Examkin

Tüm alıştırma soruları

976 soru

Tüm türler976Çoktan seçmeli502Çoklu seçim450Sıralama24
Soru 81Soru →

A health-tech company hosts its patient record access portal on the apex domain (`patientportal.com`). The company must comply with strict data residency regulations: all web traffic originating from the European Union (EU) must be directed to an Application Load Balancer (ALB) deployed in the `eu-west-1` Region, while all other global traffic must be routed to a separate ALB deployed in the `us-east-1` Region. A SysOps administrator is configuring Amazon Route 53 to implement this routing logic.

Which two Route 53 record configurations must the administrator implement to meet these compliance requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Alias record for the apex domain (`patientportal.com`) pointing to the `eu-west-1` ALB, using a Geolocation routing policy with the location set to Europe.; Create an Alias record for the apex domain (`patientportal.com`) pointing to the `us-east-1` ALB, using a Geolocation routing policy with the location set to Default.

Cevap

Create an Alias record for the apex domain pointing to the `eu-west-1` ALB with a Geolocation routing policy set to Europe, and create another Alias record for the apex domain pointing to the `us-east-1` ALB with a Geolocation routing policy set to Default.
To route traffic for the zone apex (`patientportal.com`), only Alias records can be used. DNS standards do not permit CNAME records at the zone apex because they would conflict with the mandatory SOA and NS records. To satisfy geolocation routing requirements, one record must explicitly map the Europe location to the `eu-west-1` ALB. A second record must map the Default location to the `us-east-1` ALB. The Default location is required because Route 53 does not automatically fallback to another record if a geolocation query comes from an unmapped region (e.g., Asia or South America). Without the Default record, queries from these unmapped regions would fail to resolve.

Adım Adım Çözüm

1
Identify DNS constraints at the zone apex.
Determine that CNAME records cannot coexist with SOA and NS records at the zone apex (`patientportal.com`), meaning only Alias records are valid.
DNS standard protocols forbid CNAME records at the zone apex. Route 53 Alias records resolve this by dynamically resolving to the target AWS resources.
2
Define the geolocation routing rule for the compliance-restricted region (EU).
Configure a Geolocation routing policy pointing to the `eu-west-1` ALB with the location set to Europe.
This guarantees that users within the EU are directed to the regional ALB to fulfill data residency compliance.
3
Configure a fallback rule for all other global locations.
Configure a Geolocation routing policy pointing to the `us-east-1` ALB with the location set to Default.
Without a Default record, any DNS queries coming from non-EU locations not explicitly mapped (e.g., Asia or South America) will receive a DNS resolution failure.

Anahtar Kavram

Amazon Route 53 Geolocation routing policy and zone apex record restrictions
Soru 82Soru →

A company hosts an API on Amazon EC2 instances behind an Application Load Balancer (ALB), which is protected by an AWS WAF Web ACL. A SysOps administrator notices that legitimate API clients receive HTTP 403 Forbidden responses when uploading payload files larger than 64 KB64\text{ KB}. The AWS WAF logs indicate that these requests are blocked by a custom rule designed to inspect the request body for SQL injection (SQLi) attacks. The administrator needs to ensure that clients can upload large payloads while maintaining SQLi threat protection on the inspectable portion of the request body. Which configuration change should the administrator implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Modify the custom SQLi rule and set the request body oversize handling setting to Continue.

Cevap

Modify the custom SQLi rule and set the request body oversize handling setting to Continue.
Setting the request body oversize handling to 'Continue' allows AWS WAF to inspect the request up to the maximum inspectable size (which is 64 KB64\text{ KB} for Application Load Balancers) and evaluate it against the rule. The rest of the payload is ignored by this specific rule, but the request itself is not automatically blocked, allowing legitimate large uploads to proceed.

Adım Adım Çözüm

1
Analyze the AWS WAF logs to identify why requests exceeding 64 KB64\text{ KB} are blocked.
The logs confirm the custom SQL injection (SQLi) rule is blocking the requests because the body size exceeds the WAF inspection limit for Application Load Balancers.
Before making changes, the administrator must verify which specific rule and limit are triggering the block.
2
Locate the custom SQLi rule in the Web ACL configuration and evaluate its oversize handling setting.
The rule's oversize handling is set to Match or Block, causing any request exceeding the 64 KB64\text{ KB} body limit to be treated as a match and blocked.
By default, if oversize handling is not set to Continue, WAF will block requests that exceed the inspectable size limit when the rule action is set to Block.
3
Update the oversize handling configuration of the custom SQLi rule to Continue.
AWS WAF will now inspect the first 64 KB64\text{ KB} of the request body for SQLi threats and allow the request to proceed without evaluating the remainder of the payload.
This configuration meets the requirement to allow large uploads while maintaining security inspection on the first part of the payload.

Anahtar Kavram

AWS WAF Body Inspection Limits and Oversize Handling
Tahmini Süre:1m 30s
Soru 83Soru →

A SysOps Administrator is setting up automated patching for a fleet of Windows Server EC2 instances using AWS Systems Manager Patch Manager. The instances are divided into 'Staging' and 'Production' environments, and each group must be patched on different schedules using Systems Manager Maintenance Windows. The administrator has created two custom patch baselines. Which combination of steps is required to successfully implement this configuration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Tag the EC2 instances with the case-sensitive key 'Patch Group' and a value representing their environment, and then associate the patch group names with the custom patch baselines in Systems Manager.; Configure an IAM policy for the administrator with the 'iam:PassRole' action allowed on the Maintenance Window service role to permit task registration and execution.

Cevap

To successfully implement this configuration, the administrator must tag the EC2 instances with the case-sensitive key 'Patch Group' and a value representing their environment, and configure an IAM policy for the administrator with the 'iam:PassRole' action allowed on the Maintenance Window service role.
Applying the exact case-sensitive tag key 'Patch Group' to the instances allows Systems Manager to identify and map them to their registered custom patch baselines. Additionally, the administrator must possess the 'iam:PassRole' permission to successfully register the execution task with the Maintenance Window service role, which authorizes Systems Manager to run the patch document on the target instances.

Adım Adım Çözüm

1
Tag the target EC2 instances.
Apply the tag with Key='Patch Group' and Value='Staging' or Value='Production' to the respective instances.
Systems Manager Patch Manager requires the exact case-sensitive tag key 'Patch Group' to associate instances with patch groups.
2
Associate patch groups with patch baselines.
Register the 'Staging' and 'Production' patch groups with their corresponding custom patch baselines in the Systems Manager console.
This mapping ensures that the appropriate custom patch baseline is selected during the patching run.
3
Configure iam:PassRole permissions.
Ensure the administrator's IAM policy permits the 'iam:PassRole' action on the Maintenance Window service role.
This permission is necessary for the administrator to register the task in the Maintenance Window and allow Systems Manager to assume the role on their behalf.

Anahtar Kavram

AWS Systems Manager Patch Manager configuration requires mapping instances to baselines using the case-sensitive 'Patch Group' tag key, and registering Maintenance Window tasks requires iam:PassRole permissions.
Soru 84Soru →

A company hosting its main corporate portal at the zone apex (corporateportal.com) needs to implement an active-passive disaster recovery strategy. The primary infrastructure is fronted by an Application Load Balancer (ALB) in the us-east-1 Region, and the secondary disaster recovery site is fronted by an ALB in the us-west-2 Region. The DNS configuration must ensure that user traffic is automatically directed to the standby site only when the primary ALB or its registered targets become unhealthy. Which configuration should a SysOps Administrator implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create primary and secondary Alias records for the zone apex (corporateportal.com) using the Failover routing policy. Point the primary record to the us-east-1 ALB and the secondary record to the us-west-2 ALB. Set "Evaluate Target Health" to Yes for both records.

Cevap

Create primary and secondary Alias records for the zone apex (corporateportal.com) using the Failover routing policy, pointing to the respective ALBs, with "Evaluate Target Health" set to Yes for both records.
Creating Alias records at the zone apex with a Failover routing policy and enabling 'Evaluate Target Health' allows Route 53 to automatically redirect traffic to the standby ALB when the primary ALB or its targets are detected as unhealthy.

Adım Adım Çözüm

1
Evaluate the zone apex requirements
Identify that a CNAME record cannot be used at the zone apex (corporateportal.com) due to DNS RFC limitations, making Route 53 Alias records necessary.
Alias records allow mapping the zone apex to AWS resources like Application Load Balancers directly without violating DNS standards.
2
Select the appropriate routing policy
Choose the Failover routing policy to establish an active-passive configuration.
Failover routing directs traffic to a primary resource when it is healthy, and to a secondary standby resource when the primary is unhealthy.
3
Configure health checking for the Alias records
Enable 'Evaluate Target Health' on both the primary and secondary Alias records.
Enabling 'Evaluate Target Health' allows Route 53 to check the health of the Application Load Balancer and its registered targets automatically, triggering failover when the primary becomes unhealthy.

Anahtar Kavram

Configuring Route 53 Failover Routing Policies with Alias records at the zone apex
Tahmini Süre:2m 0s
Soru 85Soru →

A company wants to identify and receive alerts for unexpected, machine-learning-detected spikes in spending related specifically to resources tagged with `CostCenter: Marketing`. The SysOps administrator must ensure that these alerts are sent to the finance team using an existing Amazon SNS topic. Which two actions must the SysOps administrator perform to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Cost Anomaly Monitor in AWS Cost Anomaly Detection, choosing the Tag monitor type and specifying the CostCenter tag key with the Marketing value.; Create an Alert Subscription in AWS Cost Anomaly Detection, link it to the tag monitor, define the alerting threshold, and select the Amazon SNS topic.

Cevap

The correct actions are to create a Cost Anomaly Monitor using the Tag monitor type with the specific cost allocation tag, and to create an Alert Subscription linked to that monitor targeting the Amazon SNS topic.
To detect machine-learning-based anomalies on specific tagged resources, a Tag monitor must be created in AWS Cost Anomaly Detection. To receive alerts from this monitor, an Alert Subscription must be configured and associated with the monitor and an SNS topic.

Adım Adım Çözüm

1
Create a cost monitor in AWS Cost Anomaly Detection.
The monitor will evaluate AWS spend data using machine learning to detect anomalies.
The Tag monitor type allows filtering anomalies specifically for resources tagged with CostCenter: Marketing.
2
Create an alert subscription in AWS Cost Anomaly Detection.
A subscription is established that connects the monitor to the SNS topic.
The subscription determines which anomalies trigger alerts and routes them to the correct notification target.

Anahtar Kavram

AWS Cost Anomaly Detection uses machine learning to monitor cost data, using Cost Anomaly Monitors to detect issues and Alert Subscriptions to route alerts.
Soru 86Soru →

A company has an AWS Lambda function that needs to decrypt data using a customer managed KMS key in the same AWS account. A SysOps Administrator has attached an IAM policy to the Lambda execution role that allows the `kms:Decrypt` action on the KMS key. However, when the Lambda function runs, it fails with an `AccessDeniedException` error during the decryption operation. The customer managed KMS key policy contains only the following statement:

{
"Version": "2012-10-17",
"Id": "key-policy-1",
"Statement": [
{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/AdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
"
}
]
}

Which modification to the configuration will resolve this error?

Cevabı ve açıklamayı göster

Cevap: Modify the KMS key policy to include a statement that grants the root account principal (`arn:aws:iam::123456789012:root`) permissions for KMS actions, thereby enabling the Lambda execution role's IAM policy to take effect.

Cevap

Modify the KMS key policy to include a statement that grants the root account principal permissions for KMS actions, enabling the Lambda execution role's IAM policy to take effect.
The correct answer explains that the key policy must grant the root account principal access to the key. In AWS KMS, a customer managed key policy must explicitly delegate authorization control to the AWS account to make identity-based IAM policies effective. Adding this statement allows the Lambda execution role's IAM policy to grant the decryption permission.

Adım Adım Çözüm

1
Analyze the customer managed key policy and the identity-based IAM policy on the execution role.
The Lambda function's execution role has an IAM policy allowing `kms:Decrypt`, but the KMS key policy lacks a statement enabling IAM delegation (specifically, a statement permitting the root principal of the account `arn:aws:iam::123456789012:root`).
Identify the cause of the authorization failure by checking the KMS evaluation order, which requires the key policy to explicitly authorize the caller or delegate authorization to the AWS account.
2
Determine the necessary change in the KMS key policy to enable IAM policy authorization.
Adding a statement to the customer managed key policy that grants the root principal (`arn:aws:iam::<AccountID>:root`) access to the key will allow IAM policies in the same account to grant KMS permissions.
Without this root delegation statement, any identity-based IAM policy trying to grant permissions to the customer managed key will be ignored.
3
Select the correct option that specifies root delegation in the key policy.
The option describing the addition of a statement to grant the root principal access is selected.
This configuration enables the Lambda execution role's identity-based policy to successfully authorize the decryption action.

Anahtar Kavram

By default, customer managed KMS keys are governed strictly by their key policies. To allow identity-based IAM policies in the same account to grant access to the key, the key policy must contain a statement that grants the account's root principal (`arn:aws:iam::<account-id>:root`) permission to perform KMS actions. If this root delegation statement is missing, all identity-based policies granting access to that key will be ignored, resulting in an AccessDeniedException.
Soru 87Soru →

An Application Load Balancer (ALB) is configured to route HTTP traffic on port 80 to a target group containing Amazon EC2 instances. The EC2 instances run a web application that automatically redirects all incoming HTTP requests to HTTPS (HTTP 301) to enforce encryption. The target group health checks are configured to use HTTP on the traffic port with the path `/`. The load balancer registers all EC2 instances as unhealthy. Which TWO actions should a SysOps administrator take to resolve this health check issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the target group's health check settings to include 301 in the Success codes (Matcher) range.; Configure the web server on the EC2 instances to return an HTTP 200 OK status code directly for health check requests without redirecting them to HTTPS.

Cevap

Modify the target group's health check settings to include 301 in the Success codes (Matcher) range, and configure the web server on the EC2 instances to return an HTTP 200 OK status code directly for the health check requests without redirecting them.
The correct responses involve updating the target group's Success codes (Matcher) to include 301, or configuring the web server to respond with 200 OK for health check paths without redirecting. This directly addresses the application's redirect behavior causing the default health check validation to fail.

Adım Adım Çözüm

1
Analyze the health check failure reason.
The target instances are marked unhealthy because they redirect HTTP requests on port 80 to HTTPS (HTTP 301), while the ALB health check expects a default response code of 200 OK.
Understanding the mismatch between the load balancer's default expectation (200 OK) and the server's redirect response (301) isolates the root cause.
2
Configure the target group to accept redirection status codes.
By updating the Success codes (Matcher) range to include 301, the ALB will accept the redirect response as a healthy state.
This allows the ALB to receive the 301 redirect code and still classify the target instance as operational.
3
Alternatively, adjust the web server behavior on the backend instances.
The web server is configured to respond with HTTP 200 OK directly for health check requests before redirecting traffic to HTTPS.
This satisfies the load balancer's default health check parameters without requiring modifications to the target group configuration.

Anahtar Kavram

Application Load Balancer health checks require the target instances to respond with status codes that match the configured Matcher (default 200). If the instance redirects traffic (HTTP 301/302), the matcher must be updated, or the instance must bypass the redirect for health checks.
Soru 88Soru →

A company stores daily database backup files in an Amazon S3 Standard bucket. Each backup file is approximately 10 GB10\text{ GB}. The backups are frequently accessed during the first 3030 days after upload. After 3030 days, access is rare, but the database team must be able to retrieve any backup within 1515 minutes if a restore is needed. The backups must be retained for a total of 9090 days before being permanently deleted.

A SysOps administrator is configuring an Amazon S3 Lifecycle policy to automate this process at the lowest cost.

Which TWO configurations should the administrator include in the S3 Lifecycle policy?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Transition objects from S3 Standard to S3 Glacier Instant Retrieval after 3030 days; Configure an expiration action to permanently delete the objects after 9090 days

Cevap

The correct configurations are transitioning objects from S3 Standard to S3 Glacier Instant Retrieval after 3030 days, and configuring an expiration action to permanently delete the objects after 9090 days.
Transitioning objects from S3 Standard to S3 Glacier Instant Retrieval after 3030 days is a valid and cost-effective configuration because S3 Glacier Instant Retrieval offers millisecond retrieval times, satisfying the 1515-minute restore requirement, while significantly reducing storage costs. Additionally, configuring an expiration action to permanently delete objects after 9090 days ensures compliance with the company's retention policy without retaining data longer than necessary.

Adım Adım Çözüm

1
Analyze the access pattern and retrieval requirements to identify the appropriate storage classes.
Frequently accessed for the first 3030 days (requires S3 Standard), rarely accessed thereafter but must be retrievable within 1515 minutes (requires S3 Glacier Instant Retrieval, which offers millisecond access, rather than S3 Glacier Flexible Retrieval which defaults to 3−53-5 hours standard retrieval).
S3 Glacier Instant Retrieval provides cost-optimized archive storage while maintaining instant retrieval performance.
2
Evaluate S3 Lifecycle transition constraints for the proposed rules.
Transitioning from S3 Standard to S3 Glacier Instant Retrieval at day 3030 is valid. Transitioning to Standard-IA at day 1515 or moving from Standard-IA to another class before 3030 days (e.g., day 4545 after transitioning at day 3030) is invalid and violates S3 transition limits.
Ensures that all configured lifecycle rules comply with Amazon S3 validation constraints.
3
Verify retention and expiration rules.
Configure an expiration rule to permanently delete objects after 9090 days.
This satisfies the requirement to retain files for exactly 9090 days.

Anahtar Kavram

Amazon S3 Storage Class and Lifecycle Optimization
Soru 89Soru →

A SysOps administrator has launched an Amazon EC2 instance in a newly created private subnet (10.0.2.0/2410.0.2.0/24) to run a database client. The client needs to connect to an external API on the internet. The administrator has deployed a NAT Gateway in another subnet (10.0.1.0/2410.0.1.0/24) within the same VPC. However, the EC2 instance cannot establish any connection to the internet. Which of the following configuration changes are required to resolve this connectivity issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add a route in the route table associated with the database client's subnet (10.0.2.0/2410.0.2.0/24) with a destination of 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.; Add a route in the route table associated with the NAT Gateway's subnet (10.0.1.0/2410.0.1.0/24) with a destination of 0.0.0.0/00.0.0.0/0 pointing to the Internet Gateway.

Cevap

Add a route in the route table associated with the database client's subnet pointing to the NAT Gateway, and add a route in the route table associated with the NAT Gateway's subnet pointing to the Internet Gateway.
To allow instances in a private subnet to access the internet, the routing must be configured in two stages. First, the route table for the private subnet where the client resides must direct all outbound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway. Second, the NAT Gateway itself must be located in a public subnet, which requires a route table with a route directing outbound traffic (0.0.0.0/00.0.0.0/0) to the Internet Gateway.

Adım Adım Çözüm

1
Examine the routing path from the private subnet to the internet.
The private subnet lacks a route to direct outbound traffic to the NAT Gateway.
Outbound internet traffic (0.0.0.0/00.0.0.0/0) must first be directed to the NAT Gateway for translation.
2
Examine the routing path from the NAT Gateway's subnet to the internet.
The NAT Gateway's subnet lacks a route to the Internet Gateway.
For a NAT Gateway to access the internet, its hosting subnet must be public, meaning it requires a route targeting the Internet Gateway.

Anahtar Kavram

Two-tier routing setup is required for private instances accessing the internet via a NAT Gateway: private subnet routes to the NAT Gateway, and the NAT Gateway's subnet routes to the Internet Gateway.
Soru 90Soru →

A company has established an AWS Site-to-Site VPN connection between their on-premises network (192.168.10.0/24192.168.10.0/24) and a VPC (10.0.0.0/1610.0.0.0/16) using a Virtual Private Gateway. The VPN tunnel status is active. A SysOps administrator deploys a database server on an Amazon EC2 instance in a private subnet (10.0.2.0/2410.0.2.0/24). The database server needs to communicate with an application server running on-premises (192.168.10.50192.168.10.50). However, network tests show that the database server cannot reach the on-premises server. Which action should the administrator take to resolve this connectivity issue?

Cevabı ve açıklamayı göster

Cevap: Enable route propagation for the virtual private gateway on the route table associated with the private subnet.

Cevap

Enable route propagation for the virtual private gateway on the route table associated with the private subnet.
Enabling route propagation dynamically adds the VPN routes to the subnet's route table, directing on-premises destined traffic to the virtual private gateway.

Adım Adım Çözüm

1
Inspect the route table associated with the private subnet hosting the database server.
Identify that the route table lacks a route pointing to the Virtual Private Gateway for the destination IP range of the on-premises network.
Without a valid route, the VPC router does not know how to forward traffic intended for the on-premises subnet.
2
Enable route propagation for the Virtual Private Gateway in the route table settings.
The on-premises routes configured on the VPN connection are dynamically populated in the route table.
Route propagation ensures that the correct routes are maintained automatically without manual static routing updates.

Anahtar Kavram

For instances in a VPC to communicate with an on-premises network via a Virtual Private Gateway (VGW), the route table associated with their subnets must contain routes directing the on-premises CIDR block to the VGW. This can be configured statically or dynamically using route propagation.
Soru 91Soru →

A company uploads system telemetry archives to an Amazon S3 Standard bucket. The logs must be accessed frequently with millisecond latency for the first 3030 days. After 3030 days, the logs are accessed occasionally but still require millisecond access. After 9090 days from upload, the logs are rarely accessed, but if a retrieval request is made, the logs must be available within 33 to 55 hours. The logs must be kept for a total of 360360 days before deletion.

Which two lifecycle transitions should a SysOps administrator configure to meet these requirements in the most cost-effective manner? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Transition objects from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) after 3030 days.; Transition objects from S3 Standard-IA to S3 Glacier Flexible Retrieval after 9090 days.

Cevap

Transitioning objects from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) after 3030 days, and transitioning objects from S3 Standard-IA to S3 Glacier Flexible Retrieval after 9090 days.
The correct configuration transitions objects from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) after 3030 days, and then to S3 Glacier Flexible Retrieval after 9090 days. S3 Standard-IA provides millisecond latency for the occasional access required between days 3030 and 9090, satisfying the 3030-day minimum limit. S3 Glacier Flexible Retrieval provides standard retrievals in 33 to 55 hours, meeting the recovery time requirement at a highly optimized cost.

Adım Adım Çözüm

1
Analyze the access frequency, latency, and retrieval time requirements for each phase of the lifecycle.
Identified that the 3030-to-9090-day phase requires millisecond access and occasional use, while the post-9090-day phase requires retrieval within 33 to 55 hours.
This establishes the target S3 storage classes (S3 Standard-IA and S3 Glacier Flexible Retrieval).
2
Verify S3 Standard-IA transition constraints.
Transitioning to S3 Standard-IA after 3030 days is valid because S3 Lifecycle rules require objects to reside in S3 Standard for at least 3030 days before transitioning.
Ensures compliance with S3 minimum storage duration limits.
3
Verify S3 Glacier Flexible Retrieval transition constraints from S3 Standard-IA.
Transitioning to S3 Glacier Flexible Retrieval at day 9090 (after 6060 days in S3 Standard-IA) is valid because the objects have met the 3030-day minimum storage duration of S3 Standard-IA.
Confirms the transition sequence is valid and satisfies the 33 to 55 hours retrieval requirement.

Anahtar Kavram

Amazon S3 Lifecycle transition rules and minimum storage duration constraints for cost optimization.
Soru 92Soru →

A company hosts a web application at the zone apex (example.com). The application is deployed behind Application Load Balancers (ALBs) located in both the us-east-1 and eu-central-1 Regions. A SysOps Administrator needs to configure Amazon Route 53 to route user traffic to the region that offers the lowest network latency. Additionally, the configuration must automatically divert traffic away from a region if its ALB becomes unhealthy. Which two actions should the SysOps Administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Alias A record at the zone apex for each region and select the Latency routing policy.; Configure the Evaluate Target Health setting to Yes on both Alias records.

Cevap

Create an Alias A record at the zone apex for each region, select the Latency routing policy, and configure the Evaluate Target Health setting to Yes on both Alias records.
To route traffic to the region offering the lowest network latency for a zone apex, Route 53 Alias A records must be created with a Latency routing policy. Additionally, to ensure high availability, the 'Evaluate Target Health' setting should be set to Yes on these Alias records so Route 53 automatically detects the health of the ALB target groups and reroutes traffic if an ALB fails.

Adım Adım Çözüm

1
Determine the record type to use at the zone apex.
Identify that a CNAME record cannot be used at the zone apex due to DNS standards. An Alias A record pointing to the ALB is required.
Alias records allow routing traffic at the zone apex directly to AWS resources like Application Load Balancers.
2
Select the correct routing policy to optimize user performance.
Choose the Latency routing policy for the Alias records in both regions.
Latency routing policy routes users to the region that offers the lowest network latency, which aligns with the performance goal.
3
Configure high availability and failover mechanism.
Set 'Evaluate Target Health' to Yes on both records.
Setting 'Evaluate Target Health' to Yes enables Route 53 to check the health of the ALB (and its target groups) and automatically stop routing traffic to that region if it becomes unhealthy.

Anahtar Kavram

Configuring latency-based routing at the zone apex using Alias records and enabling target health evaluation for automatic regional failover.
Tahmini Süre:2m 0s
Soru 93Soru →

A SysOps administrator wants to automatically remediate non-compliant Amazon S3 buckets that allow public read access using AWS Config. The administrator plans to use the AWS-ConfigureS3BucketPublicAccessBlock Systems Manager Automation document to perform the remediation. Which of the following configurations are required to set up this automated remediation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a remediation action within the AWS Config rule that targets the AWS-ConfigureS3BucketPublicAccessBlock Systems Manager Automation document.; Specify an IAM service role (remediation role) that grants Systems Manager Automation permission to modify S3 bucket settings, and ensure the administrator has iam:PassRole permission for this role.

Cevap

Configure a remediation action within the AWS Config rule targeting the Systems Manager Automation document, and specify an IAM service role with permissions to modify S3 settings along with the iam:PassRole permission for the configuring administrator.
Setting up automatic remediation in AWS Config requires linking the compliance rule to a remediation target, such as a Systems Manager Automation document. Because Systems Manager performs the modification on the resource, it must be granted permission through an IAM service role. Additionally, the administrator setting up this remediation must possess the iam:PassRole permission to pass the role to Systems Manager.

Adım Adım Çözüm

1
Associate the AWS Config rule with the Systems Manager Automation remediation target.
The AWS Config rule will automatically trigger the specified Systems Manager Automation document when a compliance change detects a public S3 bucket.
This establishes the event flow between the compliance check and the automated remediation.
2
Create and configure the IAM service role for Systems Manager.
An IAM role is established that allows Systems Manager to update the public access block configuration on the S3 buckets.
Systems Manager requires authorization to interact with and modify S3 bucket settings.
3
Ensure the administrator configuring the rule has iam:PassRole permissions.
The administrator can successfully assign the IAM service role to the remediation rule without authorization errors.
To prevent privilege escalation, AWS requires administrators to have the PassRole permission when associating execution roles with services.

Anahtar Kavram

Configuring automatic remediation for compliance violations in AWS Config using Systems Manager Automation and appropriate IAM service roles.
Soru 94Soru →

A SysOps Administrator is configuring an AWS CodeBuild project to decrypt sensitive environment variables retrieved from AWS Systems Manager Parameter Store. The parameters are encrypted with a customer managed KMS key in AWS Account `111122223333`. The administrator has already added `kms:Decrypt` and `kms:DescribeKey` permissions to the CodeBuild service role's IAM policy.

The customer managed KMS key has the following key policy:

{
"Version": "2012-10-17",
"Id": "key-policy-1",
"Statement": [
{
"Sid": "Allow direct access to key administrators",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/KMSAdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

When CodeBuild attempts to decrypt the parameters, the build fails with an Access Denied error.

Which of the following modifications will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Add a statement to the KMS key policy that grants the AWS account root principal (arn:aws:iam::111122223333:root) permission to perform kms:* actions, which allows IAM policies in the account to delegate key permissions.

Cevap

Add a statement to the KMS key policy that grants the AWS account root principal (arn:aws:iam::111122223333:root) permission to perform kms:* actions, which allows IAM policies in the account to delegate key permissions.
In AWS KMS, the key policy is the primary controller of access. For IAM policies in the same account to grant access to a KMS key, the key policy must contain a statement that enables IAM policies. This is typically achieved by granting the AWS account root principal (arn:aws:iam::111122223333:root) permissions to perform KMS actions (kms:*). Since the current key policy only allows administrative actions for the KMSAdminRole and does not have the default delegation statement for the account root, the CodeBuild role's IAM policy has no effect and results in an Access Denied error. Adding the delegation statement to the key policy enables IAM policies to delegate key access.

Adım Adım Çözüm

1
Analyze the IAM policy of the CodeBuild service role.
The identity-based IAM policy has the correct kms:Decrypt and kms:DescribeKey permissions attached.
This ensures the identity-side configuration is correct and that the failure is due to the key policy.
2
Evaluate the KMS key policy.
The key policy only lists KMSAdminRole and only for administration actions. The default statement delegating control to the account root (arn:aws:iam::111122223333:root) is missing.
KMS key policies must explicitly allow IAM delegation (via the root principal) for identity-based IAM policies to have any effect.
3
Identify the remediation step.
Add the root principal statement to the key policy to enable IAM delegation.
This establishes key policy delegation, permitting the CodeBuild service role's IAM policy to grant the decryption permissions.

Anahtar Kavram

KMS Key Policy Delegation
Tahmini Süre:1m 30s
Soru 95Soru →

A company connects several VPCs to an on-premises datacenter (CIDR 192.168.0.0/16192.168.0.0/16) using an AWS Transit Gateway. The Transit Gateway has two attachments: an AWS Direct Connect Gateway (associated with a Transit VIF) and an AWS Site-to-Site VPN. Both attachments are configured to dynamically propagate routes to the Transit Gateway route table using BGP. During an operational review, a SysOps Administrator discovers that all outbound traffic from the VPCs to the on-premises network is traversing the Site-to-Site VPN connection instead of the Direct Connect path, despite the Direct Connect connection being fully operational and active. Which of the following is the most likely cause of this routing behavior?

Cevabı ve açıklamayı göster

Cevap: A static route for 192.168.0.0/16192.168.0.0/16 pointing to the Site-to-Site VPN attachment is configured in the Transit Gateway route table.

Cevap

A static route for 192.168.0.0/16192.168.0.0/16 pointing to the Site-to-Site VPN attachment is configured in the Transit Gateway route table.
The correct answer identifies that a static route configured in a Transit Gateway route table always takes precedence over dynamically propagated routes. Since the static route targets the VPN attachment, it overrides the dynamic BGP route propagated by the Direct Connect Gateway, forcing all traffic to use the VPN connection.

Adım Adım Çözüm

1
Analyze the Transit Gateway route table evaluation logic for prefix length matches.
Confirm that both paths advertise the same destination CIDR of 192.168.0.0/16192.168.0.0/16, meaning longest prefix match does not differentiate them.
Longest prefix match is the primary rule for routing decisions.
2
Evaluate the precedence between static and dynamic (propagated) routes in the Transit Gateway route table.
Determine that static routes always take precedence over dynamic/propagated routes.
If a static route exists pointing to the VPN attachment for the target prefix, it overrides any dynamically learned BGP routes.
3
Confirm the default preference for dynamic BGP routes when no static routes override them.
Direct Connect Gateway attachments are preferred over VPN attachments when routing dynamic prefixes of equal length.
Understanding this default dynamic preference rules out AS-Path or other BGP attributes from shifting the preference to VPN if dynamic propagation is working normally.

Anahtar Kavram

Transit Gateway Route Evaluation Priority
Tahmini Süre:3m 0s
Soru 96Soru →

API instances running on Amazon EC2 in Subnet X (172.16.10.0/24172.16.10.0/24) are unable to establish TCP connections with Redis cache nodes running in Subnet Y (172.16.20.0/24172.16.20.0/24) on port 63796379. The security groups associated with both the API instances and the cache nodes permit all inbound and outbound traffic between the two subnets. To troubleshoot, a SysOps Administrator enables VPC Flow Logs on the elastic network interfaces (ENIs) of the cache nodes. The administrator identifies the following log records:

2 123456789012 eni-0987654321fedcba0 172.16.10.50 172.16.20.200 58291 6379 6 1 60 1781234560 1781234620 ACCEPT OK
2 123456789012 eni-0987654321fedcba0 172.16.20.200 172.16.10.50 6379 58291 6 1 40 1781234560 1781234620 REJECT OK

Which configuration change will resolve the connectivity issue?

Cevabı ve açıklamayı göster

Cevap: Add a rule to the Network ACL associated with Subnet Y allowing outbound TCP traffic to destination 172.16.10.0/24172.16.10.0/24 on ports 1024−655351024-65535.

Cevap

The correct configuration change is to add a rule to the Network ACL associated with Subnet Y allowing outbound TCP traffic to destination 172.16.10.0/24172.16.10.0/24 on ports 1024−655351024-65535.
The flow logs indicate that inbound traffic from the API instance (172.16.10.50172.16.10.50) to the Redis cache node (172.16.20.200172.16.20.200) on TCP port 63796379 is accepted, but the return traffic from the cache node to the client's ephemeral port (5829158291) is rejected. Since security groups are stateful and automatically allow return traffic, a security group would not log a reject for the return traffic if the inbound request was accepted. Therefore, the block is occurring at the stateless Network ACL level. To allow the response traffic to pass through the Network ACL, an outbound rule must be added to the cache subnet's (Subnet Y) Network ACL allowing outbound traffic to the API subnet (172.16.10.0/24172.16.10.0/24) on the ephemeral port range (1024−655351024-65535).

Adım Adım Çözüm

1
Analyze the provided VPC Flow Log records to determine where the traffic is being blocked.
The flow logs show that the inbound packet from the client (172.16.10.50172.16.10.50) to the server (172.16.20.200172.16.20.200) on port 63796379 is accepted, but the return packet from the server to the client on port 5829158291 is rejected.
Identifying the direction and port of the rejected traffic is the first step in isolating the misconfigured network control.
2
Compare the behavior of stateful and stateless security controls in a VPC.
Security groups are stateful and would automatically allow the return traffic if the inbound traffic was accepted. Network ACLs are stateless and require explicit rules in both directions.
This allows us to rule out Security Groups as the source of the drop and attribute it to a Network ACL.
3
Determine the correct ports and protocol required for the return traffic rule in the stateless control.
The return traffic goes from the server (source port 63796379) to the client's ephemeral port (destination port 5829158291). The rule must allow outbound traffic on destination ports 1024−655351024-65535.
This ensures the return packet can pass through the outbound filter of the subnet's Network ACL.

Anahtar Kavram

VPC Security Controls and Traffic Analysis
Soru 97Soru →

A SysOps Administrator is building an Amazon CloudWatch dashboard to monitor resource utilization of microservices running on an Amazon ECS cluster. All tasks in the cluster run on AWS Fargate. The Administrator enabled CloudWatch Container Insights for the cluster, but is unable to find container-level CPU and memory utilization metrics under the default AWS/ECS namespace in the CloudWatch console. Which of the following explains this behavior and identifies the correct location of these metrics?

Cevabı ve açıklamayı göster

Cevap: Container-level and task-level metrics collected by Container Insights are automatically published to the AWS/ECS/ContainerInsights namespace, whereas the default AWS/ECS namespace only provides cluster-level and service-level metrics.

Cevap

Container-level and task-level metrics collected by Container Insights are automatically published to the AWS/ECS/ContainerInsights namespace, whereas the default AWS/ECS namespace only provides cluster-level and service-level metrics.
The correct answer explains that Container Insights automatically sends detailed container-level and task-level metrics to the AWS/ECS/ContainerInsights namespace. The default AWS/ECS namespace only supports cluster-level and service-level metrics.

Adım Adım Çözüm

1
Identify the environment and target metrics.
The environment is Amazon ECS on AWS Fargate with Container Insights enabled. The goal is to locate container-level CPU and memory utilization metrics.
Understanding the launch type and metrics namespace behavior is crucial since Fargate abstracts away the underlying EC2 instances.
2
Compare default ECS metrics with Container Insights metrics.
Default ECS metrics are published to the AWS/ECS namespace but only at the cluster and service levels. Container Insights collects much more granular metrics at the container and task levels.
This allows the SysOps Administrator to locate the exact namespace where the granular metrics are published.
3
Determine the correct CloudWatch namespace.
Container Insights automatically delivers these metrics under the AWS/ECS/ContainerInsights namespace.
Knowing the correct namespace allows the Administrator to query the metrics and add them to the CloudWatch dashboard.

Anahtar Kavram

CloudWatch Container Insights Namespace
Soru 98Soru →

A SysOps Administrator is configuring AWS CloudTrail to deliver log events to Amazon CloudWatch Logs for real-time compliance monitoring. The administrator needs to ensure that the integration is secure and log delivery is successful.

Which two configuration steps must the administrator perform to achieve this? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that allows the CloudTrail service principal to assume it, and attach a permissions policy allowing the logs:CreateLogStream and logs:PutLogEvents actions.; Specify a target CloudWatch Logs log group that resides in the same AWS Region as the CloudTrail trail.

Cevap

The correct configurations are to create an IAM role with a trust policy that allows the CloudTrail service principal to assume it (with permissions for creating log streams and putting log events) and to specify a CloudWatch Logs log group in the same AWS Region as the CloudTrail trail.
The correct configuration requires establishing a cross-service trust and permission model. First, the CloudWatch Logs log group must exist in the same region as the CloudTrail trail. Second, an IAM role must be configured with a trust policy allowing the CloudTrail service principal to perform the assume role action, along with a permissions policy that grants the ability to create log streams and write log events into that specific log group.

Adım Adım Çözüm

1
Set up the destination log group.
A CloudWatch Logs log group is created in the same AWS Region as the CloudTrail trail.
CloudTrail cannot send logs to a log group in a different region.
2
Configure the IAM role and policy.
An IAM role is created with a trust relationship allowing 'cloudtrail.amazonaws.com' to assume the role (sts:AssumeRole), and permissions are granted for logs:CreateLogStream and logs:PutLogEvents on the log group resource.
This allows CloudTrail to authenticate and securely write the log stream events to CloudWatch Logs.
3
Associate the role and log group with CloudTrail.
The CloudTrail trail is updated with the CloudWatch Logs log group ARN and the role ARN.
This completes the integration, allowing automated log forwarding to commence.

Anahtar Kavram

AWS CloudTrail integration with CloudWatch Logs requires a same-region destination log group and an IAM service role that trusts CloudTrail to write log streams.
Soru 99Soru →

A retail company's inventory platform is hosted on Amazon EC2 instances within a private subnet. The instances are registered to a target group associated with an Application Load Balancer (ALB). A SysOps administrator logs into the AWS Management Console and observes that all registered EC2 targets show an 'Unhealthy' status with the error description 'Health check failed'. The administrator checks the configuration and confirms that both the Security Groups and Network ACLs allow inbound HTTP traffic on the application port from the ALB. The ALB health check is configured to query the HTTP path '/health' on the traffic port. Which two configuration issues on the EC2 instances or the web server could be causing the health checks to fail? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The web server software on the EC2 instances is configured to listen only on the loopback address (127.0.0.1) instead of the primary network interface.; The application web server requires a specific domain name in the HTTP Host header and returns a 404 Not Found response when queried by the ALB using the instance's private IP address.

Cevap

The correct options are: the web server software listening only on the loopback address (127.0.0.1), and the application web server requiring a specific domain name in the HTTP Host header.
The health checks fail because the Application Load Balancer cannot establish a successful connection or receive a successful HTTP response code. First, if the web server daemon is bound to the loopback address (127.0.0.1) instead of the network interface address, it will not accept connections originating from the ALB. Second, if the web server configuration requires a specific domain name in the HTTP Host header, the default ALB health check (which uses the instance's private IP address in the Host header) will result in a 404 Not Found response, which does not match the expected success codes.

Adım Adım Çözüm

1
Analyze the symptoms and the confirmed security settings.
Network connectivity is permitted because the security groups and network ACLs allow traffic on the configured port, meaning the failure is at the host or application layer.
To rule out network routing and access control policies as the source of the unhealthy status.
2
Evaluate the web server's network binding configuration.
If the web server is bound only to the loopback interface (127.0.0.1), it will reject requests arriving on the instance's private IP address from the ALB.
To verify if the daemon is correctly listening to external requests on the primary network interface (0.0.0.0).
3
Examine virtual host header requirements on the web server.
The ALB health checks send the target IP as the Host header. If the web server rejects this and demands a specific domain name, it returns a 404 response, which fails health check expectations.
To explain how an application-level configuration can prevent successful HTTP status code returns (typically 200 OK) for health checks.

Anahtar Kavram

Elastic Load Balancing Health Checks and Troubleshooting
Soru 100Soru →

A SysOps Administrator is configuring AWS Elastic Disaster Recovery (AWS DRS) to replicate on-premises virtual machines to AWS. The administrator faces two challenges: the replication servers in the staging area cannot communicate with the AWS DRS service, and subsequent attempts to launch drill instances fail due to permission authorization errors.

Which TWO actions should the administrator take to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Ensure the staging area subnet has a route to the AWS DRS service endpoints via a NAT gateway or through Interface VPC endpoints (AWS PrivateLink).; Grant the iam:PassRole permission to the IAM identity initiating the drill launch, allowing it to pass the required execution roles to the recovery instances.

Cevap

The correct actions are: ensuring the staging area subnet has a route to the AWS DRS service endpoints via a NAT gateway or Interface VPC endpoints, and granting the iam:PassRole permission to the IAM identity initiating the drill launch.
AWS DRS replication servers in the staging VPC require communication with the AWS DRS control plane, which can be accomplished either publicly via a NAT gateway or privately using Interface VPC endpoints. During a drill or recovery launch, the initiating IAM user or role must possess the iam:PassRole permission to pass the required execution and helper instance profile roles to the target recovery EC2 instances.

Adım Adım Çözüm

1
Analyze the networking requirements for the staging area.
Identify that replication servers in the staging VPC must communicate with the AWS DRS control plane endpoints, which requires either public routing (NAT gateway) or private routing (Interface VPC endpoints).
This establishes the replication path between the source servers and the DRS service.
2
Analyze the IAM permission requirements for launching EC2 recovery instances.
Identify that launching EC2 instances with associated roles requires the launching user or role to have the iam:PassRole permission.
This resolves the authorization failure during the drill launch process.
3
Evaluate and eliminate incorrect alternatives.
Discard Gateway endpoints (unsupported for DRS), active-active Route 53 routing (not applicable to agent replication paths), and sts:AssumeRole (incorrect permission type for launching instances with roles).
This ensures the selected options are both technically valid and relevant to the scenario.

Anahtar Kavram

AWS Elastic Disaster Recovery (AWS DRS) staging network connectivity and IAM PassRole launch permissions
ÖncekiSayfa 5 / 49Sonraki