VPC Endpoint does not allow inbound TCP port 443 traffic from the security group of the EC2 instances. Interface VPC Endpoints create Elastic Network Interfaces (ENIs) inside the subnet. The security group attached to these ENIs acts as a firewall. Since the AWS CLI communicates over HTTPS, the endpoint's security group must permit inbound traffic on TCP port 443 from the EC2 instances or their subnet CIDR.

Adım Adım Çözüm

1
Analyze the symptom.
The AWS CLI command hangs and times out, indicating a network-level blockage (traffic is being dropped silently) rather than a DNS resolution failure (which would result in an immediate 'Could not resolve host' error).
Timeouts in AWS VPC environments typically point to security groups, network ACLs, or routing table issues dropping packets.
2
Evaluate the routing requirement.
Since this is an Interface VPC Endpoint (AWS PrivateLink), traffic is directed to the ENIs associated with the endpoint via DNS. No route table changes are required for the subnet.
Interface VPC Endpoints do not use Gateway-style route table entries.
3
Evaluate the security group configuration.
The security group on the EC2 instances allows all outbound traffic, but the security group on the VPC Endpoint's ENIs must allow inbound traffic on TCP port 443 from the EC2 instances.
Security groups are stateful, but inbound rules must still be explicitly configured on the destination (the endpoint ENI) to accept connection requests.

Anahtar Kavram

Security group configuration for Interface VPC Endpoints (AWS PrivateLink)
Soru 663Soru →

A SysOps Administrator is designing a security and monitoring architecture for a database tier containing private Amazon RDS DB instances. The database instances must only accept MySQL traffic on port 3306 from the application tier subnets, and all network traffic to and from the database subnet must be monitored using VPC Flow Logs sent to Amazon CloudWatch Logs. The administrator must ensure that the IAM role used by the flow logs can publish to CloudWatch Logs and that log storage costs are managed efficiently. Which of the following actions should the administrator perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the destination Amazon CloudWatch Logs group with a specific retention period, such as 90 days, instead of the default setting of Never Expire.; Create the VPC Flow Log using an IAM role that has a trust relationship with the VPC Flow Logs service principal and contains the necessary logs write permissions, ensuring the administrator has the permission to pass this role.

Cevap

To secure and monitor the database subnets while keeping costs low, the CloudWatch Logs group must be configured with a specific retention period to prevent infinite storage fees, and the VPC Flow Log must be created using an IAM role that trusts the flow logs service principal, has write permissions to CloudWatch, and is passed by an administrator who possesses the iam:PassRole permission.
Configuring a specific retention period on the CloudWatch Logs group ensures that log data does not accumulate indefinitely, minimizing storage costs. Furthermore, creating the VPC Flow Log requires an IAM role with a trust relationship that allows the VPC Flow Logs service principal to assume it, and the administrator must have the iam:PassRole permission to attach this role to the flow log.

Adım Adım Çözüm

1
Set a retention limit on the destination CloudWatch Logs group.
The log group automatically purges logs older than the defined period (e.g., 90 days).
By default, CloudWatch Logs are kept forever, resulting in continuous growth of storage costs. Specifying a retention period controls costs.
2
Set up the IAM role for the VPC Flow Logs and ensure correct trust and permission policies are present.
The Flow Logs service principal is authorized to assume the role, and the user can pass the role to the service.
VPC Flow Logs need permission to call CreateLogStream and PutLogEvents. The role's trust policy must allow vpc-flow-logs.amazonaws.com to assume it, and the SysOps Administrator needs iam:PassRole to assign the role to the flow log.

Anahtar Kavram

VPC Flow Logs IAM roles and CloudWatch retention policies are critical components for secure traffic auditing and cost optimization in AWS networking.
Soru 664Soru →

A company operates a microservices application split across two VPCs (VPC A and VPC B) in the same AWS Region. VPC A hosts the front-end API gateway, and VPC B hosts the backend database services. Approximately 30 TB30\text{ TB} of data is transferred monthly between VPC A and VPC B. Currently, the VPCs are connected using an AWS Transit Gateway, which has caused a significant increase in the monthly AWS bill due to data processing charges. Which of the following strategies should a SysOps administrator implement to minimize data transfer costs while keeping the traffic entirely within the AWS private network? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish a VPC Peering connection between VPC A and VPC B, and route the traffic between the VPCs through the peering connection.; Ensure that the resources in VPC A and VPC B that communicate with each other are deployed in the same Availability Zone.

Cevap

Establish a VPC Peering connection between VPC A and VPC B, and ensure that the resources in VPC A and VPC B that communicate with each other are deployed in the same Availability Zone.
Establishing a VPC Peering connection eliminates the $0.02\$0.02 per GB AWS Transit Gateway data processing charges since VPC Peering has no processing fees. Furthermore, ensuring that communicating resources are deployed in the same Availability Zone eliminates the cross-AZ data transfer charge of $0.01\$0.01 per GB, reducing the data transfer cost for this traffic to zero.

Adım Adım Çözüm

1
Analyze the current network architecture and pricing model.
AWS Transit Gateway charges $0.02\$0.02 per GB for data processing in the same region. For 30 TB30\text{ TB} of data, this results in $600\$600 per month in Transit Gateway data processing fees.
Understanding current costs helps identify the most cost-effective alternative.
2
Evaluate alternative private connectivity options.
VPC Peering has no data processing fees, making it $0\$0 per GB for data processing. Compared to Transit Gateway and AWS PrivateLink (Interface Endpoints, which charge $0.01\$0.01 per GB), VPC Peering is the most cost-effective transport mechanism.
VPC Peering provides direct routing between VPCs without intermediate processing costs.
3
Optimize the placement of resources across Availability Zones.
Data transfer over VPC Peering is free if both the source and target resources reside in the same Availability Zone. If they reside in different Availability Zones, a charge of $0.01\$0.01 per GB applies for both egress and ingress.
Aligning resources in the same Availability Zone eliminates cross-AZ data transfer fees, reducing the variable cost to zero.

Anahtar Kavram

Minimizing AWS intra-region data transfer costs by using VPC Peering instead of Transit Gateway and matching Availability Zones to avoid cross-AZ fees.
Tahmini Süre:1m 30s
Soru 665Soru →

An organization has EC2 instances running in a private VPC subnet that must send log data to Amazon CloudWatch Logs. To comply with security policies, this traffic must remain entirely within the AWS network. A SysOps Administrator creates an Interface VPC Endpoint for CloudWatch Logs (com.amazonaws.us-east-1.logs) in the VPC. However, the EC2 instances are still unable to reach CloudWatch Logs, and application log agents report connection timeouts. Which of the following actions should the SysOps Administrator take to resolve this connectivity issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on port 443 from the security group of the EC2 instances.; Enable Private DNS on the Interface VPC Endpoint, and ensure that both DNS resolution and DNS hostnames are enabled for the VPC.

Cevap

To resolve the connectivity issue, the Administrator must modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS (port 443) traffic from the EC2 instances, and enable Private DNS on the endpoint along with DNS resolution and DNS hostnames in the VPC.
The correct options are to modify the endpoint's security group to allow inbound HTTPS traffic from the EC2 instances, and to enable Private DNS on the endpoint along with DNS hostnames and resolution on the VPC. This combination allows traffic to flow securely to the endpoint's ENIs and enables standard DNS queries to resolve to private endpoint IPs without code modifications.

Adım Adım Çözüm

1
Check the security group configuration of the Interface VPC Endpoint.
Ensure that the security group attached to the endpoint network interfaces allows inbound HTTPS (port 443) traffic from the source EC2 instances.
Interface VPC Endpoints are represented by Elastic Network Interfaces (ENIs) in the VPC and require security group rules to permit traffic.
2
Verify VPC DNS settings and Endpoint Private DNS configuration.
Enable 'DNS resolution' and 'DNS hostnames' on the VPC, and check the 'Enable Private DNS' box on the Interface VPC Endpoint settings.
This allows the default regional service endpoint to automatically resolve to the private IP addresses of the endpoint's ENIs, preventing the need to change the application's configuration.

Anahtar Kavram

Interface VPC Endpoints rely on DNS resolution and security groups rather than route tables to secure private connectivity to AWS services.
Soru 666Soru →

A SysOps Administrator is designing a backup and recovery solution for a critical web application. The application's static media files are stored in an Amazon S3 bucket, and its transactional data is hosted on a single-node Amazon RDS for PostgreSQL DB instance.

The recovery plan has the following operational requirements:
* All static media files must be automatically copied to a secondary AWS Region for disaster recovery.
* The database must automatically fail over to a standby instance in another Availability Zone with minimal downtime if the primary instance fails.

Which combination of actions must the SysOps Administrator perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable bucket versioning on both the source and destination Amazon S3 buckets, and configure S3 Cross-Region Replication (CRR).; Modify the Amazon RDS DB instance to a Multi-AZ deployment to enable synchronous replication and automated failover.

Cevap

Enable bucket versioning on both the source and destination Amazon S3 buckets, configure S3 Cross-Region Replication (CRR), and modify the Amazon RDS DB instance to a Multi-AZ deployment.
To meet the disaster recovery and backup requirements, the SysOps Administrator must configure S3 Cross-Region Replication (CRR) and RDS Multi-AZ. Enabling bucket versioning on both the source and destination S3 buckets is a prerequisite for configuring S3 CRR. Converting the RDS PostgreSQL instance from Single-AZ to Multi-AZ enables synchronous replication to a standby instance in another Availability Zone and ensures automatic DNS failover with minimal downtime in the event of an outage.

Adım Adım Çözüm

1
Configure versioning on the S3 buckets.
Bucket versioning is enabled on both the source bucket in the primary Region and the destination bucket in the secondary Region.
S3 Cross-Region Replication requires versioning to be enabled on both source and destination buckets to track object versions during replication.
2
Set up S3 Cross-Region Replication.
An IAM role is created with replication permissions, and a replication rule is configured on the source bucket pointing to the destination bucket.
This automates the copying of all new static media uploads to the secondary AWS Region to satisfy the disaster recovery requirement.
3
Modify the RDS DB instance to Multi-AZ.
The Single-AZ RDS PostgreSQL DB instance is converted to a Multi-AZ deployment.
AWS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a failure, RDS automatically switches to the standby with minimal downtime and updates the DNS endpoint.

Anahtar Kavram

Disaster recovery and backup management using S3 replication and RDS Multi-AZ deployments.
Tahmini Süre:2m 0s
Soru 667Soru →

A company's production database runs on an Amazon RDS for PostgreSQL DB instance. A SysOps Administrator must establish a cross-Region disaster recovery (DR) solution that guarantees a Recovery Point Objective (RPO) of less than 30 minutes and a Recovery Time Objective (RTO) of less than 15 minutes. Which strategy should the administrator implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a cross-Region Read Replica of the DB instance in the disaster recovery Region. During a disaster, promote the Read Replica to a standalone DB instance and update the application endpoint.

Cevap

Create a cross-Region Read Replica of the DB instance in the disaster recovery Region. During a disaster, promote the Read Replica to a standalone DB instance and update the application endpoint.
Creating a cross-Region Read Replica provides asynchronous replication to another AWS Region, which typically keeps replication lag (RPO) to under a few minutes. If a regional disaster occurs, promoting the Read Replica to a standalone DB instance and modifying the application's endpoint is a quick operation that easily fits within the 15-minute RTO.

Adım Adım Çözüm

1
Analyze the cross-Region disaster recovery requirements (RPO of 30 minutes, RTO of 15 minutes).
Determine that the replication must cross AWS Regions, and the recovery process must take less than 15 minutes.
This establishes the constraints needed to evaluate the options.
2
Evaluate the capabilities of Amazon RDS Multi-AZ.
Determine that Multi-AZ replication is synchronous but only functions within a single AWS Region.
This rules out standard Multi-AZ for cross-Region DR.
3
Evaluate using Amazon S3 Cross-Region Replication (CRR) for automated backups.
Identify that RDS automated backups cannot be replicated using S3 CRR directly, and S3 CRR requires versioning on both buckets.
This rules out S3 CRR without versioning on system-managed buckets.
4
Evaluate the cross-Region Read Replica solution.
A cross-Region Read Replica provides asynchronous cross-Region replication (low RPO). Promoting the replica to a standalone instance takes minutes (low RTO).
This confirms that Read Replica promotion meets both the RPO and RTO requirements.

Anahtar Kavram

Cross-Region disaster recovery for Amazon RDS using Read Replicas.
Soru 668Soru →

A SysOps Administrator is configuring a backup and disaster recovery architecture for a business-critical application. The application stores uploaded documents in an Amazon S3 bucket and utilizes an Amazon RDS for PostgreSQL database. To meet reliability and compliance requirements:

1. S3 bucket data must be replicated to a destination bucket in a different AWS Region.
2. The database must support automatic failover with zero manual intervention to mitigate Availability Zone outages in the primary Region.
3. Access to the replicated S3 bucket must go through a private network path within the AWS VPC without traversing the public internet.

The administrator initiates S3 cross-Region replication and configures an RDS Read Replica. However, during testing, replication of new S3 objects fails, database failover is not automatic during an outage, and S3 traffic continues over the public internet.

Which combination of configuration changes will resolve these issues?

Cevabı ve açıklamayı göster

Cevap: Enable versioning on both the source and destination S3 buckets. Modify the database to use a Multi-AZ deployment. Create an S3 Gateway VPC Endpoint and associate it with the subnet route tables.

Cevap

The configuration that enables versioning on both the source and destination S3 buckets, modifies the database to use a Multi-AZ deployment, and creates an S3 Gateway VPC Endpoint associated with the subnet route tables.
The correct configuration requires enabling versioning on both the source and destination S3 buckets to support Cross-Region Replication, converting the database to a Multi-AZ deployment to enable automated database failover, and creating an S3 Gateway VPC Endpoint associated with the subnet route tables to route traffic to S3 privately. This addresses all three requirements of replication, automatic failover, and private networking.

Adım Adım Çözüm

1
Identify the requirements for Amazon S3 Cross-Region Replication (CRR).
Determine that bucket versioning must be enabled on both the source and destination S3 buckets.
AWS S3 CRR requires versioning to track and replicate object versions across Regions.
2
Evaluate the database failover requirement to mitigate Availability Zone outages automatically.
Determine that a Multi-AZ deployment is required, whereas Read Replicas are for scaling read traffic and do not support automated failover without custom scripting.
RDS Multi-AZ provides synchronous replication to a standby instance in another Availability Zone with automated DNS failover during outages.
3
Analyze the networking path required to access S3 privately from within the VPC.
Determine that an S3 Gateway VPC Endpoint must be created and explicitly associated with the subnet route tables.
Creating the gateway endpoint is not enough; without route table association, traffic destined for S3 will continue to route via the internet gateway.

Anahtar Kavram

Multi-component backup, recovery, and access configuration in AWS, including S3 Cross-Region Replication, RDS Multi-AZ failover, and Gateway VPC Endpoint routing.
Tahmini Süre:1m 30s
Soru 669Soru →

An organization runs a fleet of Amazon EC2 instances in a private VPC subnet (10.0.2.0/2410.0.2.0/24) that must initiate outbound connections to a third-party payment gateway on the internet on TCP port 84438443. The client application on the EC2 instances uses ephemeral ports (1024−655351024-65535) as source ports. Outbound traffic is routed through a NAT Gateway located in a public subnet (10.0.1.0/2410.0.1.0/24). Both the private subnet's Network Access Control List (NACL) and the EC2 instances' security group are custom and currently deny all inbound and outbound traffic. Which combination of rule configurations will successfully allow the EC2 instances to establish connections and receive responses from the payment gateway? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the custom security group, add an outbound rule that allows TCP traffic on port 84438443 to 0.0.0.0/00.0.0.0/0.; In the private subnet's custom NACL, add an outbound rule that allows TCP traffic on port 84438443 to 0.0.0.0/00.0.0.0/0, and an inbound rule that allows TCP traffic on port range 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.

Cevap

In the custom security group, add an outbound rule that allows TCP traffic on port 84438443 to 0.0.0.0/00.0.0.0/0; and in the private subnet's custom NACL, add an outbound rule that allows TCP traffic on port 84438443 to 0.0.0.0/00.0.0.0/0, and an inbound rule that allows TCP traffic on port range 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.
The correct configuration requires allowing outbound TCP port 84438443 in the security group to 0.0.0.0/00.0.0.0/0, as security groups are stateful and track the destination IP of the packet. In addition, because NACLs are stateless, the private subnet's NACL must explicitly allow the outbound request on port 84438443 and the inbound response on the ephemeral port range (1024−655351024-65535).

Adım Adım Çözüm

1
Analyze the Security Group requirements for the outbound payment gateway traffic.
Since Security Groups are stateful, only an outbound rule is needed. The destination must be the payment gateway's IP address (or 0.0.0.0/00.0.0.0/0), not the next-hop NAT Gateway's private IP, because security groups evaluate the packet's destination IP. No inbound rule is required because response traffic is automatically allowed.
To configure the security group correctly, we must allow port 84438443 outbound and rely on stateful packet tracking for the return traffic.
2
Analyze the Network Access Control List (NACL) requirements for the private subnet.
NACLs are stateless, meaning rules must be configured for both the outbound request and the inbound response. The outbound rule must allow destination port 84438443. The inbound rule must allow the return traffic to the client's ephemeral port range (1024−655351024-65535).
Without the inbound NACL rule for the ephemeral port range, the return response from the payment gateway will be blocked at the subnet boundary.

Anahtar Kavram

Stateful vs. Stateless network controls in AWS VPC (Security Groups vs. NACLs) and their handling of ephemeral ports.
Soru 670Soru →

A SysOps administrator is deploying an application on Amazon EC2 instances. The application needs to retrieve database credentials from AWS Systems Manager (SSM) Parameter Store. The credentials are stored as a SecureString parameter named `/prod/db/password` and are encrypted using a customer managed KMS key.

The EC2 instances are associated with an IAM role that has the following policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:GetParameter",
"ssm:GetParameters"
],
"Resource": "arn:aws:ssm:us-east-1:111122223333:parameter/prod/db/password"
},
{
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": "arn:aws:kms:us-east-1:111122223333:key/12345678-abcd-1234-abcd-123456789abc"
}
]
}

Despite this configuration, the application logs show an `AccessDeniedException` when calling the `ssm:GetParameter` API with decryption enabled. Which of the following is the most likely cause of this access denied error?

Cevabı ve açıklamayı göster

Cevap: The KMS key policy for the customer managed key does not allow the EC2 IAM role or the AWS account root principal to perform the `kms:Decrypt` action.

Cevap

The KMS key policy for the customer managed key does not allow the EC2 IAM role or the AWS account root principal to perform the `kms:Decrypt` action.
For customer managed KMS keys, the key policy is the primary authority. Even if an IAM policy grants `kms:Decrypt` permission to the EC2 IAM role, the request will be denied unless the KMS key policy explicitly permits the role or delegates access control to the account root principal (which allows IAM policies to take effect). Therefore, the lack of permission in the KMS key policy is the cause of the `AccessDeniedException`.

Adım Adım Çözüm

1
Identify the service and components involved in the request.
The application calls SSM Parameter Store (`ssm:GetParameter`) to retrieve a `SecureString` encrypted with a custom KMS key.
Retrieving encrypted parameters requires both read access to the SSM parameter and decrypt access to the associated KMS key.
2
Analyze the IAM policy attached to the EC2 instances.
The IAM policy correctly grants `ssm:GetParameter` on the parameter resource and `kms:Decrypt` on the KMS key resource.
This confirms that identity-based permissions are correctly configured.
3
Evaluate resource-based policy requirements for AWS KMS keys.
Unlike other resources, KMS key policies must explicitly allow IAM policies to govern key access (using the account root principal) or explicitly grant the principal permissions.
Without this delegation in the KMS key policy, identity-based IAM policies cannot grant access to the key, resulting in an `AccessDeniedException`.

Anahtar Kavram

KMS Key Policy Precedence over IAM Policies
Tahmini Süre:2m 0s
Soru 671Soru →

A SysOps Administrator is managing an AWS CloudFormation stack that contains an Amazon RDS DB instance and an IAM role. A drift detection operation on the stack reports that both resources are in a DRIFTED status because of manual modifications. The Administrator needs to bring the stack and the physical resources back into alignment. Which of the following actions should the Administrator take to remediate this resource drift? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Manually modify the RDS DB instance and the IAM role outside of CloudFormation to match the expected configurations defined in the stack template.; Update the CloudFormation template or parameters to match the current manual configurations of the resources, and then perform a stack update.

Cevap

Remediate the drift by either manually modifying the RDS DB instance and the IAM role outside of CloudFormation to match the template, or by updating the CloudFormation template to match the drifted resources and running a stack update.
To remediate resource drift in AWS CloudFormation, you can either manually modify the resources directly in their respective services to align with the template's expected configurations, or you can update the template and parameters to reflect the drifted configurations and perform a stack update. Modifying the resources manually resets them to the state defined in the template, while updating the template accepts the changes as the new source of truth.

Adım Adım Çözüm

1
Detect drift on the stack.
Identify that the RDS DB instance and the IAM role have configurations that differ from the template.
This establishes which resource properties have changed from their expected template definitions.
2
Choose remediation path: either align resources with the template, or align the template with the resources.
Decide whether to revert manual changes on the physical resources or update the template to accept the manual modifications.
CloudFormation does not auto-sync drift; the administrator must perform these manual reconciliation actions.
3
Perform stack update or manual configuration changes.
The stack status returns to IN_SYNC.
Completing the chosen path resolves the configuration discrepancy.

Anahtar Kavram

CloudFormation drift detection identifies manual changes made to stack resources outside of CloudFormation. Remediation requires either manually reverting the changes on the resource or updating the template to reflect the current state and updating the stack.
Soru 672Soru →

A SysOps Administrator is configuring an AWS Systems Manager State Manager association to run a custom script on a fleet of target Amazon EC2 instances. The target instances have the SSM Agent installed and running, and they are configured with an IAM instance profile containing the AmazonSSMManagedInstanceCore policy. The administrator configures the association to use a custom service role named StateManagerExecutionRole to perform the operations. However, when the administrator attempts to create the association, the action fails with an "Access Denied" error. What is the most likely cause of this failure?

Cevabı ve açıklamayı göster

Cevap: The administrator's IAM user or role policy is missing the iam:PassRole permission for the StateManagerExecutionRole.

Cevap

The administrator's IAM policy is missing the iam:PassRole permission for the StateManagerExecutionRole, preventing the user from passing the role to Systems Manager.
The correct answer is correct because creating a State Manager association that executes tasks using a custom service role requires the user to have the iam:PassRole permission for that role. Without this permission, the AWS API prevents the user from passing the role to Systems Manager, resulting in an Access Denied error during creation.

Adım Adım Çözüm

1
Analyze the error message and context.
The error is 'Access Denied' when creating the State Manager association using a custom service role. This indicates an IAM authorization failure.
Before passing a role to an AWS service, AWS verifies that the caller has permission to pass that specific role.
2
Identify the permission required to pass a role to a service.
The iam:PassRole action is required in the policy attached to the administrator's IAM user or role.
This prevents unauthorized users from passing highly privileged roles to services.
3
Select the option that correctly identifies this missing authorization.
The correct option is the one stating that the administrator's policy is missing the iam:PassRole permission.
Without this permission, any attempt to create a service association or task using that role will fail with an Access Denied error.

Anahtar Kavram

IAM PassRole requirement for AWS Systems Manager Service Roles
Tahmini Süre:1m 30s
Soru 673Soru →

A SysOps administrator is troubleshooting a connectivity issue between an Amazon EC2 instance in a private subnet of VPC A (10.10.1.0/2410.10.1.0/24) and a database instance in a private subnet of VPC B (10.20.2.0/2410.20.2.0/24). The two VPCs are connected via an AWS Transit Gateway. The administrator verifies the following configuration details:

1. Security Groups: The EC2 instance security group allows all outbound traffic, and the database security group allows inbound traffic on port 33063306 from VPC A's CIDR (10.10.0.0/1610.10.0.0/16).
2. Network ACLs: The Network ACLs for both subnets allow all inbound and outbound traffic.
3. Subnet Route Tables:
- VPC A's private subnet route table has a route: 10.20.0.0/16→10.20.0.0/16 \rightarrow tgw-0123456789abcdef0 (Transit Gateway).
- VPC B's private subnet route table has a route: 10.10.0.0/16→10.10.0.0/16 \rightarrow tgw-0123456789abcdef0 (Transit Gateway).
4. Transit Gateway Route Tables:
- The Transit Gateway has two route tables: `TGW-RT-1` and `TGW-RT-2`.
- The VPC A attachment is associated with `TGW-RT-1` and propagates its routes to `TGW-RT-2`.
- The VPC B attachment is associated with `TGW-RT-2` and propagates its routes to `TGW-RT-2`.

Which of the following explains why the EC2 instance cannot connect to the database?

Cevabı ve açıklamayı göster

Cevap: The Transit Gateway route table `TGW-RT-1` lacks a route to VPC B because the VPC B attachment only propagates to `TGW-RT-2`.

Cevap

The Transit Gateway route table `TGW-RT-1` lacks a route to VPC B because the VPC B attachment only propagates to `TGW-RT-2`.
The correct answer is that the Transit Gateway route table associated with VPC A (`TGW-RT-1`) does not have a route to VPC B because VPC B's attachment is only configured to propagate to `TGW-RT-2`. When a packet arrives at the Transit Gateway from an attachment, the Transit Gateway looks up the route table that is associated with that source attachment. In this case, it checks `TGW-RT-1` for a route to VPC B's CIDR (10.20.2.0/2410.20.2.0/24). Because VPC B's attachment does not propagate to `TGW-RT-1`, no route exists, and the traffic is dropped.

Adım Adım Çözüm

1
Trace the outbound traffic path from VPC A to VPC B.
The traffic leaves VPC A's private subnet and is routed to the Transit Gateway based on the VPC subnet route table entry (10.20.0.0/16→10.20.0.0/16 \rightarrow Transit Gateway).
This confirms that the initial VPC-level routing is correct.
2
Identify the Transit Gateway route table evaluated for packets arriving from VPC A.
The Transit Gateway evaluates `TGW-RT-1` because the VPC A attachment is associated with `TGW-RT-1`.
Transit Gateway routes incoming traffic based on the route table associated with the source attachment.
3
Check the routes present in `TGW-RT-1`.
There is no route to VPC B (10.20.0.0/1610.20.0.0/16) in `TGW-RT-1` because the VPC B attachment only propagates to `TGW-RT-2`.
Propagations determine which route tables automatically learn the CIDRs of the attached VPCs. Since VPC B only propagates to `TGW-RT-2`, `TGW-RT-1` has no knowledge of VPC B's CIDR.
4
Determine the packet outcome.
The Transit Gateway drops the packet due to a missing route in the evaluated route table (`TGW-RT-1`).
Without a destination route in the associated route table, the traffic cannot be forwarded.

Anahtar Kavram

AWS Transit Gateway route evaluation depends on the association of the source attachment and the propagation of the destination attachment.
Soru 674Soru →

A SysOps administrator is configuring AWS Config in a new AWS account. The administrator wants to use the AWS CLI to create a configuration recorder that uses a custom, pre-created IAM role named `ConfigRecorderRole`. However, when attempting to run the CLI command, the administrator receives an Access Denied error.

Which of the following actions are required to resolve this issue and successfully create the configuration recorder? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the trust policy of `ConfigRecorderRole` to allow the `config.amazonaws.com` service principal to perform the `sts:AssumeRole` action.; Attach an IAM policy to the SysOps administrator's IAM identity that grants the `iam:PassRole` permission for the Amazon Resource Name (ARN) of `ConfigRecorderRole`.

Cevap

To successfully configure the AWS Config recorder, the administrator must configure the trust policy of the IAM role to allow the AWS Config service principal to perform the assume-role action, and attach an IAM policy to their own IAM identity that grants the permission to pass the IAM role.
The correct options are the action to configure the trust policy of the IAM role to trust the AWS Config service principal and the action to attach an IAM policy to the administrator's identity granting the pass-role permission. These actions address the two independent permission boundaries required for service role assignment: trusting the service to assume the role, and authorizing the user to delegate the role.

Adım Adım Çözüm

1
Analyze the Access Denied error context when assigning an IAM role to an AWS service.
Identify that the operation involves delegation of permissions where a service (AWS Config) needs to act on behalf of the account using a specific IAM role.
This establishes that both service trust (AssumeRole) and user authorization to delegate the role (PassRole) are required.
2
Verify and update the trust relationship of the IAM role.
Ensure that the trust policy explicitly allows the `config.amazonaws.com` service principal to call `sts:AssumeRole`.
Without this trust relationship, the service principal cannot assume the role, regardless of user permissions.
3
Ensure the administrator has delegation permissions.
Grant the `iam:PassRole` permission for the target role's ARN to the administrator's IAM identity.
This prevents users from passing highly privileged roles to services without explicit authorization.

Anahtar Kavram

Configuring service trust relationships and role delegation permissions for AWS services.
Tahmini Süre:1m 30s
Soru 675Soru →

A SysOps Administrator is configuring a custom Network Access Control List (NACL) for a private subnet that hosts a fleet of Amazon EC2 instances. These instances must download security patches from an external repository over HTTPS (TCP port 443) via a NAT gateway. The security group associated with the instances permits all outbound traffic.

The private subnet's custom NACL has the following rules:
- Outbound: Rule 100 allows TCP port 443 to 0.0.0.0/00.0.0.0/0.
- Inbound: Rule 100 allows TCP port 443 from 0.0.0.0/00.0.0.0/0.
All other traffic is denied by the default rules. The instances are currently unable to download the patches.

Which configuration change will resolve this connectivity issue?

Cevabı ve açıklamayı göster

Cevap: Add an inbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 from 0.0.0.0/00.0.0.0/0.

Cevap

Add an inbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 from the internet.
Because Network Access Control Lists (NACLs) are stateless, return traffic must be explicitly allowed. When an EC2 instance initiates a connection to an external repository over HTTPS (TCP port 443), the return traffic from the repository is sent to the instance's ephemeral port range (1024-65535). Therefore, an inbound NACL rule must be configured to allow TCP traffic on ports 1024-65535.

Adım Adım Çözüm

1
Identify the nature of the network security controls in use.
The security group is stateful, while the Network Access Control List (NACL) is stateless.
Since the security group is stateful, it automatically permits the response traffic for any established outbound connection. However, because the NACL is stateless, we must configure rules to allow both the outbound request and the inbound response.
2
Analyze the port requirements for the outbound request and inbound response.
The outbound connection goes to destination port 443 (HTTPS) from an ephemeral source port (1024-65535). The inbound response comes from source port 443 to the destination ephemeral port (1024-65535) of the EC2 instance.
We must verify that both paths are permitted by the NACL rules.
3
Review the existing NACL rules and identify the bottleneck.
The outbound NACL rule allows TCP port 443, which permits the outbound request. However, the inbound NACL rule only allows TCP port 443, which blocks the inbound response since its destination port is an ephemeral port (1024-65535).
Adding an inbound NACL rule for TCP ports 1024-65535 allows the response traffic to reach the instances.

Anahtar Kavram

Statelessness of Network Access Control Lists (NACLs) and the requirement of ephemeral ports for return traffic.
Soru 676Soru →

A company runs a production application using an Amazon RDS for MariaDB DB instance configured in a Multi-AZ deployment. During a scheduled maintenance window, Amazon RDS performs a failover to the standby replica. The SysOps Administrator needs to confirm that the failover was successful and ensure that the application servers reconnect to the newly promoted primary instance as quickly as possible. Which of the following actions should the SysOps Administrator take? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Monitor the Amazon RDS events for the DB instance to verify that a failover has started and completed.; Ensure that the DNS caching configuration (TTL) on the application servers is set to a low value so that they quickly resolve the DB instance CNAME record to the new primary IP address.

Cevap

To verify the failover status and ensure rapid application reconnection, the administrator should monitor the Amazon RDS events and configure a low DNS caching TTL on the application servers.
The correct options recommend monitoring Amazon RDS events to verify failover completion and configuring client-side DNS TTL settings to a low value. Since Amazon RDS manages Multi-AZ failover by updating the CNAME record for the DB instance endpoint, the application needs to query DNS for the new IP address quickly without using cached values.

Adım Adım Çözüm

1
Check the Amazon RDS events for the DB instance.
Locate events showing the failover started and completed.
Amazon RDS logs failover activities as service events, providing a definitive audit trail of the transition.
2
Analyze client-side DNS caching settings on application servers.
Set client or OS-level DNS TTL to a small value (e.g., less than 30 seconds).
Amazon RDS Multi-AZ failover relies on updating a CNAME record. If the client caches the old IP address, it will continue attempting to connect to the offline primary instance.

Anahtar Kavram

Amazon RDS Multi-AZ failover utilizes automatic CNAME redirection, requiring short client-side DNS caching (TTL) for quick application recovery.
Soru 677Soru →

An organization operates an e-commerce platform using an Amazon Aurora PostgreSQL DB cluster. The cluster consists of one primary DB instance and three Aurora Replicas. During a localized Availability Zone outage affecting the primary instance, the SysOps Administrator needs to ensure that the replica configured with the highest compute specifications is prioritized for promotion to the primary instance during failover.

Which configuration should the administrator modify to guarantee this promotion order?

Cevabı ve açıklamayı göster

Cevap: Assign a promotion tier value of 0 to the high-specification replica, and higher tier values to the remaining replicas.

Cevap

Assign a promotion tier value of 0 to the high-specification replica, and higher tier values to the remaining replicas.
The correct option correctly configures the high-specification replica with a promotion tier of 0, which represents the highest promotion priority. Since the other replicas are assigned higher tier numbers (lower priority), Amazon Aurora will always attempt to promote the high-specification replica first during a failover event.

Adım Adım Çözüm

1
Analyze the cluster architecture and identify how Amazon Aurora handles failover promotions.
Amazon Aurora promotes one of the existing Aurora Replicas to become the new primary instance during a failover, using a designated promotion tier setting (values 0-15).
Understanding the failover mechanism is necessary to determine which configuration parameter controls replica promotion order.
2
Evaluate the priority order of the promotion tiers.
Replicas in lower-numbered tiers (starting at 0) have higher priority for promotion than those in higher-numbered tiers (up to 15).
Determining the correct priority scale avoids the misconception that larger numbers indicate higher priority.
3
Assign the appropriate promotion tier values to each replica to ensure the high-specification replica is promoted first.
The high-specification replica is configured with tier 0, while the remaining replicas are configured with tier 1 or higher.
Setting the lowest tier value to the targeted replica guarantees it will be evaluated and promoted before the other replicas.

Anahtar Kavram

Amazon Aurora Replica Promotion Tiers
Soru 678Soru →

An organization is setting up Amazon S3 Cross-Region Replication (CRR) to copy objects from a source bucket in the us-east-1 Region to a destination bucket in the us-west-2 Region. A SysOps Administrator has created the destination bucket and configured the replication rule on the source bucket, specifying an IAM role for replication. However, new objects uploaded to the source bucket are not replicating. Which of the following actions must the SysOps Administrator perform to successfully enable replication? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable S3 Versioning on both the source bucket and the destination bucket.; Grant the Amazon S3 service principal permissions to assume the IAM replication role, and configure the role's policy to permit replication actions.

Cevap

To successfully enable replication, S3 Versioning must be enabled on both the source and destination buckets, and the IAM replication role must be assumable by the Amazon S3 service principal with appropriate permissions to read from the source and write to the destination.
To configure S3 replication, versioning must be enabled on both the source and destination buckets. Additionally, the IAM replication role must have a trust relationship that allows the Amazon S3 service principal to assume the role, and the role must be granted permissions to retrieve object versions from the source bucket and replicate objects to the destination bucket.

Adım Adım Çözüm

1
Enable versioning on the source and destination buckets.
Both buckets support versioned objects, which is required for S3 to track and replicate individual object states.
S3 replication requires versioning to be enabled on both the source and destination buckets.
2
Configure the trust relationship of the IAM replication role to trust s3.amazonaws.com and allow sts:AssumeRole.
The Amazon S3 service principal is authorized to assume the role.
Amazon S3 needs to assume the replication role to perform replication actions on your behalf.
3
Attach a policy to the IAM replication role allowing s3:GetObjectVersion and s3:GetObjectVersionAcl on the source bucket, and s3:ReplicateObject on the destination bucket.
The role has the necessary permissions to read replication source metadata and write replication target objects.
Replication fails if the replication role lacks permissions to read source objects or write to the destination bucket.

Anahtar Kavram

Amazon S3 replication requires versioning to be enabled on both source and destination buckets, and an IAM role trusted by the Amazon S3 service principal with appropriate bucket and object access permissions.
Tahmini Süre:1m 30s
Soru 679Soru →

A company's infrastructure team distributes standardized environments across multiple business units using AWS Service Catalog portfolios. An administrator is configuring a launch constraint in a spoke account using an IAM role named CatalogLaunchRole to enforce principal-based execution. When a team member attempts to provision a product, the deployment fails. The provisioning details reveal two distinct errors: one stating that the user is not authorized to pass the launch role, and another in the AWS CloudFormation event log showing a failure to create an IAM instance profile. Which of the following actions must be taken to resolve these deployment errors? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the developer's IAM identity policy to allow the iam:PassRole action targeting the CatalogLaunchRole resource.; Update the permissions policy of CatalogLaunchRole to include the iam:CreateInstanceProfile action.

Cevap

Configure the developer's IAM identity policy to allow the iam:PassRole action targeting the CatalogLaunchRole resource, and update the permissions policy of CatalogLaunchRole to include the iam:CreateInstanceProfile action.
The correct actions are to configure the developer's IAM identity policy to allow the iam:PassRole action targeting the CatalogLaunchRole resource, and to update the permissions policy of CatalogLaunchRole to include the iam:CreateInstanceProfile action. When using an AWS Service Catalog launch constraint, the user launching the product must have the iam:PassRole permission to pass the specified launch role to the Service Catalog service. Additionally, because the launch role is used to execute the underlying CloudFormation deployment, that role must possess the permissions needed to create every resource in the template, including the IAM instance profile.

Adım Adım Çözüm

1
Address the user-side authorization failure by examining the developer's IAM policy.
Identify that the developer lacks the permission to pass the CatalogLaunchRole.
Before AWS Service Catalog can assume the launch role under a launch constraint, the requesting principal must have iam:PassRole permission for that specific role.
2
Add the iam:PassRole permission to the developer's policy, targeting the CatalogLaunchRole ARN.
The developer is now authorized to delegate provisioning actions to the launch role.
This resolves the authorization error preventing the deployment from starting.
3
Address the underlying CloudFormation resource creation failure by examining the CatalogLaunchRole permissions.
Identify that the role lacks permissions to create IAM instance profiles.
During launch constraint execution, all resource creation actions are executed by the launch role. The role must have policies allowing it to provision all resources in the CloudFormation template.
4
Add iam:CreateInstanceProfile (and other required IAM actions) to the CatalogLaunchRole's permission policy.
The launch role can successfully create the instance profile during deployment.
This resolves the CloudFormation permission failure and prevents the stack from rolling back.

Anahtar Kavram

Under AWS Service Catalog launch constraints, the user needs iam:PassRole permissions for the launch role, and the launch role itself must have all the permissions required to create the resources in the underlying CloudFormation template.
Soru 680Soru →

A compliance auditor operating from an external AWS account (Account B) requires access to read consolidated AWS CloudTrail logs stored in an Amazon S3 bucket within the main corporate AWS account (Account A). The log files are encrypted with an AWS KMS customer managed key in Account A. The SysOps Administrator has attached an IAM policy to the auditor's IAM role in Account B that permits s3:GetObject on the S3 bucket and kms:Decrypt on the KMS key. The S3 bucket policy in Account A has also been updated to allow access from the auditor's role in Account B. However, when the auditor attempts to retrieve a log file, they receive an Access Denied error. Which action must the SysOps Administrator perform to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Update the key policy of the KMS key in Account A to allow the auditor's IAM role in Account B to perform the kms:Decrypt action.

Cevap

Update the key policy of the KMS key in Account A to allow the auditor's IAM role in Account B to perform the kms:Decrypt action.
For cross-account access to KMS-encrypted data, authorization must be granted by both the external identity's account and the resource owner's account. Because the customer managed key is in Account A and the auditor is in Account B, the KMS key policy in Account A must explicitly allow the auditor's IAM role ARN to perform the kms:Decrypt action. Once this key policy permission is in place, it works in tandem with the auditor's IAM policy in Account B to permit successful decryption.

Adım Adım Çözüm

1
Identify that the access request is cross-account (Account B requesting access to resources in Account A).
Confirm that IAM policies in the destination account (Account B) cannot automatically grant access to resources in the source account (Account A) without resource-level permissions.
Cross-account authorization requires both the identity-based policy in the consuming account and the resource-based policy in the owning account to allow the action.
2
Evaluate the encryption configuration of the target files.
Observe that the CloudTrail logs are encrypted with a customer managed KMS key.
Accessing the encrypted objects requires both s3:GetObject permissions on the S3 bucket and kms:Decrypt permissions on the KMS key.
3
Examine the KMS key policy in Account A.
Determine that the KMS key policy does not explicitly permit the external auditor's role to decrypt.
By default, KMS key policies restrict access. Unlike S3 bucket policies where trust can sometimes be delegated purely via IAM, cross-account KMS access requires the key policy itself to explicitly trust the external IAM principal.
4
Update the KMS key policy in Account A.
Include the ARN of the auditor's IAM role from Account B in the Principal element of a policy statement allowing the kms:Decrypt action.
This establishes the necessary trust in the key owner's account to allow the external IAM role to use the key.

Anahtar Kavram

Cross-account KMS key delegation and policy precedence
Tahmini Süre:2m 30s
ÖncekiSayfa 34 / 49Sonraki