Courseiva

AWS Certified SysOps Administrator Associate SOA-C02 (SOA-C02) — Questions 1–75

247 questions total · 4pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 4

Page 2
1
MCQmedium

A company runs a stateful web application on a single Amazon EC2 instance. The application stores session state in memory and writes critical data to an Amazon EBS volume. The SysOps administrator needs to implement a highly available architecture that can tolerate an Availability Zone (AZ) failure. The administrator plans to use an Auto Scaling group and an Application Load Balancer (ALB). Which combination of steps is required to make the application highly available while preserving session and data durability across AZ failures?

A.Create an AMI of the current instance, configure an Auto Scaling group with a launch template that uses the AMI, and attach the existing EBS volume to new instances.
B.Create a multi-AZ Auto Scaling group and use sticky sessions (session affinity) on the ALB to tie users to specific instances.
C.Use an Auto Scaling group across multiple AZs, migrate session storage to Amazon ElastiCache (multi-AZ), and migrate application data from EBS to Amazon EFS (file system mounted across AZs).
D.Use an Auto Scaling group in a single AZ and use a Multi-AZ RDS instance for data storage.
AnswerC

ElastiCache provides a shared, cross-AZ in-memory session store. EFS provides a shared, cross-AZ file system. The Auto Scaling group launches instances in multiple AZs, and the ALB distributes traffic. This architecture survives an AZ failure.

Why this answer

It addresses both session state and data durability across AZ failures. Migrating session storage to ElastiCache (multi-AZ) ensures session data survives instance failure, and migrating application data from EBS to EFS provides a shared, multi-AZ file system that persists independently of any single EC2 instance. This combination allows the Auto Scaling group to launch new instances in any AZ and immediately access both session and application data.

Exam trap

The trap here is that candidates often assume sticky sessions (session affinity) alone are sufficient for high availability, but they fail to realize that sticky sessions do not replicate session state across instances, so an instance failure still loses the session data.

How to eliminate wrong answers

Option A is wrong because attaching the existing EBS volume to new instances is not possible across AZs (EBS volumes are AZ-scoped) and does not provide a shared, durable data layer; it also fails to address session state persistence. Option B is wrong because sticky sessions alone do not preserve session data if the instance fails; they only route traffic to the same instance, and if that instance goes down, the session is lost. Option D is wrong because using a single AZ for the Auto Scaling group cannot tolerate an AZ failure, and while Multi-AZ RDS handles database durability, it does not address the application's in-memory session state or EBS-stored data.

Full explanation →
2
MCQeasy

A SysOps administrator maintains an AWS CloudFormation stack that deploys an Amazon EC2 instance. The administrator needs to change the instance type from t2.micro to t3.micro. The administrator wants to review the proposed changes before applying them to ensure no unexpected resource replacement occurs. Which CloudFormation feature should the administrator use?

A.Use the AWS CloudFormation console to directly update the stack with the new instance type and monitor the events.
B.Create a change set from the updated template, review the changes, and then execute the change set.
C.Use the AWS CloudFormation drift detection feature to check for differences between the stack and the template.
D.Modify the CloudFormation template locally and use the AWS CLI to validate it with 'aws cloudformation validate-template'.
AnswerB

A change set is generated from an updated template against the current stack, providing a detailed, resource-by-resource summary of whether CloudFormation will add, modify, or replace resources. Because changing an EC2 instance type typically requires replacement, the change set would explicitly flag a "Replace" action, letting the administrator assess the impact and even cancel before executing. Only after reviewing and confirming the change set is it executed, and the execution applies the exact changes that were previewed.

Why this answer

A change set allows the administrator to review the proposed modifications (including whether any resource replacement will occur) before applying them. By creating a change set from the updated template, the administrator can inspect the list of changes, such as the instance type update, and confirm that no unexpected resource replacement (e.g., a new EC2 instance being created) will happen. Only after reviewing the change set can the administrator safely execute it to apply the changes.

Exam trap

The trap here is that candidates confuse change sets with drift detection or template validation, not realizing that change sets are specifically designed to preview the impact of stack updates before execution.

How to eliminate wrong answers

Option A is wrong because directly updating the stack via the console applies changes immediately without a review step, so the administrator cannot preview whether resource replacement will occur. Option C is wrong because drift detection compares the current stack resources against the expected template configuration to identify manual changes, not to preview proposed updates before applying them. Option D is wrong because 'aws cloudformation validate-template' only checks the syntax of the template, not the impact of changes on existing resources or whether replacement will occur.

Full explanation →
3
Multi-Selectmedium

A SysOps administrator needs to restrict access to an S3 bucket so that only users from the corporate network IP range (203.0.113.0/24) can read objects. Which TWO elements are required to implement this? (Choose two.)

Select 2 answers
A.An IAM policy that allows s3:GetObject from the corporate IP
B.Amazon CloudFront distribution with an origin access identity
C.The S3 endpoint URL (s3.amazonaws.com) accessible from the corporate network
D.An S3 bucket policy with a condition that uses aws:SourceIp
E.A VPC gateway endpoint for S3
AnswersC, D

For a bucket policy with an aws:SourceIp condition to take effect, the S3 REST endpoint (s3.amazonaws.com) must be reachable from the corporate network. If outbound firewall rules, proxy settings, or DNS resolution prevent access to this endpoint, the request will never reach S3, and the policy condition will never be evaluated. Ensuring endpoint connectivity is therefore a necessary prerequisite for the IP-based access restriction to work as intended.

Why this answer

To restrict access to an S3 bucket based on IP range, two elements are required: an S3 bucket policy with a condition using aws:SourceIp to allow s3:GetObject only from the corporate IP range (203.0.113.0/24), and the S3 endpoint (s3.amazonaws.com) must be reachable from the corporate network (typically over the internet). Option A is incorrect because an IAM policy by itself does not restrict bucket-level access; a bucket policy is needed. Option B is not required as CloudFront is not necessary for IP-based restrictions.

Option E is incorrect because a VPC endpoint is used for private connectivity within a VPC, not for restricting access from an external IP range.

Full explanation →
4
MCQeasy

A company uses AWS CodeCommit to store its source code and AWS CodeBuild to compile and test the code. The SysOps administrator is setting up a new build project that needs to access a private Amazon S3 bucket to download build dependencies. The build project runs in a VPC. The administrator has attached an IAM role to the build project with permissions to access the S3 bucket. However, the build fails with an access denied error when trying to download the dependencies. The S3 bucket is in the same region and account. What should the administrator do to resolve the issue?

A.Attach an internet gateway to the VPC to provide internet access.
B.Configure the security group for CodeBuild to allow outbound traffic to the S3 bucket.
C.Create a VPC endpoint for Amazon S3 and associate it with the VPC where CodeBuild runs.
D.Update the IAM role to include 's3:ListBucket' permission.
AnswerC

Creating a VPC endpoint for Amazon S3 (gateway or interface type) and associating it with the VPC where CodeBuild runs gives the build container a private, routable path to S3 without traversing the public internet. Because CodeBuild runs inside the VPC on elastic network interfaces, outbound traffic to S3 will only succeed if the VPC has a route to S3 via a gateway endpoint or a NAT/internet gateway. The gateway endpoint uses prefix lists to route S3 traffic within the AWS network, which resolves the access denied error caused by the lack of network connectivity. This is the intended fix because the root cause is a network routing problem, not missing IAM permissions or security group misconfiguration.

Why this answer

When CodeBuild runs in a VPC, it cannot access S3 endpoints over the internet by default. An S3 VPC endpoint allows CodeBuild to access S3 privately without needing an internet gateway or NAT. The IAM role already has the necessary permissions; the issue is network connectivity.

Full explanation →
5
MCQeasy

A company stores sensitive data in an RDS database. Which AWS service should be used to encrypt the database at rest?

A.AWS Certificate Manager (ACM)
B.AWS Identity and Access Management (IAM)
C.AWS Key Management Service (KMS)
D.AWS CloudHSM
AnswerC

AWS Key Management Service (KMS) is a managed service for creating and controlling customer master keys (CMKs) that encrypt data at rest across AWS services, including Amazon RDS. When you enable encryption on an RDS instance, RDS uses a KMS CMK to encrypt the underlying EBS storage, automated backups, snapshots, and read replicas, with encryption handled transparently by the service. KMS is the only service among these options that natively integrates with RDS for at-rest encryption, making it the correct choice.

Why this answer

AWS Key Management Service (KMS) provides encryption keys that can be used to enable encryption at rest for Amazon RDS databases. Option A is incorrect because AWS Certificate Manager (ACM) is used for managing SSL/TLS certificates, not for encryption at rest. Option B is incorrect because AWS Identity and Access Management (IAM) manages user identities and permissions, not encryption keys.

Option D is incorrect because AWS CloudHSM provides hardware security modules but is not the primary service used for RDS encryption; KMS is the simpler and recommended service for RDS encryption.

Full explanation →
6
Multi-Selectmedium

A SysOps administrator is creating an AWS CloudFormation template to deploy a web application. The template will create an Application Load Balancer (ALB), an Auto Scaling group, and an Amazon RDS database. The administrator wants to ensure that the Auto Scaling group is created only after the ALB and the RDS database are fully created and available. Which TWO actions should the administrator take? (Choose two.)

Select 2 answers
A.Add a DependsOn attribute to the Auto Scaling group resource that lists only the ALB resource.
B.Add a DependsOn attribute to the Auto Scaling group resource that lists both the ALB and the RDS database resources.
C.Add an UpdatePolicy to the Auto Scaling group resource to wait for a signal.
D.Add a CreationPolicy to the RDS database resource to wait for a signal that the database is available.
E.Add a CreationPolicy to the Auto Scaling group resource to wait for a signal from the instances.
AnswersB, D

This ensures the Auto Scaling group is created after both resources are created.

Why this answer

To ensure the Auto Scaling group is created only after both the ALB and RDS database are fully available, the administrator should add a DependsOn attribute to the Auto Scaling group that lists both the ALB and RDS resources (Option B). This ensures CloudFormation creates the group after those resources. Additionally, a CreationPolicy on the RDS database resource (Option D) can be used to wait for a signal (e.g., from a cfn-signal script) indicating that the database is fully operational and accepting connections, ensuring it is 'fully available' before the Auto Scaling group creation proceeds.

Option A is incorrect because it only lists the ALB, ignoring RDS. Option C is irrelevant for creation order. Option E addresses instance signaling, not resource creation.

Full explanation →
7
MCQmedium

A company requires that all users in an AWS account must authenticate with multi-factor authentication (MFA) before they can perform any actions on Amazon EC2 instances. The SysOps administrator needs to implement this requirement using IAM policies. Which IAM policy condition key should be used to enforce MFA?

A.aws:SourceIp
B.aws:MultiFactorAuthPresent
C.aws:RequestedRegion
D.iam:PassedToService
AnswerB

This condition key checks if the requester authenticated with an MFA device. It can be used to require MFA for specific actions.

Why this answer

The `aws:MultiFactorAuthPresent` condition key checks whether the user authenticated using a valid MFA device before making the API request. By setting this condition to `true` in an IAM policy, you can enforce that all actions on EC2 instances require MFA authentication, meeting the company's requirement.

Exam trap

The trap here is that candidates often confuse `aws:MultiFactorAuthPresent` with `aws:SourceIp` or `iam:PassedToService`, thinking IP-based or role-passing conditions can enforce MFA, but only the MFA-specific condition key directly checks authentication strength.

How to eliminate wrong answers

Option A is wrong because `aws:SourceIp` restricts access based on the source IP address, not MFA status. Option C is wrong because `aws:RequestedRegion` limits actions to specific AWS regions, not MFA enforcement. Option D is wrong because `iam:PassedToService` controls which roles can be passed to AWS services, not MFA authentication.

Full explanation →
8
MCQmedium

An environment has 12 individual CloudWatch metric alarms covering CPU, memory, disk, and network. When one instance degrades, all 12 alarms fire simultaneously and send 12 separate notifications to the on-call engineer. The team wants a single notification per incident regardless of how many individual alarms trigger. What CloudWatch feature addresses this?

A.Create a composite alarm that enters ALARM state when any of the 12 child alarms is in ALARM state, and configure a single SNS action on the composite alarm only
B.Increase the alarm evaluation period on all 12 alarms to 30 minutes so they fire less frequently
C.Use an SNS topic with a delivery policy that batches notifications sent within a 60-second window
D.Configure all 12 alarms to write to the same CloudWatch Events rule and suppress duplicate events with EventBridge deduplication
AnswerA

The composite alarm's rule expression 'ALARM(alarm1) OR ALARM(alarm2) OR ...' triggers when any child fires. By routing all notifications through the composite alarm's action and removing actions from the child alarms, exactly one notification is sent per incident. Child alarm states remain visible in the console for root cause analysis.

Why this answer

A composite alarm in CloudWatch can aggregate multiple child alarms into a single parent alarm. When any of the 12 child alarms enters the ALARM state, the composite alarm transitions to ALARM and triggers a single SNS notification, thereby reducing alert noise to one notification per incident.

Exam trap

The trap here is that candidates may think SNS batching or EventBridge deduplication can consolidate separate alarm notifications, but those services do not aggregate distinct alarm state changes into a single event; only composite alarms provide that logical grouping.

How to eliminate wrong answers

Option B is wrong because increasing the evaluation period to 30 minutes does not consolidate multiple notifications into one; it merely delays the alarms, and all 12 would still fire individually after the longer period. Option C is wrong because SNS delivery policies control retries and message batching for HTTP/HTTPS endpoints, not deduplication or aggregation of separate alarm notifications; each alarm still sends its own message to the topic. Option D is wrong because CloudWatch Events (now EventBridge) can route alarm state changes to targets, but EventBridge deduplication applies to events based on a deduplication ID and is designed for idempotent event processing, not for collapsing multiple distinct alarm events into a single notification.

Full explanation →
9
MCQeasy

An application runs on c5.xlarge EC2 instances 24 hours a day, 7 days a week in us-east-1. The workload is stable and will not change instance type for at least 12 months. The team wants to reduce compute costs by 30 to 40 percent compared to On-Demand pricing. Which purchasing option achieves this with the lowest financial risk?

A.Purchase a 1-year Standard Reserved Instance for c5.xlarge in us-east-1 with All Upfront or Partial Upfront payment
B.Use Spot Instances with an interruption tolerance of 5 minutes for the workload
C.Enable EC2 Auto Scaling with a target tracking policy to scale down to zero instances during off-peak hours
D.Purchase a 3-year Convertible Reserved Instance to maximize the discount percentage
AnswerA

A 1-year Standard RI matches the 12-month stability horizon and delivers 30–40 percent savings versus On-Demand. All Upfront provides the deepest discount; Partial Upfront reduces the upfront cash requirement with a slightly lower overall saving. The 1-year commitment limits risk compared to a 3-year commitment for an uncertain future period.

Why this answer

A 1-year Standard Reserved Instance (RI) with All Upfront or Partial Upfront payment offers a 30-40% discount over On-Demand pricing for a stable, always-on workload. This option provides the lowest financial risk because it commits to a fixed instance type and region for only one year, matching the workload's stable nature without the flexibility premium of Convertible RIs or the interruption risk of Spot Instances.

Exam trap

The trap here is that candidates may choose the 3-year Convertible RI (Option D) for its higher discount percentage, overlooking the fact that the longer commitment and unnecessary flexibility introduce greater financial risk for a stable, unchanging workload.

How to eliminate wrong answers

Option B is wrong because Spot Instances can be interrupted with as little as a 5-minute warning, which introduces significant financial and operational risk for a workload that must run 24/7 without interruption. Option C is wrong because scaling down to zero instances during off-peak hours would violate the requirement that the application runs 24/7, and it does not address the need to reduce costs for the always-on baseline. Option D is wrong because a 3-year Convertible Reserved Instance, while offering a higher discount percentage, introduces greater financial risk due to the longer commitment period and the unnecessary flexibility to change instance types, which the workload does not require.

Full explanation →
10
MCQmedium

A SysOps administrator notices that the monthly bill for Amazon S3 has increased significantly. The company uses S3 for storing application logs and user uploads. The logs are accessed rarely but must be retained for 3 years. User uploads are accessed frequently for the first 30 days, then rarely after. Which S3 lifecycle policy will optimize storage costs?

A.Transition logs to S3 Glacier Deep Archive after 30 days, and transition user uploads to S3 Standard-IA after 30 days, then to Glacier Deep Archive after 90 days.
B.Transition user uploads to S3 Glacier Deep Archive after 30 days, and transition logs to S3 Glacier after 90 days.
C.Move logs to S3 Glacier Deep Archive after 30 days, and delete user uploads after 1 year.
D.Transition logs to S3 Standard-IA after 30 days, and transition user uploads to S3 One Zone-IA after 30 days.
AnswerA

This is correct because logs are typically append-only and rarely accessed after the first 30 days, making S3 Glacier Deep Archive the lowest-cost storage class while satisfying the 3-year retention requirement. User uploads, however, are frequently accessed in the month after upload, so S3 Standard-IA after 30 days reduces cost without sacrificing retrieval performance; then transitioning to Glacier Deep Archive after 90 days aligns with the access drop-off and keeps lifecycle costs minimal.

Why this answer

This lifecycle policy optimizes costs by transitioning logs (rarely accessed but need retention) directly to S3 Glacier Deep Archive after 30 days, and for user uploads (frequently accessed for the first 30 days, then rarely), transition to S3 Standard-IA after 30 days, then to Glacier Deep Archive after 90 days. Option B is wrong because it transitions user uploads (initially frequent access) to Glacier Deep Archive too early, causing retrieval costs. Option C is wrong because logs should be archived, but deleting user uploads after 1 year may be premature.

Option D is wrong because it transitions logs to Standard-IA, which is not cost-effective for long-term retention, and user uploads to One Zone-IA, which lacks durability.

Full explanation →
11
MCQmedium

A company uses AWS CodePipeline to automate the deployment of a web application. The pipeline consists of a source stage (AWS CodeCommit) and a deploy stage (AWS CodeDeploy) that deploys to an Auto Scaling group. The SysOps administrator needs to add a stage to run automated unit tests before the deployment proceeds. The tests must be executed in an isolated environment, and if they fail, the pipeline must stop and notify the development team. Which action should the administrator take?

A.Add a manual approval action between the source and deploy stages. The development team will manually run the tests on their local machines and then approve the pipeline to proceed.
B.Insert a test stage after the source stage with an AWS CloudFormation action that deploys a test stack and runs tests using a custom resource Lambda function.
C.Add a stage between source and deploy that uses an AWS CodeBuild action to run unit tests defined in a buildspec file. The pipeline will automatically stop if the build action fails.
D.Add a Lambda function as an action in the pipeline that runs the unit tests. The Lambda function writes the test results to an S3 bucket, and a subsequent approval action checks the results.
AnswerC

CodeBuild is the ideal service for running automated tests in a controlled environment. It integrates natively with CodePipeline: if the CodeBuild build fails, the pipeline transitions to a failed state, stopping further execution and optionally sending notifications via Amazon SNS.

Why this answer

AWS CodeBuild is natively integrated with CodePipeline to run automated tests defined in a buildspec file. When the build action fails, CodePipeline automatically stops the pipeline execution and can send notifications via Amazon SNS, meeting the requirement for an isolated test environment and automatic failure notification without manual intervention.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing CloudFormation or Lambda, overlooking that CodeBuild is the native, simplest, and most cost-effective service for running automated tests within a CodePipeline.

How to eliminate wrong answers

Option A is wrong because it relies on manual approval and local test execution, which violates the requirement for automated tests in an isolated environment and does not provide automatic pipeline stop on test failure. Option B is wrong because using a CloudFormation action to deploy a test stack and run tests via a custom Lambda function adds unnecessary complexity, cost, and latency; it also does not natively integrate with CodePipeline's failure handling as cleanly as CodeBuild. Option D is wrong because a Lambda function action in CodePipeline cannot directly run unit tests in an isolated environment; it would require custom orchestration, and the subsequent approval action would not automatically stop the pipeline on failure—it would only pause for manual review.

Full explanation →
12
MCQmedium

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and receive an email notification when the metric exceeds 90% for 5 consecutive minutes. The solution should use the least operational overhead. Which combination of AWS services should be used?

A.Create a CloudWatch alarm on the CPUUtilization metric and configure the alarm to send a notification to an Amazon SNS topic with email subscriptions.
B.Create an Amazon EventBridge rule that triggers an AWS Lambda function to check the CPUUtilization metric and send an email via Amazon SES.
C.Configure the EC2 instance to publish CPU logs to Amazon CloudWatch Logs, then create a metric filter to detect high CPU and trigger an SNS notification.
D.Use AWS CloudTrail to monitor EC2 CPU metrics and send notifications to an Amazon SQS queue.
AnswerA

This is the simplest approach. CloudWatch natively monitors EC2 metrics and can trigger SNS notifications without any custom code.

Why this answer

A CloudWatch alarm directly monitors the CPUUtilization metric for an EC2 instance and can be configured to evaluate whether the metric exceeds 90% for 5 consecutive minutes (e.g., 5 evaluation periods of 1 minute each). The alarm then publishes to an Amazon SNS topic, which sends email notifications to subscribed endpoints, requiring no additional infrastructure or code, thus minimizing operational overhead.

Exam trap

The trap here is that candidates may overcomplicate the solution by introducing Lambda or log-based filters, when the simplest and most direct path—a CloudWatch alarm on the existing CPUUtilization metric with an SNS action—is the correct answer for minimal operational overhead.

How to eliminate wrong answers

Option B is wrong because it introduces unnecessary complexity by using an EventBridge rule and a Lambda function to poll or process metrics, which increases operational overhead and latency compared to a native CloudWatch alarm. Option C is wrong because publishing CPU logs to CloudWatch Logs and creating a metric filter is designed for log-based metrics (e.g., parsing log entries), not for the native CPUUtilization metric, which is already available as a CloudWatch metric without logs. Option D is wrong because AWS CloudTrail records API calls and management events, not EC2 CPU utilization metrics, and cannot monitor or trigger notifications based on performance metrics.

Full explanation →
13
MCQmedium

A company runs a critical production database on Amazon RDS for MySQL with Multi-AZ deployment. The SysOps administrator needs to be automatically notified when a failover event occurs, and also capture the exact time and reason for the failover for compliance purposes. Which AWS service or feature should be used to capture the failover event details with the least operational overhead?

A.Create an Amazon CloudWatch Events rule that matches the 'RDS DB Instance Event' for 'failover' and sends the event to an Amazon SNS topic for notification and logging.
B.Enable detailed monitoring on the RDS instance and stream the logs to Amazon CloudWatch Logs where a metric filter can detect failover patterns.
C.Configure AWS CloudTrail to log all RDS API calls and analyze the logs for the 'Failover' event type.
D.Use AWS Config to create a config rule that evaluates whether the 'DBInstanceStatus' changes to 'failover' and then trigger a remediation action.
AnswerA

Amazon CloudWatch Events (now part of Amazon EventBridge) natively integrates with RDS event notifications, emitting a structured event whenever a DB instance experiences a failover. By creating a rule that matches the 'RDS DB Instance Event' source and the specific detail type for failover, you can route that event to an SNS topic in near-real time, enabling automated alerting, logging, and downstream remediation. This is the intended, low-overhead approach because RDS already publishes these lifecycle events, and no polling or custom detection logic is required.

Why this answer

Amazon CloudWatch Events (now part of Amazon EventBridge) can match RDS DB Instance events, including 'failover', and route them to an SNS topic for notification and to CloudWatch Logs for logging. This approach requires no custom scripting or polling, providing the least operational overhead while capturing the exact time and reason for the failover directly from the RDS event stream.

Exam trap

The trap here is that candidates confuse CloudTrail (which logs API calls) with RDS events (which log internal service events), leading them to choose CloudTrail even though automatic failovers are not API-driven and thus not recorded by CloudTrail.

How to eliminate wrong answers

Option B is wrong because detailed monitoring on RDS provides enhanced metrics (e.g., CPU, memory) but does not generate failover events or detect failover patterns; metric filters on CloudWatch Logs would require RDS to log failover details to CloudWatch Logs, which RDS does not do by default. Option C is wrong because AWS CloudTrail logs API calls (e.g., FailoverDBInstance), not internal failover events triggered by AWS; a Multi-AZ failover is an automatic process, not an API call, so CloudTrail will not capture it. Option D is wrong because AWS Config evaluates resource configuration changes (e.g., DBInstanceStatus) but does not natively detect a 'failover' status change; the DBInstanceStatus transitions through multiple states (e.g., 'creating', 'available', 'resetting-master-credentials') and 'failover' is not a valid status—Config rules would require custom logic and still not capture the exact reason for the failover.

Full explanation →
14
MCQhard

Refer to the exhibit. A security group is attached to an Application Load Balancer (ALB) that serves HTTPS traffic on port 443. Users can access the application via HTTPS. However, the ALB's health checks to targets on port 80 are failing. What is the reason?

A.The ALB's security group does not allow HTTPS traffic from the internet.
B.The security group for the target instances does not allow HTTP traffic from the ALB's security group.
C.The ALB's security group does not allow HTTP traffic from the target's IP range.
D.The health check is configured to use HTTPS, but the target only supports HTTP.
AnswerB

This is correct because the ALB sends health check requests from its own network interfaces, using the ALB's security group as the source in the allowed inbound rule on each target. The target instance's security group must explicitly allow inbound TCP on the health check port (HTTP/80) from the ALB's security group ID (or from the VPC CIDR if the security group reference is not used). Without that rule, the OS receives the SYN packet but the security group silently drops it, so the health check times out and the target is marked unhealthy. This is the standard root cause for healthy-app-turned-unhealthy after an ALB change or when targets are in a different security group.

Why this answer

The ALB's security group allows inbound HTTPS from anywhere (0.0.0.0/0) on port 443, and inbound HTTP from the VPC CIDR (10.0.0.0/16) on port 80. Health checks originate from the ALB's private IP addresses, which are within the VPC CIDR. Therefore, the ALB's security group is correctly configured.

The health checks fail because the target instances' security group does not allow inbound HTTP traffic from the ALB's security group. When the target's security group lacks a rule permitting traffic from the ALB's security group, the health check requests are blocked. Option A is incorrect because the ALB's security group does allow HTTPS from the internet.

Option C is incorrect because the ALB's security group allows HTTP from the VPC CIDR, which includes the target's IP range. Option D is incorrect because health checks are configured on port 80 (HTTP), not HTTPS.

Full explanation →
15
MCQmedium

A company is deploying a new web application using AWS Elastic Beanstalk. The application requires a custom Amazon Machine Image (AMI) with specific software pre-installed. The SysOps administrator creates a custom AMI and configures Elastic Beanstalk to use it. However, during deployment, the instances fail to pass the health check. The health check endpoint is a simple 'index.html' file. What is the MOST likely cause?

A.The Elastic Beanstalk environment was created before the custom AMI was registered.
B.The custom AMI does not have a web server installed and configured to serve the application.
C.The custom AMI is not registered with the same account that owns the Elastic Beanstalk environment.
D.The custom AMI does not have the latest patches, causing the instance to fail the EC2 status checks.
AnswerB

The health check performed by Elastic Beanstalk is an HTTP request to the environment's health check path (typically / on port 80). If the custom AMI lacks a web server or the web server isn't configured to serve the application, the ELB health check receives a connection refused or non-2xx response, causing the instance to be marked unhealthy. Simply having a running EC2 instance is insufficient; the AMI must include the same web server and configuration as the standard Elastic Beanstalk platform AMI to serve traffic.

Why this answer

Elastic Beanstalk expects the web server (e.g., Apache, Nginx) to be installed and configured to serve the application. If the custom AMI does not have a web server installed, the health check endpoint will not respond. Option A is incorrect because the environment URL is created regardless of the AMI.

Option C is incorrect because Elastic Beanstalk does not require a specific AMI ID; it uses the one provided. Option D is incorrect because the health check is based on HTTP response, not instance status checks.

Full explanation →
16
MCQeasy

A SysOps administrator needs to deploy a new version of a web application to Amazon EC2 instances using AWS Elastic Beanstalk. The administrator wants to deploy the new version with zero downtime and validate the new version before routing production traffic to it. Which deployment policy should be used?

A.All at once
B.Rolling
C.Immutable
D.Traffic splitting
AnswerC

The immutable deployment policy launches a completely new set of instances with the new application version. Once healthy, the environment's CNAME is switched to the new instances, providing zero downtime and the ability to validate the new version before traffic is routed.

Why this answer

Immutable deployment is correct because it launches a completely new set of EC2 instances in a separate Auto Scaling group, deploys the new application version to them, and passes health checks before swapping the environment's CNAME record to point to the new instances. This ensures zero downtime and allows validation of the new version before any production traffic is routed to it, as the old instances remain untouched until the swap is complete.

Exam trap

The trap here is that candidates confuse 'Traffic splitting' with 'canary testing' and assume it allows pre-validation, but in Elastic Beanstalk, traffic splitting immediately routes a percentage of live traffic to the new version, whereas immutable deployment keeps all traffic on the old version until the new version is fully validated and swapped.

How to eliminate wrong answers

Option A is wrong because All at once deploys the new version to all instances simultaneously, causing downtime during the deployment and no ability to validate before traffic is routed. Option B is wrong because Rolling deploys the new version in batches across existing instances, which can cause a brief period of reduced capacity and does not allow full validation of the new version before all traffic is switched; it also does not guarantee zero downtime if health checks fail mid-batch. Option D is wrong because Traffic splitting (canary deployment) routes a percentage of traffic to the new version immediately, which does not allow validation before any production traffic is sent; it is designed for gradual traffic shifting, not pre-validation with zero initial traffic.

Full explanation →
17
Multi-Selecteasy

A company wants to ensure that their Amazon S3 bucket policy only allows access from a specific VPC endpoint. Which TWO condition keys can be used in the bucket policy? (Choose TWO.)

Select 2 answers
A.s3:SourceVpce
B.aws:SourceIp
C.aws:SourceVpc
D.ec2:Vpc
E.aws:SourceVpce
AnswersC, E

aws:SourceVpc is the correct condition key because it allows S3 bucket policies to restrict access to requests originating from a specific VPC by using the VPC ID (e.g., vpc-0abc123). It ensures that only EC2 instances, Lambda functions, or other resources within that VPC can access the bucket, without needing to know the individual IP addresses.

Why this answer

The correct condition keys are 'aws:SourceVpc' (option C) and 'aws:SourceVpce' (option E). 'aws:SourceVpc' restricts access to all VPC endpoints within a specified VPC, while 'aws:SourceVpce' restricts access to a specific VPC endpoint. Option A 's3:SourceVpce' is not a valid condition key. Option B 'aws:SourceIp' is used for IP address restrictions, not VPC endpoints.

Option D 'ec2:Vpc' is not applicable in S3 bucket policies.

Full explanation →
18
MCQeasy

A SysOps administrator wants to automate the creation of an AWS Lambda function and its associated IAM role using infrastructure as code. Which AWS service should be used?

A.AWS CloudFormation
B.AWS Elastic Beanstalk
C.AWS CodeDeploy
D.AWS Systems Manager
AnswerA

AWS CloudFormation is the native infrastructure-as-code service that lets you define the Lambda function, IAM role, and every related resource in a declarative JSON or YAML template. CloudFormation automatically handles resource dependencies, creation order, and rollback on failure, making it ideal for automating repeatable, consistent environments. It is the correct tool because you need to provision the resources themselves, not just deploy code to existing infrastructure.

Why this answer

AWS CloudFormation is the correct service because it allows you to define both the Lambda function and its IAM role as infrastructure as code using a template (JSON or YAML). CloudFormation handles the creation, updating, and deletion of these resources in an orderly, repeatable manner, ensuring the IAM role is created before the Lambda function due to dependency management.

Exam trap

The trap here is that candidates often confuse AWS CodeDeploy (which can deploy Lambda code) with the ability to create the Lambda function and its IAM role, but CodeDeploy does not provision the underlying infrastructure resources—it only handles the deployment of the code to an existing function.

How to eliminate wrong answers

Option B (AWS Elastic Beanstalk) is wrong because it is a PaaS service designed for deploying and scaling web applications, not for creating individual Lambda functions and IAM roles via infrastructure as code. Option C (AWS CodeDeploy) is wrong because it automates code deployments to EC2, Lambda, or on-premises instances, but it does not provision the underlying IAM roles or Lambda function resources; it only deploys the code. Option D (AWS Systems Manager) is wrong because it provides operational management and automation for AWS resources (e.g., patching, runbooks), but it is not designed for declarative infrastructure provisioning of Lambda functions and IAM roles.

Full explanation →
19
Multi-Selecteasy

Which TWO actions should a SysOps administrator take to ensure high availability of a web application running on EC2 instances? (Choose two.)

Select 2 answers
A.Enable termination protection on all EC2 instances.
B.Launch all EC2 instances in a single Availability Zone.
C.Use a larger instance type for all EC2 instances.
D.Configure an Auto Scaling group with a health check to replace unhealthy instances.
E.Deploy EC2 instances across multiple Availability Zones.
AnswersD, E

Auto Scaling automatically replaces unhealthy instances.

Why this answer

An Auto Scaling group with a health check can automatically detect and replace unhealthy EC2 instances, ensuring that the web application remains available even if an instance fails. The health check can be configured to use Elastic Load Balancing (ELB) health checks or EC2 status checks to determine instance health, and the Auto Scaling group will launch a new instance to replace any that fails the health check.

Exam trap

The trap here is that candidates often confuse termination protection (a safety feature) with high availability, or think that larger instance types inherently provide fault tolerance, when in fact only redundancy across multiple Availability Zones and automated health-based replacement ensure high availability.

Full explanation →
20
MCQeasy

A company wants to securely store secrets such as database credentials and API keys used by applications running on Amazon EC2. Which AWS service should be used to manage and rotate these secrets automatically?

A.AWS Identity and Access Management (IAM)
B.AWS Secrets Manager
C.AWS Key Management Service (KMS)
D.AWS Systems Manager Parameter Store
AnswerB

AWS Secrets Manager is a purpose-built service for securely storing and managing database credentials, API keys, and other secrets throughout their lifecycle. It natively supports automatic rotation, either through built-in integration with AWS services like RDS, Redshift, and DocumentDB, or via custom AWS Lambda rotations. Unlike generic parameter storage, Secrets Manager enforces fine-grained IAM access policies and provides audit trails via AWS CloudTrail, making it the recommended choice for production secrets that require rotation and regulated access.

Why this answer

AWS Secrets Manager is designed to manage secrets, including automatic rotation. Option A is wrong because IAM is for AWS user credentials and permissions, not for storing application secrets. Option C is wrong because AWS KMS is for encryption keys, not secrets management.

Option D is wrong because AWS Systems Manager Parameter Store can store secrets but does not support automatic rotation natively (requires custom Lambda).

Full explanation →
21
Drag & Dropmedium

Drag and drop the steps to troubleshoot an unhealthy target in an Application Load Balancer target group into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Troubleshooting starts with security group rules, then health check configuration, then instance and application status, then logs, and finally replacement if needed.

Full explanation →
22
Multi-Selecthard

A company's security team requires that all API calls to AWS services are encrypted in transit using TLS 1.2 or higher. Which TWO actions should be taken to enforce this?

Select 2 answers
A.Enable AWS CloudTrail to log all API calls.
B.Configure EC2 security groups to only allow HTTPS traffic.
C.Use AWS CloudTrail to monitor for API calls using TLS 1.0 and generate alerts.
D.Create an IAM policy that denies access unless the request uses TLS 1.2.
E.Create an SCP that denies AWS API calls using protocols lower than TLS 1.2.
AnswersC, E

CloudTrail can log TLS version; monitoring and alerting can detect non-compliance.

Why this answer

Options C and E are correct. Using AWS CloudTrail to monitor for API calls using TLS 1.0 allows the security team to detect non-compliant requests and generate alerts. Creating an SCP that denies AWS API calls using protocols lower than TLS 1.2 enforces encryption in transit at the organizational level.

Option A is incorrect because CloudTrail logging alone does not enforce encryption; it only records events. Option B is incorrect because EC2 security groups control network traffic to instances, not API calls to AWS services. Option D is incorrect because IAM policies can require HTTPS via the aws:SecureTransport condition, but cannot enforce a specific TLS version like 1.2.

Full explanation →
23
MCQhard

Instances in a private subnet need outbound internet access for software updates. The route table sends 0.0.0.0/0 to a NAT gateway, but updates fail. Which condition should you check first?

A.Confirm the NAT gateway is in a public subnet whose route table has 0.0.0.0/0 to an internet gateway.
B.Attach an internet gateway directly to the private subnet instances.
C.Replace all security groups with network ACLs.
D.Enable VPC peering to another account.
AnswerA

Without an IGW route from the NAT gateway subnet, outbound internet access fails.

Why this answer

A NAT gateway must reside in a public subnet with a route table entry directing 0.0.0.0/0 to an internet gateway (IGW). Without this, the NAT gateway cannot translate private IPs to the IGW's public IP, so outbound traffic from private instances fails. This is the most common root cause for failed internet access through a NAT gateway.

Exam trap

The trap here is that candidates assume any subnet with a NAT gateway automatically has internet access, overlooking the requirement that the NAT gateway itself must be in a public subnet with a default route to an internet gateway.

How to eliminate wrong answers

Option B is wrong because attaching an internet gateway directly to a private subnet is not supported; an IGW can only be attached to a VPC and associated with public subnets, and private subnet instances lack public IPs to use it directly. Option C is wrong because replacing security groups with network ACLs does not solve the routing issue; NACLs are stateless and can filter traffic, but they do not provide internet connectivity. Option D is wrong because VPC peering does not provide internet access; it only enables private connectivity between VPCs, and does not route traffic to the internet.

Full explanation →
24
MCQmedium

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The SysOps administrator checks the deployment logs and finds that the application installation script exits with a non-zero exit code. What is the MOST likely cause?

A.The Auto Scaling group does not have enough instances to meet the minimum capacity.
B.The security group for the instances blocks outbound traffic to CodeDeploy endpoints.
C.The AppSpec file contains a lifecycle hook that fails.
D.The CodeDeploy agent is outdated on the instances.
AnswerC

A failing lifecycle hook leads to non-zero exit code and deployment failure.

Why this answer

A non-zero exit code from an AppSpec lifecycle hook (e.g., ApplicationStop, BeforeInstall, AfterInstall, ApplicationStart, ValidateService) during the deployment process causes the overall deployment to fail. The error message indicates that individual instances failed deployment, and the installation script exiting with a non-zero exit code is a direct sign of a lifecycle hook failure. Option A is incorrect because insufficient instances in the Auto Scaling group would trigger a different error related to minimum capacity, not a script exit code.

Option B is incorrect because the security group blocking outbound traffic would prevent the CodeDeploy agent from communicating with the service, resulting in a connection error, not a script exit code issue. Option D is incorrect because an outdated CodeDeploy agent would typically produce agent-specific errors or version mismatch warnings, not a non-zero exit code from the installation script.

Full explanation →
25
Multi-Selecteasy

A SysOps administrator needs to monitor the disk space usage on an EC2 instance running Windows Server. Which actions are required to collect this metric? (Select TWO.)

Select 2 answers
A.Install the CloudWatch Logs agent to monitor disk usage logs.
B.Enable EC2 status checks to monitor disk health.
C.Use Windows Performance Monitor to track disk space and send to CloudWatch.
D.Create an IAM role with permissions to publish custom metrics and attach it to the instance.
E.Install the CloudWatch agent on the instance and configure it to collect disk metrics.
AnswersD, E

The instance needs IAM permissions to publish metrics.

Why this answer

The CloudWatch agent requires permissions to publish custom metrics to CloudWatch. An IAM role with the appropriate policy (e.g., CloudWatchAgentServerPolicy) must be attached to the EC2 instance to allow the agent to send disk space metrics. Option E is correct because the CloudWatch agent must be installed and configured with a JSON configuration file that includes the "disk" section to collect disk space utilization metrics, which are not available by default from EC2.

Exam trap

The trap here is that candidates often confuse the CloudWatch Logs agent with the CloudWatch agent, or assume that EC2 status checks or Performance Monitor can directly send disk metrics to CloudWatch without additional configuration.

Full explanation →
26
MCQeasy

A SysOps administrator needs to monitor the CPU utilization of an Amazon EC2 instance and send an alert when it exceeds 90% for 5 consecutive minutes. Which combination of AWS services should the administrator use to meet this requirement?

A.Amazon CloudWatch metric (CPUUtilization), a CloudWatch alarm, and an Amazon SNS topic.
B.Amazon CloudWatch Logs, a metric filter to extract CPU utilization from logs, and an alarm on that metric.
C.A CloudWatch dashboard and an AWS Lambda function that checks the dashboard periodically.
D.Amazon EventBridge (CloudWatch Events) and a Lambda function that calls the EC2 DescribeInstances API.
AnswerA

EC2 publishes a standard hypervisor-level CPUUtilization metric to CloudWatch every 5 minutes (or 1 minute with detailed monitoring). A CloudWatch alarm can evaluate that metric against a threshold using a period, statistic (e.g., Average), and evaluation periods, then transition to ALARM state and publish a message to an SNS topic, which can fan out to email, SMS, or HTTP endpoints. This is the native, least-effort, and most reliable pattern for triggering on CPU utilization; it requires no custom code, log filtering, or polling.

Why this answer

The correct approach is to use a CloudWatch metric for CPUUtilization, which is automatically published by EC2 instances. A CloudWatch alarm can be configured to evaluate this metric over a period of 5 consecutive minutes with a threshold of 90%, and when the alarm state is triggered, it publishes to an SNS topic to send notifications. This is the native, efficient, and recommended method for monitoring and alerting on EC2 CPU utilization.

Exam trap

The trap here is that candidates may confuse CloudWatch Logs metric filters (used for custom log-based metrics) with the built-in EC2 metrics, or think that EventBridge can directly access CPU utilization data, when in fact CPUUtilization is a CloudWatch metric and must be monitored via CloudWatch alarms.

How to eliminate wrong answers

Option B is wrong because CloudWatch Logs and metric filters are used to extract custom metrics from log data (e.g., application logs), not to monitor the built-in CPUUtilization metric which is already available as a CloudWatch metric without needing log extraction. Option C is wrong because a CloudWatch dashboard is a visualization tool and does not trigger alerts; a Lambda function polling a dashboard periodically is inefficient, introduces latency, and is not a supported pattern for real-time alerting. Option D is wrong because EventBridge and a Lambda function calling DescribeInstances API only retrieves instance metadata and state, not CPU utilization metrics; CPU utilization is a CloudWatch metric, not available via the EC2 DescribeInstances API.

Full explanation →
27
Multi-Selectmedium

A company needs to restrict access to an S3 bucket so that only users from a specific VPC can read objects. Which THREE configurations are required?

Select 3 answers
A.Create a bucket policy that denies access unless the request comes from a specific VPC endpoint.
B.Update the route table in the VPC to route S3 traffic through the VPC endpoint.
C.Create IAM users and assign them permissions to access the bucket.
D.Create a VPC endpoint for S3 in the specified VPC.
E.Attach a security group to the S3 bucket.
AnswersA, B, D

This bucket policy explicitly denies all S3 access unless the vpc:SourceVpce condition matches the specified VPC endpoint (e.g., vpce-12345678). You must include both an Allow statement for the principal (such as the account root) and a Deny statement with StringNotEquals to prevent all other network paths. Requests from the VPC endpoint will carry the vpcSourceVpce value automatically, so only traffic routed through that endpoint is permitted.

Why this answer

Options A, B, and D are correct. A bucket policy with a condition for vpc:SourceVpce, a VPC endpoint for S3, and route table updates are required. Option C is wrong because IAM users alone do not restrict access by VPC; a bucket policy with a VPC condition is needed.

Option E is wrong because security groups cannot be attached to S3 buckets as they are not network interfaces.

Full explanation →
28
MCQmedium

A company has two Amazon VPCs (VPC-A and VPC-B) in the same AWS Region with non-overlapping CIDR blocks. The SysOps administrator needs to establish private IP connectivity between the two VPCs with high throughput and minimal cost. Which solution should the administrator implement?

A.VPC Peering
B.AWS Transit Gateway
C.AWS VPN CloudHub
D.AWS Direct Connect
AnswerA

VPC peering allows private connectivity between two VPCs using AWS's private network. It is simple to set up, has no bandwidth limitations, and incurs no hourly cost. It is the most cost-effective solution for connecting two VPCs in the same region.

Why this answer

VPC Peering is the correct solution because it allows direct private IP connectivity between two VPCs in the same AWS Region using the AWS global network backbone, with no bandwidth bottlenecks, no single point of failure, and no additional cost beyond data transfer charges. Since the VPCs have non-overlapping CIDR blocks, they can be peered without route conflicts, and traffic flows entirely within AWS without traversing the public internet or requiring a transit hub.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing AWS Transit Gateway for its centralized routing features, forgetting that for a simple two-VPC peering scenario with non-overlapping CIDRs, VPC Peering is the most cost-effective and high-performance option without the overhead of a transit hub.

How to eliminate wrong answers

Option B (AWS Transit Gateway) is wrong because it introduces unnecessary complexity and cost (hourly per-attachment charges and data processing fees) for a simple two-VPC scenario where VPC Peering provides the same high throughput at lower cost. Option C (AWS VPN CloudHub) is wrong because it requires VPN connections over the public internet, which adds latency, reduces throughput, and incurs hourly VPN connection charges, making it less performant and more expensive than VPC Peering. Option D (AWS Direct Connect) is wrong because it is designed for hybrid connectivity between on-premises networks and AWS, not for VPC-to-VPC communication, and involves significant setup costs, long lead times, and monthly port fees that are unnecessary for this use case.

Full explanation →
29
MCQmedium

A SysOps administrator needs to monitor memory utilization on an Amazon EC2 instance. Memory metrics are not available by default in Amazon CloudWatch for EC2 instances. Which action should the administrator take to collect memory utilization metrics?

A.Install the CloudWatch agent on the EC2 instance
B.Enable detailed monitoring on the EC2 instance
C.Use an AWS Lambda function to query the EC2 instance for memory metrics
D.Use Amazon Inspector to collect memory metrics
AnswerA

The CloudWatch agent can collect memory and other system-level metrics from the EC2 instance and publish them to CloudWatch custom metrics.

Why this answer

The CloudWatch agent is the correct solution because it can collect custom metrics, including memory utilization, from EC2 instances. Unlike the default hypervisor-level metrics (CPU, network, disk), memory metrics require an in-guest agent to read the operating system's memory counters and publish them to CloudWatch.

Exam trap

The trap here is that candidates confuse 'detailed monitoring' (which increases metric frequency) with the ability to collect new metric types, assuming it will magically include memory metrics when it only affects existing hypervisor-level metrics.

How to eliminate wrong answers

Option B is wrong because enabling detailed monitoring only increases the frequency of default EC2 metrics (e.g., CPU, disk I/O) from 5 minutes to 1 minute; it does not add memory metrics. Option C is wrong because AWS Lambda cannot directly query an EC2 instance's OS-level memory metrics without an agent or API endpoint installed inside the instance. Option D is wrong because Amazon Inspector is a vulnerability assessment service that scans for software vulnerabilities and network exposures, not a tool for collecting OS-level performance metrics like memory utilization.

Full explanation →
30
MCQmedium

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application uses session stickiness (sticky sessions) to maintain user sessions. The SysOps administrator notices that when instances are replaced during a scale-in or failure event, users lose their session data. The administrator needs to preserve session data across instance failures without losing stickiness benefits. What should the administrator do?

A.Disable sticky sessions on the ALB and configure the application to store session data in an external session store like Amazon ElastiCache for Redis.
B.Increase the stickiness duration to a very high value so that sessions are not lost during brief interruptions.
C.Change the Auto Scaling group to use a larger instance type to handle more sessions per instance, reducing the likelihood of session loss.
D.Configure the Auto Scaling group to use a larger minimum size and a lower maximum, so instances are less likely to be terminated.
AnswerA

Disabling sticky sessions and moving session state to an external service like ElastiCache for Redis decouples user session data from individual EC2 instance lifecycles. When an ALB routes requests to any healthy instance, the instance can retrieve the session from Redis, so a failed or terminated instance does not lose state. Because ElastiCache replicates across AZs, sessions also survive single-cache-node failures, making the app tier effectively stateless and highly resilient.

Why this answer

It eliminates the dependency on stickiness by storing session data externally in Amazon ElastiCache for Redis. This way, if an instance fails or is scaled in, any other instance can retrieve the session data from the shared cache, preserving the user session. Disabling sticky sessions is necessary because with external storage, stickiness is no longer needed and can cause uneven load distribution.

Exam trap

The trap is that candidates may think they need to keep stickiness active, but the correct solution is to remove stickiness and store session data externally. Stickiness only provides routing affinity, not data persistence, and with external storage, any instance can serve any session.

How to eliminate wrong answers

Option B is wrong because increasing the stickiness duration does not preserve session data when an instance is terminated or fails; it only controls how long the ALB remembers the routing cookie, but the session data stored locally on the instance is still lost. Option C is wrong because using a larger instance type does not solve the fundamental problem of session data being stored locally; it only reduces the frequency of scale-in events but does not protect against instance failures or replacements. Option D is wrong because adjusting the Auto Scaling group's minimum and maximum sizes does not prevent session loss during scale-in or failure events; it only changes the number of instances running, but any instance that is terminated or replaced will still lose its locally stored session data.

Full explanation →
31
Multi-Selecteasy

A SysOps administrator is implementing an automated backup solution for Amazon RDS databases. The solution must support point-in-time recovery and cross-region disaster recovery. Which TWO AWS services or features should be used?

Select 2 answers
A.Manual DB snapshots.
B.Cross-region read replicas.
C.Automated backups with a retention period.
D.Amazon S3 lifecycle policies.
E.Automated cross-region snapshot copy.
AnswersC, E

Automated backups with a retention period enable RDS to automatically perform daily backups and capture transaction logs every five minutes, allowing point-in-time recovery to any second within the configured retention window (default 7 days, maximum 35 days). This option is technically valid for automated backups, but it is confined to a single Region; it does not provide cross-Region durability or disaster recovery, so it fails the specific requirement for a backup copy stored in a different geographical location.

Why this answer

Automated backups (Option C) enable point-in-time recovery within a specified retention period, meeting the backup requirement. Automated cross-region snapshot copy (Option E) provides cross-region disaster recovery by automatically copying snapshots to another AWS region. Manual DB snapshots (Option A) are not automated, so they do not satisfy the automation requirement.

Cross-region read replicas (Option B) are designed for read scaling and do not serve as a backup solution. Amazon S3 lifecycle policies (Option D) are used for managing object storage, not for RDS backup automation.

Full explanation →
32
Multi-Selecthard

A company is using AWS KMS to encrypt data. The security team wants to ensure that a specific IAM role can use a KMS key, but only when the request comes from a specific VPC. Which THREE conditions should be included in the KMS key policy? (Choose three.)

Select 2 answers
A.aws:SourceSubnet equals the subnet ID.
B.aws:SourceArn equals the IAM role ARN.
C.aws:SourceVpc equals the VPC ID.
D.aws:SourceIp equals the VPC CIDR.
E.aws:SourceVpce equals the VPC endpoint ID.
AnswersC, E

Restricts to VPC.

Why this answer

The aws:SourceArn condition key is used to restrict access based on the ARN of the resource that is the source of the request, such as an S3 bucket or Lambda function; it is not appropriate for restricting access to a specific IAM role ARN. Therefore, option B is incorrect. Option C is correct: aws:SourceVpc restricts use to requests originating from a specific VPC.

Option E is correct: aws:SourceVpce restricts use to requests coming through a specific VPC endpoint. Option A is incorrect because aws:SourceSubnet is not a valid condition key. Option D is incorrect because aws:SourceIp restricts based on IP address, which does not reliably correspond to a VPC (for example, traffic through a NAT gateway would appear from the NAT’s IP).

Full explanation →
33
MCQmedium

A company manages multiple AWS accounts under AWS Organizations. The SysOps administrator needs to deploy a baseline set of AWS Config rules and an Amazon SNS topic to each account in the organization. The deployment must be centrally managed from the management account and automatically applied to any new member account added in the future. Which solution should the administrator use?

A.Create an AWS CloudFormation StackSet with the template containing the AWS Config rules and SNS topic. Configure the StackSet to deploy to the organization and enable automatic deployment to new accounts.
B.Use AWS Service Catalog to create a product that bundles the AWS Config rules and SNS topic. Grant each account access to launch the product.
C.Configure AWS Config conformance packs in the management account and use AWS Resource Access Manager to share them with member accounts.
D.Create an AWS Organizations Service Control Policy (SCP) that enforces the creation of AWS Config rules and SNS topics in every account.
AnswerA

CloudFormation StackSets can centrally deploy stacks to accounts in AWS Organizations. With automatic deployment enabled, new accounts added to the organization will automatically receive the stack.

Why this answer

AWS CloudFormation StackSets can be deployed to an entire AWS Organizations organization or organizational units (OUs), and they support automatic deployment to new accounts added to the organization. By creating a StackSet with a template that defines the AWS Config rules and SNS topic, and enabling automatic deployment, the administrator ensures that every current and future member account receives the baseline configuration without manual intervention.

Exam trap

The trap here is that candidates often confuse Service Control Policies (SCPs) with resource enforcement, not realizing that SCPs only control permissions and cannot create or configure resources like AWS Config rules or SNS topics.

How to eliminate wrong answers

Option B is wrong because AWS Service Catalog requires each account to manually launch the product, which does not provide automatic deployment to new accounts and is not centrally enforced. Option C is wrong because AWS Config conformance packs can be deployed to multiple accounts via StackSets, but AWS Resource Access Manager (RAM) is used to share resources like subnets or license configurations, not to deploy conformance packs; conformance packs themselves are deployed using StackSets or directly per account. Option D is wrong because Service Control Policies (SCPs) are used to restrict permissions and cannot enforce the creation of specific resources like AWS Config rules or SNS topics; they only control what actions are allowed or denied.

Full explanation →
34
MCQmedium

A company runs a stateful web application on a single Amazon EC2 instance. The SysOps administrator needs to implement a high availability architecture that can tolerate an Availability Zone (AZ) failure. The application stores session state in memory and also writes critical data to an Amazon EBS volume. The administrator wants to use an Auto Scaling group and an Application Load Balancer (ALB). Which combination of steps is required to make the application highly available?

A.Create an Auto Scaling group that spans at least two Availability Zones, attach the existing EBS volume to the new instances, and use an ALB to distribute traffic.
B.Migrate session state to Amazon ElastiCache for Redis, store critical data in Amazon EFS, create an Auto Scaling group across multiple AZs, and place it behind an ALB.
C.Place the EC2 instance in an Auto Scaling group with a minimum and maximum of 1 in the same AZ, and attach an Elastic IP to the instance.
D.Use an ALB with the existing single instance as the target, and enable cross-zone load balancing.
AnswerB

This option makes the application stateless at the compute layer by externalizing session state to ElastiCache for Redis, which all instances can access, and storing critical application data on Amazon EFS, a shared regional file system. An Auto Scaling group spanning multiple Availability Zones ensures that an instance failure or entire AZ outage triggers replacement, while the ALB distributes traffic only to healthy instances and performs health checks. This architecture achieves both high availability and horizontal scalability because no unique state is tied to any individual EC2 instance.

Why this answer

It addresses both the stateless requirement for horizontal scaling and the persistence of critical data across AZ failures. Migrating session state to ElastiCache for Redis removes the dependency on local instance memory, allowing any instance to handle any request. Storing critical data on Amazon EFS provides a shared, NFS-based file system that is accessible from all instances across multiple AZs, unlike EBS which is tied to a single AZ.

Combining these with a multi-AZ Auto Scaling group and an ALB ensures the application can survive an entire AZ outage.

Exam trap

The trap here is that candidates assume EBS volumes can be shared across instances or AZs, or that a single-instance setup with an ALB provides high availability, when in fact EBS is a single-AZ resource and the ALB requires multiple healthy targets to tolerate failures.

How to eliminate wrong answers

Option A is wrong because EBS volumes are AZ-scoped and cannot be attached to instances in a different AZ; attaching the existing EBS volume to new instances in another AZ is impossible without snapshotting and recreating, which defeats high availability. Option C is wrong because keeping a single instance in one AZ with an Elastic IP does not provide fault tolerance for an AZ failure; the Auto Scaling group with min/max of 1 cannot replace the instance in a different AZ automatically, and the Elastic IP does not reroute traffic to a healthy instance. Option D is wrong because using an ALB with a single instance as the target and enabling cross-zone load balancing does not add redundancy; if the instance or its AZ fails, the ALB has no other targets to route traffic to, so the application becomes unavailable.

Full explanation →
35
MCQmedium

A company has a legacy application that runs on a single Amazon EC2 instance. The SysOps administrator is tasked with migrating the application to an Auto Scaling group behind an Application Load Balancer to improve availability. The application stores session state locally on the instance. What should the administrator do to ensure a seamless migration with minimal changes to the application code?

A.Configure the Application Load Balancer with sticky sessions (session affinity).
B.Disable the feature that stores session state locally.
C.Use Amazon ElastiCache for Redis to store session data externally.
D.Modify the application to store session data in an Amazon RDS database.
AnswerC

Amazon ElastiCache for Redis provides a fast, in-memory data store that can hold session data externally. This makes the application stateless, allowing any instance in the Auto Scaling group to handle requests without losing session data. Requires minimal code changes.

Why this answer

Using Amazon ElastiCache for Redis to store session data externally allows the application to be stateless, enabling seamless scaling across multiple EC2 instances in an Auto Scaling group. This approach requires minimal code changes (typically just configuring the application to use a Redis endpoint instead of local storage) and ensures session data is not lost if an instance fails. Option A (sticky sessions) is a workaround but does not eliminate the dependency on local storage; sessions are still lost if an instance fails.

Option B (disabling local session storage) does not solve the problem because the application still needs persistent session storage. Option D (using RDS) is possible but is not the best choice for session data because relational databases are typically slower for session caching and require more significant code and schema changes compared to Redis, which is an in-memory data store optimized for session management.

Full explanation →
36
MCQmedium

A company uses AWS CodePipeline to automate its software release process. The pipeline includes a source stage (Amazon S3), a build stage (AWS CodeBuild), and a deploy stage (AWS CodeDeploy). Recently, a developer committed a change that broke the build. The pipeline failed and the developer fixed the code. The developer wants to rerun the pipeline from the source stage without making another commit. What should the developer do?

A.Create a new commit with an empty message to trigger the pipeline.
B.Use the 'Release change' button in the CodePipeline console to manually rerun the pipeline.
C.Wait for the pipeline to automatically retry after the failure.
D.Re-upload the same artifact to the source S3 bucket to trigger the pipeline.
AnswerB

Using the 'Release change' button in the CodePipeline console manually reruns the pipeline from the source stage, using the latest source revision. This is the correct action because it triggers a new execution without requiring a new commit.

Why this answer

The correct action is to use the 'Release change' button in the CodePipeline console. This manually reruns the pipeline from the source stage, using the latest source revision. Option A is incorrect because creating a new commit with an empty message would trigger the pipeline only if the source repository is configured to detect changes, but it is unnecessary.

Option C is incorrect because CodePipeline does not automatically retry after a failure; it stops at the failed stage. Option D is incorrect because re-uploading the same artifact may not trigger the pipeline if the S3 event is configured to detect only new objects, and it is not the standard procedure to rerun the pipeline.

Full explanation →
37
MCQhard

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment strategy is set to CodeDeployDefault.HalfAtATime. The lifecycle hooks for the Auto Scaling group include a test hook that runs during instance launch. During a recent deployment, the deployment failed because the new instances failed the test hook and were not marked as healthy. The SysOps administrator needs to ensure that failed instances are automatically terminated and replaced with new ones from the Auto Scaling group. Which configuration change should the administrator make?

A.Modify the Auto Scaling group's health check type to ELB
B.Modify the CodeDeploy deployment configuration to use an increased minimum healthy instance count
C.Modify the Auto Scaling group's health check grace period to a lower value
D.Modify the CodeDeploy deployment to ignore the lifecycle hook failure
AnswerA

When the health check type is set to ELB, the Auto Scaling group uses the Application Load Balancer's health checks. If the test hook fails, the instance will be marked unhealthy by the ALB, and the Auto Scaling group will terminate and replace it, ensuring only healthy instances remain.

Why this answer

Setting the Auto Scaling group's health check type to ELB (Elastic Load Balancer) ensures that the Auto Scaling group uses the ELB's health check status to determine instance health. When the test lifecycle hook fails, the new instances are not marked as healthy by the ELB, causing the Auto Scaling group to automatically terminate and replace them. This aligns with the requirement to automatically replace failed instances, as the default EC2 health check only considers instance status (e.g., running vs. stopped) and does not reflect application-level health.

Exam trap

The trap here is that candidates often assume the default EC2 health check is sufficient for detecting application-level failures, but it only monitors instance status (e.g., running/stopped), not the success of lifecycle hooks or application health, so the ELB health check type is required to trigger automatic replacement.

How to eliminate wrong answers

Option B is wrong because increasing the minimum healthy instance count in the CodeDeploy deployment configuration (e.g., using CodeDeployDefault.AllAtOnce or a custom configuration) does not cause failed instances to be terminated and replaced; it only adjusts the number of instances that must remain healthy during the deployment, which could actually reduce the deployment's tolerance for failures. Option C is wrong because reducing the health check grace period would cause the Auto Scaling group to check instance health sooner, but it does not change the health check type; with the default EC2 health check, the test hook failure is not detected, so a shorter grace period has no effect on terminating failed instances. Option D is wrong because ignoring the lifecycle hook failure would allow the deployment to proceed despite the test failure, but it would not trigger automatic termination and replacement of the failed instances; the instances would remain in service, potentially causing application issues.

Full explanation →
38
MCQhard

A company runs a critical web application on Amazon EC2 instances that are part of an Auto Scaling group. The application receives unpredictable traffic spikes. The SysOps administrator needs to ensure that when a scale-out event occurs, new instances are ready to serve traffic quickly to minimize latency spikes. Currently, the instance launch and configuration process (including software installs and cache warming) takes about 5 minutes. The administrator wants to reduce the time it takes for new instances to start serving traffic. Which combination of Auto Scaling features should be used?

A.Use a launch template that includes a pre-warmed Amazon Machine Image (AMI) with all software pre-installed, and configure the Auto Scaling group to use a larger instance type to reduce initialization time.
B.Implement an Auto Scaling warm pool with a minimum number of pre-initialized instances in a 'Stopped' state. Configure the scaling policy to move instances from the warm pool to the Auto Scaling group when needed.
C.Use scheduled scaling to predictively launch instances before the traffic spikes based on historical patterns.
D.Configure lifecycle hooks to add a wait time during instance launch so that the instance is fully configured before it is placed behind the load balancer.
AnswerB

A warm pool maintains instances that have been fully launched and configured but are stopped or in a standby state. When scale-out occurs, instances from the warm pool are started or moved into service quickly, drastically reducing the time to handle traffic.

Why this answer

An Auto Scaling warm pool maintains a pool of pre-initialized instances in a 'Stopped' state that are fully configured (software installed, cache warmed) and ready to serve traffic. When a scale-out event occurs, instances from the warm pool are moved to the Auto Scaling group and transitioned to 'Running' state, bypassing the 5-minute launch and configuration delay, thereby minimizing latency spikes.

Exam trap

The trap here is that candidates often confuse warm pools with lifecycle hooks or pre-warmed AMIs, assuming that reducing software install time alone is sufficient, when the real bottleneck is the entire instance initialization process that warm pools bypass.

How to eliminate wrong answers

Option A is wrong because using a pre-warmed AMI reduces software installation time but does not eliminate the instance launch and initialization overhead (e.g., kernel boot, network setup, cache warming), and using a larger instance type does not inherently reduce initialization time—it may even increase it due to more hardware resources to initialize. Option C is wrong because scheduled scaling relies on predictable traffic patterns and cannot handle unpredictable traffic spikes; it would either over-provision or under-provision for unexpected demand. Option D is wrong because lifecycle hooks add a wait time during instance launch, which would increase the time before the instance is ready to serve traffic, contradicting the goal of reducing latency spikes.

Full explanation →
39
MCQhard

A SysOps Administrator manages a VPC with public and private subnets. The private subnets need to access the internet for software updates. The Administrator creates a NAT Gateway in a public subnet and updates the private subnet route table to point 0.0.0.0/0 to the NAT Gateway. However, instances in the private subnet still cannot reach the internet. What is the MOST likely reason?

A.The security group on the private instances blocks outbound HTTPS traffic.
B.The internet gateway is not attached to the NAT Gateway.
C.The NAT Gateway does not have an Elastic IP address assigned.
D.The NAT Gateway's security group is blocking inbound traffic from the private subnet.
AnswerC

A NAT Gateway requires an Elastic IP to communicate with the internet; without one, it cannot route traffic.

Why this answer

A NAT Gateway must have an Elastic IP (EIP) address assigned to it in order to function as an internet gateway for private subnets. Without an EIP, the NAT Gateway cannot communicate with the internet. Option A is unlikely because security groups allow outbound traffic by default.

Option B is incorrect because the internet gateway attaches to the VPC, not to the NAT Gateway. Option D is incorrect because NAT Gateways do not have security groups; they use network ACLs at the subnet level, but the issue here is the missing EIP.

Full explanation →
40
MCQhard

A company runs a critical database workload on an Amazon RDS for MySQL DB instance with Multi-AZ deployment in the us-east-1 region. The SysOps administrator must design a disaster recovery strategy that can recover from a complete regional outage. The Recovery Time Objective (RTO) is 2 hours and the Recovery Point Objective (RPO) is 1 hour. Which solution meets these requirements at the lowest cost?

A.Create manual snapshots of the DB instance every hour and copy them to another AWS Region.
B.Enable automated backups with a retention period of 35 days and restore to a different Region when needed.
C.Create a cross-Region read replica in another Region and promote it to a standalone DB instance during a disaster.
D.Use AWS Database Migration Service (DMS) to continuously replicate data to a DB instance in another Region.
AnswerC

A cross-Region read replica provides continuous asynchronous replication with low lag (typically seconds). In a disaster, promoting the replica to a primary instance takes only minutes, meeting the RTO and RPO requirements with minimal cost.

Why this answer

A cross-Region read replica continuously replicates data from the primary RDS MySQL instance to another Region with minimal lag, typically achieving an RPO of seconds to minutes, well within the 1-hour requirement. Promoting the replica to a standalone instance during a disaster can be done in minutes, meeting the 2-hour RTO. This approach is the lowest cost among the viable options as it uses existing replication infrastructure without additional data transfer fees for snapshots or DMS replication instances.

Exam trap

The trap here is that candidates often choose Option B (automated backups) because they assume backups can be restored cross-Region, but automated backups are Region-specific and do not support cross-Region restore without additional snapshot copy configuration, which is not mentioned in the option.

How to eliminate wrong answers

Option A is wrong because manual snapshots taken every hour would incur significant storage costs for storing and copying snapshots across Regions, and the copy process can take longer than 1 hour, potentially exceeding the RPO. Option B is wrong because automated backups with a 35-day retention period are stored only in the source Region and cannot be restored to a different Region; cross-Region snapshot copy must be explicitly configured and is not part of automated backups. Option D is wrong because AWS DMS incurs additional costs for a replication instance and data transfer, making it more expensive than a cross-Region read replica, and it adds operational complexity for continuous replication that is unnecessary when native MySQL replication can achieve the same RPO/RTO.

Full explanation →
41
MCQhard

A company is using AWS Lambda functions to process incoming messages from Amazon SQS. The Lambda function sometimes fails due to a transient error, and the message is not processed. The team wants to automatically retry failed messages and send them to a dead-letter queue (DLQ) after three failed attempts. Which configuration meets these requirements?

A.Set the Lambda function's reserved concurrency to 1 and enable 'maximumRetryAttempts' to 2.
B.Create an SQS queue with a visibility timeout that allows three retries before sending to a DLQ.
C.Configure the SQS queue as an event source for Lambda with a DLQ specified in the Lambda function's dead-letter configuration.
D.Configure the SQS queue with a redrive policy that allows three maximum receives before sending to a DLQ.
AnswerD

A redrive policy with maxReceiveCount set to 3 ensures that after the message has been received from the queue three times without successful processing, the message is automatically moved to the configured dead-letter queue. This is the standard SQS mechanism for defining retry limits because each receive attempt by the Lambda consumer counts toward maxReceiveCount. The DLQ is configured on the SQS queue itself, not on the Lambda function, and this behavior is specific to SQS event sources.

Why this answer

When SQS is configured as an event source for Lambda, retries are controlled by the SQS queue's redrive policy. The redrive policy with maxReceiveCount determines how many times a message can be received before it is moved to the DLQ. Setting maxReceiveCount to 3 means after three receive attempts (i.e., three failed processing attempts), the message is sent to the DLQ.

Option C is incorrect because Lambda's dead-letter configuration is used for asynchronous invocations, not for SQS event source mappings. For SQS-triggered functions, the DLQ must be configured on the SQS queue itself using a redrive policy, not on the Lambda function.

Exam trap

The trap is that candidates often assume the Lambda dead-letter configuration applies to SQS event source mappings. However, for SQS triggers, retries and DLQ routing are managed by the SQS queue's redrive policy, not by Lambda's DLQ settings.

How to eliminate wrong answers

Option A is wrong because setting reserved concurrency to 1 does not control retry behavior; 'maximumRetryAttempts' is a property of the Lambda event source mapping, not a direct function configuration, and setting it to 2 would only allow 2 retries (total 3 attempts), but the reserved concurrency limit is irrelevant for retry logic. Option B is wrong because the SQS visibility timeout controls how long a message is hidden after being polled, but it does not inherently trigger retries or send messages to a DLQ after three failures; the redrive policy on the SQS queue is needed for that. Option D is wrong because configuring the SQS queue with a redrive policy that allows three maximum receives sends messages to the DLQ after three receives, but this does not integrate with Lambda's automatic retry mechanism; Lambda would need to delete the message after successful processing, and the redrive policy would only trigger if the message is not deleted, which may not align with the requirement for Lambda to retry on transient errors.

Full explanation →
42
MCQhard

A company has a VPC with public and private subnets. The private subnets need outbound internet access to download software updates while preventing any inbound internet traffic. The SysOps administrator must minimize costs. Which solution should the administrator implement?

A.Create a NAT Gateway in a public subnet and update the private subnet route table to use it
B.Launch a NAT instance in a public subnet with an Elastic IP and disable source/destination check, then update private subnet route tables
C.Attach an Internet Gateway to the VPC and add a default route to the Internet Gateway in the private subnets
D.Use AWS Transit Gateway with a VPN connection to an on-premises data center for internet access
AnswerB

Launching a NAT instance is the correct cost-minimizing solution because it uses a regular EC2 instance, which incurs only standard instance-hour charges and no per-gigabyte data processing fees, unlike a NAT Gateway. To make it work, you must assign an Elastic IP so the NAT instance has a stable public address, disable the source/destination check so the instance can forward traffic, and update the private subnet route tables to point 0.0.0.0/0 at the NAT instance's private IP. This configuration provides outbound internet access for private instances while preserving the cost advantage over the managed gateway service.

Why this answer

A NAT instance, when launched in a public subnet with an Elastic IP and source/destination check disabled, can route outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. This solution minimizes costs compared to a NAT Gateway, as NAT instances use existing EC2 instance pricing and can be further reduced with spot instances or smaller instance types.

Exam trap

The trap here is that candidates often choose the NAT Gateway (Option A) because it is fully managed and simpler, overlooking the explicit cost-minimization requirement that favors the cheaper, self-managed NAT instance.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway incurs hourly charges and data processing fees, making it more expensive than a NAT instance, which is contrary to the requirement to minimize costs. Option C is wrong because attaching an Internet Gateway directly to private subnets and adding a default route would expose those subnets to inbound internet traffic, violating the security requirement to prevent inbound traffic. Option D is wrong because AWS Transit Gateway with a VPN connection to an on-premises data center is over-engineered and costly for simple outbound internet access, and it does not directly provide internet access without additional routing and infrastructure.

Full explanation →
43
MCQmedium

A company runs a web application on a fleet of Amazon EC2 instances behind an Application Load Balancer. The application has predictable traffic patterns with high traffic during business hours and low traffic at night. The SysOps administrator wants to reduce compute costs while ensuring the application remains responsive during peak hours. The administrator has already implemented Auto Scaling based on CPU utilization. Which additional action should the administrator take to optimize costs?

A.Use On-Demand instances only
B.Purchase Reserved Instances for the baseline capacity and use Spot Instances for the additional capacity during peak hours
C.Increase the minimum number of instances in the Auto Scaling group
D.Use Dedicated Hosts to reduce licensing costs
AnswerB

This approach minimizes costs by applying the highest discount (Reserved Instances) to the steady-state capacity and leveraging the cost savings of Spot Instances for the flexible, peak-demand capacity. Auto Scaling can be configured to launch Spot Instances as needed, providing both cost efficiency and performance.

Why this answer

It combines Reserved Instances for predictable baseline capacity (lower cost per hour) with Spot Instances for elastic peak demand, leveraging Auto Scaling to handle variable traffic. This hybrid approach reduces compute costs compared to using On-Demand instances for all capacity, while maintaining responsiveness during peak hours.

Exam trap

The trap here is that candidates may think increasing the minimum instance count (Option C) improves responsiveness, but it actually increases costs during low-traffic periods without addressing the cost optimization goal.

How to eliminate wrong answers

Option A is wrong because using only On-Demand instances ignores cost-saving opportunities from Reserved or Spot Instances, leading to higher costs for predictable baseline traffic. Option C is wrong because increasing the minimum number of instances raises baseline costs unnecessarily, as the application has low traffic at night and does not require a higher minimum. Option D is wrong because Dedicated Hosts are designed for licensing or compliance requirements, not for general cost optimization, and they incur additional costs without addressing variable traffic patterns.

Full explanation →
44
MCQhard

A company stores video files in Amazon S3. The files are accessed frequently for the first week, then weekly for the next month, and then rarely after that. The files must be retained for 5 years and any access must be served within minutes. The SysOps administrator needs to minimize storage costs while meeting these requirements. Which lifecycle policy configuration is the most cost-effective?

A.Transition to S3 Standard-IA after 7 days, then to S3 Glacier Flexible Retrieval after 30 days.
B.Transition to S3 One Zone-IA after 7 days, then to S3 Glacier Deep Archive after 30 days.
C.Transition to S3 Standard-IA after 7 days, then to S3 Glacier Instant Retrieval after 30 days.
D.Transition to S3 Intelligent-Tiering after 7 days.
AnswerC

S3 Standard-IA after 7 days is a sound choice because the files are accessed weekly during that period, and Standard-IA offers the same high durability (99.999999999%) and millisecond latency as Standard while reducing storage costs. After 30 days, transitioning to S3 Glacier Instant Retrieval further cuts storage costs while still providing millisecond retrieval times, so the videos remain instantly accessible on demand. This lifecycle meets the 'within minutes' requirement without incurring the higher retrieval latency or costs of Flexible Retrieval or Deep Archive, making it the most cost-effective and compliant strategy.

Why this answer

It transitions to S3 Standard-IA after 7 days (matching the frequent first-week access), then to S3 Glacier Instant Retrieval after 30 days (matching the weekly access for the next month). Glacier Instant Retrieval provides millisecond retrieval for rarely accessed data, meeting the 'within minutes' requirement while minimizing costs compared to Standard-IA or Intelligent-Tiering.

Exam trap

The trap here is that candidates often confuse S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive as cost-effective options without verifying the retrieval time requirement, assuming 'Glacier' always means cheap but slow, while the question explicitly requires access 'within minutes'.

How to eliminate wrong answers

Option A is wrong because S3 Glacier Flexible Retrieval has retrieval times of minutes to hours (not within minutes), failing the access requirement. Option B is wrong because S3 One Zone-IA does not provide the durability needed for long-term retention (5 years) and S3 Glacier Deep Archive has retrieval times of 12-48 hours, violating the 'within minutes' requirement. Option D is wrong because S3 Intelligent-Tiering incurs monitoring and automation costs that are not cost-effective for a predictable access pattern, and it does not transition to a cold storage tier that minimizes costs for rarely accessed data after 30 days.

Full explanation →
45
Drag & Dropmedium

Drag and drop the steps to create an Amazon CloudWatch alarm that sends an email notification when CPU utilization exceeds 90% into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First set up the SNS topic, then create the alarm selecting the metric, define the condition, and finally add the notification action.

Full explanation →
46
Drag & Dropmedium

Drag and drop the steps to configure a VPC peering connection between two VPCs into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create the peering request, then accept it, then update route tables in both VPCs, and finally adjust security groups.

Full explanation →
47
MCQeasy

A SysOps administrator needs to monitor the memory utilization of an EC2 instance running Windows Server. Which steps are required to collect memory metrics?

A.Install and configure the Amazon CloudWatch agent on the instance.
B.Install the AWS Systems Manager Agent (SSM Agent) and use Run Command.
C.Enable detailed monitoring on the EC2 instance.
D.Use the AWS Management Console to enable memory monitoring.
AnswerA

The CloudWatch agent can collect memory and disk metrics.

Why this answer

Amazon CloudWatch does not collect memory metrics from EC2 instances by default; it only captures hypervisor-level metrics such as CPU, network, and disk I/O. To monitor in-guest memory utilization on a Windows Server instance, you must install and configure the Amazon CloudWatch agent, which sends custom metrics (e.g., Memory % Committed Bytes In Use) to CloudWatch. The agent uses the Windows Performance Monitor (PerfMon) counters to gather this data.

Exam trap

The trap here is that candidates assume memory metrics are automatically available or can be enabled via a simple console toggle, when in fact they require the CloudWatch agent to be installed and configured on the instance.

How to eliminate wrong answers

Option B is wrong because the AWS Systems Manager Agent (SSM Agent) and Run Command are used for management tasks like patching or executing scripts, not for collecting and publishing memory metrics to CloudWatch. Option C is wrong because enabling detailed monitoring only increases the frequency of existing hypervisor-level metrics (e.g., CPU, network) from 5 minutes to 1 minute; it does not add in-guest memory metrics. Option D is wrong because the AWS Management Console does not have a built-in toggle to enable memory monitoring; memory metrics require the CloudWatch agent to be installed and configured on the instance.

Full explanation →
48
Multi-Selectmedium

A SysOps administrator is troubleshooting an issue where an Application Load Balancer (ALB) is returning 503 errors to clients. The target group has healthy EC2 instances. Which THREE possible causes should the administrator investigate? (Choose three.)

Select 3 answers
A.The load balancer is not attached to a subnet.
B.The security group for the load balancer is blocking traffic.
C.The load balancer has reached its capacity limit.
D.The target group has no registered targets.
E.The target group health check is misconfigured.
AnswersA, B, C

Incorrect because the load balancer must be attached to subnets to function; if not, it would fail to provision, but the ALB is already running and returning 503, so this is not a likely cause.

Why this answer

If the load balancer is not attached to a subnet, it cannot route traffic to targets and may return 503 errors. Option B is correct because the load balancer's security group must allow inbound traffic from clients; if it blocks HTTP/HTTPS traffic, the ALB cannot forward requests and returns 503 errors. Option C is correct because an ALB has a capacity limit; once reached, it cannot handle new requests and returns 503 errors.

Option D is incorrect because the stem explicitly states the target group has healthy EC2 instances, meaning registered targets exist. Option E is incorrect because the health check is functioning correctly since targets are healthy; a misconfigured health check would cause targets to be unhealthy, contradicting the given information.

Exam trap

The trap is that candidates often assume a 503 error always indicates unhealthy targets, but the question explicitly states healthy instances, so they must consider other causes like security group misconfiguration, ALB capacity limits, or the load balancer not being attached to a subnet.

Full explanation →
49
MCQhard

A SysOps Administrator is configuring a VPC with a public subnet and a private subnet. The public subnet has an Internet Gateway. An EC2 instance in the private subnet needs to access an S3 bucket. What is the MOST secure way to provide this access?

A.Attach an Internet Gateway to the private subnet.
B.Create a VPC Gateway Endpoint for S3 in the private subnet's route table.
C.Use a VPC peering connection to an S3 bucket.
D.Create a NAT Gateway in the public subnet and route traffic through it.
AnswerB

Correct because a Gateway Endpoint provides secure, private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 privately without traversing the internet, using AWS's internal network. This is the most secure method as it avoids exposing the private subnet to the public internet or requiring a NAT Gateway, and it leverages AWS PrivateLink for direct, low-latency connectivity.

Exam trap

The trap here is that candidates often confuse VPC Gateway Endpoints with Interface Endpoints or assume a NAT Gateway is required for all outbound traffic, not realizing that S3 can be accessed privately via a Gateway Endpoint without internet connectivity.

How to eliminate wrong answers

Option A is wrong because attaching an Internet Gateway to a private subnet would make it public, defeating the purpose of a private subnet and exposing the EC2 instance to the internet, which is less secure. Option C is wrong because VPC peering connects VPCs, not to an S3 bucket; S3 is a regional service, not a VPC resource, and peering does not provide direct access to S3. Option D is wrong because a NAT Gateway in the public subnet would route traffic through the internet to reach S3, which is less secure and incurs additional costs compared to a VPC Gateway Endpoint that keeps traffic within the AWS network.

Full explanation →
50
Multi-Selecthard

A company wants to implement a disaster recovery solution for its on-premises database using AWS. The solution must have an RPO of less than 1 hour and an RTO of less than 4 hours. Which THREE steps should the SysOps administrator take? (Choose THREE.)

Select 3 answers
A.Set up a cross-Region read replica for the RDS instance.
B.Launch an EC2 instance with the database software and configure replication.
C.Use AWS Database Migration Service (DMS) to replicate data to an RDS instance.
D.Use AWS DataSync to sync the database files to Amazon S3.
E.Configure the RDS instance with Multi-AZ.
AnswersA, B, C

A cross-Region read replica creates a continuously updated, asynchronous replicate of an RDS database in a different AWS Region, with typical replication lag well under the 1-hour RPO. Promoting the replica makes it a standalone writable instance, a process that generally completes within minutes and satisfies the RTO. This is a solid DR approach, but it presupposes that the database is already running on RDS; for an on-premises source, you would need an initial migration into RDS before this option becomes viable.

Why this answer

A cross-Region read replica for an RDS instance provides asynchronous replication to a secondary Region. After promoting the replica, the RTO can be under 4 hours, and the RPO is typically less than 1 hour. Option B is correct by launching an EC2 instance with the same database software and configuring continuous replication (e.g., log shipping or mirroring) from the on-premises database.

This allows failover to the EC2 instance within the RPO and RTO targets. Option C is correct as AWS DMS can perform ongoing replication from the on-premises database to an RDS instance, meeting the RPO requirement with minimal data loss. Together, these steps form a multi-layered DR strategy: DMS for continuous replication, EC2 as a standby, and a cross-Region replica for regional resilience.

Exam trap

Candidates often assume Multi-AZ (Option E) is a valid DR solution. However, Multi-AZ only provides high availability within a single Region, with synchronous replication and automatic failover. It does not protect against Region-wide outages or on-premises failures, and does not meet the cross-Region disaster recovery requirement implied by the need for an RPO < 1 hour and RTO < 4 hours for an on-premises database.

Full explanation →
51
MCQhard

A company runs a critical database on an RDS for PostgreSQL instance in a single Availability Zone. The database experiences high write latency. The SysOps Administrator needs to improve the database's reliability and performance without downtime. Which solution meets these requirements?

A.Modify the RDS instance to be Multi-AZ with a standby in another Availability Zone.
B.Create a Multi-AZ deployment in the same Availability Zone.
C.Increase the allocated storage for the RDS instance.
D.Create a read replica in another Availability Zone and redirect read traffic.
AnswerA

Modifying the RDS instance to a Multi-AZ deployment provisions a synchronous standby replica in a different Availability Zone, and Amazon RDS automatically fails over to that standby if an AZ outage or primary instance failure occurs. This change can typically be applied without downtime, as it only requires a metadata modification and provisioning of the standby. This gives the database the high availability and automatic failover that the company needs.

Why this answer

Enabling Multi-AZ for an RDS for PostgreSQL instance provisions a standby replica in a different Availability Zone and synchronously replicates data to it. This eliminates the single point of failure, improving reliability. The modification is performed as a zero-downtime operation via a DNS update, meeting the requirement for no downtime.

Note that Multi-AZ improves availability but does not reduce write latency; performance improvement may come from offloading backups and other administrative tasks to the standby.

Exam trap

The trap here is that candidates confuse Multi-AZ (synchronous replication for high availability) with read replicas (asynchronous replication for read scaling), assuming a read replica can improve write performance or reliability when it only helps with read traffic.

How to eliminate wrong answers

Option B is wrong because Multi-AZ requires the standby to be in a different Availability Zone; deploying in the same AZ provides no fault isolation and does not improve reliability. Option C is wrong because increasing allocated storage addresses capacity or IOPS limits but does not improve reliability through redundancy or reduce write latency caused by synchronous replication overhead. Option D is wrong because a read replica is asynchronous and does not improve write latency or reliability for the primary database; it only offloads read traffic, leaving the primary as a single point of failure.

Full explanation →
52
MCQhard

An organization has a VPC with public and private subnets. The private subnets need to access the internet for software updates. A NAT gateway is deployed in a public subnet and the private subnet route table has a route for 0.0.0.0/0 pointing to the NAT gateway. However, instances in the private subnet cannot reach the internet. What could be the issue?

A.The NAT gateway's subnet does not have a route to an internet gateway
B.The private subnet's network ACL blocks outbound HTTPS traffic
C.The security group attached to the NAT gateway does not allow outbound traffic
D.The private instances do not have a public IP address assigned
AnswerA

For the NAT gateway to successfully forward traffic from private subnets to the internet, the subnet where the NAT gateway resides must have a route to an internet gateway (IGW). Without a route to the IGW in that subnet's route table, the NAT gateway cannot send or receive traffic from the internet, even though it has a public Elastic IP. This is the most common reason for failed outbound internet access from private instances when a NAT gateway is present.

Why this answer

The NAT gateway must be in a public subnet with a route table that includes a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, because the IGW is the only way to reach public IP addresses. The question states the NAT gateway is deployed in a public subnet, but if that subnet's route table lacks the IGW route, outbound traffic from the NAT gateway will fail.

Exam trap

The trap here is that candidates assume placing a NAT gateway in a 'public subnet' automatically gives it internet access, but the subnet must have a route table entry pointing 0.0.0.0/0 to an internet gateway for the NAT gateway to function.

How to eliminate wrong answers

Option B is wrong because a network ACL (NACL) is stateless and would need to block both outbound HTTPS (port 443) and the corresponding inbound ephemeral return traffic; however, the default NACL allows all traffic, and the question does not indicate any custom NACL changes, so this is unlikely the root cause. Option C is wrong because security groups are stateful and are attached to resources like EC2 instances, not to NAT gateways; NAT gateways do not have security groups, so this option is technically invalid. Option D is wrong because instances in a private subnet do not need public IP addresses; they rely on the NAT gateway's public IP for outbound internet access, so the absence of a public IP on the private instances is not the issue.

Full explanation →
53
MCQeasy

A SysOps administrator needs to allow traffic from a specific IP address range (203.0.113.0/24) to access an Amazon EC2 instance in a VPC. Which configuration step should be performed?

A.Create an IAM policy that allows inbound traffic from 203.0.113.0/24.
B.Add a rule to the network ACL associated with the subnet to allow inbound traffic from 203.0.113.0/24.
C.Modify the route table of the subnet to include a route for 203.0.113.0/24 to the internet gateway.
D.Add an inbound rule to the security group associated with the EC2 instance allowing traffic from 203.0.113.0/24.
AnswerD

A security group is a stateful, instance-level virtual firewall that filters traffic at the elastic network interface. Adding an inbound rule that permits 203.0.113.0/24 on the desired port allows that specific source to reach the EC2 instance, and because security groups are stateful, the return traffic is automatically allowed without any additional outbound rule. This provides the most precise and correct method for the stated requirement.

Why this answer

Security groups act as a virtual firewall for EC2 instances, allowing you to specify inbound rules to permit traffic from specific IP ranges like 203.0.113.0/24. Option A is incorrect because IAM policies manage permissions for AWS actions, not network traffic filtering. Option B is incorrect because network ACLs provide stateless filtering at the subnet level, but security groups are more appropriate for instance-level control and are stateful.

Option C is incorrect because route tables control the direction of outbound traffic and do not restrict inbound access to instances.

Full explanation →
54
MCQmedium

A company runs an application across multiple Availability Zones. The application servers are in private subnets and need outbound internet access to download software updates and patches. The SysOps administrator needs a highly available, fully managed solution to provide this outbound connectivity. Which solution should be used?

A.Deploy a NAT instance in each private subnet
B.Deploy a single NAT Gateway in one public subnet
C.Deploy a NAT Gateway in each public subnet
D.Attach an Internet Gateway directly to the private subnets
AnswerC

By deploying a NAT Gateway in each Availability Zone's public subnet and configuring private subnets to use the NAT Gateway in the same AZ, the solution is both fully managed and highly available. If one AZ fails, the other AZ's NAT Gateway continues to provide internet access.

Why this answer

Deploying a NAT Gateway in each public subnet provides a highly available, fully managed solution for outbound internet access from private subnets. NAT Gateways are managed by AWS, automatically scale, and are resilient within an Availability Zone; using one per AZ ensures that if one AZ fails, the others continue to provide outbound connectivity. This meets the requirement for high availability without the operational overhead of managing NAT instances.

Exam trap

The trap here is that candidates often confuse NAT Gateways with NAT instances or assume a single NAT Gateway is sufficient for high availability, overlooking the need for one per Availability Zone to achieve true fault tolerance.

How to eliminate wrong answers

Option A is wrong because NAT instances are self-managed EC2 instances that require manual patching, scaling, and failover configuration, which contradicts the 'fully managed' requirement and introduces a single point of failure if only one instance is used per subnet. Option B is wrong because a single NAT Gateway in one public subnet creates a single point of failure; if that Availability Zone becomes unavailable, all private subnets lose outbound internet access, violating the high availability requirement. Option D is wrong because attaching an Internet Gateway directly to private subnets would expose those subnets to inbound internet traffic, defeating the purpose of a private subnet and violating security best practices; Internet Gateways are designed for public subnets only.

Full explanation →
55
Multi-Selecteasy

A SysOps administrator is creating an Auto Scaling group using a launch template. The administrator wants to ensure that instances are automatically registered with an Application Load Balancer (ALB) target group. Which TWO steps are required? (Choose TWO.)

Select 2 answers
A.Configure the instance security group to allow traffic from the ALB.
B.Specify the target group ARN in the Auto Scaling group configuration.
C.Configure health checks on the Auto Scaling group to use ELB.
D.Create a security group for the ALB and attach it to the Auto Scaling group.
E.Include the target group ARN in the launch template.
AnswersA, B

To allow the Application Load Balancer to forward traffic and perform health checks, the instance security group must contain an inbound rule that permits traffic from the ALB's security group or CIDR range on the application's port. If this rule is missing, the ALB's health checks will time out and instances will be marked unhealthy, preventing the ALB from serving requests. Even after the target group ARN is attached, this security group rule is necessary for end-to-end connectivity.

Why this answer

To automatically register instances with an ALB target group, you must configure the instance security group to allow traffic from the ALB (Option A) and specify the target group ARN in the Auto Scaling group configuration (Option B). Option C is incorrect because health checks are configured on the target group, not on the Auto Scaling group. Option D is incorrect because you attach the target group to the Auto Scaling group, not a security group.

Option E is incorrect because the target group ARN is specified in the Auto Scaling group, not in the launch template.

Full explanation →
56
MCQmedium

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect to an on-premises network using a site-to-site VPN. The on-premises network uses 10.0.0.0/16 as well. Which solution avoids routing conflicts?

A.Attach an Internet Gateway and use public IPs for communication.
B.Set up a second VPN connection to a different virtual private gateway.
C.Create a VPC peering connection between the VPC and on-premises network.
D.Use a NAT instance to translate addresses for overlapping ranges.
AnswerD

NAT can translate overlapping IPs.

Why this answer

A NAT instance can translate the overlapping IP addresses from the on-premises network (10.0.0.0/16) to a different IP range within the VPC, allowing communication without routing conflicts. The NAT instance performs destination NAT (DNAT) for inbound traffic and source NAT (SNAT) for outbound traffic, effectively hiding the overlap. This is a common workaround when both networks use the same CIDR block and cannot be renumbered.

Exam trap

The trap here is that candidates often assume a second VPN connection or VPC peering can solve overlapping CIDR issues, but AWS requires unique, non-overlapping IP ranges for both VPN route propagation and VPC peering, making NAT the only viable option among the choices.

How to eliminate wrong answers

Option A is wrong because attaching an Internet Gateway and using public IPs does not resolve the routing conflict within the VPC; the VPC's route tables still have a local route for 10.0.0.0/16, which will conflict with the on-premises route, and traffic destined for the on-premises network would be incorrectly routed locally. Option B is wrong because setting up a second VPN connection to a different virtual private gateway does not address the overlapping CIDR; both VPN connections would still require unique, non-overlapping IP ranges for the route tables, and the conflict persists. Option C is wrong because VPC peering does not support overlapping CIDR blocks; AWS explicitly prohibits peering connections between VPCs with overlapping or identical IP ranges, and on-premises networks cannot be peered directly with a VPC.

Full explanation →
57
MCQmedium

A SysOps administrator notices that an EC2 instance running a web server is receiving unexpected traffic from an IP address that is known to be malicious. The administrator wants to block this IP address at the instance level. Which solution should be used?

A.Modify the network ACL to deny traffic from that IP.
B.Use AWS WAF to block the IP address.
C.Install a third-party firewall on the instance.
D.Update the security group to deny traffic from that IP.
AnswerC

A third-party firewall installed on the instance, such as iptables or a host-based security agent, can filter inbound traffic based on source IP at the operating system level before the application processes it. This is the only option that fulfills the 'instance level' requirement, as it controls traffic directly on that specific EC2 instance regardless of the surrounding subnet or VPC configuration. Security groups cannot explicitly deny, making a host-based firewall the correct solution.

Why this answer

A host-based firewall (such as a third-party firewall installed on the instance) can block traffic from a specific IP address at the instance level. Option A is incorrect because network ACLs operate at the subnet level, not the instance level. Option B is incorrect because AWS WAF is designed to filter web requests at the application layer and is typically associated with load balancers or CloudFront, not directly with an individual EC2 instance.

Option D is incorrect because security groups do not support deny rules; they only allow traffic, so they cannot be used to block specific IPs.

Exam trap

The question specifies 'at the instance level,' which disqualifies subnet-level solutions like network ACLs. Candidates often overlook this detail and choose NACLs because they support explicit deny.

Full explanation →
58
MCQhard

A containerized API runs on Amazon ECS with an Application Load Balancer. The team wants to deploy new container versions with zero downtime, automatically route traffic to the new version only after health checks pass, and automatically roll back if error rates spike within 10 minutes of the shift. Which deployment strategy and configuration implements all three requirements?

A.Use CodeDeploy with the ECS blue/green deployment type, configure a Canary or Linear traffic shifting strategy, and attach a CloudWatch alarm for error rate as a deployment alarm
B.Update the ECS service with a rolling update deployment configuration and set the minimum healthy percent to 100
C.Create a second ECS service with the new task definition and use Route 53 weighted routing to shift traffic at the DNS level
D.Enable ECS circuit breaker on the service to roll back failed deployments automatically
AnswerA

The ECS blue/green deployment starts the green task set, registers it with a second target group, and uses ALB weighted routing to shift traffic progressively. The deployment alarm monitors a 5xx error rate metric. If the alarm enters ALARM state at any point during traffic shifting or the bake period, CodeDeploy automatically shifts traffic back to the original blue target group. The team defines the 10-minute bake window via the deployment configuration's terminationWaitTimeInMinutes.

Why this answer

CodeDeploy's ECS blue/green deployment type supports canary or linear traffic shifting, which automatically routes traffic to the new version only after health checks pass. By attaching a CloudWatch alarm for error rate as a deployment alarm, CodeDeploy can automatically trigger a rollback if error rates spike within the specified monitoring period (e.g., 10 minutes), meeting all three requirements: zero downtime, health-check-gated traffic shifting, and automatic rollback on error rate spikes.

Exam trap

The trap here is that candidates often confuse the ECS circuit breaker (which only handles task-level failures during deployment) with the need for post-deployment error rate monitoring and traffic shifting, leading them to select Option D without realizing it lacks the canary/linear traffic shifting and CloudWatch alarm integration required for automatic rollback based on error spikes.

How to eliminate wrong answers

Option B is wrong because a rolling update with minimum healthy percent set to 100 does not provide automatic rollback based on error rate spikes; it only ensures availability during the update but lacks the traffic-shifting and alarm-based rollback capabilities. Option C is wrong because using Route 53 weighted routing at the DNS level does not provide health-check-gated traffic shifting at the application layer, and DNS caching can cause delayed or uneven traffic distribution, failing to ensure zero downtime and immediate rollback on error spikes. Option D is wrong because the ECS circuit breaker only rolls back a service if tasks fail to start or become unhealthy during deployment, but it does not monitor post-deployment error rates or support canary/linear traffic shifting.

Full explanation →
59
MCQeasy

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect to an on-premises network with a CIDR of 10.0.0.0/8. What is the issue?

A.The on-premises CIDR is private and cannot be used with AWS.
B.AWS does not support /8 CIDR blocks.
C.The CIDR blocks overlap, causing routing conflicts.
D.The VPC CIDR is too large.
AnswerC

The VPC CIDR block 10.0.0.0/16 and an on-premises CIDR that also uses part of the 10.0.0.0/16 range overlap. When you establish a VPN connection or AWS Direct Connect between the VPC and the on-premises network, overlapping CIDRs create ambiguous routing: the VPC route table cannot determine whether traffic for those IPs should go to the local network or the on-premises network, so traffic may be dropped or misrouted. AWS does not allow overlapping CIDRs for VPC peering or for VPN/Direct Connect connections, so you must redesign the IP addressing to avoid overlap.

Why this answer

Overlapping CIDR blocks prevent VPC peering or VPN connections because routes conflict. Option A is not the issue. Option B is not the primary issue.

Option D is not directly a problem.

Full explanation →
60
Multi-Selecteasy

A SysOps Administrator needs to automate the deployment of a three-tier web application on AWS. The application consists of a web tier, application tier, and database tier. The administrator wants to use AWS CloudFormation to provision the infrastructure. Which TWO resources should be included in the CloudFormation template to ensure the application is highly available across multiple Availability Zones?

Select 2 answers
A.Auto Scaling group
B.NAT Gateway
C.Amazon S3 bucket
D.Amazon Route 53 hosted zone
E.Application Load Balancer
AnswersA, E

An Auto Scaling group is capacity management that spans multiple Availability Zones, launching and terminating instances to maintain a desired count and to replace unhealthy ones automatically. By distributing instances across AZs, it ensures that the application tier remains available even if an entire AZ becomes unavailable, providing fault tolerance and elasticity.

Why this answer

Options A and E are correct. An Auto Scaling group maintains a desired number of instances across multiple Availability Zones, ensuring resilience and high availability. An Application Load Balancer (ALB) distributes incoming traffic across those instances, further supporting high availability and fault tolerance.

Option B (NAT Gateway) is used for outbound internet access from private subnets, not for high availability of the application. Option C (S3 bucket) is a storage service and does not directly impact compute high availability. Option D (Route 53 hosted zone) provides DNS routing but is not a primary resource for ensuring high availability within the application tiers; Route 53 can be used for DNS-level failover, but the question asks for resources directly in the CloudFormation template to ensure high availability across AZs, and the ALB and Auto Scaling group are the core components.

Full explanation →
61
Multi-Selectmedium

Which TWO steps should a SysOps administrator take to ensure that an RDS for MySQL instance can withstand an Availability Zone failure? (Choose 2)

Select 1 answer
A.Enable Multi-AZ deployment.
B.Create a read replica in a different AZ.
C.Enable automated backups with a short retention period.
D.Enable deletion protection on the DB instance.
E.Enable provisioned IOPS for the DB instance.
AnswersA

Enable Multi-AZ deployment. This provisions a synchronous standby replica in a different AZ and provides automatic failover, ensuring the instance can withstand an AZ failure.

Why this answer

To withstand an Availability Zone failure, the RDS instance must provide automatic failover to a standby in a different AZ. Only Multi-AZ deployment (Option A) achieves this by provisioning a synchronous standby replica and enabling automatic failover. Automated backups (Option C) are for point-in-time recovery, not high availability, so they do not help during an ongoing AZ failure.

Exam trap

The trap here is that candidates often confuse read replicas with Multi-AZ deployments, assuming a read replica in a different AZ provides automatic failover, when in fact read replicas are asynchronous and require manual promotion, making them unsuitable for automatic AZ failure recovery.

Full explanation →
62
MCQhard

A company has a VPC with multiple subnets. The SysOps administrator wants to ensure that EC2 instances in a private subnet can access Amazon S3 without going through a NAT Gateway or internet gateway. Which solution meets this requirement?

A.Set up a NAT Gateway in a public subnet and route traffic through it.
B.Create a VPC Gateway Endpoint for S3.
C.Use S3 Transfer Acceleration.
D.Create a VPC Interface Endpoint for S3.
AnswerB

Gateway Endpoint provides private access to S3.

Why this answer

A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 privately without needing a NAT Gateway or internet gateway. Option A is incorrect because a NAT Gateway requires an internet gateway and does not provide private access. Option C is incorrect because S3 Transfer Acceleration is for faster transfers over the internet, not private connectivity.

Option D is incorrect because although a VPC Interface Endpoint can also provide private access to S3, the Gateway Endpoint is the recommended solution for S3 due to lower cost and simpler configuration.

Full explanation →
63
MCQhard

A company runs a read-heavy database workload on Amazon RDS for PostgreSQL with a primary instance and two read replicas. The SysOps administrator observes that the read replicas frequently experience high replica lag during peak hours, causing stale reads for the application. The administrator needs to reduce replica lag while optimizing costs. The workload is predictable, with spikes during business hours and low traffic at night. Which combination of actions should the administrator take?

A.Convert the read replicas to Multi-AZ instances to improve the replication process and reduce lag.
B.Upgrade the instance class of the read replicas to a larger type with more CPU and memory to handle the increased WAL replay rate.
C.Add additional read replicas to distribute the read load and reduce the lag on each individual replica.
D.Upgrade the primary DB instance to a larger class with increased IOPS to reduce the amount of data that needs to be replicated.
AnswerB

Replica lag occurs when the replica cannot keep up with the rate of changes from the primary. Increasing the replica's instance size gives it more resources to apply WAL data faster, reducing lag. This directly addresses the performance bottleneck.

Why this answer

Upgrading the read replica instance class provides more CPU and memory, which directly increases the WAL replay rate. In RDS for PostgreSQL, replica lag is primarily caused by the replica's inability to apply WAL changes as fast as the primary generates them. A larger instance class alleviates this bottleneck without incurring the cost of upgrading the primary instance.

Exam trap

The trap here is that candidates often confuse replica lag with primary performance, leading them to upgrade the primary (Option D) or add more replicas (Option C), when the real bottleneck is the replica's WAL replay capacity.

How to eliminate wrong answers

Option A is wrong because Multi-AZ is a high-availability feature that uses synchronous replication to a standby in a different AZ, not a solution for read replica lag; it does not improve asynchronous replication performance and adds cost without addressing the WAL replay bottleneck. Option C is wrong because adding more read replicas distributes the read load but does not reduce the lag on each individual replica; each replica still must apply the same volume of WAL changes from the primary, so lag per replica remains unchanged. Option D is wrong because upgrading the primary instance class with increased IOPS reduces the primary's write latency but does not affect the replica's ability to replay WAL; the primary already generates WAL at the same rate, and the bottleneck is on the replica side.

Full explanation →
64
MCQmedium

A SysOps administrator manages an Amazon RDS for MySQL instance that handles a critical web application. During peak traffic, the number of database connections exceeds 500 for more than 15 minutes, leading to connection timeouts. The administrator wants to automatically increase the DB instance size when the connection count remains high, and decrease it when the load drops, to balance performance and cost. Which combination of AWS services should be used to achieve this automation with the least operational overhead?

A.Configure a CloudWatch alarm on DatabaseConnections that triggers an Amazon CloudWatch Events rule, which directly modifies the DB instance class using a CloudFormation custom resource.
B.Use an AWS Config rule to monitor DatabaseConnections and invoke an AWS Lambda function to scale the RDS instance when the threshold is breached.
C.Set up an Amazon CloudWatch alarm on the DatabaseConnections metric that triggers an AWS Lambda function to modify the DB instance class via the RDS API.
D.Use an AWS Systems Manager Automation runbook to periodically check the DatabaseConnections metric and adjust the RDS instance class if needed.
AnswerC

Correct: you create a CloudWatch alarm on DatabaseConnections with a threshold (e.g., high connections for 5 minutes); when it enters ALARM, it sends a notification to an SNS topic that triggers a Lambda function, or uses an alarm action to invoke Lambda directly. The Lambda function calls the RDS ModifyDBInstance API with the desired DBInstanceClass and the DBInstanceIdentifier, and RDS performs the scaling. This is an event-driven, low-latency pattern that requires no polling and is a supported, commonly used approach for automated RDS instance-class scaling.

Why this answer

It uses a CloudWatch alarm to monitor the DatabaseConnections metric, which triggers an AWS Lambda function that directly calls the RDS ModifyDBInstance API to change the instance class. This approach provides the least operational overhead by leveraging native AWS services without additional infrastructure, custom resources, or periodic polling, and it enables real-time, event-driven scaling based on the specified threshold.

Exam trap

The trap here is that candidates often confuse AWS Config rules (designed for compliance) with CloudWatch alarms (designed for metric monitoring), leading them to choose Option B, or they overcomplicate the solution with CloudFormation custom resources (Option A) or Systems Manager runbooks (Option D) when a simple Lambda function triggered by a CloudWatch alarm is the most direct and low-overhead approach.

How to eliminate wrong answers

Option A is wrong because CloudFormation custom resources require a Lambda-backed provisioning function and are designed for infrastructure provisioning, not for real-time, event-driven scaling of an existing RDS instance; they introduce unnecessary complexity and latency. Option B is wrong because AWS Config rules are designed for compliance and resource configuration auditing, not for monitoring real-time CloudWatch metrics like DatabaseConnections, and they cannot directly invoke a Lambda function for metric-based scaling without additional setup. Option D is wrong because AWS Systems Manager Automation runbooks are intended for operational tasks and remediation workflows, but periodically checking metrics introduces polling overhead and latency, which is less efficient than event-driven triggers and increases operational complexity.

Full explanation →
65
MCQmedium

Account A owns an S3 bucket containing shared artifacts. Account B needs to read objects from the bucket. The Account A team wants to grant access without creating IAM users, sharing access keys, or creating a role in Account A that Account B assumes. How should the bucket be configured to allow Account B's IAM roles to read objects?

A.Add an S3 bucket policy on Account A's bucket with Principal set to Account B's account ID and s3:GetObject permission; ensure Account B's roles have s3:GetObject in their identity policies
B.Create an IAM role in Account A with s3:GetObject permission and a trust policy allowing Account B's roles to assume it
C.Generate a presigned URL for each object in Account A and share the URLs with Account B's services
D.Enable S3 Access Points on the bucket and create an access point that allows Account B's VPC to connect via PrivateLink
AnswerA

Cross-account S3 access requires both a resource-based policy (bucket policy) that grants Account B access, and identity-based policies in Account B that allow the action. The bucket policy's Principal field specifies Account B's account root ARN or specific role ARNs. When both sides allow, the call succeeds without any role chaining or credential sharing.

Why this answer

It uses an S3 bucket policy with a Principal set to Account B's account ID, which grants cross-account access to all IAM principals (users and roles) in Account B. Account B's IAM roles must also have an identity policy that allows s3:GetObject, ensuring that the effective permissions require both the bucket policy and the role's policy to allow the action. This approach avoids creating IAM users, sharing access keys, or setting up a role in Account A for Account B to assume.

Exam trap

The SOA-C02 exam often tests the misconception that a bucket policy with a cross-account Principal automatically grants access to all IAM roles in that account, but candidates forget that the roles must also have an explicit allow in their identity policies for the action to succeed.

How to eliminate wrong answers

Option B is wrong because it requires creating a role in Account A that Account B assumes, which violates the requirement to avoid such a setup. Option C is wrong because presigned URLs grant temporary access but require generating and sharing a URL for each object, which is not a scalable or secure method for ongoing access by IAM roles, and it does not leverage IAM policies for authorization. Option D is wrong because S3 Access Points with VPC PrivateLink restrict access to a specific VPC, but they do not inherently grant cross-account access to IAM roles in Account B without additional bucket policies or resource policies, and the question does not specify VPC-based access.

Full explanation →
66
MCQeasy

A company stores critical data in an S3 bucket. The SysOps administrator needs to ensure that the data is durable and can be recovered if an entire AWS Region becomes unavailable. What is the MOST cost-effective solution?

A.Use AWS Backup to manually copy the bucket to another Region.
B.Enable S3 Versioning on the bucket.
C.Use S3 Standard storage class.
D.Configure S3 Cross-Region Replication to a bucket in another Region.
AnswerD

CRR replicates data to another Region for disaster recovery.

Why this answer

D is correct because S3 Cross-Region Replication (CRR) automatically replicates objects to a bucket in another AWS Region, ensuring data durability and recoverability even if an entire Region becomes unavailable. This is the most cost-effective solution for cross-region disaster recovery as it only incurs replication costs and storage fees in the destination Region, without requiring manual intervention or additional infrastructure.

Exam trap

The trap here is that candidates often confuse S3 Versioning (which protects against accidental deletion within a Region) with Cross-Region Replication (which protects against Regional outages), leading them to select Option B as a cheaper alternative without understanding that versioning does not provide geographic redundancy.

How to eliminate wrong answers

Option A is wrong because AWS Backup does not support manual copying of S3 buckets to another Region; it automates backup policies but does not provide a direct 'copy bucket' feature, and manual copying would be inefficient and error-prone. Option B is wrong because enabling S3 Versioning protects against accidental deletion or overwrite within the same Region but does not protect against a Regional outage, as all versions remain in the same Region. Option C is wrong because using the S3 Standard storage class provides high durability (99.999999999%) within a single Region but does not replicate data across Regions, so it cannot recover data if the entire Region becomes unavailable.

Full explanation →
67
Multi-Selecthard

A SysOps administrator needs to audit all changes to IAM resources in their AWS account. Which THREE AWS services can be used together to achieve this? (Choose THREE.)

Select 3 answers
A.AWS CloudTrail
B.Amazon GuardDuty
C.AWS Config
D.AWS Trusted Advisor
E.Amazon CloudWatch Logs
AnswersA, C, E

Records IAM API calls.

Why this answer

AWS CloudTrail records all IAM API calls, providing a detailed audit trail of changes. Option C is correct because AWS Config tracks changes to IAM resource configurations and can evaluate them against rules. Option E is correct because Amazon CloudWatch Logs can store and monitor CloudTrail logs, enabling alerting on specific IAM changes.

Option B is wrong because Amazon GuardDuty is for threat detection, not auditing configuration changes. Option D is wrong because AWS Trusted Advisor provides best-practice checks but does not log or track changes to IAM resources.

Full explanation →
68
MCQhard

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed in a single AWS region. The company wants to improve performance for users in other regions and reduce the load on the origin servers. The SysOps administrator decides to use Amazon CloudFront. After implementing CloudFront, the administrator notices that the cache hit ratio is very low (around 10%) for the dynamic API responses that are served by the application. These API responses are personalized per user and change frequently. The administrator wants to improve performance for these dynamic requests while still using CloudFront. The application uses cookies for session management and the API responses depend on the user's session. The administrator must ensure that users receive the correct personalized content. Which configuration should the administrator use?

A.Use Lambda@Edge to generate personalized responses at the edge without forwarding all requests to the origin.
B.Configure CloudFront to use origin shield and enable keep-alive connections to the origin.
C.Configure CloudFront to forward cookies to the origin and enable caching based on cookies.
D.Disable caching for the API behavior in CloudFront and enable real-time logs.
AnswerA

Use Lambda@Edge to generate personalized responses at the edge. This allows dynamic content to be served from the edge without requiring a round trip to the origin, improving performance while maintaining correctness. It directly addresses the low cache hit ratio by avoiding caching altogether for personalized content.

Why this answer

For dynamic, personalized API responses that depend on user session cookies, caching is ineffective because each user's response is unique. Lambda@Edge allows you to run code at CloudFront edge locations to generate personalized responses or modify requests/responses. By using a Lambda function that inspects the session cookie and generates the appropriate API response at the edge, you can serve personalized content without forwarding every request to the origin.

This improves performance by reducing round trips and origin load while ensuring users receive correct personalized content. Options B, C, and D do not effectively address the need for dynamic personalization with low cache hit ratio.

Full explanation →
69
Drag & Dropmedium

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Restoration starts by selecting the snapshot, then configuring instance details, security, and parameters, then initiating the restore.

Full explanation →
70
MCQmedium

Users are intermittently reporting 502 Bad Gateway errors when accessing the application through an Application Load Balancer. The team needs to identify which target IPs are associated with the failures and the request processing time for those requests. Application logs on instances do not capture failures before the ALB connection. What should be enabled?

A.Enable ALB access logs, specify an S3 bucket destination, and query the logs to filter on elb_status_code=502
B.Enable AWS X-Ray on the ALB to trace each request end-to-end from client to target
C.Configure a VPC Flow Log on the subnets containing the ALB to capture all network traffic
D.Install an agent on the application instances that logs all incoming connection attempts from the ALB
AnswerA

Access logs capture every ALB request including 502s. Each log entry contains the target_ip:target_port field identifying which instance handled (or failed to handle) the request, and request_processing_time and target_processing_time values for performance analysis. This data is available without any changes to instance-side software.

Why this answer

ALB access logs capture detailed information about each request, including the target IP address, request processing time, and the HTTP status code returned by the ALB. By enabling these logs and querying for `elb_status_code=502`, you can identify which target IPs were associated with the failures and the `request_processing_time` for those requests. This directly addresses the need to correlate failures with specific targets and timing, without relying on application instance logs that miss pre-connection failures.

Exam trap

The trap here is that candidates often confuse ALB access logs with VPC Flow Logs or X-Ray, assuming any logging mechanism that captures network traffic or traces will include HTTP-level details like status codes and request processing times, but only ALB access logs provide the specific fields needed to correlate 502 errors with target IPs and timing.

How to eliminate wrong answers

Option B is wrong because AWS X-Ray traces requests end-to-end, but it requires the application to be instrumented with the X-Ray SDK and does not capture failures that occur before the ALB establishes a connection to the target (e.g., connection timeouts or TLS handshake failures that result in a 502). Option C is wrong because VPC Flow Logs capture metadata about network traffic (source/destination IP, ports, protocol, and packet counts) but do not include HTTP status codes, request processing times, or ALB-specific error codes like 502. Option D is wrong because installing an agent on the application instances would only log connection attempts that reach the instance; it would not capture failures that occur before the ALB successfully connects to the target (e.g., connection refused or health check failures), which are the very failures causing the 502 errors.

Full explanation →
71
MCQhard

An EC2 instance in the subnet associated with the network ACL above cannot receive HTTP traffic (port 80) from the internet. The instance has a security group allowing HTTP inbound. What is the cause?

A.The NACL allows HTTP inbound on rule 300, but the outbound rule does not allow the return traffic
B.The NACL inbound rule for HTTP is using the wrong protocol (6 instead of 17)
C.The NACL has a deny all rule (rule 400) that blocks all inbound traffic, overriding the allow rules
D.The security group does not allow HTTP inbound
AnswerC

Rule 400 denies all inbound traffic, so even though rule 300 allows HTTP, it is overridden.

Why this answer

Network ACLs are stateless and rules are evaluated in order by rule number. Rule 400 denies all inbound traffic, and since it has a higher rule number than rules 100 and 300, it is evaluated later and overrides the allows. Rule 400 denies all inbound traffic, so HTTP (port 80) is denied.

Option A is wrong because rule 300 allows port 80 inbound from 0.0.0.0/0, so HTTP is allowed by that rule, but rule 400 denies all. Option B is wrong because the outbound rule allows all traffic. Option D is wrong because the security group allows HTTP inbound but the NACL blocks it.

Full explanation →
72
Multi-Selectmedium

A SysOps administrator is troubleshooting an Amazon EC2 instance that is unreachable. The instance passes the system status check but fails the instance status check. Which TWO of the following are likely causes of this issue? (Choose TWO.)

Select 2 answers
A.Network connectivity issues
B.Detached EBS root volume
C.Misconfigured firewall or iptables
D.Insufficient memory for applications
E.Corrupted file system
AnswersC, E

A misconfigured firewall or iptables ruleset can block all inbound and outbound traffic, effectively making the instance unreachable despite the OS running normally. The instance status check performs a network reachability test at the OS level, and if the packet filtering rules prevent the response, the check fails, indicating an instance-level problem. Since the issue stems from guest OS configuration rather than AWS infrastructure, it is correctly identified as an instance status check failure.

Why this answer

An instance status check failure indicates that the operating system or the instance itself is not functioning correctly, even though the underlying hardware (system status check) is healthy. A misconfigured firewall or iptables can block required network traffic, causing the instance to appear unreachable, while a corrupted file system can prevent the OS from booting or operating properly, both of which are detected by the instance status check.

Exam trap

The trap here is that candidates often confuse instance status checks with system status checks, incorrectly attributing network-level issues (like detached volumes or external connectivity) to instance status failures when they actually belong to system status failures.

Full explanation →
73
MCQhard

A company uses AWS Organizations and wants to restrict access to S3 buckets based on project tags. The security policy requires that users in the 'DataScientists' group can only access S3 buckets that have the tag 'Project: DataEngineering'. Which IAM policy condition key should the SysOps administrator use in a customer managed policy to enforce this restriction?

A.aws:ResourceTag
B.s3:ExistingObjectTag
C.s3:ResourceTag
D.iam:ResourceTag
AnswerA

The aws:ResourceTag condition key allows you to control access based on tags attached to the resource being accessed (e.g., S3 bucket tag). You can use it in the 'Condition' element of an IAM policy to enforce the tag requirement.

Why this answer

The `aws:ResourceTag` condition key is used in IAM policies to control access based on the tags attached to the AWS resource (in this case, an S3 bucket). By specifying `aws:ResourceTag/Project` with a value of `DataEngineering`, the policy ensures that only S3 buckets with that exact tag are accessible to the 'DataScientists' group. This key is evaluated against the resource's tags at the time of the request, making it the appropriate choice for tag-based resource restrictions.

Exam trap

The trap here is that candidates often confuse `aws:ResourceTag` with service-specific keys like `s3:ExistingObjectTag`, mistakenly applying object-level conditions to bucket-level restrictions, or they assume `s3:ResourceTag` exists as a valid key when it does not.

How to eliminate wrong answers

Option B is wrong because `s3:ExistingObjectTag` is used to condition access based on tags on individual objects within an S3 bucket, not on the bucket itself, and thus cannot restrict access to buckets based on bucket-level tags. Option C is wrong because `s3:ResourceTag` is not a valid IAM condition key; AWS uses `aws:ResourceTag` for resource-level tags across services, and S3-specific condition keys like `s3:ExistingObjectTag` or `s3:RequestObjectTag` are for object-level operations. Option D is wrong because `iam:ResourceTag` is specific to IAM resources (such as users, roles, or policies) and cannot be used to restrict access to S3 buckets based on bucket tags.

Full explanation →
74
MCQhard

A SysOps team needs to monitor application logs in Amazon CloudWatch Logs for specific error codes and automatically invoke an AWS Lambda function for remediation within 5 minutes of an error occurring. Which solution involves the least operational overhead?

A.Create a CloudWatch Logs subscription filter to stream logs directly to an AWS Lambda function.
B.Create a CloudWatch metric filter on the log group, create a CloudWatch alarm on the metric, and configure the alarm to post to an SNS topic that triggers the Lambda function.
C.Use a third-party log aggregation tool that sends webhook notifications to an API Gateway endpoint to invoke the Lambda function.
D.Write a custom script that runs on an EC2 instance to poll CloudWatch Logs every minute and invoke the Lambda function.
AnswerB

Correct. This uses native CloudWatch features with minimal overhead, meeting the 5-minute requirement through alarm evaluation intervals.

Why this answer

It uses CloudWatch metric filters and alarms to detect error codes in logs and trigger remediation via SNS and Lambda, all within a fully managed AWS pipeline. This approach requires no custom code or infrastructure to maintain, and the alarm can be configured to evaluate logs within a 1-minute period, easily meeting the 5-minute requirement with minimal operational overhead.

Exam trap

The trap here is that candidates often assume a subscription filter (Option A) is the simplest because it directly streams logs to Lambda, but they overlook that it lacks native filtering for specific error codes and requires the Lambda to process all log events, increasing complexity and cost compared to a metric filter and alarm.

How to eliminate wrong answers

Option A is wrong because CloudWatch Logs subscription filters stream logs in near real-time but do not provide a built-in mechanism to filter for specific error codes before invoking Lambda; the Lambda function would have to parse every log event, increasing cost and complexity, and there is no native alarm or retry logic for missed events. Option C is wrong because introducing a third-party log aggregation tool and an API Gateway endpoint adds significant operational overhead for setup, maintenance, and cost, and it violates the 'least operational overhead' requirement. Option D is wrong because writing a custom script on an EC2 instance to poll CloudWatch Logs every minute introduces unnecessary compute resources, potential single points of failure, and ongoing maintenance overhead, which is far from the least operational overhead solution.

Full explanation →
75
Multi-Selecthard

A company uses CloudWatch Logs to collect application logs from EC2 instances. The logs are critical for troubleshooting. The operations team notices that some log entries are missing during peak hours. The CloudWatch Logs agent is configured with a batch size of 1 MB and a batch timeout of 10 seconds. Which TWO actions should the administrator take to reduce the chance of missing log events?

Select 2 answers
A.Use PutLogEvents directly from the application.
B.Reduce the retry count for failed requests.
C.Increase the batch size to 5 MB.
D.Increase the batch timeout to 30 seconds.
E.Enable log compression in the agent configuration.
AnswersC, E

Larger batches reduce the number of API calls, lowering the chance of hitting rate limits.

Why this answer

Increasing the batch size from 1 MB to 5 MB allows the CloudWatch Logs agent to buffer more log data before sending a request. During peak hours, log volume spikes can cause the agent to drop events if the batch fills up faster than it can be transmitted. A larger batch size reduces the frequency of API calls and helps ensure that all log entries are successfully delivered.

Exam trap

The trap here is that candidates often think increasing the batch timeout (Option D) will help, but in reality, a longer timeout increases the risk of buffer overflow during peak traffic, whereas increasing batch size and enabling compression directly address throughput and payload limits.

Full explanation →

Page 1 of 4

Page 2

All pages

1234

Practice SOA-C02 by domain

Target a specific domain to shore up weak areas.

Monitoring, Logging, and RemediationReliability and Business ContinuityDeployment, Provisioning, and AutomationSecurity and ComplianceNetworking and Content DeliveryCost and Performance Optimization
See all domains with question counts →