Examkin

Tüm alıştırma soruları

450 soru

Tüm türler976Çoktan seçmeli502Çoklu seçim450Sıralama24
Soru 1Soru →

A SysOps Administrator is configuring automatic remediation for an AWS Config rule named `s3-bucket-ssl-requests-only` using the `AWS-PublishSNSNotification` Systems Manager (SSM) Automation document. The administrator has created a custom IAM role named `SSMRemediationRole` containing the necessary permissions to publish to the Amazon SNS topic. When the administrator attempts to associate this remediation action with the AWS Config rule in the AWS Management Console, the operation fails with an authorization error. Which of the following actions should the administrator perform to resolve this issue and ensure that the remediation executes successfully? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the `SSMRemediationRole` ARN.; Configure the trust policy of the `SSMRemediationRole` to allow the `ssm.amazonaws.com` service principal to assume the role.

Cevap

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the SSMRemediationRole ARN, and configure the trust policy of the SSMRemediationRole to allow the ssm.amazonaws.com service principal to assume the role.
To successfully configure and run automatic remediation for an AWS Config rule using a Systems Manager (SSM) Automation document with a custom execution role, two key permissions are required. First, the administrator setting up the remediation in the console or via the API must have the `iam:PassRole` permission on their IAM identity, referencing the ARN of the execution role. This allows the administrator to pass the role to the service. Second, because Systems Manager is the service that assumes the role to run the remediation document, the trust policy of the execution role must trust the `ssm.amazonaws.com` service principal.

Adım Adım Çözüm

1
Identify the identity attempting to configure the remediation action and verify its permissions.
The identity lacks the iam:PassRole permission on the target role, resulting in an authorization error during configuration.
When configuring AWS Config automatic remediation with an SSM Automation document, the user or role performing the configuration must be authorized to pass the execution role to the service.
2
Add the iam:PassRole permission to the administrator's IAM policy for the specific SSMRemediationRole ARN.
The authorization error is resolved, allowing the remediation action to be successfully associated with the AWS Config rule.
This grants the administrator the ability to delegate the execution role to the target service.
3
Configure the trust relationship policy of the SSMRemediationRole.
The trust policy allows ssm.amazonaws.com to assume the role.
When AWS Config triggers the remediation, AWS Systems Manager assumes the specified role to execute the automation document; therefore, the role must trust the Systems Manager service principal.

Anahtar Kavram

Configuring automatic remediation in AWS Config rules requires the configuring administrator to have iam:PassRole permissions for the execution role, and the execution role must trust the ssm.amazonaws.com service principal since Systems Manager executes the automation.
Soru 2Soru →

A SysOps administrator is configuring a blue/green deployment for a microservice hosted on Amazon ECS with AWS Fargate. The deployment pipeline uses AWS CodeDeploy. The administrator wants to route 10% of the production traffic to the new version of the microservice for a duration of 15 minutes before routing the remaining traffic. Additionally, if the new version displays elevated HTTP 5XX error rates during this test period, the deployment must automatically roll back. Which of the following configuration steps should the administrator perform to achieve this? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Specify the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration in the CodeDeploy deployment group.; Create an Amazon CloudWatch alarm that monitors the HTTP 5XX metric of the replacement (green) target group, and add it as a rollback trigger in the CodeDeploy deployment group.

Cevap

Specify the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration in the CodeDeploy deployment group, and create an Amazon CloudWatch alarm that monitors the HTTP 5XX metric of the replacement (green) target group and add it as a rollback trigger in the CodeDeploy deployment group.
To implement the required canary traffic shifting, the administrator must choose the predefined CodeDeploy deployment configuration for ECS that corresponds to shifting 10% of traffic for 15 minutes, which is CodeDeployDefault.ECSCanary10Percent15Minutes. To automate the rollback based on application errors, the administrator must configure a CloudWatch alarm targeting the green (replacement) target group's HTTP 5XX metrics and add that alarm as a rollback trigger to the CodeDeploy deployment group.

Adım Adım Çözüm

1
Select the appropriate canary deployment configuration in AWS CodeDeploy.
CodeDeployDefault.ECSCanary10Percent15Minutes is selected, which matches the required traffic shifting behavior (10% traffic shifted to the new task set, followed by the remaining 90% after 15 minutes).
This configuration directly automates the 10% canary traffic allocation for the specified 15-minute duration without requiring manual DNS or routing adjustments.
2
Configure a monitoring alarm for rollback triggers.
An Amazon CloudWatch alarm is created to track the HTTP 5XX error rate metric specifically for the green (replacement) target group under the Application Load Balancer.
Monitoring the green target group ensures that issues affecting only the new version of the service are detected.
3
Link the alarm to the CodeDeploy deployment group.
The CloudWatch alarm is designated as a rollback trigger in the CodeDeploy deployment group configuration.
This linkage enables CodeDeploy to automatically abort the deployment and shift 100% of the traffic back to the original (blue) task set if the alarm enters the ALARM state during the deployment process.

Anahtar Kavram

AWS CodeDeploy deployment configurations and rollback triggers for Amazon ECS blue/green deployments.
Soru 3Soru →

A SysOps Administrator is configuring cross-account, cross-region replication for an Amazon S3 bucket. The source bucket is in Account A (us-east-1) and contains objects encrypted with an AWS KMS customer managed key. The destination bucket is in Account B (us-west-2). The administrator has enabled versioning on the source bucket, created the replication configuration in Account A, and specified a new replication IAM role in Account A. However, the replication is failing, and no objects are appearing in the destination bucket. Which two actions must the administrator take to successfully replicate the KMS-encrypted objects?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable bucket versioning on the destination bucket in Account B.; Modify the KMS key policy in Account B to grant the replication IAM role from Account A permissions to perform kms:GenerateDataKey and kms:Encrypt actions.

Cevap

Enable bucket versioning on the destination bucket in Account B, and modify the KMS key policy in Account B to grant the replication IAM role from Account A permissions to perform kms:GenerateDataKey and kms:Encrypt actions.
Replicating KMS-encrypted objects across accounts requires S3 versioning to be enabled on both the source and destination buckets, as S3 replication requires versioning to track and sync objects. Additionally, the replication IAM role in Account A must have permissions to encrypt objects in the destination bucket using Account B's KMS key. This is accomplished by updating the KMS key policy in Account B to grant kms:GenerateDataKey and kms:Encrypt permissions to the replication role in Account A.

Adım Adım Çözüm

1
Enable versioning on the destination bucket in Account B.
Meets the core prerequisite that both source and destination buckets in an S3 replication setup must have versioning enabled.
S3 replication relies on versioning metadata to track and sync object states, so replication will fail if the destination bucket lacks versioning.
2
Update the KMS key policy for the destination key in Account B.
Grants the replication IAM role (from Account A) permission to encrypt objects at the destination using Account B's KMS key.
Since the replication role resides in Account A, the cross-account KMS key policy in Account B must explicitly permit that role to call kms:Encrypt and kms:GenerateDataKey.

Anahtar Kavram

Amazon S3 Cross-Account Replication with KMS Encryption
Soru 4Soru →

A SysOps Administrator is configuring VPC Flow Logs to capture traffic from a critical production subnet and deliver the logs to an Amazon CloudWatch Logs log group. After creating the flow log, the administrator notices that the log group remains empty and no log streams are generated. The administrator verifies that the flow log status is active but no logs are being delivered.

Which of the following configuration issues are likely causing this problem? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The trust policy of the IAM role assigned to the flow log does not list the vpc-flow-logs.amazonaws.com service principal as a trusted entity.; The IAM policy attached to the flow log's IAM role does not grant the logs:CreateLogStream and logs:PutLogEvents permissions for the destination log group.

Cevap

The correct answers are that the IAM role's trust policy must trust the vpc-flow-logs.amazonaws.com service principal, and the policy attached to the role must grant the logs:CreateLogStream and logs:PutLogEvents permissions.
To successfully publish VPC Flow Logs to CloudWatch Logs, the flow log service requires an IAM role. The trust policy of this IAM role must allow the vpc-flow-logs.amazonaws.com service principal to perform the sts:AssumeRole action. Additionally, the permissions policy attached to the role must grant logs:CreateLogStream and logs:PutLogEvents permissions for the target CloudWatch Logs log group. If either of these is missing, VPC Flow Logs will be unable to deliver logs even if the flow log status is active.

Adım Adım Çözüm

1
Analyze the IAM role trust policy.
Ensure that the trust relationship allows the VPC Flow Logs service principal (vpc-flow-logs.amazonaws.com) to assume the role.
Without this trust relationship, AWS cannot assume the role to write logs to CloudWatch Logs.
2
Verify the IAM role permissions policy.
Confirm that the role has permissions to create log streams and put log events (logs:CreateLogStream, logs:PutLogEvents) in the target log group.
Even if the role is trusted, it must have the necessary access permissions to write the log data.

Anahtar Kavram

VPC Flow Logs requires an IAM role with a trust policy allowing the vpc-flow-logs.amazonaws.com service principal to assume the role, and an attached policy allowing logs:CreateLogStream and logs:PutLogEvents.
Tahmini Süre:2m 0s
Soru 5Soru →

A SysOps Administrator is using AWS CloudFormation to update a production application hosted on an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The administrator is updating the launch template inside the CloudFormation template. The deployment must maintain full capacity at all times during the update to prevent performance degradation. Additionally, if the new instances fail application health checks during deployment, the stack must automatically roll back to its previous state.

Which two configurations should the administrator implement to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the AutoScalingRollingUpdate policy's MinInstancesInService parameter to match the desired capacity of the Auto Scaling group.; Set up CloudFormation rollback triggers in the RollbackConfiguration parameter to monitor CloudWatch alarms associated with the Application Load Balancer target group's health.

Cevap

Configure the AutoScalingRollingUpdate policy's MinInstancesInService parameter to match the desired capacity of the Auto Scaling group, and set up CloudFormation rollback triggers in the RollbackConfiguration parameter to monitor CloudWatch alarms associated with the Application Load Balancer target group's health.
To maintain full capacity during a rolling update, the AutoScalingRollingUpdate policy's MinInstancesInService parameter must equal the desired capacity. This forces CloudFormation to launch new instances before terminating old ones. To automate rollback based on health checks, CloudFormation rollback triggers (RollbackConfiguration) must monitor CloudWatch alarms. If the alarms are triggered due to unhealthy instances, CloudFormation automatically rolls back the stack.

Adım Adım Çözüm

1
Configure the AutoScalingRollingUpdate policy on the Auto Scaling group in the CloudFormation template.
The MinInstancesInService parameter matches the desired capacity of the group.
This guarantees that CloudFormation launches new instances first before terminating any old instances, maintaining 100%100\% capacity during the update.
2
Create CloudWatch alarms that monitor the Application Load Balancer target group's health metrics.
A configured alarm transitions into the ALARM state if the new deployment fails application-level health checks.
CloudWatch alarms are required to detect operational failures during the deployment process.
3
Associate the CloudWatch alarms with the CloudFormation stack's RollbackConfiguration triggers.
Automated monitoring of the alarms during and for a specified time after the stack update.
If any alarm breaches, CloudFormation detects it via the rollback triggers and automatically rolls back the stack to the last stable state.

Anahtar Kavram

Using CloudFormation AutoScalingRollingUpdate policies to preserve capacity combined with RollbackConfiguration to automate rollback on health check failure.
Tahmini Süre:2m 0s
Soru 6Soru →

A SysOps Administrator is setting up an active-passive disaster recovery solution using Amazon Route 53 for a public web application. The primary infrastructure runs in the us-west-2 Region behind an Application Load Balancer (ALB), and the backup infrastructure runs in the us-east-1 Region behind another ALB. The administrator wants to route all user traffic to us-west-2 under normal conditions, and automatically redirect traffic to us-east-1 if the primary application becomes unavailable. Which combination of actions must the administrator perform to configure this failover mechanism? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Alias record pointing to the primary Application Load Balancer in us-west-2, select the Failover routing policy, set the Failover Record Type to Primary, and set Evaluate Target Health to Yes.; Create an Alias record pointing to the backup Application Load Balancer in us-east-1, select the Failover routing policy, set the Failover Record Type to Secondary, and set Evaluate Target Health to Yes.

Cevap

The correct configuration requires creating a primary Failover Alias record pointing to the primary Application Load Balancer in us-west-2 with Evaluate Target Health set to Yes, and a secondary Failover Alias record pointing to the backup Application Load Balancer in us-east-1 with Evaluate Target Health set to Yes.
To configure an active-passive failover in Amazon Route 53 using Alias records pointing to Application Load Balancers, the administrator must create a primary record for the active endpoint and a secondary record for the standby endpoint. Setting the routing policy to Failover and configuring the Failover Record Type to Primary and Secondary respectively aligns with active-passive design. Enabling 'Evaluate Target Health' on both Alias records allows Route 53 to automatically evaluate the health of the load balancers based on the health of their registered targets, triggering the failover when the primary ALB's targets become unhealthy.

Adım Adım Çözüm

1
Identify the routing policy and record type required for the primary endpoint.
A Failover routing policy with the Failover Record Type set to Primary pointing to the primary Application Load Balancer.
Active-passive disaster recovery setups in Route 53 require a Failover routing policy where the primary record represents the main active resource.
2
Determine how to monitor the health of the Application Load Balancer without extra cost or configuration.
Enable the 'Evaluate Target Health' setting on the Alias record.
When Evaluate Target Health is set to Yes, Route 53 inherits the health status of the Application Load Balancer from the backend EC2 targets registered with the ALB's target groups.
3
Configure the standby endpoint for failover.
A Failover routing policy with the Failover Record Type set to Secondary pointing to the backup ALB in the us-east-1 Region, with Evaluate Target Health set to Yes.
This ensures Route 53 will route DNS queries to the standby ALB when the primary ALB's health checks fail.

Anahtar Kavram

Active-passive Route 53 DNS failover configuration using Alias records and the Evaluate Target Health feature.
Soru 7Soru →

A company is designing a backup and disaster recovery strategy for a critical multi-tier application. The application stores transaction logs in an Amazon S3 bucket and uses an Amazon RDS for PostgreSQL DB instance. The backup policy requires all database backups to be replicated to a secondary AWS Region to enable point-in-time recovery (PITR) with a minimum recovery time. Additionally, the S3 transaction logs must be replicated to the secondary Region while retaining full version history. Which combination of actions should the SysOps Administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable versioning on both the source S3 bucket and the destination S3 bucket, and configure S3 Cross-Region Replication (CRR).; Enable cross-Region automated backups replication for the Amazon RDS DB instance to replicate automated backups to the secondary Region.

Cevap

To meet the requirements, the SysOps Administrator must enable versioning on both the source and destination S3 buckets and configure S3 Cross-Region Replication (CRR), and enable cross-Region automated backups replication for the Amazon RDS DB instance.
Enabling versioning on both the source and destination S3 buckets is a prerequisite for configuring Cross-Region Replication (CRR). Replicating RDS automated backups to a secondary Region provides the capability to restore the DB instance to any point in time within the backup retention window in the destination Region.

Adım Adım Çözüm

1
Enable versioning on both S3 buckets.
Both source and destination S3 buckets are versioning-enabled.
S3 Cross-Region Replication (CRR) requires versioning to be enabled on both the source and destination buckets to function properly.
2
Configure Cross-Region Replication.
S3 objects and version history are automatically copied to the secondary Region.
This configuration satisfies the S3 replication requirements while maintaining version history.
3
Configure Amazon RDS cross-Region automated backup replication.
RDS automated backups are replicated to the secondary Region.
This allows the administrator to perform point-in-time recovery (PITR) in the secondary Region directly from the replicated automated backups.

Anahtar Kavram

Configuring S3 Cross-Region Replication with versioning and RDS cross-Region automated backup replication for disaster recovery.
Soru 8Soru →

A company hosts a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the eu-central-1 (Frankfurt) region. The company wants to implement an active-passive disaster recovery strategy using Amazon Route 53. If the application's response latency exceeds 5 seconds, traffic must fail over to a static maintenance page hosted on an Amazon S3 bucket configured for website hosting in the eu-west-1 (Ireland) region. The latency metric is monitored via a custom CloudWatch metric. Which two configuration steps must the SysOps Administrator perform to set up this Route 53 DNS failover configuration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create the CloudWatch alarm for the latency metric in the us-east-1 (N. Virginia) Region, and associate the Route 53 health check with this alarm.; Create a primary Route 53 Failover record pointing to the ALB with the custom health check associated, and a secondary Route 53 Failover record pointing to the S3 bucket website endpoint.

Cevap

Creating the CloudWatch alarm for the latency metric in the us-east-1 Region to link with the Route 53 health check, and creating a primary Route 53 Failover record pointing to the ALB alongside a secondary Route 53 Failover record pointing to the S3 website endpoint.
To set up Route 53 active-passive failover based on custom metrics like latency, the SysOps Administrator must use a CloudWatch alarm. Route 53 can only integrate with CloudWatch alarms residing in the us-east-1 region, meaning the alarm must be created there even if the metric data originates elsewhere. Additionally, the DNS configuration requires defining a primary Failover record associated with the health check and a secondary Failover record pointing to the passive destination (the S3 bucket website hosting endpoint).

Adım Adım Çözüm

1
Configure metric publishing to the us-east-1 region, or configure a cross-region CloudWatch alarm in us-east-1 that evaluates the custom metric data coming from the eu-central-1 region.
A CloudWatch alarm monitoring the response latency is created in the us-east-1 Region.
Amazon Route 53 health checks are global and only integrate with CloudWatch alarms created in the us-east-1 region.
2
Create a Route 53 health check that monitors the state of the newly created CloudWatch alarm in us-east-1.
A Route 53 health check is established that reports unhealthy status when the CloudWatch alarm transitions to the ALARM state.
This links the application-layer latency metric directly to the DNS failover logic.
3
Create a primary routing record (e.g., an Alias A record for the zone apex or a standard CNAME) pointing to the ALB in eu-central-1, configure it with the Failover routing policy, and associate it with the created Route 53 health check.
The primary record will route traffic to the ALB as long as the health check reports healthy.
Associating the health check ensures that Route 53 will detect latency spikes and stop resolving queries to the primary ALB.
4
Create a secondary routing record with the same name, configure it with the Failover routing policy, and point it to the S3 bucket website endpoint in eu-west-1.
The secondary record will serve traffic to the maintenance page when the primary endpoint is unhealthy.
Completes the active-passive failover configuration.

Anahtar Kavram

Amazon Route 53 DNS Active-Passive Failover with CloudWatch Alarms
Tahmini Süre:2m 30s
Soru 9Soru →

An organization configures Amazon CloudWatch Logs subscription filters to stream log events to an Amazon Kinesis Data Firehose delivery stream. The delivery stream writes the log data to a destination Amazon S3 bucket. Both the delivery stream and the destination S3 bucket are encrypted using a Customer Managed Key (CMK) managed by AWS Key Management Service (AWS KMS). The SysOps Administrator observes that the S3 bucket is empty and log delivery has failed. Which of the following troubleshooting steps should the administrator perform to resolve this issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the IAM policy attached to the CloudWatch Logs role to allow the firehose:PutRecord action on the delivery stream and the kms:GenerateDataKey action on the KMS key used by Kinesis Data Firehose.; Configure the KMS key policy of the S3 bucket's encryption key to grant the Kinesis Data Firehose delivery role permissions to perform the kms:GenerateDataKey and kms:Encrypt actions.

Cevap

Configure the IAM policy attached to the CloudWatch Logs role to allow the firehose:PutRecord action on the delivery stream and the kms:GenerateDataKey action on the KMS key used by Kinesis Data Firehose, and configure the KMS key policy of the S3 bucket's encryption key to grant the Kinesis Data Firehose delivery role permissions to perform the kms:GenerateDataKey and kms:Encrypt actions.
The correct troubleshooting actions involve ensuring that CloudWatch Logs has permissions to write to the encrypted Kinesis Data Firehose stream (which requires both the firehose:PutRecord action and the kms:GenerateDataKey action on the stream's encryption key), and ensuring that the Firehose delivery role has permissions to write to the encrypted S3 bucket (which requires the kms:GenerateDataKey and kms:Encrypt actions on the bucket's KMS key policy).

Adım Adım Çözüm

1
Verify CloudWatch Logs permissions to write to Kinesis Data Firehose.
Ensure the CloudWatch Logs subscription role includes firehose:PutRecord permissions.
CloudWatch Logs needs direct write permissions to deliver log records into the Kinesis Data Firehose stream.
2
Analyze KMS permissions for Kinesis Data Firehose ingestion.
Ensure the CloudWatch Logs role is granted kms:GenerateDataKey on the Customer Managed Key (CMK) encrypting Kinesis Data Firehose.
Since the stream is encrypted, writing to it requires generating data keys using the stream's KMS key.
3
Analyze KMS permissions for Kinesis Data Firehose S3 delivery.
Update the S3 bucket's KMS key policy to permit the Kinesis Data Firehose delivery role to perform kms:GenerateDataKey and kms:Encrypt.
Firehose must be able to generate encryption keys and encrypt data objects before uploading them to the encrypted S3 bucket.

Anahtar Kavram

Troubleshooting CloudWatch Logs subscription filter delivery issues involving AWS KMS key policies and IAM service permissions.
Soru 10Soru →

A SysOps Administrator is configuring a blue/green deployment strategy for a containerized application running on Amazon Elastic Container Service (Amazon ECS) behind an Application Load Balancer (ALB). The updates must be deployed using AWS CodeDeploy. The administrator needs to ensure that the deployment automatically rolls back if the new tasks fail to launch or fail target group health checks, or if application performance degradation (such as elevated error rates) occurs during traffic shifting. Which two configuration steps must the administrator perform to meet these requirements? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the ECS service definition to set the deployment controller type to CodeDeploy, and associate the deployment group with two target groups: one for the active traffic environment and one for the standby environment.; Create Amazon CloudWatch alarms that monitor application metrics, and add these alarms to the CodeDeploy deployment group's automatic rollback configuration.

Cevap

To configure the blue/green deployment for Amazon ECS using AWS CodeDeploy with automatic rollback capabilities, the administrator must configure the ECS service deployment controller type to CodeDeploy, associate the deployment group with blue and green target groups, and configure Amazon CloudWatch alarms to trigger automatic rollbacks in the CodeDeploy deployment group.
The correct options specify configuring the ECS service to use the CodeDeploy deployment controller with two target groups (blue and green) to enable the blue/green deployment pattern, and configuring CloudWatch alarms in the CodeDeploy deployment group's automatic rollback settings to monitor metrics during deployment and trigger a rollback if needed.

Adım Adım Çözüm

1
Configure the deployment controller on the ECS service definition.
The ECS service is set to use the CodeDeploy deployment controller type instead of the default ECS rolling update controller.
This allows AWS CodeDeploy to manage the tasks, traffic shifting, and lifecycle hooks of the deployment.
2
Associate two target groups with the CodeDeploy deployment group.
CodeDeploy can direct traffic between the active target group (blue) and the target group running the new task version (green).
Two target groups are required in a blue/green deployment configuration to allow isolated testing and seamless traffic shifting.
3
Add CloudWatch alarms to the CodeDeploy rollback configuration.
If the metrics (like 5XX errors or response times) exceed limits, CodeDeploy detects the alarm and automatically reverts the traffic back to the original target group.
This meets the requirement to automatically roll back the deployment upon detecting application performance degradation.

Anahtar Kavram

AWS CodeDeploy manages ECS blue/green deployments by shifting traffic between two target groups and can automate rollbacks using native CloudWatch alarm integration.
Soru 11Soru →

A SysOps administrator is configuring an automated remediation workflow to enable Amazon S3 Block Public Access on any S3 bucket when a PutBucketPolicy API call is detected. The administrator creates an Amazon EventBridge rule that filters CloudTrail API events for PutBucketPolicy and targets the AWS Systems Manager Automation document AWS-ConfigureS3BucketPublicAccessBlock. The Automation document requires an execution role (AutomationAssumeRole) to perform the configuration changes. However, the execution fails to start when a policy changes.

Which of the following configuration steps must the SysOps administrator perform to successfully implement this automated remediation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document.; Grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.

Cevap

Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document, and grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.
To successfully execute automated remediation using Amazon EventBridge and AWS Systems Manager Automation, two authorization steps are necessary: first, the EventBridge rule must assume a role that permits starting the automation execution (ssm:StartAutomationExecution). Second, because Systems Manager must assume an execution role to perform the S3 bucket configuration change, the EventBridge role must be permitted to pass this execution role (iam:PassRole) to Systems Manager.

Adım Adım Çözüm

1
Ensure EventBridge is authorized to trigger the Systems Manager execution.
EventBridge target is associated with an IAM service role containing the ssm:StartAutomationExecution action for the AWS-ConfigureS3BucketPublicAccessBlock document.
By default, EventBridge does not have permissions to execute Systems Manager Automation documents unless explicitly granted via a service role.
2
Ensure the Systems Manager Automation execution role can be passed to the Systems Manager service.
The EventBridge target execution role has iam:PassRole permissions targeting the SSM Automation execution role (AutomationAssumeRole).
When a target service executes using a specified role, the calling service (EventBridge) must have permission to pass that role to the target service.

Anahtar Kavram

Configuring correct IAM permissions and service integration targets for event-driven Systems Manager Automation via Amazon EventBridge.
Soru 12Soru →

A SysOps administrator is launching a new Amazon EC2 instance that must run an application that accesses an Amazon S3 bucket. An IAM role with the necessary S3 permissions has already been created. The administrator needs to configure the EC2 instance to run the application using this role.

Which two actions are required to successfully complete this configuration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate the IAM role with an instance profile, and attach the instance profile to the EC2 instance.; Ensure the administrator's IAM user identity is granted the iam:PassRole permission for the specific IAM role.

Cevap

The correct actions are associating the IAM role with an instance profile to attach it to the EC2 instance, and ensuring the administrator's IAM user identity has the iam:PassRole permission.
To configure an EC2 instance to run an application with specific IAM permissions, you must wrap the IAM role inside an instance profile and attach it to the EC2 instance. Furthermore, the administrator who performs this attachment must possess the iam:PassRole permission to authorize passing the role to the EC2 service.

Adım Adım Çözüm

1
Determine how roles are attached to EC2 instances.
EC2 instances require an instance profile wrapper to hold the IAM role.
The EC2 service uses instance profiles to pass role credentials to the instance's metadata service.
2
Determine the required user permissions for delegating the role.
The user launching or configuring the instance must have the iam:PassRole permission.
To prevent unauthorized delegation of administrative privileges, AWS requires that users have explicit permission to pass roles to services.

Anahtar Kavram

Delegating AWS permissions to EC2 instances using Instance Profiles and the iam:PassRole permission
Soru 13Soru →

A company hosts a web application behind an Application Load Balancer (ALB) in the us-west-2 Region. The company uses Amazon Route 53 with active-passive failover routing to redirect traffic to a backup static website in Amazon S3 if the primary application goes down. The SysOps Administrator configures a Route 53 health check to monitor a CloudWatch alarm. The alarm is based on the UnHealthyHostCount metric for the ALB's target group in us-west-2. During an application outage where all backend instances become unresponsive and stop reporting metrics, the Route 53 health check status remains 'Healthy' and failover does not occur. Which of the following configuration changes are required to resolve this issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Recreate the CloudWatch alarm in the us-east-1 Region, referencing the ALB metrics from the us-west-2 Region.; Configure the Route 53 health check to treat insufficient data (INSUFFICIENT_DATA state) as unhealthy.

Cevap

Recreating the CloudWatch alarm in the us-east-1 Region (referencing the us-west-2 ALB metrics) and configuring the Route 53 health check to treat insufficient data (INSUFFICIENT_DATA state) as unhealthy.
The correct configurations involve recreating the CloudWatch alarm in us-east-1 because Route 53 health checks can only monitor alarms in that specific Region, and configuring the health check to treat the INSUFFICIENT_DATA state as unhealthy to trigger failover when metrics stop reporting.

Adım Adım Çözüm

1
Identify the regional requirements for Route 53 health checks monitoring CloudWatch alarms.
Confirm that Route 53 can only integrate with CloudWatch alarms created in the us-east-1 Region, regardless of the target resource's Region.
Route 53's integration with CloudWatch is globally anchored in the N. Virginia Region.
2
Analyze the behavior of the CloudWatch alarm when metrics are missing.
Recognize that when all backend instances go down and stop reporting metrics, the alarm status changes to INSUFFICIENT_DATA.
Without active reporting from targets, no metric values are sent, resulting in missing data points.
3
Adjust the health check state configuration for missing data.
Configure the Route 53 health check to treat the INSUFFICIENT_DATA state as unhealthy so that the primary record is marked unhealthy and traffic fails over.
By default, Route 53 may not treat insufficient data as a failure state, which prevents failover.

Anahtar Kavram

Route 53 DNS Failover using CloudWatch Alarms
Soru 14Soru →

A SysOps Administrator is configuring Amazon EC2 instances in a private subnet with no internet access to invoke AWS Lambda functions. The VPC has no Internet Gateway or NAT Gateway attached. The administrator creates an Interface VPC Endpoint for AWS Lambda (com.amazonaws.us-east-1.lambda) in the VPC and associates it with the private subnet. However, application scripts on the EC2 instances continue to receive connection timeouts when trying to invoke Lambda functions using the default AWS SDK endpoint (lambda.us-east-1.amazonaws.com).

Which of the following configuration changes should the SysOps Administrator make to resolve this connectivity issue? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable private DNS hostnames for the Interface VPC Endpoint.; Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443 from the security group of the EC2 instances.

Cevap

Enabling private DNS hostnames for the Interface VPC Endpoint and allowing inbound HTTPS traffic on port 443 from the EC2 instances' security group in the endpoint's security group will resolve the connection timeouts.
To resolve the timeout issue, private DNS hostnames must be enabled on the Interface VPC Endpoint so that the AWS SDK's default domain name resolves to the endpoint's private IP addresses. Additionally, the security group of the Interface VPC Endpoint must allow inbound HTTPS traffic on port 443 from the EC2 instances' security group.

Adım Adım Çözüm

1
Enable private DNS hostnames on the Interface VPC Endpoint configuration.
DNS queries from the EC2 instances for lambda.us-east-1.amazonaws.com resolve to the private IP addresses of the endpoint network interfaces.
This ensures the standard SDK client requests are automatically routed internally to the private endpoint instead of resolving to public IP addresses.
2
Update the security group of the Interface VPC Endpoint to permit inbound HTTPS (port 443) traffic from the security group associated with the EC2 instances.
The network interfaces of the VPC endpoint accept incoming TCP connection requests on port 443 from the EC2 instances.
Security groups on Interface VPC Endpoints are stateful and must explicitly allow inbound traffic from clients accessing the service.

Anahtar Kavram

Interface VPC Endpoints require both Private DNS to resolve standard service endpoints internally and appropriate inbound security group rules to allow client traffic.
Soru 15Soru →

An administrator wants to implement automatic remediation for non-compliant resources detected by an AWS Config rule. The rule identifies Amazon S3 buckets that allow public read access. The administrator plans to use the `AWS-DisableS3BucketPublicReadWrite` Systems Manager (SSM) Automation document as the remediation action. During configuration, the administrator encounters permission errors and the remediation fails to run.

Which actions must the administrator take to successfully resolve the permission issues and enable the automated remediation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an IAM execution role with a trust policy that allows the ssm.amazonaws.com service principal to assume it, and attach policies granting permissions to modify S3 bucket settings.; Grant iam:PassRole permissions for the Systems Manager execution role to the IAM identity configuring the AWS Config remediation action.

Cevap

The administrator must configure an IAM execution role with a trust policy that allows the ssm.amazonaws.com service principal to assume it (with permissions to modify S3 settings), and grant the iam:PassRole permission for the execution role to the IAM identity configuring the remediation.
To remediate non-compliant resources automatically via AWS Config and Systems Manager Automation, two requirements must be satisfied. First, a role assumed by Systems Manager (ssm.amazonaws.com) must exist and have permissions to perform the corrective actions on S3. Second, the user or service principal initiating the automation setup must possess the iam:PassRole permission to pass this execution role to Systems Manager.

Adım Adım Çözüm

1
Create an IAM role for Systems Manager execution.
An IAM role is created with a trust relationship for ssm.amazonaws.com and a policy allowing the required S3 bucket configuration changes.
Systems Manager needs permissions to perform the actual remediation steps on S3 buckets.
2
Assign the PassRole permission to the configuring administrator.
The administrator has iam:PassRole permission explicitly defined for the target execution role ARN in their IAM policy.
This permission allows the administrator to pass the Systems Manager execution role to the service for performing remediation actions.

Anahtar Kavram

AWS Config automated remediation using Systems Manager Automation documents requires configuring service trust relationships and granting the administrator iam:PassRole permissions to delegate roles to the service.
Soru 16Soru →

A SysOps Administrator is securing a customer managed KMS key in the us-west-2 Region that is used to encrypt Amazon Elastic Block Store (EBS) volumes. The administrator wants to enforce the following security requirements:
- Users in the AWS account must be able to administer the key (such as enabling rotation or updating policies) using IAM policies.
- The key must only be allowed to encrypt and decrypt EBS volumes when the request is made by Amazon EC2 on behalf of a user, preventing direct API calls using the AWS CLI or SDKs.

Which two actions must the administrator take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Include a statement in the KMS key policy that grants `kms:*` permissions to the account's root principal (`arn:aws:iam::111122223333:root`).; Add a condition to the KMS key policy's cryptographic operations statement that specifies `"StringEquals": { "kms:ViaService": "ec2.us-west-2.amazonaws.com" }`.

Cevap

The administrator must add a statement to the KMS key policy that grants `kms:*` permissions to the account's root principal (`arn:aws:iam::111122223333:root`) and add a condition to the KMS key policy's cryptographic operations statement specifying `"kms:ViaService": "ec2.us-west-2.amazonaws.com"`.
To allow IAM policies to manage the key, the KMS key policy must delegate administrative permissions to the root principal of the AWS account. Additionally, to restrict key usage to EBS volume operations while blocking direct API calls, the key policy must include a condition restricting requests to the EC2 service in the appropriate Region using the `kms:ViaService` condition key set to `ec2.us-west-2.amazonaws.com`.

Adım Adım Çözüm

1
Enable IAM policy delegation in the KMS key policy.
Allows IAM policies attached to users and roles within the account to control access permissions for the KMS key.
By default, a KMS key is only manageable via its key policy unless it explicitly grants permissions to the account root principal.
2
Add the `kms:ViaService` condition to the key policy for cryptographic operations.
Restricts key usage to requests made by specified AWS services on behalf of the user.
This prevents users from performing direct decrypt/encrypt actions via the CLI/SDK, forcing the requests to go through EC2 when attaching the EBS volume.
3
Set the service principal to `ec2.us-west-2.amazonaws.com`.
Ensures the restriction correctly matches EBS operations in the us-west-2 Region.
EBS uses the EC2 service endpoint under the hood for volume attachment and encryption.

Anahtar Kavram

KMS key policies control authorization, and IAM policies can only manage a KMS key if the key policy explicitly delegates authority to the account root principal. The `kms:ViaService` condition key restricts KMS key usage to requests coming from specific AWS services.
Soru 17Soru →

A company runs a memory-bound microservices application on Amazon EC2 instances. A SysOps Administrator notices that AWS Compute Optimizer is generating resource recommendations based only on CPU and network metrics, without factoring in memory utilization. Which of the following actions must the administrator take to ensure AWS Compute Optimizer includes memory metrics in its recommendations? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the unified CloudWatch agent on the EC2 instances to publish memory utilization metrics to the default CWAgent namespace.; Attach an IAM role to the EC2 instances that includes the CloudWatchAgentServerPolicy managed policy.

Cevap

Configure the unified CloudWatch agent on the EC2 instances to publish memory utilization metrics to the default CWAgent namespace, and attach an IAM role to the EC2 instances that includes the CloudWatchAgentServerPolicy managed policy.
To include memory metrics in AWS Compute Optimizer recommendations, the unified CloudWatch agent must be installed on the EC2 instances to capture OS-level memory utilization and publish it to the CWAgent namespace. Additionally, the EC2 instances must be authorized to write these metrics to CloudWatch, which requires attaching an IAM role with the CloudWatchAgentServerPolicy policy.

Adım Adım Çözüm

1
Configure metric collection at the OS level.
The unified CloudWatch agent is installed and configured to send OS-level memory metrics (such as mem_used_percent) to the CWAgent namespace in CloudWatch.
By default, EC2 only reports hypervisor-level metrics like CPU and disk I/O. Memory is an OS-level metric that requires an agent to collect.
2
Grant the instances permission to write metrics.
An IAM role containing the CloudWatchAgentServerPolicy managed policy is attached to the EC2 instances.
The CloudWatch agent requires permissions to call the PutMetricData API to send metrics to CloudWatch.
3
Ensure Compute Optimizer reads the metrics.
Compute Optimizer detects the memory metrics under the CWAgent namespace and begins factoring them into recommendations.
Compute Optimizer is pre-configured to look for memory metrics specifically under the CWAgent namespace.

Anahtar Kavram

AWS Compute Optimizer memory metric requirements
Soru 18Soru →

An application running on an Amazon EC2 instance in Account B (444455556666) needs to decrypt sensitive files stored in an Amazon S3 bucket in Account A (111122223333). The files in the S3 bucket are encrypted using Server-Side Encryption with AWS KMS (SSE-KMS) and a customer managed KMS key in Account A. The KMS key currently has the following key policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

An IAM role named AppRole is attached as the instance profile for the EC2 instance in Account B. Which TWO configurations are required to allow AppRole in Account B to decrypt the objects in the S3 bucket? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the KMS key policy in Account A to allow the IAM role AppRole in Account B to perform the kms:Decrypt action.; Attach an IAM policy to the IAM role AppRole in Account B that allows the kms:Decrypt action on the KMS key ARN in Account A.

Cevap

To configure cross-account decryption, update the KMS key policy in Account A to grant permission to the external role, and attach an IAM policy to the role in Account B allowing decryption on the key ARN.
To establish cross-account access to a customer managed KMS key, permissions must be granted on both sides. The key policy of the KMS key in Account A must be configured to trust the external role (or Account B's root principal), and the IAM policy attached to the EC2 instance role in Account B must allow the kms:Decrypt action on the ARN of the KMS key in Account A. Together, these two configurations authorize the cross-account decryption request.

Adım Adım Çözüm

1
Review the requirements for cross-account AWS KMS key access.
Identify that cross-account access requires permissions to be granted in both the KMS key policy of the owning account and the IAM policy of the calling account.
AWS KMS requires explicit authorization from both the key owner and the caller's account when requests cross AWS accounts.
2
Update the KMS key policy in Account A (the key owner).
Add a statement to the key policy that permits the external IAM role (arn:aws:iam::444455556666:role/AppRole) to perform the kms:Decrypt action.
The customer managed key policy must trust the external identity before Account B can delegate or use the key.
3
Attach an IAM policy to the EC2 instance role in Account B (the caller).
Add a policy allowing the kms:Decrypt action on the target key's ARN in Account A.
The caller's identity must be explicitly permitted by its own account's IAM policy to access the external key resource.

Anahtar Kavram

Cross-account AWS KMS access requires configuring both the KMS key policy in the source account to trust the destination principal, and an IAM policy in the destination account to permit the caller to use the external KMS key.
Soru 19Soru →

A SysOps Administrator is managing resource optimization across a multi-account organization using AWS Organizations. The administrator notices that AWS Compute Optimizer is generating EC2 rightsizing recommendations based only on CPU and network metrics, failing to analyze memory utilization. Additionally, several member accounts are running gp2 EBS volumes that are overprovisioned for size just to achieve higher throughput. Which TWO actions should the SysOps Administrator take to resolve these issues?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the Amazon CloudWatch agent to the EC2 instances in the member accounts to collect and report memory utilization metrics.; Modify the EBS volumes from gp2 to gp3 to allow independent scaling of throughput and size while reducing storage costs.

Cevap

Deploy the Amazon CloudWatch agent to the EC2 instances in the member accounts to collect and report memory utilization metrics, and modify the EBS volumes from gp2 to gp3 to allow independent scaling of throughput and size while reducing storage costs.
Deploying the Amazon CloudWatch agent is correct because memory is an operating system-level metric that is not visible to the hypervisor. AWS Compute Optimizer requires the agent to be configured to receive these metrics. Modifying gp2 volumes to gp3 is correct because gp3 volumes decouple throughput and IOPS from storage capacity, enabling cost savings and rightsizing without overprovisioning storage size.

Adım Adım Çözüm

1
Identify the cause of missing memory metrics in AWS Compute Optimizer.
Realize that memory metrics are OS-level metrics and require the Amazon CloudWatch agent to be installed on the EC2 instances.
AWS Compute Optimizer cannot access memory utilization metrics by default because they are not monitored at the hypervisor level.
2
Identify the optimization strategy for gp2 volumes overprovisioned for throughput.
Choose gp3 volumes as the target class, which allows independent provisioning of IOPS and throughput without scaling volume size.
Migrating to gp3 directly solves the issue of overprovisioning storage size solely to get higher throughput.

Anahtar Kavram

AWS Compute Optimizer rightsizing requirements and EBS volume performance optimization.
Soru 20Soru →

A SysOps administrator has configured a Network Load Balancer (NLB) to route custom TCP traffic on port 9000 to a target group of Amazon EC2 instances located in private subnets. The targets are registered by instance ID. Although the application is running on all instances and successfully listening on port 9000, the target group shows all EC2 instances as unhealthy. Which of the following configuration issues could be the cause of the failing health checks? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The security group of the EC2 instances does not permit inbound traffic from the private IP addresses of the NLB nodes on port 9000.; The target group health check protocol is set to HTTP, but the application running on the instances only supports raw TCP connections.

Cevap

The target group health checks are failing because the EC2 instances' security groups do not allow inbound traffic from the private IP addresses of the Network Load Balancer nodes, and the target group is misconfigured to use HTTP health checks for an application that only supports raw TCP traffic.
The correct options identify the security group and protocol mismatch issues. When registering targets by instance ID, the NLB sends health checks from its private IP addresses. The target security groups must explicitly allow this inbound traffic. Additionally, an HTTP health check configuration expects an HTTP response code, which a raw TCP service cannot provide.

Adım Adım Çözüm

1
Analyze the network path for health checks between the Network Load Balancer (NLB) and the targets in the private subnets.
Since targets are registered by instance ID, the health checks originate from the NLB's private IP addresses, meaning the backend security groups must permit this inbound traffic.
Security groups on EC2 instances must allow inbound traffic from the load balancer on the health check port to allow health probes to succeed.
2
Examine the health check protocol configuration of the target group.
If the target group uses HTTP health checks but the application listens for raw TCP traffic, the health checks will fail due to protocol mismatch.
An HTTP health check requires a valid HTTP status code response (e.g., 200 OK), which a raw TCP application cannot provide.

Anahtar Kavram

Network Load Balancer health checks require proper security group configuration to allow private IP traffic from NLB nodes, and the health check protocol must match the backend application's capabilities.
Sayfa 1 / 23Sonraki