Examkin

Tüm alıştırma soruları

976 soru

Tüm türler976Çoktan seçmeli502Çoklu seçim450Sıralama24
Soru 921Soru →

A company's security policy requires automatic rotation of database credentials stored in AWS Secrets Manager. A SysOps administrator writes a custom AWS Lambda function to perform the rotation logic. When trying to enable rotation for the database secret, the AWS Management Console displays an error indicating that the Secrets Manager service does not have permission to execute the rotation Lambda function. How should the administrator resolve this error to successfully enable rotation?

Cevabı ve açıklamayı göster

Cevap: Add a permission statement to the Lambda function's policy to allow the secretsmanager.amazonaws.com principal to invoke the function

Cevap

Add a permission statement to the Lambda function's policy to allow the secretsmanager.amazonaws.com principal to invoke the function
AWS Secrets Manager requires permission to invoke the AWS Lambda rotation function. This service-to-service invocation permission must be granted via a resource-based policy on the Lambda function itself, specifying secretsmanager.amazonaws.com as the principal and lambda:InvokeFunction as the action.

Adım Adım Çözüm

1
Analyze the error message showing that Secrets Manager lacks permission to execute the Lambda function.
Identify that the configuration blocker is a service-to-service invocation boundary.
Before Secrets Manager can run rotation logic, it must be authorized to call the Lambda API endpoint.
2
Determine the appropriate policy type to grant service principal invocation access to a Lambda function.
Confirm that a Lambda resource-based policy (also known as a function policy) must be used.
Resource-based policies define which principals (in this case, the secretsmanager.amazonaws.com service principal) are allowed to invoke the target resource.
3
Apply the permission using the AWS CLI or AWS Console.
Add the lambda:InvokeFunction permission with the secretsmanager.amazonaws.com principal.
This allows Secrets Manager to successfully trigger the rotation function and enables the console setup to complete.

Anahtar Kavram

Resource-based policies for AWS Lambda rotation functions in AWS Secrets Manager
Tahmini Süre:1m 30s
Soru 922Soru →

A SysOps Administrator is configuring an Amazon EC2 Auto Scaling group to launch instances with encrypted Amazon EBS volumes. The EBS volumes must be encrypted using a customer managed AWS KMS key in the same account (123456789012123456789012).

The administrator creates a custom IAM policy that grants the Auto Scaling service-linked role (`AWSServiceRoleForAutoScaling`) permission to perform `kms:Encrypt`, `kms:Decrypt`, `kms:ReEncrypt*`, `kms:GenerateDataKey*`, `kms:DescribeKey`, and `kms:CreateGrant` actions on the KMS key. This policy is successfully attached to the service-linked role.

The KMS key has the following key policy:

{
"Version": "2012-10-17",
"Id": "key-policy-ebs",
"Statement": [
{
"Sid": "Allow administration of the key",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/SysOpsAdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "Allow cryptographic operations",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/ApplicationServerRole"
},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
}
]
}

When the Auto Scaling group attempts to scale out, the new instances fail to launch, and the activity history indicates a failure to use the KMS key.

Which of the following modifications will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Add a statement to the KMS key policy that grants the AWS account's root principal (arn:aws:iam::123456789012:root) permissions for all KMS actions (kms:*).

Cevap

Add a statement to the KMS key policy that grants the AWS account's root principal (arn:aws:iam::123456789012:root) permissions for all KMS actions (kms:*).
To allow IAM policies to control access to a customer managed KMS key, the key policy must delegate authorization to the AWS account. This is accomplished by adding a policy statement that allows the root principal (`arn:aws:iam::123456789012:root`) to perform `kms:*` actions on the key. Once this root delegation statement is present in the key policy, IAM policies (such as the custom policy attached to the service-linked role) can successfully grant permissions to use the key.

Adım Adım Çözüm

1
Analyze the failed service configuration and error context.
The EC2 Auto Scaling group fails to launch instances with EBS encryption, showing a KMS authorization failure despite the service-linked role having appropriate IAM permissions.
Identify the actors involved and verify if permissions are correctly set in both IAM policies and Key policies.
2
Inspect the KMS key policy for IAM delegation.
The KMS key policy contains specific statements for administrative and cryptographic roles but does not contain the default root principal delegation statement (`arn:aws:iam::123456789012:root`).
KMS key policies are the primary authorization mechanism. Without explicit delegation to the root principal, IAM policies cannot grant access to the key.
3
Determine the required policy modification to allow the service-linked role access.
Add a statement allowing the root principal (`arn:aws:iam::123456789012:root`) to perform `kms:*` actions. This enables IAM authorization evaluation.
By delegating key access control to the account root, the IAM policy attached to the service-linked role is evaluated, authorizing the role's KMS operations.

Anahtar Kavram

AWS KMS Key Policy Precedence and IAM Policy Delegation
Soru 923Soru →

A SysOps administrator has configured automatic rotation for a database secret in AWS Secrets Manager. The secret stores credentials for an Amazon RDS for PostgreSQL DB instance that is located in a private subnet. During testing, the automatic rotation fails, and the administrator observes that the credentials are not being updated on the database. Which of the following configuration changes should the SysOps administrator make to resolve this failure? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Lambda rotation function to run within the VPC with access to the private subnets where the database is located.; Grant permission to the Secrets Manager service principal to invoke the Lambda function using a Lambda resource policy.

Cevap

To resolve the automatic rotation failure for the private database secret, the administrator must configure the Lambda rotation function to run inside the VPC with access to the private subnets, and grant the Secrets Manager service principal permission to invoke the Lambda function via a Lambda resource policy.
The correct actions are configuring the Lambda rotation function to run within the VPC and granting the Secrets Manager service principal permission to invoke the Lambda function. Because the database is private, the Lambda function must have network access via the VPC. Additionally, Secrets Manager requires permission to invoke the Lambda function, which is configured on the Lambda resource policy.

Adım Adım Çözüm

1
Analyze network connectivity requirements between the rotation Lambda function and the private Amazon RDS database.
The Lambda function needs to be configured with the appropriate VPC, subnets, and security groups to establish a network path to the database.
Since the database is in a private subnet, the Lambda function must also reside in the VPC to reach it.
2
Review the service permissions required for AWS Secrets Manager to trigger the rotation process.
Identify that the Lambda function's resource policy must allow lambda:InvokeFunction from the secretsmanager.amazonaws.com principal.
Without this policy, Secrets Manager cannot invoke the Lambda function to execute rotation.
3
Verify and rule out incorrect options involving default KMS key policy modifications and PassRole requirements.
Default AWS managed KMS key policies cannot be changed, and iam:PassRole is not used for Secrets Manager rotation invocation.
Ensures that administrative actions align with AWS security bounds and permission models.

Anahtar Kavram

AWS Secrets Manager database credential rotation in a VPC requires proper network path configuration and Lambda invocation permissions.
Soru 924Soru →

A digital media platform distributes content globally via an Amazon CloudFront distribution. A SysOps administrator must defend the platform against application-layer DDoS attacks using AWS WAF. A partner organization crawls the platform for metadata updates from a known set of static IP addresses.

The administrator must implement a rate limit of 20002{}000 requests per 5 minutes for all incoming client connections, while ensuring the partner's crawler is not affected by this limit and remains subject to all other security rules in the Web ACL. Additionally, the administrator must minimize the storage costs and ingestion fees of WAF logs in Amazon S3 by only recording traffic that is blocked by the Web ACL.

Which two actions must the administrator take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IP set containing the partner's IP addresses. In the rate-based rule configuration, set the scope of inspection to evaluate only requests that do not match the IP set.; Enable WAF logging with Amazon Kinesis Data Firehose as the destination. Configure WAF log filtering with a rule action of Keep when the terminating rule action is Block.

Cevap

To meet the requirements, the administrator should create an IP set containing the partner's IP addresses and set the scope of inspection in the rate-based rule configuration to evaluate only requests that do not match the IP set. Additionally, WAF logging should be enabled with Amazon Kinesis Data Firehose as the destination, and WAF log filtering should be configured with a Keep action when the terminating rule action is Block.
To exclude the partner's static IPs from the rate limit without bypassing other Web ACL rules, the administrator must configure a scope-down statement within the rate-based rule to only evaluate requests that do not match the partner's IP set. To reduce costs, the administrator should enable WAF logging to Kinesis Data Firehose and configure log filtering to only 'Keep' logs where the terminating rule action is Block, dropping all allowed request logs at the source.

Adım Adım Çözüm

1
Exempt the partner's traffic from the rate-limiting rule without exempting them from other security rules.
Create an IP Set with the partner's IP addresses and apply a scope-down statement containing a logical NOT condition in the rate-based rule configuration.
Since WAF evaluates rules sequentially and an Allow rule terminates evaluation, a scope-down statement inside the rate-based rule itself is required to exclude the partner's IP set while keeping their traffic subject to other rules in the Web ACL.
2
Configure WAF logging to filter allowed traffic and only capture blocked traffic.
Enable WAF logging to Amazon Kinesis Data Firehose and configure WAF log filtering with a rule action of Keep when the terminating rule action is Block.
This filters and drops logs at the source, preventing unnecessary data from being ingested by Kinesis Firehose and written to S3, reducing both ingestion and storage costs.

Anahtar Kavram

AWS WAF Scope-Down Statements and Log Filtering
Soru 925Soru →

A SysOps administrator is setting up an Amazon Data Firehose delivery stream to send application logs to an Amazon S3 bucket. The administrator creates an IAM role named FirehoseDeliveryRole to grant Firehose write access to the S3 bucket. However, when attempting to create the delivery stream using the AWS CLI, the administrator receives an Access Denied error.

Which of the following actions are required to resolve this issue and successfully create the delivery stream? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a policy to the administrator's IAM user that allows the iam:PassRole action on the FirehoseDeliveryRole resource.; Modify the trust policy of FirehoseDeliveryRole to allow the service principal firehose.amazonaws.com to perform the sts:AssumeRole action.

Cevap

The correct options are: adding a policy to the administrator's IAM user that allows the iam:PassRole action on the FirehoseDeliveryRole resource, and modifying the trust policy of FirehoseDeliveryRole to allow the service principal firehose.amazonaws.com to perform the sts:AssumeRole action.
The correct configuration requires two parts. First, the administrator must have permission to associate the IAM role with the AWS service. This is controlled by granting the administrator's IAM user the iam:PassRole permission on the specific IAM role (FirehoseDeliveryRole). Second, the IAM role itself must trust the service that is going to assume it. This is done by modifying the trust policy of the role to allow the service principal firehose.amazonaws.com to perform the sts:AssumeRole action. Together, these two steps allow the administrator to pass the role and the Firehose service to assume it.

Adım Adım Çözüm

1
Analyze the roles and permissions required when an administrator delegates an IAM role to an AWS service.
Identify that the administrator needs iam:PassRole to pass the execution role to the service, and the service needs a trust policy on the role to perform sts:AssumeRole.
This establishes the dual permissions model required for service role delegation in AWS.
2
Evaluate the administrator's user policy permissions.
Confirm that the user needs the iam:PassRole permission targeting the FirehoseDeliveryRole ARN.
Without this, AWS prevents the user from passing the role to the Amazon Data Firehose service.
3
Evaluate the FirehoseDeliveryRole trust policy.
Ensure that the trust policy allows firehose.amazonaws.com to assume the role.
Without a valid trust relationship, the service cannot assume the role to write logs to S3, even if the user has pass role permissions.

Anahtar Kavram

Delegating permissions to AWS services requires the user to have iam:PassRole permissions on the role, and the role's trust policy must allow the service principal to perform sts:AssumeRole.
Soru 926Soru →

An administrator is troubleshooting a failed stack update in AWS CloudFormation. The stack has entered the UPDATE_ROLLBACK_FAILED state. The update failed due to a misconfiguration in an Amazon EC2 launch template, and the subsequent rollback failed because the IAM service role originally associated with the stack was accidentally deleted.

Which combination of actions must the administrator take to successfully roll back the stack to a stable state? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Ensure the administrator's IAM identity is granted the iam:PassRole permission for the IAM service role to be used for the rollback.; Execute the continue-update-rollback command, specifying the ARN of the IAM service role.

Cevap

The administrator must ensure their IAM identity is granted the iam:PassRole permission for the service role and execute the continue-update-rollback command specifying the ARN of that service role.
The correct options are: granting the administrator the iam:PassRole permission and executing the continue-update-rollback command with the role ARN. When a service role associated with a stack is deleted, any attempt to roll back will fail because CloudFormation cannot assume the role. The administrator can resolve this by providing a new or recreated role during the continue-update-rollback command. To do this, the administrator's identity must possess the iam:PassRole permission for the new role so CloudFormation can assume it.

Adım Adım Çözüm

1
Verify and configure permissions for the administrator.
The administrator's IAM user or role is granted the iam:PassRole permission for the target IAM service role.
Before passing any IAM role to an AWS service like CloudFormation, the caller must have the iam:PassRole permission to ensure security delegation boundaries.
2
Ensure the target IAM service role exists with the required permissions.
A valid service role is available with the necessary policies to delete, update, or revert the EC2 launch template resources in the stack.
CloudFormation must assume this role to modify the physical resources in AWS during the rollback process.
3
Run the resume operation using the CLI or Console.
The rollback is resumed using the continue-update-rollback command, specifying the --role-arn parameter pointing to the valid service role.
Specifying the role ARN allows CloudFormation to use the new/recreated role instead of the deleted one to complete the rollback.

Anahtar Kavram

Remediating CloudFormation stacks in the UPDATE_ROLLBACK_FAILED state by specifying an alternative or recreated service role.
Soru 927Soru →

A SysOps Administrator is using AWS Systems Manager Run Command to execute the `AWS-RunPatchBaseline` document on a group of Amazon EC2 instances. All instances are powered on, and the SSM Agent is installed and running on each instance. Each instance has an IAM instance profile attached with the `AmazonSSMManagedInstanceCore` policy. The command targets instances using the tag key `PatchGroup` and value `Production`. The command executes successfully on several instances, but other instances with this intended configuration are neither updated nor shown in the Run Command target list.

Which two conditions could explain why these instances were not targeted?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The instances are in a private subnet with no internet route, and the VPC lacks the required VPC interface endpoints (ssm, ssmmessages, and ec2messages) for Systems Manager.; The resource tags on the affected instances use different character casing (such as `patchgroup` or `production`), and Systems Manager tag-based targeting is case-sensitive.

Cevap

The correct reasons are that the instances are in a private subnet with no internet route and the VPC lacks the required VPC interface endpoints for Systems Manager, and that the resource tags on the affected instances use different character casing as tag-based targeting is case-sensitive.
For EC2 instances to be targetable by Systems Manager Run Command, they must be registered as managed instances, which requires the SSM Agent to communicate with the Systems Manager service. If instances are in a private subnet with no route to the internet, VPC interface endpoints for ssm, ssmmessages, and ec2messages must be configured for the SSM Agent to connect. Additionally, tag-based targeting in Systems Manager is case-sensitive, meaning a tag mismatch in casing (such as lowercase keys or values) will prevent the instances from being targeted.

Adım Adım Çözüm

1
Verify SSM managed instance status in Fleet Manager.
Identify that the affected instances are not listed as managed instances in Systems Manager.
Run Command can only target instances that are successfully registered as managed instances.
2
Check tag casing on the affected instances.
Ensure that the tag key and value match 'PatchGroup' and 'Production' exactly, respecting case sensitivity.
Systems Manager tag filters are case-sensitive, so any casing discrepancy prevents targeting.
3
Verify network connectivity from the private subnet to AWS Systems Manager endpoints.
Ensure that the VPC has interface endpoints (ssm, ssmmessages, ec2messages) configured and associated with the private subnet's route tables.
SSM Agent requires outbound connectivity on port 443 to register the instance as a managed instance.

Anahtar Kavram

AWS Systems Manager Run Command targeting requires instances to be managed instances (with network connectivity to SSM endpoints) and matches resource tags using case-sensitive comparison.
Soru 928Soru →

A SysOps Administrator is using AWS Systems Manager Run Command to execute the `AWS-RunPatchBaseline` document on a fleet of Amazon EC2 instances. The SSM Agent is running on all target instances, and the `AmazonSSMManagedInstanceCore` IAM policy is attached to their instance profiles. The administrator has created a custom patch baseline for production instances and associated it with a patch group named `Production`. However, during execution, the administrator discovers that the production instances are being patched using the default patch baseline instead of the custom production patch baseline. Which of the following is the most likely cause of this behavior?

Cevabı ve açıklamayı göster

Cevap: The target instances do not have a resource tag with the key `Patch Group` and the value `Production` to associate them with the custom baseline.

Cevap

The target instances do not have a resource tag with the key 'Patch Group' and the value 'Production' to associate them with the custom baseline.
The correct answer is correct because AWS Systems Manager Patch Manager determines which patch baseline to apply to an instance based on the presence of a resource tag with the key 'Patch Group' and the corresponding patch group value. If the tag is missing, mismatched, or case-incorrect, the instance defaults to the default patch baseline.

Adım Adım Çözüm

1
Identify the mechanism Systems Manager uses to map instances to custom baselines.
Systems Manager uses the 'Patch Group' resource tag on the EC2 instances.
To determine which baseline to apply, Patch Manager matches the 'Patch Group' tag value on the instance with the patch group registered to the baseline.
2
Analyze the symptom of the failure.
The instances are patched successfully but use the default patch baseline instead of the custom production one.
This indicates that Systems Manager could communicate with the instances and execute the document, but fell back to the default baseline because it could not match the instances to a registered patch group.
3
Deduce the configuration gap.
The instances lack the correct resource tag (key: 'Patch Group', value: 'Production').
Without this tag, the custom baseline association is ignored, and the default baseline is applied.

Anahtar Kavram

AWS Systems Manager Patch Manager utilizes case-sensitive resource tags (specifically with the key 'Patch Group') on managed instances to map them to registered patch baselines. If an instance lacks the designated patch group tag, it falls back to the default patch baseline.
Soru 929Soru →

A SysOps Administrator is configuring connectivity between an application server hosted on an Amazon EC2 instance in Subnet A (10.50.1.0/2410.50.1.0/24) and an Oracle database instance in Subnet B (10.50.2.0/2410.50.2.0/24) inside the same VPC. The database listens on TCP port 15211521. Security groups are already configured correctly to allow this traffic.

Subnet A is associated with NACL-A, which has the following custom rules:
* Inbound: Allow TCP port 15211521 from Subnet B (10.50.2.0/2410.50.2.0/24)
* Outbound: Allow TCP port 15211521 to Subnet B (10.50.2.0/2410.50.2.0/24)

Subnet B is associated with NACL-B, which has the following custom rules:
* Inbound: Allow TCP port 15211521 from Subnet A (10.50.1.0/2410.50.1.0/24)
* Outbound: Allow TCP port 15211521 to Subnet A (10.50.1.0/2410.50.1.0/24)

All other traffic in both NACLs is denied. The application server is unable to connect to the database.

Which of the following actions should the SysOps Administrator take to resolve this connectivity issue?

Cevabı ve açıklamayı göster

Cevap: Add an inbound rule to NACL-A allowing inbound TCP traffic on ports 1024−655351024-65535 from Subnet B, and add an outbound rule to NACL-B allowing outbound TCP traffic on ports 1024−655351024-65535 to Subnet A.

Cevap

Add an inbound rule to NACL-A allowing inbound TCP traffic on ports 1024−655351024-65535 from Subnet B, and add an outbound rule to NACL-B allowing outbound TCP traffic on ports 1024−655351024-65535 to Subnet A.
The correct option adds the necessary ephemeral port rules to the stateless NACLs. Since Network Access Control Lists (NACLs) are stateless, they do not track connection state, meaning separate rules are required to allow both request and response traffic. The application server initiates the connection on TCP port 15211521 using an ephemeral source port (range 1024−655351024-65535). While the request path is fully allowed by current rules, the response path (from the database to the application server's ephemeral port) is blocked. To allow this return traffic, NACL-B must allow outbound TCP traffic on ports 1024−655351024-65535 to Subnet A, and NACL-A must allow inbound TCP traffic on ports 1024−655351024-65535 from Subnet B.

Adım Adım Çözüm

1
Analyze the connection flow from the initiator (Application Server in Subnet A) to the receiver (Database in Subnet B).
The application server initiates a TCP request. The destination IP is the database IP, destination port is 15211521. The source IP is the application server IP, and the source port is a dynamically allocated ephemeral port from the range 1024−655351024-65535.
This establishes the source and destination port parameters for both the outbound request and the return response.
2
Evaluate the NACL rules for the request path.
NACL-A allows outbound TCP port 15211521 to Subnet B. NACL-B allows inbound TCP port 15211521 from Subnet A. The request path is successfully permitted.
Ensure that the initial connection request is not blocked by either NACL.
3
Evaluate the NACL rules for the return path.
The return traffic from the database (Subnet B) to the application server (Subnet A) has a source port of 15211521 and a destination port in the ephemeral range 1024−655351024-65535. NACL-B outbound only allows destination port 15211521, and NACL-A inbound only allows destination port 15211521.
NACLs are stateless, meaning return traffic must be explicitly allowed on the destination ports.
4
Determine the necessary rules to permit the return path.
NACL-B must allow outbound TCP traffic to Subnet A on destination ports 1024−655351024-65535. NACL-A must allow inbound TCP traffic from Subnet B on destination ports 1024−655351024-65535.
This allows the response packet to reach the application server, completing the TCP handshake.

Anahtar Kavram

Network Access Control Lists (NACLs) are stateless packet filters, meaning return traffic must be explicitly allowed. For client-initiated connections, return traffic is sent to ephemeral ports (1024−655351024-65535).
Soru 930Soru →

A company has deployed a fleet of backend processing instances in a private subnet (192.168.2.0/24192.168.2.0/24) that must query an external license validation API at 198.51.100.85/32198.51.100.85/32 over HTTPS. The outbound traffic is routed through a NAT Gateway in the public subnet (192.168.1.0/24192.168.1.0/24). The Network Access Control List (NACL) associated with the private subnet currently has default deny rules for custom traffic. Which two changes are required in the private subnet's NACL to enable successful end-to-end communication with the license validation server?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An outbound rule to allow TCP port 443443 traffic destined for the external validation server IP address.; An inbound rule to allow TCP traffic from the external validation server IP address on ephemeral ports 10241024 to 6553565535.

Cevap

The changes required are: adding an outbound rule to allow TCP port 443 traffic to the external validation server, and adding an inbound rule to allow TCP traffic from the external validation server on ephemeral ports.
Because Network Access Control Lists (NACLs) are stateless, both the request (outbound TCP port 443) and response (inbound TCP ephemeral ports 1024-65535) must be explicitly allowed. Since the backend instances initiate the HTTPS connection to the external validation server, the outbound path requires a rule allowing TCP port 443 traffic to the destination. For the return traffic, the external server will respond from its port 443 to the ephemeral ports allocated by the client instances in the private subnet. Therefore, the inbound path requires a rule allowing TCP traffic from the validation server's IP address to the ephemeral port range (1024 to 65535) of the private subnet.

Adım Adım Çözüm

1
Analyze the traffic flow requirements.
The private instances initiate an outbound connection to the external validation server over HTTPS (port 443).
To determine which ports and directions are involved in the request phase.
2
Identify the stateless behavior of Network Access Control Lists (NACLs).
Both outbound request traffic and inbound response traffic must be explicitly allowed.
Unlike stateful Security Groups, NACLs do not automatically track connection state.
3
Determine the port configuration for the return traffic.
The response traffic from the external server will target the ephemeral port range of the client instances (1024 to 65535).
To ensure the inbound NACL rule allows the response traffic back to the originating instances.

Anahtar Kavram

The stateless nature of Network Access Control Lists (NACLs) requires rules for both request and response paths, including allowing inbound traffic on ephemeral ports for outbound connections.
Soru 931Soru →

A SysOps Administrator is managing a multi-region application deployed on Amazon EC2 instances in both the `us-east-1` and `us-west-2` Regions. The application uses client-side encryption to protect configuration payloads before writing them to Amazon DynamoDB. To support this, the administrator created an AWS KMS Multi-Region primary customer managed key in `us-east-1` and replicated it to `us-west-2`.

The EC2 instances in `us-west-2` run under an IAM role with an IAM policy that allows `kms:Decrypt` on all resources (`"Resource": "*"`). However, when the application in `us-west-2` attempts to decrypt payloads that were encrypted in `us-east-1`, it receives an `AccessDeniedException` from AWS KMS.

Which of the following actions must the Administrator take to resolve this issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the key policy of the replica key in `us-west-2` to explicitly grant `kms:Decrypt` permissions to the EC2 instance IAM role.; Configure the application in `us-west-2` to target the regional AWS KMS endpoint in `us-west-2` and reference the replica key's ARN in `us-west-2`.

Cevap

Modify the key policy of the replica key in the target Region to grant decrypt permissions to the EC2 IAM role, and configure the application in that Region to use the local replica key ARN at the local regional KMS endpoint.
The correct options address the independent nature of AWS KMS Multi-Region key resources. The option directing the administrator to modify the key policy of the replica key in the local region is necessary because key policies are managed independently, and the default policy might not permit local IAM role access without explicit trust. The option to configure the application to target the regional AWS KMS endpoint using the replica key's ARN ensures the decryption operation happens locally and utilizes the authorized replica key, avoiding cross-region calls that may fail due to key policy restrictions on the primary key.

Adım Adım Çözüm

1
Analyze the resource boundaries for AWS KMS Multi-Region keys.
Identify that while primary and replica keys share the same key ID and key material, they are separate AWS resources with distinct ARNs and independent key policies.
This determines that permission changes on the primary key policy do not automatically apply to the replica key policy.
2
Evaluate the key policy of the replica key in the target Region (`us-west-2`).
Update the replica key's policy to either explicitly trust the IAM role of the EC2 instances or allow IAM policy delegation from the root account.
AWS KMS requires that the key policy itself grants or delegates permission; IAM policies alone cannot grant access to a KMS key without key policy authorization.
3
Align the application's KMS API calls with the local Region.
Configure the application to make local decryption calls to the `us-west-2` KMS endpoint using the `us-west-2` replica key ARN.
This avoids cross-region network calls and resolves access issues related to the primary key's policy or regional endpoint connectivity.

Anahtar Kavram

AWS KMS Multi-Region keys share the same key material but are distinct resources with independent key policies that must be managed and authorized separately in each Region.
Soru 932Soru →

A SysOps Administrator needs to execute an AWS Systems Manager Run Command document on a fleet of Amazon EC2 instances. The administrator wants to store the execution command output in an Amazon S3 bucket and ensure the log files are encrypted using a customer managed AWS KMS key.

Arrange the configuration steps in the correct order to set up secure command execution logging.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

To set up secure execution logging, first create the S3 bucket. Second, configure the KMS key policy to allow the EC2 role access. Third, attach an IAM policy to the EC2 instance profile granting s3:PutObject and kms:GenerateDataKey permissions. Finally, execute the Run Command, specifying the S3 bucket and KMS key ID.
Secure Run Command logging requires setting up the target S3 bucket and KMS key, granting the EC2 instance profile permissions to write to S3 and use the KMS key, and then executing the command with these parameters.

Adım Adım Çözüm

1
Create S3 bucket.
S3 bucket is created.
Establishes the storage location for the logs.
2
Configure KMS key policy.
KMS key policy allows the EC2 role access.
Allows the EC2 instance role to perform cryptographic operations.
3
Attach IAM policy to the EC2 instance profile.
EC2 instance has permissions to write to S3 and use the KMS key.
Gives the agent running on the EC2 instance the credentials to write the logs and encrypt them.
4
Run the command with S3 and KMS options.
Command execution logs are securely stored in S3.
Initiates the task and directs the output to the secure repository.

Anahtar Kavram

Systems Manager Run Command S3 logging with KMS encryption
Soru 933Soru →

A SysOps Administrator is updating an AWS CloudFormation stack that manages an Auto Scaling Group. The update introduces a new Launch Template that references a new IAM instance profile. The update fails during execution, and CloudFormation attempts to roll back. However, the stack transitions to the UPDATE_ROLLBACK_FAILED state. The administrator reviews the stack events and discovers that CloudFormation does not have permission to associate the previous IAM instance profile with the Auto Scaling Group. Which action should the SysOps Administrator take to resolve this issue and successfully complete the rollback of the stack?

Cevabı ve açıklamayı göster

Cevap: Update the CloudFormation service role to include the iam:PassRole permission for the previous IAM instance profile, and then perform the Continue Update Rollback operation on the stack.

Cevap

Update the CloudFormation service role to include the iam:PassRole permission for the previous IAM instance profile, and then perform the Continue Update Rollback operation on the stack.
The correct action is to add the iam:PassRole permission to the CloudFormation execution role to allow it to pass the previous IAM instance profile's role to the Auto Scaling launch template. Once this permission is in place, the administrator must run Continue Update Rollback to resume the rollback process.

Adım Adım Çözüm

1
Analyze the stack status and events.
Identify that the stack is in the UPDATE_ROLLBACK_FAILED state due to missing permissions to configure the previous IAM instance profile.
CloudFormation requires authorization to pass existing or new IAM roles to AWS services during updates and rollbacks.
2
Modify the CloudFormation execution/service role policy.
Grant the iam:PassRole permission targeting the ARN of the previous IAM instance profile's role.
This enables CloudFormation to successfully associate the IAM role/profile with the Launch Template during rollback.
3
Invoke the Continue Update Rollback operation.
CloudFormation resumes and completes the rollback process, returning the stack to a stable UPDATE_ROLLBACK_COMPLETE state.
This is the required action to recover a stack from the UPDATE_ROLLBACK_FAILED state once the blocker is resolved.

Anahtar Kavram

Recovering from CloudFormation UPDATE_ROLLBACK_FAILED using Continue Update Rollback and configuring iam:PassRole permissions.
Tahmini Süre:1m 30s
Soru 934Soru →

A SysOps administrator is configuring security protections for an AWS AppSync GraphQL API using AWS WAF. The administrator needs to protect the API from HTTP flood attacks from single client IP addresses, while ensuring that legitimate users are not blocked. The administrator also needs to log all blocked requests for security analysis, but must minimize Amazon CloudWatch Logs ingestion costs by excluding allowed requests from the logs.

Which two actions should the administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a rate-based rule in the Web ACL with a custom rate limit and set the rule action to Block.; Enable AWS WAF logging to Amazon CloudWatch Logs and configure a logging filter with a condition that matches the Block rule action.

Cevap

Create a rate-based rule in the Web ACL with a custom rate limit set to Block, and configure AWS WAF logging to CloudWatch Logs with a logging filter matching the Block action.
To protect the AWS AppSync GraphQL API from HTTP flood attacks from single client IP addresses, the administrator should create a rate-based rule in the Web ACL with the action set to Block. This dynamically blocks requests from any IP address that exceeds the defined threshold within a 5-minute window. To minimize CloudWatch Logs ingestion costs, the administrator should enable WAF logging and configure a logging filter. The logging filter can be set with a condition that matches the Block rule action, which ensures that only blocked requests are written to the log group while allowed requests are dropped prior to ingestion.

Adım Adım Çözüm

1
Add a rate-based rule to the Web ACL protecting the AWS AppSync API.
Requests from any single IP address that exceed the rate threshold are automatically blocked.
This protects the GraphQL API from HTTP flood attacks at the application layer.
2
Enable WAF logging and direct the logs to an Amazon CloudWatch Logs log group.
Log destination is configured, allowing access to logging filters.
This prepares the environment for custom logging criteria.
3
Configure a logging filter on the WAF Web ACL to match only requests with the Block action.
Only blocked requests are written to the log group, and allowed requests are filtered out before ingestion.
This minimizes logging costs by avoiding ingestion of logs for allowed web requests.

Anahtar Kavram

Implementing rate-based rules and optimizing logging costs via AWS WAF logging filters for application resources like AWS AppSync.
Soru 935Soru →

A company runs a fleet of EC2 instances within an isolated network environment. A SysOps Administrator attempts to run a maintenance script using AWS Systems Manager Run Command, targeting the instances manually. The SSM Agent is confirmed to be running on all target instances, and each instance has an IAM role with the AmazonSSMManagedInstanceCore policy attached. Despite these configurations, the Run Command execution fails immediately, and the instances are reported as "Offline" or "Inactive" in the Systems Manager console. Which configuration change will resolve this issue and allow the Run Command to execute?

Cevabı ve açıklamayı göster

Cevap: Configure VPC interface endpoints (AWS PrivateLink) for Systems Manager, Systems Manager Messages, and EC2 Messages within the instance's VPC.

Cevap

Configure VPC interface endpoints (AWS PrivateLink) for Systems Manager, Systems Manager Messages, and EC2 Messages within the instance's VPC.
For EC2 instances in an isolated network environment to communicate with AWS Systems Manager, they must be able to reach the Systems Manager endpoints. Since there is no internet path (like a NAT Gateway), this requires configuring Interface VPC Endpoints (AWS PrivateLink) for Systems Manager (ssm), Systems Manager Messages (ssmmessages), and EC2 Messages (ec2messages) inside the VPC. Once these endpoints are created, the SSM Agent can register and the instances will appear online.

Adım Adım Çözüm

1
Analyze the network configuration of the instances.
The instances are in an isolated network with no route to the internet, which means they cannot reach public AWS Systems Manager endpoints.
The SSM Agent requires outbound network connectivity to the Systems Manager service endpoints to receive commands.
2
Determine the correct private connection mechanism for Systems Manager.
Systems Manager requires interface VPC endpoints (powered by AWS PrivateLink) for ssm, ssmmessages, and ec2messages to allow communication from within a private VPC.
Gateway VPC endpoints are only supported for S3 and DynamoDB; all other services utilize interface VPC endpoints.
3
Verify and apply the interface endpoints.
Creating these interface endpoints in the VPC enables private DNS resolution and allows the SSM Agent to register successfully as online.
This establishes private, secure connectivity to the Systems Manager control plane without requiring an internet gateway or NAT gateway.

Anahtar Kavram

Systems Manager Network Connectivity Prerequisites for Private Subnets
Tahmini Süre:1m 30s
Soru 936Soru →

A SysOps administrator is configuring an administration workflow where an automation tool running on an Amazon EC2 instance in Account A needs to launch new EC2 instances in the same account and attach a pre-configured IAM role named "WebServerRole" to them. The EC2 instance hosting the automation tool currently has permissions to perform the ec2:RunInstances action. However, when the automation tool attempts to launch a new instance with the "WebServerRole" attached, it receives an authorization error. Which of the following actions should the SysOps administrator take to resolve this issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to the automation tool's IAM role that grants the iam:PassRole permission for the WebServerRole resource.; Configure the trust policy of the WebServerRole to allow the ec2.amazonaws.com service principal to perform the sts:AssumeRole action.

Cevap

To resolve the issue, the administrator must grant the automation tool's IAM role permission to perform the iam:PassRole action on the WebServerRole, and configure the WebServerRole's trust policy to allow the ec2.amazonaws.com service principal to perform the sts:AssumeRole action.
To successfully launch an EC2 instance with an IAM role attached, the caller must have the permission to pass the role to the service, and the service must have the trust relationship to assume the role. The correct actions are granting the caller's IAM role permission to perform the iam:PassRole action on the target role, and configuring the target role's trust policy to allow the ec2.amazonaws.com service principal to assume it.

Adım Adım Çözüm

1
Determine the role-passing requirements for the launching entity.
The automation tool's IAM role must be granted the iam:PassRole permission targeting the WebServerRole ARN.
AWS requires that any identity associating an IAM role with an AWS service must have explicit permission to pass that role to prevent unauthorized privilege escalation.
2
Determine the trust relationship requirements for the target role.
The WebServerRole's trust policy must allow the ec2.amazonaws.com service principal to perform sts:AssumeRole.
When the instance launches, the Amazon EC2 service must be allowed to assume the associated role to fetch temporary credentials.

Anahtar Kavram

Successful service role delegation requires that the calling identity has iam:PassRole permissions on the target role, and the target role's trust policy allows the service principal to perform sts:AssumeRole.
Soru 937Soru →

An administrator is managing an AWS CloudFormation stack that contains an Amazon RDS DB instance. A stack update fails because of an invalid parameter value, and the stack enters the UPDATE_ROLLBACK_FAILED state. Upon inspecting the stack events, the administrator discovers that a dependency resource was manually deleted outside of CloudFormation during the update, preventing the DB instance from rolling back to its previous configuration. Which two actions should the administrator take to successfully return the stack to a working state and reconcile the resource configurations? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Perform the Continue Update Rollback action and select the database resource to be skipped.; Manually update the actual resource configuration to match the expected template state after the rollback completes.

Cevap

Perform the Continue Update Rollback action, select the database resource to be skipped, and then manually update the actual resource configuration to match the expected template state after the rollback completes.
To resolve an UPDATE_ROLLBACK_FAILED state, the administrator must invoke the Continue Update Rollback action. By specifying the database resource to be skipped, CloudFormation can bypass the blocked resource and successfully roll back the rest of the stack. Once the stack reaches UPDATE_ROLLBACK_COMPLETE, the skipped resource must be manually updated to align with the template configuration.

Adım Adım Çözüm

1
Identify the resource causing the rollback failure from the CloudFormation event logs.
The Amazon RDS DB instance is identified as the resource failing to roll back because its subnet/dependency was deleted.
Before resolving the rollback failure, the administrator must determine which resource is blocked.
2
Execute the Continue Update Rollback operation in the CloudFormation console or via the AWS CLI, specifying the blocked RDS resource to be skipped.
CloudFormation skips the rollback for the specified resource and successfully rolls back all other resources, transitioning the stack to the UPDATE_ROLLBACK_COMPLETE state.
Skipping the failing resource is the only way to move the stack out of the UPDATE_ROLLBACK_FAILED state without deleting the stack.
3
Manually recreate or update the skipped resource to match the template configuration, or update the template to match the resource's current state.
The resource and template configurations are reconciled, resolving the drift state.
Resources skipped during rollback remain out of sync with the CloudFormation template and must be reconciled manually.

Anahtar Kavram

Recovering from UPDATE_ROLLBACK_FAILED requires running ContinueUpdateRollback and optionally skipping the blocked resources. The skipped resources must then be reconciled manually to resolve any resulting drift.
Soru 938Soru →

A SysOps Administrator is configuring an AWS Systems Manager Automation workflow to execute a custom script via Run Command on a fleet of Amazon EC2 instances targeted by instance tags. The instances are running, have the SSM Agent installed, and have the AmazonSSMManagedInstanceCore policy attached to their IAM instance profile. The administrator attempts to run the Automation using a custom IAM service role, but the execution fails immediately with an authorization error. Which actions must the administrator take to successfully execute the Automation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the Automation service role.; Configure the trust relationship of the Automation service role to allow the ssm.amazonaws.com service principal to assume the role.

Cevap

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the Automation service role, and configure the trust relationship of the Automation service role to allow the ssm.amazonaws.com service principal to assume the role.
To execute a Systems Manager Automation workflow using a custom service role, the executing administrator must have the iam:PassRole permission for that service role to delegate execution rights. Additionally, the service role itself must trust the Systems Manager service principal (ssm.amazonaws.com) to allow the service to assume the role and execute the tasks.

Adım Adım Çözüm

1
Verify the trust policy of the custom IAM service role to ensure it allows the Systems Manager service principal (ssm.amazonaws.com) to assume it.
The Systems Manager Automation service is authorized to act on behalf of the user.
Systems Manager requires delegation authority to assume the role and execute the workflow.
2
Add the iam:PassRole permission to the administrator's IAM policy, specifying the ARN of the custom service role as the resource.
The administrator can successfully pass the service role to Systems Manager when launching the Automation.
The iam:PassRole permission is required for any user or role that passes an IAM role to an AWS service.

Anahtar Kavram

Delegating permissions to AWS Systems Manager Automation using service roles and the iam:PassRole permission.
Soru 939Soru →

An organization hosts a self-hosted Git repository server on an Amazon EC2 instance in Subnet B (10.10.2.0/2410.10.2.0/24). Developer workspaces run on Amazon EC2 instances in Subnet A (10.10.1.0/2410.10.1.0/24). A SysOps Administrator configures custom Network Access Control Lists (NACLs) to allow developers in Subnet A to clone repositories from Subnet B over SSH (TCP port 2222).

The custom NACL for Subnet A has the following rule configuration:
- Outbound Rule 100100: Allow TCP port 2222 to destination 10.10.2.0/2410.10.2.0/24

The custom NACL for Subnet B has the following rule configuration:
- Inbound Rule 100100: Allow TCP port 2222 from source 10.10.1.0/2410.10.1.0/24
- Outbound Rule 100100: Allow TCP ports 1024−655351024-65535 to destination 10.10.1.0/2410.10.1.0/24

Developers report that they cannot connect to the Git repository server. Which rule addition will resolve this network connection issue?

Cevabı ve açıklamayı göster

Cevap: Add an inbound rule to Subnet A's NACL allowing TCP ports 1024−655351024-65535 from source 10.10.2.0/2410.10.2.0/24

Cevap

Add an inbound rule to Subnet A's NACL allowing TCP ports 1024-65535 from source 10.10.2.0/24
Because Network Access Control Lists (NACLs) are stateless, a rule must be explicitly created to allow return traffic. When a client in Subnet A establishes an SSH connection (TCP port 22) to a server in Subnet B, the client allocates an ephemeral port (typically in the range 1024-65535) for the source port of the connection. The server responds from its port 22 back to the client's ephemeral port. Therefore, Subnet A's NACL must allow inbound traffic on TCP ports 1024-65535 from the Subnet B source CIDR.

Adım Adım Çözüm

1
Analyze the traffic flow direction and port numbers for the SSH connection.
The client in Subnet A initiates the connection to Subnet B on port 22, allocating a random ephemeral port (1024-65535) as the source port.
Understanding TCP client-server port allocations is necessary to configure stateless firewalls.
2
Evaluate the existing NACL rules for Subnet A and Subnet B.
Subnet A allows outbound port 22. Subnet B allows inbound port 22 and outbound ephemeral ports. Subnet A's inbound path for response packets (from Subnet B port 22 to Subnet A ephemeral ports) is blocked by the default deny rule.
Since NACLs are stateless, return traffic must be explicitly permitted in both directions.
3
Determine the missing rule to allow the return traffic.
Subnet A requires an inbound rule to permit TCP traffic on ports 1024-65535 from source CIDR 10.10.2.0/24.
This completes the return path of the connection at the Subnet A boundary.

Anahtar Kavram

Stateless Network Access Control Lists (NACLs) require explicit rules for both the request and the return traffic paths, including the allocation of client ephemeral ports.
Soru 940Soru →

A SysOps administrator is using an IAM user account to deploy an AWS Lambda function that processes messages from an Amazon SQS queue. The administrator has already created a custom IAM execution role named LambdaSQSProcessorRole with all necessary permissions for the function. However, when the administrator attempts to create the Lambda function and associate it with this role, the operation fails with an AccessDenied error. Which of the following actions will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to the administrator's IAM user that allows the iam:PassRole action on the LambdaSQSProcessorRole resource.

Cevap

Attach an IAM policy to the administrator's IAM user that allows the iam:PassRole action on the LambdaSQSProcessorRole resource.
The correct action is to attach an IAM policy to the administrator's IAM user that allows the iam:PassRole action. In AWS, when an IAM user or role configures a service to run under a specific execution role, they must have the iam:PassRole permission on that target role resource. Without this, the service cannot receive the role, resulting in an AccessDenied error.

Adım Adım Çözüm

1
Analyze the error context.
The SysOps administrator's IAM user is attempting to pass a service execution role (LambdaSQSProcessorRole) to the AWS Lambda service during function creation, but encounters an AccessDenied error.
When configuring an AWS service to run with a specific role, the configuration identity must have permission to pass that role to the service.
2
Identify the required IAM action.
The action required is 'iam:PassRole' on the specific role ARN.
This permission ensures that only authorized users can assign high-privilege roles to AWS services.
3
Select the correct option.
The correct action is to attach a policy to the administrator's IAM user allowing 'iam:PassRole' on the 'LambdaSQSProcessorRole' resource.
This directly resolves the AccessDenied error by granting the required permission to the administrator's user identity.

Anahtar Kavram

IAM PassRole Permission
ÖncekiSayfa 47 / 49Sonraki