Tüm alıştırma soruları

976 soru

Tüm türler976 Çoktan seçmeli502 Çoklu seçim450 Sıralama24

An administrator is configuring a custom step scaling policy for an Amazon EC2 Auto Scaling group (ASG) based on a custom MemoryUtilization metric. The custom metric is collected and sent to Amazon CloudWatch by the CloudWatch agent installed on the EC2 instances. During testing, the administrator notices two issues:

1. Scale-out actions are delayed by up to 5 minutes because the custom metric alarms are evaluated using the default period.
2. Immediately after a scale-out event triggers, the ASG repeatedly launches additional instances before the newly launched instances have finished booting and initializing, causing temporary over-provisioning.

Which two actions should the administrator take to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Modify the CloudWatch alarm to evaluate the metric over a 1-minute period instead of a 5-minute period.

Configure or increase the estimated instance warmup time for the step scaling policy.

Enable detailed monitoring in the Auto Scaling group launch template to increase the reporting frequency of the custom metric to 1 minute.

Increase the default cooldown period of the Auto Scaling group to block subsequent scaling triggers.

Attach an IAM policy with the iam:PassRole permission to the Auto Scaling group's service role to allow the policy to read the metric.

Cevabı ve açıklamayı göster

Cevap: Modify the CloudWatch alarm to evaluate the metric over a 1-minute period instead of a 5-minute period.; Configure or increase the estimated instance warmup time for the step scaling policy.

Cevap

Modify the CloudWatch alarm to evaluate the metric over a 1-minute period instead of a 5-minute period, and configure or increase the estimated instance warmup time for the step scaling policy.

To resolve the scale-out delay, modifying the CloudWatch alarm to evaluate the metric over a 1-minute period ensures the threshold is checked frequently, aligning with the agent's reporting interval. To resolve the over-provisioning issue, configuring or increasing the estimated instance warmup time prevents the step scaling policy from launching additional instances while existing ones are still booting up.

Adım Adım Çözüm

Reduce the alarm evaluation latency.

By updating the CloudWatch alarm's period to 60 seconds (1 minute), alarms are evaluated more frequently, resolving the 5-minute scale-out delay.

CloudWatch custom metrics sent by the agent default to 1-minute reporting, but the alarm must also be configured to evaluate at this higher frequency to trigger scaling actions promptly.

Prevent premature scaling actions during initialization.

Configuring the estimated instance warmup time on the step scaling policy tells the Auto Scaling group to count these warming instances but ignore their lack of metric reports for subsequent scaling evaluations.

This prevents the step scaling policy from scaling out again while the previously launched instances are still in the process of starting up.

Anahtar Kavram

Custom metric scaling configuration and warmup settings in EC2 Auto Scaling step scaling policies.

Soru 722Soru →

A SysOps administrator is troubleshooting an issue where an Amazon EC2 Auto Scaling group behind an Application Load Balancer (ALB) is registering new instances with the ALB before they are fully configured, leading to temporary HTTP 502 Bad Gateway errors. The administrator implements an `EC2_INSTANCE_LAUNCHING` lifecycle hook to pause the instance state during initialization. Arrange the sequence of operational steps and state transitions that must occur for a new instance to be successfully configured and start receiving healthy traffic from the ALB.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of steps starts with Auto Scaling launching the instance, transitioning it to the Pending state, pausing it via the launch lifecycle hook (Pending:Wait), executing the bootstrap scripts, completing the lifecycle action with a CONTINUE signal, and finally registering the instance with the Application Load Balancer target group to transition to the InService state.

The correct sequence ensures that the instance remains in a paused state (Pending:Wait) while configuration scripts run, preventing the load balancer from routing traffic to an unconfigured instance. The lifecycle hook must be completed using the API before Auto Scaling proceeds with load balancer registration and transitioning the instance to the InService state.

Adım Adım Çözüm

Auto Scaling responds to a scale-out alarm.

A new EC2 instance is launched.

To scale out capacity as defined by the scaling policy.

The instance boots up.

State transitions to Pending.

This is the default initial state for launching Auto Scaling instances.

The configured EC2_INSTANCE_LAUNCHING lifecycle hook triggers.

State transitions to Pending:Wait.

To pause the launch process and prevent early registration with the ALB.

The instance executes the bootstrap scripts specified in its User Data.

Software dependencies are installed and the application starts.

To configure the instance for production traffic while paused.

The configuration script invokes the complete-lifecycle-action CLI command.

State transitions to Pending:Proceed.

To signal to Auto Scaling that bootstrapping is complete.

Auto Scaling registers the instance with the ALB target group and monitors target health.

State transitions to InService once health checks pass.

To allow healthy traffic to be routed to the newly configured instance.

Anahtar Kavram

Auto Scaling Lifecycle Hooks and State Transitions

Tahmini Süre:2m 0s

Soru 723Soru →

A SysOps Administrator is troubleshooting network connectivity between an Amazon EC2 instance in a public subnet and an external database. The EC2 instance is attempting to connect to the database at IP address 203.0.113.50 on TCP port 5432. The connection attempts are failing with a timeout.

The administrator enables VPC Flow Logs for the EC2 instance's elastic network interface (ENI). The flow logs capture the following records:

text
2 123456789012 eni-0123456789abcdef0 10.0.1.15 203.0.113.50 49152 5432 6 1 40 1620000000 1620000060 ACCEPT OK
2 123456789012 eni-0123456789abcdef0 203.0.113.50 10.0.1.15 5432 49152 6 1 40 1620000000 1620000060 REJECT OK

Which two statements explain this behavior and identify the correct configuration changes required to resolve this connectivity issue? (Select two.)

Geçerli olan tümünü seçin

The Network Access Control List (NACL) associated with the subnet is blocking the inbound response traffic on the ephemeral port.

The Network Access Control List (NACL) associated with the subnet must be updated to allow inbound traffic on TCP ports 1024-65535 from 203.0.113.50.

The Security Group associated with the EC2 instance is blocking the response traffic and must be updated to allow inbound traffic on TCP port 49152 from 203.0.113.50.

The Security Group associated with the EC2 instance must be updated to allow inbound traffic on TCP port 5432 from 203.0.113.50.

The subnet's route table is missing a route targeting the Internet Gateway (IGW), which is preventing the outbound connection from leaving the VPC.

Cevabı ve açıklamayı göster

Cevap: The Network Access Control List (NACL) associated with the subnet is blocking the inbound response traffic on the ephemeral port.; The Network Access Control List (NACL) associated with the subnet must be updated to allow inbound traffic on TCP ports 1024-65535 from 203.0.113.50.

Cevap

The Network Access Control List (NACL) associated with the subnet is blocking the inbound response traffic on the ephemeral port, and this NACL must be updated to allow inbound traffic on TCP ports 1024-65535 from the database IP address.

The VPC Flow Logs demonstrate that the outbound packet from the EC2 instance to the database on port 5432 was successfully accepted, but the corresponding inbound response from the database to the EC2 instance's ephemeral port (49152) was rejected. Security groups are stateful, meaning they track connection states and automatically allow return traffic for allowed outbound connections. Therefore, the security group is not the component rejecting the packet. Network Access Control Lists (NACLs), however, are stateless and require explicit rules for both outbound and inbound traffic. To resolve this connectivity issue, the subnet's NACL must be modified to include an inbound rule allowing return traffic from the database's IP address on the ephemeral port range (1024-65535).

Adım Adım Çözüm

Analyze the direction, ports, and action of the VPC Flow Log records.

The first record shows an outbound packet (source 10.0.1.15 to destination 203.0.113.50 on port 5432) was accepted. The second record shows an inbound packet (source 203.0.113.50 on port 5432 to destination 10.0.1.15 on port 49152) was rejected.

VPC Flow Logs record the source and destination IPs and ports, as well as the action (ACCEPT or REJECT) taken by security groups and NACLs.

Evaluate the stateful nature of Security Groups against the log results.

Since the outbound packet was accepted, any Security Group that allowed the outbound connection would automatically permit the inbound response on the ephemeral port.

Security Groups are stateful; they track connections and allow return traffic automatically without checking inbound rules.

Evaluate the stateless nature of Network ACLs against the log results.

Because the outbound packet was accepted but the inbound response on the client's ephemeral port (49152) was rejected, the stateless Network ACL must be blocking the return traffic.

Network ACLs are stateless, meaning return traffic is not automatically tracked and must be explicitly allowed by inbound rules.

Identify the correct configuration change to restore traffic.

Add an inbound rule to the Network ACL associated with the subnet that allows TCP traffic on ephemeral ports (1024-65535) from the database's IP address (203.0.113.50).

This allows the response packets from the database to bypass the NACL restriction and reach the EC2 instance.

Anahtar Kavram

Stateful vs. Stateless Network Controls in AWS VPCs

Soru 724Soru →

An operations team reports that a critical application running on Amazon EC2 instances in a private subnet is unable to retrieve data from an external API, though the API endpoint is verified as active. To investigate the issue, a SysOps Administrator enables VPC Flow Logs for the subnet. The flow logs reveal that outbound TCP traffic to the API on port 443 shows an action of ACCEPT, but the inbound return traffic from the API's IP address on TCP ports 1024–65535 shows an action of REJECT. Which of the following is the most likely cause of this behavior?

The network ACL associated with the subnet has an inbound rule that does not allow return traffic on ephemeral ports.

The security group associated with the EC2 instances lacks an inbound rule allowing return traffic from the API on the ephemeral port range.

The subnet's route table lacks a route for a Gateway VPC Endpoint, causing the response traffic to be dropped when routed back to the instances.

The IAM role used by the SysOps Administrator to enable the flow logs lacks the iam:PassRole permission.

Cevabı ve açıklamayı göster

Cevap: The network ACL associated with the subnet has an inbound rule that does not allow return traffic on ephemeral ports.

Cevap

The network ACL associated with the subnet has an inbound rule that does not allow return traffic on ephemeral ports.

The correct answer is correct because network access control lists (NACLs) are stateless. Consequently, when an EC2 instance initiates an outbound connection, the return traffic is treated as a separate connection and must be explicitly allowed by the inbound NACL rules. Since the return traffic from the API uses ephemeral ports (1024–65535), the inbound NACL must allow this port range. If it does not, the traffic will be blocked and recorded as REJECT in the VPC Flow Logs.

Adım Adım Çözüm

Analyze the action logs for outbound and inbound traffic.

Outbound traffic is allowed (ACCEPT) on port 443, but inbound return traffic is blocked (REJECT) on ports 1024–65535.

This indicates that the outbound path is working but the return path is blocking the connection.

Evaluate the stateful nature of security groups.

Since security groups are stateful, return traffic for an initiated outbound connection is automatically allowed and would not show as REJECT.

This rules out security group misconfiguration as the cause of the REJECT action.

Evaluate the stateless nature of network ACLs.

Network ACLs are stateless, meaning outbound and inbound traffic must be evaluated independently. If the inbound network ACL rule does not allow return traffic on ephemeral ports, it will block the response.

This identifies the network ACL as the component blocking the return traffic and causing the REJECT action in the logs.

Anahtar Kavram

Stateless behavior of Network ACLs compared to stateful Security Groups in VPC Flow Logs

Soru 725Soru →

A SysOps Administrator is deploying the AWS Replication Agent on an on-premises server to configure replication with AWS Elastic Disaster Recovery (AWS DRS). The installation fails because the AWS credentials provided do not have the permissions necessary to register the source server. Which configuration will resolve this issue and allow the Replication Agent to successfully register the server?

Attach the AWSElasticDisasterRecoveryAgentInstallationPolicy managed policy to the IAM user whose credentials are used for installation.

Configure the IAM user policy to include iam:PassRole permissions to allow the agent to assume the AWS DRS service-linked role directly.

Create a Route 53 failover routing policy that maps the replication agent endpoints to the primary DRS staging area.

Enable versioning on the destination S3 bucket to act as the primary target for replication logs.

Cevabı ve açıklamayı göster

Cevap: Attach the AWSElasticDisasterRecoveryAgentInstallationPolicy managed policy to the IAM user whose credentials are used for installation.

Cevap

Attach the AWSElasticDisasterRecoveryAgentInstallationPolicy managed policy to the IAM user whose credentials are used for installation.

The correct answer is attaching the AWSElasticDisasterRecoveryAgentInstallationPolicy managed policy to the IAM user. During the installation of the AWS Replication Agent on a source server, credentials with this policy must be provided so that the agent can authenticate with AWS DRS, register the source server, and create the required replication resources in the staging area.

Adım Adım Çözüm

Identify the authentication failure during the AWS Replication Agent installation.

Confirm that the IAM user credentials provided do not have the permissions to communicate with AWS DRS.

The Replication Agent requires specific permissions to register the server in the AWS Console.

Locate the AWS managed policy designed specifically for agent installation.

Identify AWSElasticDisasterRecoveryAgentInstallationPolicy as the policy containing the minimal required permissions.

Following the principle of least privilege, this managed policy allows the agent to register servers without granting excess permissions.

Attach the managed policy to the IAM user and re-run the agent installation script.

The agent successfully authenticates, registers the server, and starts initial replication.

The newly added permissions allow the script to register the server and initialize replication to the staging area.

Anahtar Kavram

AWS Elastic Disaster Recovery Agent Authentication

Soru 726Soru →

A company's production application runs in the us-east-1 Region. The application tier consists of stateless Amazon ECS tasks running on AWS Fargate behind an Application Load Balancer (ALB). The database tier uses a Multi-AZ Amazon Aurora PostgreSQL DB cluster. User documents are stored in an Amazon S3 bucket. A SysOps administrator must establish a disaster recovery (DR) strategy in the us-west-2 Region. The business requires a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes while minimizing ongoing idle resource costs in the recovery region.

Which combination of actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure the secondary ECS service with a desired task count of zero, and use an AWS CloudFormation template to scale up the tasks during failover.

Enable S3 Versioning on both the source bucket in us-east-1 and the destination bucket in us-west-2, and configure Amazon S3 Cross-Region Replication (CRR) between the buckets.

Set up a standard cross-region Aurora Read Replica in us-west-2. Rely on Amazon RDS automatic Multi-AZ failover to promote the cross-region replica and redirect application traffic during a regional outage.

Configure Amazon S3 Cross-Region Replication (CRR) from the source bucket to the destination bucket without enabling versioning on either bucket to minimize storage overhead.

Configure Amazon Route 53 with an active-active failover routing policy and associate health checks directly with the private database endpoints to automate regional traffic redirection.

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure the secondary ECS service with a desired task count of zero, and use an AWS CloudFormation template to scale up the tasks during failover.; Enable S3 Versioning on both the source bucket in us-east-1 and the destination bucket in us-west-2, and configure Amazon S3 Cross-Region Replication (CRR) between the buckets.

Cevap

Configure an Amazon Aurora Global Database for sub-second database replication, scale the recovery region's ECS Fargate tasks from zero to meet RTO cost-effectively, and configure Amazon S3 Cross-Region Replication with versioning enabled on both source and destination buckets.

Establishing an Amazon Aurora Global Database provides storage-level replication with lag under a second, meeting the 5-minute RPO. Keeping the ECS Fargate task desired count at zero minimizes idle compute costs, and the service can be scaled up quickly via CloudFormation templates or CLI commands to meet the 15-minute RTO limit during an actual failover. For static assets, configuring S3 Cross-Region Replication with versioning enabled on both source and destination buckets satisfies the replication requirements and ensures all files are safely copied to the recovery region.

Adım Adım Çözüm

Configure database replication across regions.

Create an Aurora Global Database with the primary cluster in us-east-1 and the secondary in us-west-2 to meet the 5-minute RPO with storage-level replication.

Aurora Global Database replication lag is typically less than one second, which is well within the 5-minute RPO threshold.

Configure application tier scaling for disaster recovery.

Keep the ECS Fargate service task count in us-west-2 at zero during normal operations, and prepare a deployment workflow to scale tasks up when a failover occurs.

This Pilot Light strategy eliminates ongoing Fargate compute costs in the disaster recovery region while allowing tasks to launch within the 15-minute RTO.

Enable cross-region object replication.

Turn on S3 Versioning for both us-east-1 and us-west-2 buckets, then configure S3 Cross-Region Replication (CRR).

S3 Versioning is a strict prerequisite for S3 Cross-Region Replication.

Anahtar Kavram

Disaster recovery strategy design balancing RTO/RPO requirements and cost optimization using Aurora Global Databases, Pilot Light compute scaling, and S3 Cross-Region Replication.

Tahmini Süre:3m 0s

Soru 727Soru →

A SysOps administrator is managing an Amazon EC2 Auto Scaling group (ASG) configured to scale out based on CPU utilization using a dynamic scaling policy. The administrator observes that although the associated Amazon CloudWatch alarm has transitioned to the ALARM state, the ASG does not launch any new instances. The maximum capacity of the ASG is set to $10$ , the minimum is $2$ , and the current desired capacity is $2$ . Which two troubleshooting steps should the administrator perform to identify the root cause of this behavior? (Select TWO.)

Geçerli olan tümünü seçin

Check if the Launch process is suspended on the Auto Scaling group.

Check if the AlarmNotification process is suspended on the Auto Scaling group.

Enable detailed monitoring on the launch template, as dynamic scaling policies require

1

-minute metric intervals to trigger.

Increase the default cooldown period to ensure that the CloudWatch alarm has enough time to pass the evaluation period.

Verify that the SysOps administrator's IAM user policy contains the iam:PassRole permission for the CloudWatch service.

Cevabı ve açıklamayı göster

Cevap: Check if the Launch process is suspended on the Auto Scaling group.; Check if the AlarmNotification process is suspended on the Auto Scaling group.

Cevap

The correct troubleshooting steps are to check if the Launch process is suspended on the Auto Scaling group and to check if the AlarmNotification process is suspended on the Auto Scaling group.

The correct steps are to check the suspended processes on the Auto Scaling group. If the Launch process is suspended, the Auto Scaling group will not launch new instances even if a scaling action is requested. If the AlarmNotification process is suspended, the Auto Scaling group will not receive the notification from the CloudWatch alarm, preventing the scaling policy from executing.

Adım Adım Çözüm

Review the suspended processes list for the Auto Scaling group using the AWS Management Console or the DescribeAutoScalingGroups API call.

Identify if processes like Launch or AlarmNotification are currently in a suspended state.

Suspended processes halt specific operations. The Launch process stops new instances from starting, while the AlarmNotification process stops the ASG from reacting to CloudWatch alarms.

Verify if the Auto Scaling service-linked role is configured correctly and has not been deleted or modified.

Ensure the service-linked role has permissions to launch instances and respond to alarms.

If the service-linked role is missing or misconfigured, it will prevent scaling actions, but checking suspended processes is the primary step when alarms are triggered and capacity settings are correct.

Anahtar Kavram

Auto Scaling suspended processes prevent scaling activities from executing even when CloudWatch alarms trigger policies.

Soru 728Soru →

A SysOps Administrator is managing a write-heavy PostgreSQL database on Amazon RDS. The database is currently deployed as a standard Multi-AZ DB instance. During a recent Availability Zone outage, the database failed over to the standby instance, but the application experienced approximately 80 seconds of downtime. The administrator needs to migrate the database to a configuration that reduces the failover time to under 35 seconds while still allowing the standby instances to serve read traffic. Which database configuration and architectural transition should the administrator implement to meet these requirements?

Migrate the database to an Amazon RDS Multi-AZ DB cluster. This configuration uses semi-synchronous replication to two readable standby instances in different Availability Zones, reducing failover time because the standby instances are already running and do not require database crash recovery.

Create an Amazon RDS Read Replica in a different Availability Zone and configure an Amazon Route 53 failover routing policy to automatically promote the replica and route write traffic to it during an outage.

Configure an Amazon Route 53 latency-based routing policy to split write traffic between the primary DB instance and a read replica, enabling automatic failover if the primary instance becomes unhealthy.

Modify the existing Multi-AZ DB instance to run in an active-active configuration across two Availability Zones, and configure a Network Load Balancer to route traffic to the active instance.

Cevabı ve açıklamayı göster

Cevap: Migrate the database to an Amazon RDS Multi-AZ DB cluster. This configuration uses semi-synchronous replication to two readable standby instances in different Availability Zones, reducing failover time because the standby instances are already running and do not require database crash recovery.

Cevap

Migrating to an Amazon RDS Multi-AZ DB cluster is the correct solution. Unlike standard Multi-AZ DB instances which have a passive standby that requires database recovery during failover, a Multi-AZ DB cluster maintains two active reader instances in different Availability Zones. Because these instances are already running and serving read traffic, failover is faster (typically under 35 seconds) and requires no database recovery stage.

Adım Adım Çözüm

Evaluate the limitations of the current standard Multi-AZ DB instance deployment.

The standard Multi-AZ DB instance uses synchronous replication at the storage level to a single passive standby, which requires database engine startup and recovery during failover, leading to failover times of 1-2 minutes.

Understanding the baseline performance is necessary to identify why the current architecture fails to meet the target sub-35-second failover requirement.

Identify the high availability database options in Amazon RDS that support readable standbys and faster failover.

An Amazon RDS Multi-AZ DB cluster deployment provides one writer and two readable reader DB instances across three Availability Zones.

This deployment option is designed specifically for lower failover times (typically under 35 seconds) and read scaling from the standbys.

Determine the replication and failover mechanism of the Multi-AZ DB cluster.

The DB cluster uses semi-synchronous engine-level replication. Because the standby reader instances are already active and running, they do not need crash recovery upon failover, allowing rapid promotion to writer status.

Confirming the technical mechanism ensures that the chosen option meets both the failover time reduction and the read-traffic serving requirement.

Anahtar Kavram

Amazon RDS Multi-AZ DB Cluster Architecture and Failover Dynamics

Soru 729Soru →

A SysOps Administrator is configuring a monitoring and remediation solution for a backend service running on Amazon EC2. The service outputs space-delimited logs to an Amazon CloudWatch Logs log group. A typical log entry is formatted as follows:

`api-srv-01 srv-core WARN 500 1200`

The fields, from left to right, represent: `Source`, `Service`, `LogLevel`, `StatusCode`, and `ResponseTimeMs`.

The administrator wants to:
1. Extract `ResponseTimeMs` as a custom metric named `TransactionLatency` in the `BackendApp` namespace.
2. Only count logs where the `LogLevel` is either `WARN` or `ERROR`, and the `StatusCode` is not equal to $200$ .
3. Automatically restart the EC2 instance using the Systems Manager Automation document `AWS-RestartEC2Instance` if the average `TransactionLatency` exceeds $500$ ms over three consecutive $1$ -minute periods.

Which two steps must the SysOps Administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create a CloudWatch Logs metric filter with the pattern `[source, service, level = WARN || level = ERROR, status != 200, latency]` and map the metric value to `$latency`.

Create a CloudWatch Logs metric filter with the JSON pattern `{

.LogLevel = "WARN" ||

.LogLevel = "ERROR" &&

.StatusCode != 200 }` and map the metric value to `

.ResponseTimeMs`.

Create a CloudWatch alarm for the `TransactionLatency` metric that evaluates the average value over three consecutive

1

-minute periods, and configure an Amazon EventBridge rule that triggers the `AWS-RestartEC2Instance` Systems Manager Automation document when the alarm transitions to the `ALARM` state.

Create a CloudWatch alarm for the `TransactionLatency` metric that evaluates the average value over three consecutive

1

-minute periods, and configure the alarm's action to directly execute the `AWS-RestartEC2Instance` Systems Manager Automation document when the alarm transitions to the `ALARM` state.

Enable detailed monitoring on the Amazon EC2 instances to decrease the metric filter evaluation and ingestion interval from

5

minutes to

1

minute.

Modify the log group retention period to

3

days to force CloudWatch Logs to aggregate the custom metric data points at

1

-minute intervals.

Cevabı ve açıklamayı göster

Cevap: Create a CloudWatch Logs metric filter with the pattern `[source, service, level = WARN || level = ERROR, status != 200, latency]` and map the metric value to ` $latency`.; Create a CloudWatch alarm for the `TransactionLatency` metric that evaluates the average value over three consecutive$ 1$-minute periods, and configure an Amazon EventBridge rule that triggers the `AWS-RestartEC2Instance` Systems Manager Automation document when the alarm transitions to the `ALARM` state.

Cevap

Create a CloudWatch Logs metric filter with the pattern `[source, service, level = WARN || level = ERROR, status != 200, latency]` mapping the metric value to `$latency`, and configure an Amazon EventBridge rule to trigger the Systems Manager Automation document when the CloudWatch alarm transitions to the `ALARM` state.

The correct options are the ones stating that a positional metric filter pattern `[source, service, level = WARN || level = ERROR, status != 200, latency]` must be used, and that an EventBridge rule must be created to trigger the Systems Manager Automation document. The log entries are space-delimited, which necessitates positional bracket matching to map the fields. Because CloudWatch alarms do not natively support direct targets like Systems Manager Automation, the state transition of the alarm must be captured as an event in Amazon EventBridge, which then targets the Systems Manager Automation document to perform the EC2 restart.

Adım Adım Çözüm

Define a CloudWatch Logs metric filter pattern suitable for space-delimited text logs.

The metric filter pattern `[source, service, level = WARN || level = ERROR, status != 200, latency]` matches the position of each space-delimited log field, filters the events, and maps the fifth field to the variable `$latency`.

This extracts only log messages with warning or error levels and non-200 statuses, enabling the retrieval of the response time values.

Create the custom metric transformation under the custom namespace and metric name.

A custom metric named `TransactionLatency` is published in the `BackendApp` namespace, with its value derived from the extracted `$latency` variable.

This establishes the numeric metric timeline necessary to configure threshold alarms.

Configure the CloudWatch alarm threshold and evaluation period.

A CloudWatch alarm is set up to evaluate the average of `TransactionLatency` over three

1

-minute periods, triggering when the average is greater than

500

This defines the threshold condition under which remediation must occur.

Set up the remediation trigger using Amazon EventBridge.

An EventBridge rule matches the state change event of the CloudWatch alarm to `ALARM` and executes the target `AWS-RestartEC2Instance` Systems Manager Automation document.

This bridges the monitoring alarm with the automated operational remediation because CloudWatch alarms cannot directly call Systems Manager Automation.

Anahtar Kavram

CloudWatch Logs metric filters extract numeric metrics from space-delimited log events using positional bracket notation, and automated remediation requires routing CloudWatch alarm state change events through Amazon EventBridge to Systems Manager Automation.

Soru 730Soru →

A SysOps Administrator is configuring AWS Elastic Disaster Recovery (AWS DRS) to replicate an on-premises server to AWS. Which of the following requirements must be met to ensure that the AWS Replication Agent can successfully register the source server and replicate data to AWS? (Select TWO.)

Geçerli olan tümünü seçin

Configure outbound network access from the source server to the AWS DRS API endpoints over TCP port 443 and to the replication servers over TCP port 1500.

Attach the AWSElasticDisasterRecoveryAgentInstallationPolicy managed policy to the IAM credentials used during agent installation.

Configure a Route 53 Active-Active routing policy to dynamically route the data replication traffic to the replication staging area.

Grant iam:PassRole permissions to the AWS Replication Agent on the source server instead of installing with IAM user credentials.

Enable inbound firewall rules on the source server to allow incoming traffic on TCP ports 443 and 1500 from AWS.

Cevabı ve açıklamayı göster

Cevap: Configure outbound network access from the source server to the AWS DRS API endpoints over TCP port 443 and to the replication servers over TCP port 1500.; Attach the AWSElasticDisasterRecoveryAgentInstallationPolicy managed policy to the IAM credentials used during agent installation.

Cevap

Configuring outbound network access from the source server to the AWS DRS API endpoints over TCP port 443 and to the replication servers over TCP port 1500, and attaching the AWSElasticDisasterRecoveryAgentInstallationPolicy managed policy to the IAM credentials used during agent installation.

The correct requirements are configuring outbound network access from the source server over TCP ports 443 (for API control plane) and 1500 (for replication data), and attaching the AWSElasticDisasterRecoveryAgentInstallationPolicy managed policy to the IAM credentials used during agent installation. These two options ensure the agent has both the network path and the security authorization to start replication.

Adım Adım Çözüm

Identify network requirements for AWS Elastic Disaster Recovery (AWS DRS) agent installation.

Determine that the source agent must initiate outbound connections on TCP port 443 to contact the AWS DRS control plane, and TCP port 1500 to stream replication data to replication servers in the staging subnet.

AWS DRS replication is outbound-only, removing the need to allow inbound ports from the internet on the source database or server.

Identify the IAM permissions required to register the replication agent.

The AWS Replication Agent installation script prompts for IAM credentials (Access Key ID and Secret Access Key) associated with a user that has the AWSElasticDisasterRecoveryAgentInstallationPolicy managed policy.

This policy grants the minimum permissions needed to register the agent and communicate with the AWS DRS service.

Anahtar Kavram

AWS Elastic Disaster Recovery (AWS DRS) Agent Installation and Replication Requirements

Soru 731Soru →

A SysOps Administrator is planning to update an AWS Elastic Beanstalk application. The update must be deployed with zero downtime, and the administrator must be able to roll back to the previous version immediately if any issues are detected. The old environment must remain active during the initial cutover. Which deployment strategy meets these requirements?

All-at-once deployment

Rolling deployment

Blue/Green deployment

Rolling with additional batch deployment

Cevabı ve açıklamayı göster

Cevap: Blue/Green deployment

Cevap

Blue/Green deployment

The blue/green deployment strategy involves launching a separate, identical environment running the new version of the application. Once the new environment is fully tested and ready, traffic is redirected from the old environment to the new environment (for example, by swapping CNAMEs in Elastic Beanstalk). This ensures zero downtime and permits an immediate rollback by redirecting traffic back to the original environment, which remains running and unaffected during the initial transition.

Adım Adım Çözüm

Analyze the deployment requirements of zero downtime, immediate rollback capability, and keeping the old environment active during the cutover.

Identified that in-place deployment strategies will overwrite existing instances, preventing immediate rollback and potentially causing downtime.

Understanding the core limitations of in-place deployments is necessary to eliminate unsuitable strategies.

Evaluate the Blue/Green deployment strategy against these requirements.

Confirmed that Blue/Green deployment creates a separate environment for the new version, keeping the old environment active, and allows swapping CNAMEs to redirect traffic.

This strategy satisfies the zero downtime requirement and allows for an instant rollback by swapping CNAMEs back if the new deployment fails.

Anahtar Kavram

Selecting the appropriate deployment strategy to meet specific downtime and rollback requirements.

Tahmini Süre:45s

Soru 732Soru →

A financial services firm runs a critical transaction processing application on AWS. The application tier consists of stateless Amazon EC2 instances in an Auto Scaling group, while the data tier uses an Amazon Aurora PostgreSQL database. Transaction receipts are stored in an Amazon S3 bucket. A SysOps Administrator must establish a cross-region disaster recovery (DR) strategy that achieves a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 1 minute. The strategy must also minimize baseline infrastructure costs. Which of the following architectures meets these requirements?

Configure an Amazon Aurora Global Database with the primary cluster in the active region and a secondary cluster in the recovery region. Enable versioning on both the source and recovery S3 buckets, and configure S3 Cross-Region Replication (CRR). Store AWS CloudFormation templates in the recovery region to provision the application tier with the Auto Scaling group capacity set to 0. Use Amazon Route 53 Application Recovery Controller (Route 53 ARC) routing controls to redirect traffic and programmatically scale up the Auto Scaling group during failover.

Configure daily cross-region copies of Amazon Aurora snapshots using AWS Backup. Enable versioning and configure S3 Cross-Region Replication (CRR) on the transaction receipts bucket. In the recovery region, maintain a pre-deployed Auto Scaling group with capacity set to 0. During a disaster, restore the Aurora database from the latest cross-region snapshot and update the Auto Scaling group capacity.

Configure Amazon S3 Cross-Region Replication (CRR) from the primary bucket to a new bucket in the recovery region without enabling versioning on the destination bucket. Create a cross-region Aurora Read Replica in the recovery region, and set up a Route 53 Failover routing policy pointing directly to the replica endpoint to automate database failover. Deploy the application tier via AWS CloudFormation with the Auto Scaling group capacity set to 0.

Configure an Amazon Aurora Global Database with a secondary cluster in the recovery region. Enable versioning on the source and recovery S3 buckets and configure S3 Cross-Region Replication. Deploy a fully scaled-out Auto Scaling group in the recovery region matching the primary region's capacity, and use a Route 53 Latency routing policy with health checks to route traffic in an active-active configuration.

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Aurora Global Database with the primary cluster in the active region and a secondary cluster in the recovery region. Enable versioning on both the source and recovery S3 buckets, and configure S3 Cross-Region Replication (CRR). Store AWS CloudFormation templates in the recovery region to provision the application tier with the Auto Scaling group capacity set to 0. Use Amazon Route 53 Application Recovery Controller (Route 53 ARC) routing controls to redirect traffic and programmatically scale up the Auto Scaling group during failover.

Cevap

The correct architecture uses a Pilot Light strategy. Amazon Aurora Global Database provides sub-second replication (meeting the 1-minute RPO) and can be promoted to a primary cluster in less than a minute. S3 Cross-Region Replication, which requires versioning on both source and destination buckets, replicates transaction receipts in near real-time. To minimize baseline costs, the application tier's Auto Scaling group is kept at 0 capacity in the recovery region, which can easily be scaled up within the 15-minute RTO during a failover event managed by Route 53 Application Recovery Controller.

Adım Adım Çözüm

Evaluate the RPO requirement of less than 1 minute.

Identify that data replication mechanisms must be near real-time. Amazon Aurora Global Database provides sub-second replication, and S3 Cross-Region Replication (CRR) replicates objects within seconds, both meeting the RPO.

Traditional backup restore methods using daily snapshots cannot achieve an RPO of less than 1 minute.

Evaluate the RTO requirement of less than 15 minutes while minimizing cost.

Determine that keeping the application tier at zero capacity (Auto Scaling group capacity set to 0) in the recovery region satisfies the cost-minimization constraint while allowing enough time (under 15 minutes) to scale up compute instances using CloudFormation during a disaster.

Maintaining active compute resources in the secondary region (Warm Standby or Multi-site) is unnecessary and increases baseline costs.

Verify prerequisites for the required services.

Confirm that S3 Cross-Region Replication requires versioning to be enabled on both the source and destination buckets, and that Aurora Global Databases support fast promotion to primary status.

Omitting versioning on either bucket prevents CRR from being configured, and standard Aurora replica promotion requires manual intervention or complex custom scripting compared to Global Database promotion.

Identify the routing mechanism for failover.

Use Route 53 Application Recovery Controller (ARC) routing controls to systematically fail over traffic to the recovery region.

Latency-based active-active routing is not suitable for a pilot light disaster recovery failover.

Anahtar Kavram

Disaster Recovery Strategies (Pilot Light)

Tahmini Süre:3m 0s

Soru 733Soru →

A company uses Amazon Route 53 to manage DNS for its web application. The primary routing record is an Alias record pointing to an Application Load Balancer (ALB), and the secondary record is an Alias record pointing to an Amazon S3 static website bucket, configured as an active-passive failover pair. During a scheduled disaster recovery drill, all EC2 instances behind the ALB are stopped. However, external clients continue to be routed to the ALB, resulting in HTTP 503 Service Unavailable errors, rather than being redirected to the S3 bucket. Which configuration adjustment will resolve this issue and enable automatic failover?

Configure the primary Alias record to evaluate target health.

Reduce the Time to Live (TTL) of the primary Alias record to 10 seconds.

Associate a Route 53 health check with the secondary Alias record pointing to the S3 bucket.

Create a CloudWatch alarm based on ALB ActiveConnectionCount metrics to trigger the failover routing.

Cevabı ve açıklamayı göster

Cevap: Configure the primary Alias record to evaluate target health.

Cevap

Configure the primary Alias record to evaluate target health.

The correct option is to configure the primary Alias record to evaluate target health. For Route 53 to automatically fail over when the backend targets of an Application Load Balancer (ALB) become unhealthy, the 'Evaluate Target Health' attribute must be set to 'Yes' on the primary Alias record. This setting enables Route 53 to query the load balancer's health checks to determine the status of the backend EC2 instances. If all instances are unhealthy, Route 53 marks the ALB as unhealthy and fails over to the backup S3 bucket.

Adım Adım Çözüm

Analyze the active-passive failover configuration of Route 53.

The primary record points to an ALB, and the secondary record points to an S3 bucket.

Identify how Route 53 determines the health status of each endpoint.

Determine why Route 53 did not fail over when all EC2 instances behind the ALB were stopped.

Because Route 53 does not check the health of the ALB's target group by default unless explicitly configured to do so.

If 'Evaluate Target Health' is set to 'No', Route 53 assumes the load balancer is always healthy, regardless of the state of the back-end EC2 instances.

Select the correct option that enables backend health propagation to Route 53.

Enabling 'Evaluate Target Health' on the primary Alias record resolves the issue.

This configuration allows Route 53 to check the health of the registered EC2 instances and perform the failover when all instances are unhealthy.

Anahtar Kavram

Route 53 DNS Failover and Target Health Evaluation

Soru 734Soru →

A SysOps Administrator is setting up Amazon S3 Cross-Region Replication (CRR) between a source bucket and a destination bucket. The administrator has configured the replication rule and the IAM role, but objects are not replicating to the destination bucket. Which of the following configuration steps must be performed to enable replication? (Select two.)

Geçerli olan tümünü seçin

Enable bucket versioning on the source S3 bucket.

Enable bucket versioning on the destination S3 bucket.

Suspend versioning on the destination bucket to optimize storage usage.

Configure replication with versioning suspended on both the source and destination buckets.

Grant the administrator's IAM policy the iam:AssumeRole permission instead of the iam:PassRole permission to pass the replication role to S3.

Cevabı ve açıklamayı göster

Cevap: Enable bucket versioning on the source S3 bucket.; Enable bucket versioning on the destination S3 bucket.

Cevap

Enable bucket versioning on both the source S3 bucket and the destination S3 bucket.

For Amazon S3 replication (either Cross-Region Replication or Same-Region Replication) to function, versioning must be enabled on both the source and destination S3 buckets. Enabling versioning ensures that every version of an object created in the source bucket can be uniquely identified and copied to the destination bucket.

Adım Adım Çözüm

Verify the prerequisite configuration requirements for Amazon S3 replication.

Confirm that bucket versioning is a mandatory requirement for both the source and destination buckets.

S3 replication relies on versioning to track and replicate object creation, updates, and deletion markers across buckets.

Enable versioning on the source S3 bucket.

Source bucket versioning state is set to enabled.

Allows S3 to generate unique version IDs for objects to be replicated.

Enable versioning on the destination S3 bucket.

Destination bucket versioning state is set to enabled.

Allows the destination bucket to receive replicated objects while maintaining their version history.

Anahtar Kavram

S3 Replication Requirements

Soru 735Soru →

A company hosts a legacy resource planning application in the us-west-2 Region. The application consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) and an Amazon RDS for MySQL DB instance. The company needs to establish a disaster recovery (DR) site in the us-east-1 Region. The DR plan requires a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 15 minutes. The configuration must minimize ongoing running costs in the secondary region. Which strategy should a SysOps administrator implement to meet these requirements?

Configure a cross-region read replica of the RDS DB instance in the us-east-1 Region. Deploy the ALB and the VPC infrastructure in the us-east-1 Region, and set the Auto Scaling group minimum and desired capacity to 0. During a DR event, promote the read replica to a standalone DB instance, scale up the Auto Scaling group, and update the Amazon Route 53 DNS failover record to point to the new ALB.

Configure Amazon RDS Multi-AZ replication to replicate the database synchronously between us-west-2 and us-east-1. Deploy an identical active Auto Scaling group and ALB in us-east-1. Rely on RDS Multi-AZ automatic failover to redirect database write traffic and automatically update the application configuration during a regional failure.

Configure a cross-region read replica of the RDS DB instance in us-east-1. Deploy the ALB and active EC2 instances in us-east-1. Set up Amazon Route 53 active-active failover routing without configuring Route 53 health checks on the primary us-west-2 record, relying instead on manual DNS modifications during a failure event.

Use AWS Backup to create daily snapshots of the database and EC2 instances, and replicate them to us-east-1 using Amazon S3 Cross-Region Replication (CRR) on the backup vaults, without enabling S3 versioning on either the source or destination S3 buckets. In a DR event, restore the database and EC2 instances from the snapshots in us-east-1.

Cevabı ve açıklamayı göster

Cevap: Configure a cross-region read replica of the RDS DB instance in the us-east-1 Region. Deploy the ALB and the VPC infrastructure in the us-east-1 Region, and set the Auto Scaling group minimum and desired capacity to 0. During a DR event, promote the read replica to a standalone DB instance, scale up the Auto Scaling group, and update the Amazon Route 53 DNS failover record to point to the new ALB.

Cevap

The correct answer represents a Pilot Light disaster recovery strategy. By keeping an Amazon RDS cross-region read replica in the standby region, the data is continuously and asynchronously replicated, meeting the RPO of less than 5 minutes. Having the infrastructure (VPC and ALB) ready but scaling the EC2 Auto Scaling group to 0 minimizes running costs. In the event of a disaster, promoting the read replica and scaling up the Auto Scaling group can be completed within the 15-minute RTO.

Adım Adım Çözüm

Evaluate the database replication strategy to meet the RPO of less than 5 minutes.

Identify that cross-region RDS MySQL read replicas replicate asynchronously and typically achieve lag times of seconds to minutes, well within the 5-minute RPO.

Backup-and-restore strategies from snapshots fail to meet the 5-minute RPO because daily snapshots could result in up to 24 hours of data loss.

Evaluate the application tier deployment strategy to meet the RTO of less than 15 minutes while minimizing cost.

Identify that a Pilot Light strategy (pre-provisioning the network and ALB, and keeping the Auto Scaling group capacity at 0) keeps costs minimal while allowing rapid scaling in minutes.

Warm standby or active-active configurations would run active EC2 instances continuously, increasing ongoing costs unnecessarily. A backup-and-restore from snapshot strategy takes too long to restore the database instance, exceeding the 15-minute RTO.

Determine the failover mechanism for database promotion and DNS routing.

Promote the RDS cross-region read replica to a primary standalone DB instance, scale the Auto Scaling group, and update Amazon Route 53 DNS records using failover routing with health checks.

Promoting a read replica changes it to read-write mode in minutes, and DNS failover redirects client traffic to the secondary ALB.

Anahtar Kavram

Disaster Recovery Strategies (Pilot Light vs. Backup/Restore/Warm Standby) on AWS

Soru 736Soru →

A SysOps Administrator is configuring Amazon S3 Cross-Region Replication (CRR) between a source bucket and a destination bucket. The replication configuration is successfully applied, but the objects are not replicating. Upon investigation, the administrator discovers that S3 Versioning is enabled on the source bucket but is suspended on the destination bucket. Which action will resolve this issue?

Configure the replication rule to automatically enable versioning on the destination bucket.

Enable S3 Versioning on the destination bucket.

Grant the iam:PassRole permission to the destination S3 bucket within the replication IAM role's policy.

Associate the source bucket's subnet route tables with an S3 Gateway VPC Endpoint to allow replication traffic.

Cevabı ve açıklamayı göster

Cevap: Enable S3 Versioning on the destination bucket.

Cevap

Enable S3 Versioning on the destination bucket.

For Amazon S3 replication to work, versioning must be enabled on both the source and destination buckets. Since the destination bucket has versioning suspended, enabling versioning on it immediately satisfies the requirement and allows the replication process to succeed.

Adım Adım Çözüm

Identify S3 replication prerequisites.

Determine that S3 Versioning must be active on both the source and destination buckets.

S3 replication relies on versioning to track individual object changes and ensure consistent replication state.

Inspect the status of the destination bucket configuration.

Confirm that S3 Versioning is suspended on the destination bucket.

Identify the root cause of the replication failure.

Enable S3 Versioning on the destination bucket.

Replication initiates successfully for new objects.

Enabling versioning on the destination bucket satisfies the replication policy validation requirements.

Anahtar Kavram

Amazon S3 replication requires S3 Versioning to be enabled on both the source and destination buckets.

Tahmini Süre:45s

Soru 737Soru →

A SysOps administrator is managing an Amazon EC2 Auto Scaling group (ASG) that uses a step scaling policy to scale out when average CPU utilization exceeds $70\%$ . During unexpected traffic spikes, the ASG launches new instances, but it continues to launch more instances every $2$ minutes before the previously launched instances have finished bootstrapping and begun processing traffic. This behavior causes the group to scale out beyond the required capacity, leading to unnecessary costs. Which action will prevent the ASG from launching additional instances while the newly launched instances are still bootstrapping?

Increase the estimated instance warmup time for the step scaling policy.

Increase the default cooldown period in the Auto Scaling group configuration.

Enable detailed monitoring for the EC2 instances within the launch template.

Configure an Amazon EventBridge rule to trigger a Systems Manager Automation document that pauses scaling processes.

Cevabı ve açıklamayı göster

Cevap: Increase the estimated instance warmup time for the step scaling policy.

Cevap

Increase the estimated instance warmup time for the step scaling policy.

Increasing the estimated instance warmup time ensures that newly launched instances are given sufficient time to complete bootstrapping and start handling traffic before their metrics are included in the Auto Scaling group's aggregate metrics. During this warmup period, the step scaling policy will not initiate further scale-out actions, preventing the group from over-provisioning resources during a spike.

Adım Adım Çözüm

Identify the type of scaling policy in use by the Auto Scaling group.

The ASG is configured with a step scaling policy.

Different scaling policies use different mechanisms to handle the period immediately following an instance launch.

Determine how the step scaling policy handles new instance initialization.

Step scaling policies rely on the estimated instance warmup parameter, during which newly launched instances do not contribute to the ASG's aggregated metrics, and further scale-out events are paused.

Without a sufficient warmup period, the high average CPU utilization of existing instances will trigger subsequent scaling events before the new instances can start serving traffic.

Contrast the warmup parameter with the default cooldown period.

The default cooldown period only applies to simple scaling policies, meaning modifying it will not affect the step scaling policy's behavior.

This avoids misconfiguring the ASG by changing settings that have no effect on the current policy type.

Anahtar Kavram

Instance warmup in dynamic scaling policies

Soru 738Soru →

An operations team needs to update an application hosted on AWS Elastic Beanstalk. The update must be performed with zero downtime, and the application must maintain its full instance capacity throughout the deployment process. Which two Elastic Beanstalk deployment policies should be selected to meet these requirements?

Geçerli olan tümünü seçin

Immutable

Rolling with additional batch

All at once

Rolling

Linear

Cevabı ve açıklamayı göster

Cevap: Immutable; Rolling with additional batch

Cevap

The correct options are Immutable and Rolling with additional batch.

To achieve zero downtime and maintain full instance capacity during an update in AWS Elastic Beanstalk, you must use policies that provision extra capacity before taking any running instances offline. The Immutable policy does this by launching a new temporary Auto Scaling group with the new version, while the Rolling with additional batch policy launches a new batch of instances first to offset the capacity loss before updating the existing instances.

Adım Adım Çözüm

Analyze the capacity and downtime constraints.

The deployment must have zero downtime and maintain 100% instance capacity.

To ensure no service degradation during the update.

Evaluate the deployment policies of AWS Elastic Beanstalk.

The Immutable policy creates a new Auto Scaling group to maintain full capacity, while the Rolling with additional batch policy launches new instances first before updating existing ones.

To identify which policies satisfy both constraints.

Anahtar Kavram

AWS Elastic Beanstalk deployment policies and their impact on environment capacity and application availability.

Soru 739Soru →

An administrator is configuring a rolling update deployment for an Amazon Elastic Container Service (Amazon ECS) service that has a desired task count of $4$ . The deployment must guarantee that the service capacity does not drop below $4$ healthy tasks at any time, but it can scale up to $8$ tasks during the update process. Which deployment configuration parameters should the administrator specify to meet these requirements?

Minimum healthy percent:

50\%

, Maximum percent:

150\%

Minimum healthy percent:

100\%

, Maximum percent:

100\%

Minimum healthy percent:

100\%

, Maximum percent:

200\%

Minimum healthy percent:

0\%

, Maximum percent:

100\%

Cevabı ve açıklamayı göster

Cevap: Minimum healthy percent: $100\%$ , Maximum percent: $200\%$

Cevap

Minimum healthy percent:

100\%

, Maximum percent:

200\%

Specifying a minimum healthy percent of

100\%

ensures that the service maintains all

4

tasks (

100\%

of the desired count) at all times. Setting the maximum percent to

200\%

permits the deployment to provision up to

8

tasks (

200\%

of the desired count) temporarily. This allows the new task definitions to run alongside the old ones and pass health checks before the old tasks are drained and terminated.

Adım Adım Çözüm

Determine the required minimum healthy percent configuration.

Minimum healthy percent must be set to

100\%

Since the desired task count is

4

, and the capacity must not drop below

4

healthy tasks during the update, the ratio of healthy tasks to desired tasks is

\frac{4}{4} = 100\%

Determine the required maximum percent configuration.

Maximum percent must be set to

200\%

Since the service is allowed to scale up to

8

tasks during the update, the ratio of maximum allowed tasks to desired tasks is

\frac{8}{4} = 200\%

Combine the parameters to define the deployment configuration.

The final parameters are a minimum healthy percent of

100\%

and a maximum percent of

200\%

This specific combination ensures that the new task versions are deployed and verified as healthy before the old task versions are stopped, resulting in a zero-downtime rolling update.

Anahtar Kavram

Amazon ECS rolling update deployment configuration utilizing minimum healthy percent and maximum percent parameters.

Soru 740Soru →

A SysOps Administrator is using the AWS CLI to configure VPC Flow Logs to monitor rejected network traffic at the subnet level. The administrator wants to deliver the flow logs to an Amazon CloudWatch Logs log group. To comply with company security policies, the administrator must ensure that the role used to deliver the logs operates with least privilege. Additionally, to manage costs, the logs must be retained for only 90 days.

Which TWO actions must the administrator take to complete this configuration and meet these requirements?

Geçerli olan tümünü seçin

Modify the retention settings of the destination CloudWatch Logs log group to expire log events after 90 days.

Grant the administrator's IAM user the sts:AssumeRole permission on the flow logs delivery role rather than the iam:PassRole permission when creating the flow log.

Leave the CloudWatch Logs log group retention period at its default setting, relying on the native flow log delivery configuration to manage object lifecycles.

Configure an Amazon EventBridge rule that triggers an AWS Systems Manager Automation document to delete log streams older than 90 days from the log group.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume it, and attach a policy granting logs:CreateLogStream and logs:PutLogEvents permissions for the destination log group.; Modify the retention settings of the destination CloudWatch Logs log group to expire log events after 90 days.

Cevap

Create an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume it, and attach a policy granting logs:CreateLogStream and logs:PutLogEvents permissions for the destination log group; and modify the retention settings of the destination CloudWatch Logs log group to expire log events after 90 days.

To configure VPC Flow Logs to deliver to CloudWatch Logs, the service requires an IAM role with a trust policy allowing vpc-flow-logs.amazonaws.com to assume it, along with a permissions policy to write to the destination log group. In addition, CloudWatch Logs log groups have a default retention of 'Never expire', so the retention period must be explicitly updated to 90 days to meet the storage requirements and manage costs.

Adım Adım Çözüm

Configure the IAM delivery role for VPC Flow Logs.

An IAM role with the correct trust relationship (vpc-flow-logs.amazonaws.com) and policy permissions (logs:CreateLogStream, logs:PutLogEvents) is created, allowing VPC Flow Logs to write to CloudWatch.

This establishes the necessary trust and access permissions for the flow logs service to deliver network telemetry data to the destination log group.

Set the log retention policy in CloudWatch Logs.

The destination log group's retention configuration is updated from 'Never expire' to 90 days.

This limits log storage to the required 90-day window, preventing unnecessary storage costs.

Anahtar Kavram

VPC Flow Logs require an IAM role to publish to CloudWatch Logs, and CloudWatch Logs retention must be configured to manage log expiration.

Tahmini Süre:2m 0s

ÖncekiSayfa 37 / 49Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram