Tüm alıştırma soruları

A SysOps Administrator needs to create an Amazon CloudWatch dashboard to monitor a production Amazon EKS cluster. The dashboard must include a widget that dynamically lists the top 10 EKS pods consuming the most memory. CloudWatch Container Insights is already enabled for the cluster. Which combination of actions must the SysOps Administrator perform to configure this dashboard widget? (Select TWO.)

A healthcare application uses an Amazon RDS for MySQL DB instance in a Single-AZ deployment. The database suffers from high CPU utilization due to a mix of transactional writes and read-intensive reporting queries. A SysOps Administrator must configure the database architecture to support automatic failover in the event of an Availability Zone outage and isolate the reporting workload from the transactional write operations. Which deployment strategy will satisfy these requirements?

A SysOps administrator is setting up automated remediation for security groups that allow unrestricted inbound SSH traffic. An AWS Config rule detects non-compliant security groups and publishes compliance change events. The administrator configures an Amazon EventBridge rule to match these compliance changes and target the `AWS-DisablePublicAccessForSecurityGroup` Systems Manager Automation document. During testing, the AWS Config rule successfully marks a security group as non-compliant, but the Systems Manager Automation execution is not initiated. Which configuration change will resolve this issue?

An organization wants to automatically remediate Amazon SQS queues that are created without server-side encryption (SSE). An AWS Config rule evaluates the queues and generates compliance change events. A SysOps administrator wants to use Amazon EventBridge to detect these compliance changes and trigger the AWS-provided AWS-EnableSQSQueueEncryption Systems Manager Automation document to encrypt the non-compliant queues.

Which two configuration actions must the administrator perform to successfully set up this automated remediation pipeline? (Select TWO.)

A company operates a dynamic application environment that exhibits highly variable and un-forecastable daily resource utilization. A SysOps administrator must implement a cost-monitoring solution capable of identifying sudden, unexpected cost anomalies in near-real-time. When an anomaly is detected with a cost impact exceeding a specific threshold, the solution must automatically execute an AWS Systems Manager (SSM) Automation runbook to stop the offending resources. Which solution should the SysOps administrator implement to meet these requirements?

A company requires all Amazon S3 buckets to have default encryption enabled. A SysOps administrator has configured an AWS Config rule named s3-bucket-default-encryption-enabled to detect non-compliant buckets. The administrator wants to use Amazon EventBridge and AWS Systems Manager Automation to automatically enable server-side encryption on non-compliant buckets. Which of the following actions must the administrator perform to configure this remediation pipeline? (Select TWO.)

A SysOps Administrator is setting up Amazon S3 Same-Region Replication (SRR) between a source bucket and a destination bucket in the same AWS account. The administrator enables versioning on the source bucket, creates an IAM role with the necessary S3 permissions, and defines the replication configuration. When the administrator runs the AWS CLI command `aws s3api put-bucket-replication` to apply the configuration, the command fails with an error. Which of the following is the most likely cause of this failure?

A SysOps administrator is using Amazon S3 Batch Operations to copy a large volume of objects from a source S3 bucket to a destination S3 bucket. The administrator creates an IAM role named S3BatchCopyRole to allow S3 Batch Operations to perform the copy on their behalf. The trust policy of S3BatchCopyRole is configured to allow the batchoperations.s3.amazonaws.com service principal to assume the role. However, when the administrator attempts to create the S3 Batch Operations job and specifies S3BatchCopyRole, the operation fails with an Access Denied error. The administrator's IAM user already has an attached policy granting full permissions to S3 (s3:*). Which action must be taken to successfully create the S3 Batch Operations job?

A SysOps Administrator is implementing a security monitoring solution to detect whenever an AWS Identity and Access Management (IAM) access key is created or updated. The administrator configures an Amazon EventBridge rule in the eu-west-1 region with an Amazon Simple Notification Service (Amazon SNS) topic as the target. Although IAM access keys are being created and updated, the security team is not receiving any SNS notifications. Which of the following configurations should the SysOps Administrator implement to resolve this issue? (Select TWO.)

A SysOps Administrator is configuring an AWS Organizations trail in the management account (111111111111) to log API activity across all member accounts in the organization (o-exampleorgid). The logs must be stored in an Amazon S3 bucket named `my-organization-logs-bucket` in a dedicated log archive account (222222222222). The logs must also be encrypted at rest using a customer managed AWS KMS key located in the log archive account.

After creating the trail, the Administrator notices that logs are not being delivered to the S3 bucket, and CloudTrail reports a log delivery failure due to access denied errors.

Which two actions should the SysOps Administrator take to resolve this issue? (Select TWO.)

A SysOps Administrator is configuring a monitoring solution for an application that writes JSON-formatted log events to an Amazon CloudWatch Logs log group. A sample log event is shown below:

{
"eventType": "database_query",
"latency_ms": 120,
"statusCode": 500,
"clientIp": "192.0.2.1"
}

The administrator wants to track query performance by extracting the `latency_ms` value as a custom metric. If the `latency_ms` field is missing from a database query log event, the metric must record a default value of $5000$ ms. The administrator only wants to parse events where the `eventType` is equal to `"database_query"`.

Which combination of configurations must the administrator apply to meet these requirements? (Select TWO.)

A company hosts a processing application on Amazon EC2 instances in an Auto Scaling group (ASG). A SysOps administrator configures a step scaling policy based on a custom CloudWatch metric named QueueBacklog, which is published by the application every 60 seconds. During sudden load spikes, the administrator notices that although the metric exceeds the alarm threshold almost immediately, the ASG takes 5 minutes before launching new instances.

What is the most likely cause of this delay in scaling?

A company's security policy requires that all Amazon RDS DB instances must remain private. A SysOps administrator is configuring automated remediation to detect any RDS DB instance modified to be publicly accessible and immediately revert it to private. The administrator has created a custom AWS Systems Manager (SSM) Automation runbook that modifies the DB instance's public accessibility parameter to false. The administrator has also created an IAM role named RemediationExecutionRole that has permissions to modify RDS DB instances.

To establish this automated remediation workflow using Amazon EventBridge and Systems Manager, which two configuration steps must the administrator perform? (Select TWO.)

A company runs a latency-sensitive application on a fleet of Amazon EC2 instances. A SysOps Administrator is tasked with configuring a CloudWatch alarm to detect when the CPUUtilization metric exceeds $85\%$ for $3$ consecutive $1\text{-minute}$ evaluation periods. If the threshold is breached, the administrator must configure a notification to be sent to an Amazon SNS topic. Currently, the instances are reporting metrics at the default interval.

Which configurations are required to meet these requirements? (Select TWO.)

An organization hosts a web application behind an Application Load Balancer (ALB). The instances are registered to a target group listening on port 80. The ALB health check is configured to check the path `/healthz`. During a recent deployment, the application configuration was updated, and now the load balancer reports all target instances as unhealthy, resulting in HTTP 503 Service Unavailable errors. A review of the web server logs on the instances shows that requests to `/healthz` return a status code of HTTP 302 (Found) and redirect to `/home`. Which action is the most direct way to resolve this issue and return the instances to a healthy state?

A SysOps administrator has the following IAM policy attached to their IAM user:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EC2LaunchPermissions",
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:AssociateIamInstanceProfile"
],
"Resource": "*"
}
]
}

The administrator attempts to launch an Amazon EC2 instance and associate it with an existing IAM role named `WebServerRole` by running the following AWS CLI command:

`aws ec2 run-instances --image-id ami-0c55b159cbfafe1f0 --instance-type t3.micro --iam-instance-profile Name=WebServerProfile`

The command fails with the following error message:
`An error occurred (UnauthorizedOperation) when calling the RunInstances operation: User: arn:aws:iam::123456789012:user/AdminUser is not authorized to perform: iam:PassRole on resource: arn:aws:iam::123456789012:role/WebServerRole`

What modification should the administrator make to their user's IAM policy to successfully run the command?

An enterprise monitoring system runs on an Amazon EC2 instance in Subnet Management ($10.50.10.0/24$). It needs to scrape metrics from a Node Exporter service running on EC2 instances in Subnet Production ($10.50.20.0/24$) on custom TCP port $9100$. Subnet Production is associated with a custom Network Access Control List (NACL) that currently blocks all inbound and outbound traffic by default.

Which combination of rules must be added to the Subnet Production NACL to allow the monitoring server to scrape metrics? (Select TWO.)

A SysOps administrator is configuring an Amazon ECS task to run on an Amazon EC2 instance. The task must read data from an Amazon S3 bucket. The administrator creates an IAM role named ECSTaskS3AccessRole with an attached policy that allows S3 read access.

The trust policy for ECSTaskS3AccessRole is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

When the administrator attempts to run the task using the AWS CLI under the SysOpsAdmin IAM user identity, the command fails with the following error:
`ClientError: An error occurred (AccessDenied) when calling the RunTask operation: User: arn:aws:iam::123456789012:user/SysOpsAdmin is not authorized to perform: iam:PassRole on resource: arn:aws:iam::123456789012:role/ECSTaskS3AccessRole`

Which of the following actions are required to resolve this error and ensure the ECS task can successfully run with the required permissions? (Select TWO.)

A SysOps Administrator runs drift detection on an AWS CloudFormation stack that manages a production environment. The drift detection report indicates that an Amazon RDS DB instance is in the DRIFTED state because a developer manually updated the DB instance class and changed the backup retention period directly in the Amazon RDS console.

Which two actions should the Administrator take to resolve this resource drift and bring the stack and the DB instance back into alignment?

An organization hosts a web application behind Application Load Balancers (ALBs) deployed in two AWS Regions: `us-west-2` and `eu-central-1`. A SysOps administrator must configure Amazon Route 53 to route traffic for the apex domain (`example.com`) to satisfy these requirements:

* All users located in Europe must be routed to the ALB in `eu-central-1` to comply with regional data privacy laws.
* Users outside of Europe must be routed to the ALB that provides the lowest network latency.
* The solution must support routing at the zone apex and minimize client-side DNS lookup overhead.

Which configuration should the SysOps administrator implement to meet these requirements?