Knowledge + Practice

AWS Certified SysOps Administrator Associate SOA-C02 (SOA-C02) — Questions 1351–1425

1546 questions total · 21pages · All types, answers revealed

Take a mock exam Exam hub

Page 19 of 21

1351

MCQeasy

An organization is using AWS CloudFormation to manage its infrastructure. The SysOps administrator wants to update a stack that includes an Amazon RDS DB instance. The update requires changing the DB instance class. However, the administrator wants to minimize downtime. What should the administrator do?

A.Use CloudFormation's 'DeletionPolicy' attribute to retain the database during updates.

B.Enable Multi-AZ on the DB instance (if not already enabled) before performing the stack update.

C.Update the stack directly with 'ApplyImmediately' set to true.

D.Create a read replica, promote it, and then delete the original DB instance.

AnswerB

Why C is correct

Why this answer

Option C is correct because changing the DB instance class may require a replacement, which causes downtime. Using a Multi-AZ deployment allows the update to be applied to the standby first, then fail over, minimizing downtime. Option A is incorrect because modifying the DB instance class directly with ApplyImmediately may cause a brief outage.

Option B is incorrect because creating a read replica does not help with updating the instance class. Option D is incorrect because CloudFormation does not automatically create a standby for single-AZ deployments.

Full explanation →

1352

MCQmedium

An application running on an EC2 instance writes logs to a local file. The operations team needs to monitor these logs in near real-time for troubleshooting. Which solution provides the most efficient way to stream these logs to CloudWatch Logs?

A.Use the AWS CLI to periodically upload the log file using the put-log-events command.

B.Install the CloudWatch Logs agent on the instance and configure it to tail the log file.

C.Install the Amazon Kinesis Agent on the instance and configure it to send logs to CloudWatch Logs.

D.Configure the application to write logs to an S3 bucket and use S3 Event Notifications to trigger a Lambda function that puts logs to CloudWatch.

AnswerB

The CloudWatch Logs agent streams logs to CloudWatch Logs in near real-time.

Why this answer

The CloudWatch Logs agent (or the newer unified CloudWatch agent) is designed specifically to tail log files from EC2 instances and stream them to CloudWatch Logs in near real-time. This provides the most efficient solution because it continuously monitors the file for new entries and sends them with minimal latency, without requiring periodic uploads or complex event-driven pipelines.

Exam trap

The trap here is that candidates may confuse the Kinesis Agent with the CloudWatch Logs agent, assuming both can send directly to CloudWatch Logs, but the Kinesis Agent only supports Kinesis destinations natively.

How to eliminate wrong answers

Option A is wrong because using the AWS CLI to periodically upload logs via put-log-events introduces significant latency (since it must run on a schedule) and is inefficient for near real-time monitoring; it also requires manual scripting to track the last uploaded position. Option C is wrong because the Amazon Kinesis Agent is designed to send data to Amazon Kinesis Data Streams or Firehose, not directly to CloudWatch Logs; sending logs to CloudWatch would require an additional intermediary (e.g., a Lambda function), adding complexity and cost. Option D is wrong because writing logs to S3 and using S3 Event Notifications with Lambda adds unnecessary latency (S3 is object storage, not a streaming target) and complexity; this approach is better suited for batch or archival processing, not near real-time monitoring.

Full explanation →

1353

MCQhard

A SysOps administrator needs to monitor a custom application metric 'OrdersPerMinute' published to Amazon CloudWatch. The metric should trigger an alarm when the count exceeds 100 for more than 2 consecutive data points, but only during business hours (9 AM to 5 PM weekdays). The alarm must evaluate the metric as a rate per minute. How should the administrator configure the alarm?

A.Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and use a math expression to filter time range.

B.Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and disable the alarm outside business hours using a Lambda function triggered by CloudWatch Events.

C.Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 2, datapoints to alarm of 2, and use a metric math expression 'IF(IN_BUSINESS_HOURS(), OrdersPerMinute, 0)' but CloudWatch does not have IN_BUSINESS_HOURS function.

D.Create a CloudWatch alarm with a period of 1 minute, evaluation periods of 1, datapoints to alarm of 2 (impossible).

AnswerB

This solution uses a scheduled Lambda function (via CloudWatch Events) to enable/disable the alarm. The alarm itself is configured with the correct evaluation criteria (2 out of 2 datapoints above 100). This meets the requirement while using automated remediation.

Why this answer

Option B is correct because CloudWatch alarms cannot natively filter by time of day or day of week. The only way to achieve this requirement is to use a Lambda function triggered by a CloudWatch Events (now Amazon EventBridge) schedule to enable or disable the alarm outside business hours. This ensures the alarm only evaluates during 9 AM–5 PM weekdays while using a period of 1 minute, evaluation periods of 2, and datapoints to alarm of 2 to detect when 'OrdersPerMinute' exceeds 100 for more than 2 consecutive data points.

Exam trap

The trap here is that candidates assume CloudWatch has a built-in time-based filtering function (like IN_BUSINESS_HOURS) or that math expressions can evaluate time, when in reality AWS requires external scheduling via Lambda or EventBridge to manage alarm activation windows.

How to eliminate wrong answers

Option A is wrong because CloudWatch math expressions do not include a function like 'IN_BUSINESS_HOURS()' to filter by time range; math expressions operate on metric values, not time-based conditions. Option C is wrong because it incorrectly claims CloudWatch has an 'IN_BUSINESS_HOURS' function, which does not exist; this would cause the alarm to fail or evaluate incorrectly. Option D is wrong because it sets evaluation periods to 1 and datapoints to alarm to 2, which is impossible—the number of datapoints to alarm cannot exceed the number of evaluation periods.

Full explanation →

1354

MCQmedium

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The SysOps administrator needs to restrict access to the ALB so that it only accepts requests from CloudFront. Which solution should the administrator implement?

A.Replace the ALB with a Network Load Balancer and use a VPC endpoint

B.Create an origin access identity (OAI) and attach it to the CloudFront distribution

C.Add a security group rule to the ALB that allows traffic only from the CloudFront IP ranges

D.Configure CloudFront to add a custom HTTP header to requests, and configure the ALB to only forward requests that contain that header

AnswerD

This ensures only CloudFront requests reach the ALB.

Why this answer

Option D is correct because it uses a shared secret mechanism: CloudFront is configured to add a custom HTTP header (e.g., X-Origin-Verify) to all requests, and the ALB's listener rule is configured to only forward requests that contain that specific header value. This ensures that only requests originating from your CloudFront distribution reach the ALB, as the header is not present in direct client requests. This approach is recommended by AWS for restricting ALB access to CloudFront when the origin is an ALB, because CloudFront does not support Origin Access Identity (OAI) with ALB origins.

Exam trap

The trap here is that candidates often confuse Origin Access Identity (OAI) as a universal CloudFront feature, not realizing it only works with S3 origins, and they overlook the impracticality of using CloudFront IP ranges in security groups due to their dynamic nature.

How to eliminate wrong answers

Option A is wrong because replacing the ALB with a Network Load Balancer (NLB) and using a VPC endpoint does not inherently restrict access to CloudFront; a VPC endpoint is used for private connectivity, not for authenticating the source of traffic, and NLB does not support custom header-based filtering natively. Option B is wrong because Origin Access Identity (OAI) is a feature specific to Amazon S3 origins, not Application Load Balancers; OAI cannot be attached to a CloudFront distribution with an ALB origin. Option C is wrong because CloudFront does not have a fixed set of IP ranges; its IP addresses change frequently and are published via a public list, making it impractical and insecure to maintain a security group rule that only allows CloudFront IP ranges, as the list is large and dynamic.

Full explanation →

1355

MCQmedium

A company has a production environment that includes an Amazon RDS for MySQL database. The SysOps administrator receives an alert that the database's CPU utilization has been above 90% for the past hour. The administrator checks the CloudWatch metrics and sees that the DatabaseConnections metric is also high. The application team reports that users are experiencing slow response times. The administrator wants to investigate which queries are causing the high CPU. The database is already configured to send logs to CloudWatch Logs. Which course of action should the administrator take to identify the problematic queries?

A.Use CloudWatch Logs Insights to query the existing RDS log group for any SQL statements.

B.Enable AWS CloudTrail to capture database queries and send them to CloudWatch Logs.

C.Enable the slow query log in the RDS parameter group and publish it to CloudWatch Logs. Then use CloudWatch Logs Insights to query the logs for slow queries.

D.Enable Amazon RDS Performance Insights and use the dashboard to identify top SQL queries.

AnswerC

Slow query logs directly show queries that take a long time.

Why this answer

Option B is correct because RDS can publish slow query logs to CloudWatch Logs, which can then be queried. Option A is wrong because Performance Insights shows performance data but not raw queries. Option C is wrong because CloudWatch Logs Insights can query logs, but the slow query logs need to be enabled first.

Option D is wrong because CloudTrail does not capture database queries.

Full explanation →

1356

Multi-Selecthard

A company runs a critical web application on EC2 instances behind an ALB. The application experiences unpredictable traffic spikes. The SysOps administrator wants to ensure that the application can handle spikes without performance degradation while minimizing costs. Which TWO actions should the administrator take?

Select 2 answers

A.Use a mix of On-Demand and Spot Instances in the Auto Scaling group.

B.Use Amazon DynamoDB auto scaling to handle the spikes.

C.Use scheduled scaling to add instances during expected peak hours.

D.Use a target tracking scaling policy based on CPU utilization.

E.Use larger EC2 instance types to handle spikes.

AnswersA, D

Spot Instances reduce costs; the mix ensures availability.

Why this answer

Option A is correct because Spot Instances can reduce costs if the application can handle interruptions. Option D is correct because target tracking scaling adjusts capacity based on load. Option B is wrong because DynamoDB auto scaling is not relevant for EC2.

Option C is wrong because scheduled scaling cannot handle unpredictable spikes. Option E is wrong because increasing instance size may not be as cost-effective as scaling out.

Full explanation →

1357

MCQeasy

A company runs a web application on an EC2 instance that uses Amazon EBS volumes. The SysOps administrator notices that the instance's disk queue length is consistently high, and the application is experiencing I/O latency. The administrator wants to set up monitoring to alert when the disk queue length exceeds a threshold. Which steps should the administrator take to achieve this? The instance is already sending CloudWatch metrics.

A.Install the CloudWatch agent on the instance and configure it to collect disk queue length.

B.Create a CloudWatch alarm on the EBS metric VolumeQueueLength for the attached volume.

C.Enable VPC Flow Logs to capture disk I/O metrics.

D.Create a CloudWatch alarm on the EC2 metric DiskQueueLength.

AnswerB

VolumeQueueLength is an EBS metric available in CloudWatch.

Why this answer

Option C is correct because the EBS volume metrics (e.g., VolumeQueueLength) are sent to CloudWatch automatically. Option A is wrong because EC2 metrics do not include disk queue length. Option B is wrong because the CloudWatch agent is not required for EBS metrics.

Option D is wrong because VPC Flow Logs capture network traffic, not disk metrics.

Full explanation →

1358

MCQmedium

An organization is using AWS CloudFormation to deploy infrastructure. The SysOps administrator needs to receive notifications when stack creation fails. What is the simplest way to achieve this?

A.Create a CloudWatch alarm on the 'StackCreationFailure' metric.

B.Provide an SNS topic ARN in the --notification-arns parameter when creating the stack.

C.Create an EventBridge rule that triggers on CloudFormation events.

D.Enable CloudTrail and create a metric filter for 'CreateStack' failures.

AnswerB

CloudFormation sends stack events to the SNS topic.

Why this answer

Option B is correct because the `--notification-arns` parameter in the AWS CLI `create-stack` command directly associates an SNS topic with the stack, causing CloudFormation to publish notifications for all stack events, including failures. This is the simplest method as it requires no additional services or configuration beyond specifying the SNS topic ARN at stack creation.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing EventBridge or CloudTrail, missing the fact that CloudFormation has a built-in, one-step SNS notification feature that is the simplest and most direct way to receive stack failure alerts.

How to eliminate wrong answers

Option A is wrong because CloudFormation does not emit a 'StackCreationFailure' metric to CloudWatch; CloudWatch metrics for CloudFormation are limited to 'Drift' and 'ResourceCount', not stack status events. Option C is wrong because while an EventBridge rule can capture CloudFormation events, it requires additional setup to filter for stack creation failures and is not the simplest approach compared to directly using SNS notifications. Option D is wrong because enabling CloudTrail and creating a metric filter for 'CreateStack' failures is overly complex and indirect; CloudTrail logs API calls but does not natively trigger notifications without additional CloudWatch Alarms or EventBridge rules.

Full explanation →

1359

MCQeasy

A company wants to be able to query application logs in near real-time using a SQL-like syntax. Which AWS service should be used?

A.CloudWatch Logs Insights

B.CloudWatch Metrics Insights

C.CloudWatch Events

D.CloudWatch Logs subscription filters

AnswerA

Logs Insights allows querying logs with a SQL-like syntax.

Why this answer

CloudWatch Logs Insights is the correct service because it enables interactive querying of log data stored in CloudWatch Logs using a purpose-built SQL-like query language. It is designed for ad-hoc analysis of logs in near real-time, allowing users to filter, aggregate, and visualize log events without needing to export data to another analytics platform.

Exam trap

The trap here is that candidates confuse CloudWatch Logs Insights with CloudWatch Metrics Insights, assuming both can query logs, but Metrics Insights only works with numeric metric data and cannot parse or search log message content.

How to eliminate wrong answers

Option B is wrong because CloudWatch Metrics Insights is used to query and analyze metric data (numerical time-series data), not log data, and does not support SQL-like syntax for log content. Option C is wrong because CloudWatch Events (now part of Amazon EventBridge) is a service for routing events to targets based on rules, not for querying log data with SQL-like syntax. Option D is wrong because CloudWatch Logs subscription filters are used to stream log data in real-time to other destinations (e.g., Lambda, Kinesis, Elasticsearch) for processing, but they do not provide a query interface or SQL-like syntax for interactive analysis.

Full explanation →

1360

MCQeasy

A company wants to establish a dedicated, low-latency, private connection between its on-premises data center and an AWS VPC. The company does not want to use the public internet. Which AWS service should be used to meet this requirement?

A.AWS Direct Connect

B.AWS Virtual Private Gateway

C.AWS Transit Gateway

D.VPC Peering

AnswerA

Correct. AWS Direct Connect provides a dedicated private connection between on-premises and AWS, avoiding the public internet.

Why this answer

AWS Direct Connect is the correct service because it provides a dedicated, private, low-latency network connection from an on-premises data center to AWS, bypassing the public internet entirely. It uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a VPC, ensuring consistent network performance and reduced latency.

Exam trap

The trap here is that candidates often confuse AWS Virtual Private Gateway (a required attachment for Direct Connect) with the Direct Connect service itself, or they assume VPC Peering can extend to on-premises networks, but VPC Peering is strictly limited to inter-VPC connectivity within AWS.

How to eliminate wrong answers

Option B (AWS Virtual Private Gateway) is wrong because it is a logical component that attaches to a VPC to enable VPN or Direct Connect connections, but it is not a service that itself provides a dedicated private connection; it requires Direct Connect or a VPN to function. Option C (AWS Transit Gateway) is wrong because it is a network transit hub used to interconnect multiple VPCs and on-premises networks, but it does not provide the dedicated physical connection itself; it relies on Direct Connect or VPN for the on-premises link. Option D (VPC Peering) is wrong because it only connects two VPCs within AWS using the AWS global network, and it cannot be used to connect an on-premises data center to a VPC.

Full explanation →

1361

MCQmedium

A company runs a production database on Amazon RDS for MySQL with Multi-AZ enabled. During a recent Availability Zone outage, the database experienced a failover. After the failover, the application team notices that the database endpoint in the connection string no longer works. What is the most likely cause?

A.The application is using the IP address of the database instance instead of the DNS endpoint.

B.The DB instance identifier changed after the failover.

C.The security group for the RDS instance was modified during the failover.

D.The DNS CNAME record for the RDS endpoint was manually changed.

AnswerA

Using the IP address bypasses DNS updates; after failover, the IP changes and the application cannot connect.

Why this answer

Option A is correct because the DNS name for an RDS instance automatically resolves to the primary instance; after failover, the DNS is updated to point to the new primary, so the endpoint should still work. Option B is wrong because the CNAME is automatically updated by AWS. Option C is wrong because the DB instance identifier does not change.

Option D is wrong because the security group rules apply to the RDS instance, not the connection string.

Full explanation →

1362

MCQmedium

A SysOps administrator needs to provide temporary, limited-privilege credentials to an application running on an EC2 instance. The application needs to access an S3 bucket. What is the most secure way to grant these credentials?

A.Use a Lambda function to generate temporary credentials from an IAM user.

B.Store the AWS access keys in an S3 bucket and have the application download them at startup.

C.Attach an IAM role with the necessary permissions to the EC2 instance.

D.Create an IAM user with programmatic access and store the access keys in the application's environment variables.

AnswerC

The instance profile provides temporary credentials automatically.

Why this answer

Option C is correct because using an IAM role with an instance profile is the best practice for providing temporary credentials to EC2. Option A is wrong because hardcoding credentials is insecure. Option B is wrong because storing in S3 is insecure.

Option D is wrong because IAM user credentials are long-term, not temporary.

Full explanation →

1363

Multi-Selectmedium

A company has a VPC with a public subnet and a private subnet. The private subnet contains an EC2 instance that must access the internet for software updates. Which TWO actions are required to enable this? (Choose TWO.)

Select 2 answers

A.Add an Internet Gateway to the private subnet's route table.

B.Deploy a NAT Gateway in a public subnet.

C.Assign a public IP address to the EC2 instance.

D.Attach an Internet Gateway to the NAT Gateway.

E.Add a route in the private subnet's route table pointing to the NAT Gateway for 0.0.0.0/0.

AnswersB, E

Correct because the NAT Gateway must be in a public subnet to access the internet.

Why this answer

Option A is correct because a NAT Gateway must be in a public subnet. Option C is correct because the private subnet's route table must have a default route to the NAT Gateway. Option B is wrong because the NAT Gateway does not need an Internet Gateway; the public subnet does.

Option D is wrong because the EC2 instance does not need a public IP. Option E is wrong because an Internet Gateway is for public subnets, not private.

Full explanation →

1364

MCQhard

A company has an AWS account with multiple VPCs connected via a transit gateway. The SysOps administrator needs to ensure that all traffic between VPCs is encrypted in transit. Which solution should the administrator implement?

A.Use VPC peering connections between the VPCs.

B.Use VPC endpoints to route traffic through AWS PrivateLink.

C.Set up AWS Site-to-Site VPN connections between the VPCs via the transit gateway.

D.Configure network ACLs to deny unencrypted traffic.

AnswerC

VPN provides encryption for traffic between VPCs.

Why this answer

Option B is correct because VPN connections between VPCs or using AWS VPN CloudHub can encrypt traffic. Option A is wrong because VPC Peering does not encrypt traffic. Option C is wrong because VPC endpoints are for accessing AWS services.

Option D is wrong because NACLs are stateless packet filters, not encryption.

Full explanation →

1365

MCQmedium

A SysOps administrator ran a CloudFormation stack update that failed and rolled back. The stack status is UPDATE_ROLLBACK_FAILED. The administrator needs to fix the issue and bring the stack to a stable state. What should the administrator do FIRST?

A.Identify and resolve the resource issue that caused the rollback failure, then continue the rollback.

B.Wait for CloudFormation to automatically retry the rollback.

C.Execute a new stack update to overwrite the failed resources.

D.Delete the stack and recreate it from the template.

AnswerA

Correct: Resolving the issue allows the rollback to complete.

Why this answer

The correct answer is B because when a rollback fails, the administrator must resolve the underlying issue (e.g., permissions, resource conflict) and then continue the rollback. Option A is wrong because attempting a new update without fixing the issue may fail again. Option C is wrong because deleting the stack may cause data loss.

Option D is wrong because CloudFormation does not automatically retry.

Full explanation →

1366

Multi-Selecthard

A company has an AWS account with multiple IAM users. The security team wants to enforce that all users use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should the SysOps administrator take? (Choose THREE.)

Select 3 answers

A.Attach a service control policy (SCP) to the account to require MFA.

B.Enable MFA for each IAM user in the AWS Management Console.

C.Create an IAM policy that denies console access unless MFA is present.

D.Use AWS CloudTrail to monitor user logins and disable accounts without MFA.

E.Educate users on how to set up and use MFA devices.

AnswersB, C, E

MFA must be enabled per user.

Why this answer

Option A is correct because MFA must be enabled for each user. Option B is correct because IAM policies can require MFA for console access. Option D is correct because users need to know how to use MFA.

Option C is wrong because SCPs are for Organizations. Option E is wrong because CloudTrail does not enforce MFA.

Full explanation →

1367

MCQhard

A company has multiple VPCs in the same AWS account and Region, each with overlapping CIDR blocks (10.0.0.0/16). The SysOps administrator needs to establish connectivity between all VPCs and the on-premises network via AWS Transit Gateway. Additionally, certain VPCs must be isolated from each other while still reaching on-premises. How should the administrator configure the Transit Gateway to meet these requirements?

A.Create a single Transit Gateway route table and add routes for all VPCs and the on-premises network.

B.Create multiple Transit Gateway route tables: one for each group of VPCs that need to communicate, and associate each VPC attachment with the appropriate route table. Add static routes to the on-premises network in each route table.

C.Use VPC peering instead of Transit Gateway to connect VPCs, and use Direct Connect Gateway for on-premises connectivity.

D.Configure VPN connections between each VPC and the on-premises network, bypassing Transit Gateway.

AnswerB

Correct. This allows isolation by route table, and overlapping CIDRs are handled by attaching VPCs to separate route tables. On-premises routes can be added to each.

Why this answer

Option B is correct because AWS Transit Gateway supports multiple route tables, allowing you to isolate VPC attachments from each other while still providing a common route to the on-premises network. By creating separate route tables for each group of VPCs that need to communicate, and associating the appropriate VPC attachments with those tables, you can enforce isolation between groups. Adding static routes to the on-premises network in each route table ensures all VPCs can reach on-premises, even when they cannot communicate with each other.

Exam trap

The trap here is that candidates assume a single Transit Gateway route table is sufficient for all VPCs, overlooking the need for isolation between specific VPC groups when overlapping CIDRs are present.

How to eliminate wrong answers

Option A is wrong because a single Transit Gateway route table would allow all VPC attachments to communicate with each other, violating the requirement to isolate certain VPCs. Option C is wrong because VPC peering does not support transitive routing and cannot be used with overlapping CIDR blocks; additionally, Direct Connect Gateway alone does not provide the required VPC-to-VPC isolation and connectivity. Option D is wrong because configuring VPN connections between each VPC and on-premises bypasses the Transit Gateway, failing to centralize connectivity and making it impossible to manage isolation and routing efficiently across multiple VPCs.

Full explanation →

1368

MCQmedium

A company has an S3 bucket that stores sensitive customer data. The security team requires that all access to the bucket be logged for auditing. The SysOps administrator enabled S3 server access logging and configured the logs to be delivered to a different S3 bucket in the same account. However, after a week, the log bucket is empty. What is the most likely cause?

A.The log bucket has no lifecycle policy.

B.The source bucket has an ACL that denies the log delivery service.

C.The log bucket has a bucket policy that denies access to the log delivery service.

D.The log bucket is in a different region.

AnswerC

Prevents log delivery.

Why this answer

Option D is correct because if the log delivery bucket has a bucket policy that denies access to the log delivery service, the logs will not be written. The S3 log delivery service uses a specific principal. Option A is wrong because the ACLs are not the issue.

Option B is wrong because the log bucket is in the same account. Option C is wrong because CloudTrail is not required for S3 access logs.

Full explanation →

1369

MCQhard

A company uses AWS Direct Connect to connect its on-premises network to AWS. The SysOps team notices that traffic from the on-premises network to a VPC is not using the Direct Connect connection but instead is going over the internet. The VPC has a virtual private gateway attached and the on-premises router is advertising a specific route. What is the most likely cause?

A.The on-premises network does not have a route to the VPC CIDR.

B.The VPC route table has a more specific route (e.g., 0.0.0.0/0) pointing to an Internet Gateway.

C.The BGP session between the on-premises router and the Direct Connect router is down.

D.The virtual private gateway is not attached to the VPC.

AnswerB

More specific route takes precedence over the Direct Connect route.

Why this answer

Option B is correct because the VPC route table contains a more specific route (0.0.0.0/0) pointing to an Internet Gateway, which overrides the less specific route to the virtual private gateway for traffic destined to the on-premises network. When the on-premises router advertises a specific route (e.g., 10.0.0.0/16) via BGP, the VPC route table must have a matching route (or a more specific one) pointing to the virtual private gateway; otherwise, the default route to the Internet Gateway takes precedence, sending traffic over the internet instead of Direct Connect.

Exam trap

The trap here is that candidates often assume the BGP session or virtual private gateway attachment is the issue, but the real cause is a route table priority conflict where a less specific default route to an Internet Gateway overrides the more specific Direct Connect route.

How to eliminate wrong answers

Option A is wrong because if the on-premises network lacked a route to the VPC CIDR, traffic would not reach the VPC at all, but the scenario states traffic is going over the internet, indicating a route exists but is misdirected. Option C is wrong because if the BGP session were down, the on-premises router would not advertise any routes, and the VPC would have no learned route to the on-premises network, causing traffic to fail or use the internet gateway as a default; however, the question states the on-premises router is advertising a specific route, implying BGP is up. Option D is wrong because if the virtual private gateway were not attached to the VPC, the VPC would have no connectivity to Direct Connect, and traffic would either fail or use the internet gateway, but the scenario specifically mentions a virtual private gateway is attached, making this option incorrect.

Full explanation →

1370

Multi-Selectmedium

A company runs a production workload on Amazon EC2 instances. The SysOps administrator wants to implement a cost optimization strategy that does not compromise availability. Which TWO actions should the administrator take?

Select 2 answers

A.Use Spot Instances for fault-tolerant and stateless workloads.

B.Identify and terminate idle instances.

C.Purchase Reserved Instances for baseline capacity.

D.Use smaller instance types for all workloads.

E.Use a single Availability Zone to reduce data transfer costs.

AnswersA, C

Spot Instances are cost-effective for flexible workloads.

Why this answer

Using Spot Instances for fault-tolerant workloads and purchasing Reserved Instances for steady-state usage reduce costs without affecting availability. Option A is wrong because terminating idle instances may affect availability if they are part of a cluster. Option B is wrong because using a single Availability Zone reduces availability.

Option D is wrong because reducing instance sizes may degrade performance.

Full explanation →

1371

MCQmedium

A company uses an RDS for MySQL Multi-AZ DB instance. They want to minimize downtime during a planned maintenance update that requires a database engine version upgrade. What should the SysOps administrator do?

A.Use the AWS Console to apply the maintenance update immediately; the Multi-AZ configuration will minimize downtime.

B.Modify the DB instance to be a Single-AZ deployment, then apply the upgrade.

C.Take a snapshot, restore it as a new instance, and upgrade that instance.

D.Create a read replica in the same region, upgrade the replica, and promote it.

AnswerA

RDS applies the upgrade to the standby first, then performs a failover, so the primary is only briefly unavailable.

Why this answer

Option D is correct because Multi-AZ updates are applied to the standby first, then a failover occurs, minimizing downtime. Option A is wrong because a snapshot restore takes longer. Option B is wrong because a read replica is not used for writes and promotion takes time.

Option C is wrong because Multi-AZ already provides high availability; disabling it increases downtime.

Full explanation →

1372

MCQhard

A company is using Amazon S3 to store historical data. The data is accessed frequently for the first 30 days, then accessed infrequently for the next 90 days, and after 120 days it is rarely accessed but must be retained for 7 years for compliance. Which S3 lifecycle policy provides the LOWEST cost while meeting these requirements?

A.Standard for 30 days, then transition to Standard-IA for 90 days, then to Glacier Deep Archive.

B.Standard for 30 days, then transition to One Zone-IA for 90 days, then to Glacier Deep Archive.

C.Standard for 120 days, then transition to Glacier Deep Archive.

D.Standard for 30 days, then transition to Glacier for the remaining life.

AnswerA

Optimizes cost by using appropriate storage classes for each access pattern.

Why this answer

Option A is correct because it aligns the storage class transitions precisely with the access patterns: Standard for frequent access (first 30 days), Standard-IA for infrequent access (next 90 days), and Glacier Deep Archive for long-term retention (after 120 days). This minimizes cost by avoiding paying for premium storage when data is rarely accessed, while still meeting the 7-year compliance requirement at the lowest possible storage cost.

Exam trap

The trap here is that candidates often overlook the compliance durability requirement and choose One Zone-IA for cost savings, or they fail to optimize the infrequent access period and keep data in Standard too long, both of which increase cost or risk data loss.

How to eliminate wrong answers

Option B is wrong because One Zone-IA is not designed for data that must be retained for compliance; it offers no resilience against the loss of a single Availability Zone, which violates the durability requirement for long-term retention. Option C is wrong because keeping data in Standard for 120 days incurs higher costs than transitioning to Standard-IA after 30 days, as the data is infrequently accessed during days 31–120, making it a more expensive choice. Option D is wrong because transitioning directly to Glacier (now S3 Glacier Flexible Retrieval) after 30 days ignores the infrequent access period (days 31–120) where Standard-IA would be cheaper than Glacier, and Glacier Deep Archive is the lowest-cost option for the rarely accessed 7-year retention period.

Full explanation →

1373

MCQmedium

A company runs a web application on a fleet of Amazon EC2 instances. The application uses Amazon EBS volumes of type gp2 (General Purpose SSD). Each volume is 100 GB, which provides a baseline of 3000 IOPS (the minimum performance of gp2). The SysOps administrator monitors the volumes and finds that the average IOPS used is only 1,500, and the application performance is adequate. The administrator wants to reduce storage costs without affecting performance. Which action should the administrator take?

A.Migrate the volumes from gp2 to gp3 and provision the baseline IOPS to match the actual usage.

B.Replace the EBS volumes with instance store volumes.

C.Change the volume type to io2 (Provisioned IOPS SSD) and reduce the provisioned IOPS.

D.Change the volume type to Cold HDD (sc1) to reduce cost.

AnswerA

gp3 volumes are more cost-effective than gp2 because they offer a lower per-GB price and allow you to customize IOPS independently of storage size. By matching IOPS to actual need, you reduce costs while maintaining performance.

Why this answer

Migrating from gp2 to gp3 is the correct action because gp3 offers a baseline of 3,000 IOPS and 125 MB/s throughput at a lower per-GB cost than gp2, regardless of volume size. Since the current gp2 volumes are 100 GB and provide only 3,000 IOPS baseline, but actual usage is only 1,500 IOPS, switching to gp3 allows the administrator to provision exactly 1,500 IOPS (paying only for what is used) while still benefiting from the included baseline performance, thereby reducing costs without affecting performance.

Exam trap

The trap here is that candidates may think reducing provisioned IOPS on a premium volume like io2 is cheaper, but they overlook that gp3 already includes a baseline of 3,000 IOPS at a lower per-GB cost, making it the most cost-efficient choice for this workload.

How to eliminate wrong answers

Option B is wrong because instance store volumes are ephemeral and data is lost if the instance stops or terminates, making them unsuitable for persistent storage required by the web application. Option C is wrong because io2 volumes are designed for high-performance, latency-sensitive workloads and cost significantly more than gp2 or gp3, so reducing provisioned IOPS on io2 would still be more expensive than using gp3 with the same IOPS. Option D is wrong because Cold HDD (sc1) is a throughput-optimized volume type with very low IOPS (maximum 250 IOPS per volume), which would severely degrade application performance since the current average IOPS is 1,500.

Full explanation →

1374

MCQhard

A SysOps administrator is troubleshooting a CloudFormation stack creation failure. The stack is designed to create an Amazon RDS DB instance with a specific parameter group. The error message indicates that the DB instance could not be created because the parameter group does not exist. The administrator has verified that the parameter group exists in the same region and account. What is the MOST likely issue?

A.The parameter group name in the template has a typo or does not match the actual resource name.

B.The VPC security group specified for the DB instance does not allow inbound traffic from the application tier.

C.The DB instance class requires a different parameter group family.

D.The parameter group resource is defined in the same template but is not linked to the DB instance using the 'DependsOn' attribute.

AnswerD

Why A is correct

Why this answer

Option A is correct because CloudFormation must create resources in order based on dependencies. If the parameter group is defined in the same template, it might be created after the DB instance, causing an error. The administrator should use the DependsOn attribute to ensure the parameter group is created first.

Option B is incorrect because the error is about the parameter group not existing, not about security groups. Option C is incorrect because the parameter group name being incorrect would result in a different error. Option D is incorrect because the DB instance class does not affect parameter group existence.

Full explanation →

1375

MCQeasy

A company processes orders using an Amazon SQS standard queue. The order processing application occasionally fails to process a message. The SysOps administrator wants to ensure that any message that fails to be successfully processed after three attempts is automatically moved to a separate queue for manual review. Which SQS feature should be configured?

A.Configure a Dead Letter Queue (DLQ) with a redrive policy

B.Increase the visibility timeout of the queue

C.Convert the queue to a FIFO queue

D.Enable redrive allow policy on the queue

AnswerA

DLQs automatically move messages to a separate queue after the specified number of receive attempts.

Why this answer

A Dead Letter Queue (DLQ) with a configured redrive policy is the correct SQS feature to automatically move messages that have failed processing after a specified number of attempts (in this case, three) to a separate queue for manual review. The redrive policy defines the source queue, the DLQ, and the maximum receive count (maxReceiveCount) threshold. When a message is received from the source queue more times than the maxReceiveCount, SQS automatically redirects it to the DLQ, isolating problematic messages without manual intervention.

Exam trap

The trap here is that candidates may confuse increasing the visibility timeout (which only delays reprocessing) with the automatic isolation provided by a Dead Letter Queue, or think that converting to FIFO or enabling a redrive allow policy alone solves the problem, when the core requirement is a DLQ with a configured redrive policy that specifies the maxReceiveCount.

How to eliminate wrong answers

Option B is wrong because increasing the visibility timeout only prevents other consumers from processing a message for a longer period, but does not move failed messages to a separate queue; it merely delays reprocessing. Option C is wrong because converting the queue to a FIFO queue changes the ordering and exactly-once processing guarantees, but does not provide automatic redirection of failed messages to a separate queue; FIFO queues also support DLQs, but the conversion itself is not the solution. Option D is wrong because enabling a redrive allow policy on the queue is not a standard SQS feature; the correct term is 'redrive policy' (or 'redrive permission policy') which is used to allow a source queue to use a specific DLQ, but the question asks for the feature that moves failed messages, which is the DLQ with a redrive policy, not just the allow policy.

Full explanation →

1376

MCQmedium

A SysOps administrator is troubleshooting an issue where an IAM user can launch EC2 instances but cannot terminate them. The user's permissions are based on an IAM group policy. Which action should the administrator take to resolve this?

A.Attach a managed policy that includes ec2:TerminateInstances directly to the user

B.Add the user to a different IAM group that has the required permissions

C.Check the user's permissions boundary for any restrictions

D.Review and modify the IAM group policy to include ec2:TerminateInstances action

AnswerD

The issue is likely that the group policy lacks the terminate action; modifying the group policy will resolve it for all users in the group.

Why this answer

The administrator should review the group policy to ensure it includes ec2:TerminateInstances. The issue is likely a missing action in the policy, not a service control policy (SCP) or session policy issue, and simply adding the user to a new group won't fix the underlying policy gap.

Full explanation →

1377

MCQhard

A company runs a critical production workload on a fleet of EC2 instances managed by an Auto Scaling group. The instances are behind an Application Load Balancer (ALB). Recently, the company experienced a regional outage that caused all instances to become unhealthy. The SysOps administrator must design a solution to automatically recover from such an outage with minimal downtime. The solution must be cost-effective and not require manual intervention. The administrator considers four options. Which option meets the requirements?

A.Configure the Auto Scaling group to launch instances across multiple Availability Zones and configure the ALB to route traffic to healthy targets.

B.Increase the desired capacity of the Auto Scaling group and use larger instance types to absorb the load during failover.

C.Create a warm standby environment in another AWS Region with a smaller Auto Scaling group. Use Route53 failover routing to switch traffic.

D.Use AWS Lambda to periodically check the health of instances and automatically relaunch failed instances in another region.

AnswerA

Multi-AZ automatically handles AZ failure.

Why this answer

Option C is correct because using an Auto Scaling group across multiple Availability Zones ensures that if one AZ fails, the ASG can launch instances in other AZs, and the ALB will route traffic to healthy instances. Option A is wrong because a warm standby in another region can be costly and may not be fully automated. Option B is wrong because increasing instance size does not provide AZ failover.

Option D is wrong because manual scripts introduce single points of failure and latency.

Full explanation →

1378

MCQmedium

Refer to the exhibit. A SysOps administrator ran the commands shown. What is the state of the EC2 instance?

A.The instance is running and healthy.

B.The instance is terminated.

C.The instance is running but has a system impairment.

D.The instance is stopped.

AnswerC

System status shows impaired, indicating an underlying system issue.

Why this answer

Option C is correct because the system status check indicates impaired reachability, which means the instance is running but not reachable. The instance state shows running, so it is not stopped or terminated. The impairment is due to a system issue, not an instance-specific issue like memory pressure (which would be instance status check).

Full explanation →

1379

MCQmedium

A company runs a production web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences unpredictable traffic spikes. The operations team wants to optimize costs while maintaining performance during spikes. Which solution is MOST cost-effective?

A.Use Spot Instances to handle the spikes.

B.Use Compute Savings Plans for the baseline and run the spikes on On-Demand instances.

C.Purchase Reserved Instances for the expected baseline capacity.

D.Use Dedicated Hosts for the entire workload.

AnswerB

Savings Plans offer flexibility and cost savings across compute services.

Why this answer

Option C is correct because Savings Plans provide a flexible discount in exchange for a commitment to a consistent amount of compute usage (measured in $/hour) for 1 or 3 years, which can cover EC2, Lambda, and Fargate usage across any instance family, region, or OS. This allows the company to benefit from lower prices while still using On-Demand instances for the remaining flexible portion. Option A is wrong because Reserved Instances are tied to a specific instance family and region, which may be too restrictive if the company needs to change instance types.

Option B is wrong because Spot Instances can be interrupted and are not suitable for a production web application that requires high availability. Option D is wrong because Dedicated Hosts are expensive and provide no cost optimization for variable workloads.

Full explanation →

1380

MCQhard

A company is using AWS CodePipeline to deploy a web application. The security team requires that all code changes be reviewed and approved before deployment to production. Which action should be taken to enforce this requirement?

A.Add a manual approval action in the CodePipeline pipeline before the production deployment stage.

B.Create an IAM policy that denies the codecommit:PutFile action unless the user is in a specific group.

C.Enable AWS CloudTrail and create a CloudWatch Events rule to notify the security team of any deployments.

D.Configure a CodeCommit repository to require pull requests for all changes.

AnswerA

This ensures that a designated approver must manually approve the deployment.

Why this answer

Option A is correct because adding a manual approval action in the CodePipeline pipeline before the production deployment stage enforces a required review and approval gate. This action pauses the pipeline at that point, waiting for an authorized user to manually approve the change before it proceeds to the production stage, directly meeting the security team's requirement.

Exam trap

The trap here is that candidates often confuse source-level controls (like pull request requirements or IAM policies) with pipeline-level approval gates, mistakenly thinking that preventing direct pushes or requiring pull requests alone satisfies the deployment approval requirement.

How to eliminate wrong answers

Option B is wrong because denying the codecommit:PutFile action prevents users from pushing code directly to the repository, but it does not enforce a review and approval process within the deployment pipeline; it only restricts write access. Option C is wrong because enabling CloudTrail and creating a CloudWatch Events rule only provides notification of deployments after they occur, not a pre-deployment approval gate. Option D is wrong because configuring a CodeCommit repository to require pull requests for all changes enforces code review at the source code level, but it does not add an approval step within the CodePipeline deployment pipeline itself.

Full explanation →

1381

Drag & Dropmedium

Drag and drop the steps to set up an Amazon S3 bucket policy to grant cross-account access into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

Identify the bucket and account, write the policy with correct principal and actions, save, and test.

Full explanation →

1382

MCQeasy

A company is using Amazon CloudFront to distribute its web application. Users in a specific geographic region are experiencing high latency. What is the most cost-effective solution to reduce latency for these users?

A.Use AWS Global Accelerator to route traffic over the AWS global network.

B.Configure Route 53 latency-based routing to direct users to a different origin.

C.Increase the compute capacity of the origin server.

D.Add additional CloudFront edge locations in the affected region.

AnswerD

More edge locations bring content closer to users, reducing latency cost-effectively.

Why this answer

Option D is correct because adding additional CloudFront edge locations in the affected region brings content closer to users, reducing latency. Option A is wrong because Route 53 policies do not affect CloudFront cache behavior. Option B is wrong because increasing origin server capacity does not reduce network latency.

Option C is wrong because global accelerator adds cost without addressing edge caching.

Full explanation →

1383

Multi-Selectmedium

Which THREE measures can be used to improve the recovery time objective (RTO) for a database running on Amazon RDS? (Choose three.)

Select 3 answers

A.Use a read replica and promote it during a failure.

B.Configure automated backups with point-in-time recovery.

C.Enable deletion protection.

D.Create manual snapshots daily.

E.Enable Multi-AZ deployment.

AnswersA, B, E

Promoting a read replica is faster than restoring from backup.

Why this answer

Options A, B, and D are correct. Multi-AZ provides automatic failover, reducing RTO. Automated backups with point-in-time recovery allow quick restore to a specific time.

Read replicas can be promoted to primary quickly. Option C is incorrect because manual snapshots require manual restore, which is slower. Option E is incorrect because deletion protection is about preventing deletion, not recovery.

Full explanation →

1384

MCQmedium

A SysOps administrator is designing a disaster recovery plan for a critical application hosted on AWS. The application runs on EC2 instances with data stored in an RDS MySQL database. The RPO must be less than 15 minutes, and the RTO must be less than 1 hour. Which solution meets these requirements?

A.Take daily snapshots of the RDS instance and copy them to another Region.

B.Use an RDS DB instance with a Multi-AZ standby and a cross-Region Read Replica.

C.Use an RDS Multi-AZ DB Cluster deployment.

D.Use a single-AZ RDS instance with automated backups and point-in-time recovery.

AnswerC

Correct: Multi-AZ DB Cluster provides synchronous replication with automatic failover, meeting RPO <15min and RTO <1 hour.

Why this answer

Option D is correct because Multi-AZ DB Cluster provides automatic failover with low RPO and RTO, and synchronous replication keeps data consistent. Option A is wrong because single-AZ with snapshots has an RPO of up to 5 minutes and RTO of several hours. Option B is wrong because Read Replicas are asynchronous, leading to potential data loss.

Option C is wrong because Daily snapshots do not meet the 15-minute RPO.

Full explanation →

1385

MCQeasy

A company runs a stateless web application on Amazon EC2 instances behind an Application Load Balancer. The application usage is consistent throughout the day and is expected to grow steadily over the next year. The SysOps administrator wants to minimize compute costs while ensuring capacity is available. Which purchasing option should the administrator use for the EC2 instances?

A.On-Demand Instances

B.Reserved Instances (Standard, 1-year or 3-year)

C.Spot Instances

D.Dedicated Hosts

AnswerB

Standard Reserved Instances offer a substantial discount for a commitment to a consistent instance configuration. This is ideal for long-term, steady workloads and provides capacity reservation.

Why this answer

The application has a steady, predictable usage pattern and is expected to grow steadily, making Reserved Instances (Standard) the most cost-effective option. By committing to a 1-year or 3-year term, the administrator can receive a significant discount (up to 72% compared to On-Demand) while ensuring capacity is always available. This aligns with the requirement to minimize compute costs without sacrificing availability for a stateless, load-balanced workload.

Exam trap

The trap here is that candidates often choose On-Demand Instances for simplicity, overlooking the significant cost savings of Reserved Instances for predictable, steady workloads, or they incorrectly choose Spot Instances without considering the interruption risk for a production application.

How to eliminate wrong answers

Option A is wrong because On-Demand Instances offer no discount and would result in higher costs over time for a predictable, steady workload. Option C is wrong because Spot Instances can be interrupted with a 2-minute warning, making them unsuitable for a production web application that requires consistent capacity and availability. Option D is wrong because Dedicated Hosts are designed for licensing or compliance requirements (e.g., per-socket licensing) and are significantly more expensive than shared tenancy, providing no cost benefit for a standard stateless web application.

Full explanation →

1386

MCQmedium

A company is using AWS CloudFormation to manage its infrastructure. The SysOps Administrator needs to ensure that updates to a critical stack do not accidentally replace the database. Which feature should be used?

A.Use drift detection to identify changes.

B.Enable termination protection on the stack.

C.Use a change set to review the updates before executing them.

D.Define a stack policy that denies updates to the database resource.

AnswerD

Stack policies allow you to protect specific resources from updates.

Why this answer

Option C is correct because a stack policy can protect specific resources from being updated or replaced during a stack update. Option A is wrong because change sets allow preview but do not prevent replacement. Option B is wrong because it does not prevent updates.

Option D is wrong because drift detection identifies changes but does not prevent them.

Full explanation →

1387

MCQeasy

A company has a VPC with public and private subnets. An Application Load Balancer (ALB) is in the public subnets, and Amazon EC2 instances are in the private subnets. The SysOps administrator needs to allow the EC2 instances to access an Amazon S3 bucket in the same AWS Region without traversing the internet. Which solution should the administrator implement?

A.A VPC Gateway Endpoint for S3

B.A NAT Gateway

C.An Internet Gateway

D.VPC Peering

AnswerA

A VPC Gateway Endpoint for S3 allows instances in private subnets to access S3 privately using AWS internal networks, without internet traffic.

Why this answer

A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 buckets privately using AWS's internal network, without traversing the internet. This endpoint uses prefix lists and route table entries to direct S3 traffic through the AWS backbone, ensuring low latency and no data transfer costs.

Exam trap

The trap here is that candidates often choose a NAT Gateway or Internet Gateway because they think outbound traffic to AWS services must go through the internet, but Gateway Endpoints provide a private, cost-effective alternative for S3 and DynamoDB access within the same region.

How to eliminate wrong answers

Option B (NAT Gateway) is wrong because it routes traffic through the internet, which violates the requirement to avoid internet traversal and incurs data transfer costs. Option C (Internet Gateway) is wrong because it is used for public internet access and requires public IP addresses, not private S3 access. Option D (VPC Peering) is wrong because it connects VPCs but does not provide direct access to S3; S3 is a service outside the VPC, not a peered resource.

Full explanation →

1388

MCQhard

A company runs a critical application on Amazon EC2 instances. The application uses an NFS file system stored on an Amazon EFS file system. The SysOps administrator must ensure that the file system is highly available and can withstand an Availability Zone failure. The file system must be accessible from all Availability Zones in the region. Which configuration is required to meet these requirements?

A.Configure the EFS file system for One Zone storage class and mount it using the file system ID.

B.Configure the EFS file system for Standard storage class and mount it using the regional DNS name.

C.Configure EFS to use provisioned throughput and mount it using a mount target IP address.

D.Enable EFS lifecycle management to move files to Infrequent Access storage class.

AnswerB

Correct. Standard storage class replicates data across multiple AZs, and the regional DNS name resolves to mount targets in all AZs for high availability.

Why this answer

Option B is correct because the EFS Standard storage class replicates data across multiple Availability Zones (AZs) within a region, providing high availability and resilience against an AZ failure. Mounting the file system using the regional DNS name ensures that clients in any AZ can reach the file system via the nearest mount target, as the regional DNS name resolves to the mount target IP addresses in the local AZ. This configuration meets the requirement for the file system to be accessible from all AZs in the region while withstanding an AZ outage.

Exam trap

The trap here is that candidates often confuse storage class (One Zone vs. Standard) with performance settings (provisioned throughput) or cost-saving features (lifecycle management), and overlook that the regional DNS name is essential for multi-AZ access and failover.

How to eliminate wrong answers

Option A is wrong because the One Zone storage class stores data only within a single Availability Zone, which does not provide high availability or withstand an AZ failure. Option C is wrong because provisioned throughput is a performance setting, not a high-availability or multi-AZ configuration; mounting via a mount target IP address would pin the client to a specific AZ, failing the requirement for accessibility from all AZs. Option D is wrong because lifecycle management moves files to the Infrequent Access (IA) storage class to reduce costs, but it does not affect the availability or multi-AZ resilience of the file system.

Full explanation →

1389

MCQmedium

An Auto Scaling group launches new EC2 instances when CPU exceeds 70 percent. The instances take 4 minutes to bootstrap (install software, register with a service discovery system, and warm up caches). Without a hook, the load balancer routes traffic to new instances before they are ready, causing 503 errors. What is the correct solution?

A.Add a lifecycle hook on the autoscaling:EC2_INSTANCE_LAUNCHING transition; signal CompleteLifecycleAction(CONTINUE) when bootstrap finishes

B.Increase the load balancer health check grace period to 10 minutes to give instances time to bootstrap

C.Increase the warm-up time in the Auto Scaling group's instance refresh configuration

D.Use a weighted target group with 0 weight for new instances until they are confirmed healthy

AnswerA

The hook holds the instance in Pending:Wait, outside the target group, until the signal arrives. The load balancer never routes traffic to the instance during its Pending:Wait phase. After the CONTINUE signal, the instance enters InService and the load balancer registers it normally. The heartbeat timeout (default 1 hour, configurable) should exceed the bootstrap time.

Why this answer

Option A is correct because lifecycle hooks allow the Auto Scaling group to pause instance launch until a custom action (e.g., bootstrap completion) is finished. By adding a hook on the autoscaling:EC2_INSTANCE_LAUNCHING transition, the instance is held in a 'pending:wait' state. Once the bootstrap script calls CompleteLifecycleAction with the CONTINUE result, the instance transitions to 'InService' and can then be registered with the load balancer, preventing premature traffic and 503 errors.

Exam trap

The trap here is that candidates often confuse the health check grace period (which only delays health checks, not registration) with lifecycle hooks (which actually control when the instance becomes available to the load balancer).

How to eliminate wrong answers

Option B is wrong because increasing the load balancer health check grace period only delays when the load balancer starts checking health; it does not prevent the load balancer from routing traffic to the instance before it is ready. The instance is still added to the target group immediately, and the grace period only affects health check status, not registration. Option C is wrong because the warm-up time in an instance refresh configuration controls how long new instances are given to become healthy during a rolling update, not the initial launch or bootstrap process for a scaling event triggered by CPU.

Option D is wrong because weighted target groups distribute traffic based on weights; setting 0 weight for new instances would prevent all traffic, but the instances would still be registered and could receive traffic if the weight is later changed manually, and this approach does not automatically signal readiness after bootstrap.

Full explanation →

1390

MCQmedium

An application uses an RDS MySQL DB instance. The administrator notices that read performance is poor during peak hours. What is a cost-effective way to improve read performance?

A.Use Amazon ElastiCache for caching.

B.Enable Multi-AZ deployment.

C.Scale up the DB instance to a larger size.

D.Create a read replica in the same region.

AnswerD

Read replicas handle read traffic efficiently.

Why this answer

Option B is correct because read replicas offload read traffic from the primary instance. Scaling up is more expensive. Multi-AZ is for high availability, not read performance.

Using ElastiCache adds complexity and cost.

Full explanation →

1391

MCQeasy

A SysOps administrator needs to grant a developer access to view only the logs of a specific Amazon RDS instance. Which IAM action should be allowed?

A.rds:DownloadDBLogFilePortion

B.rds:DescribeDBInstances

C.rds:DescribeDBLogFiles

D.rds:DescribeEvents

AnswerC

This action lists log files for a DB instance.

Why this answer

Option A is correct because rds:DescribeDBLogFiles lists the available log files for an RDS instance. Option B is wrong because rds:DownloadDBLogFilePortion downloads a log file, not just view. Option C is wrong because rds:DescribeDBInstances describes instance details, not logs.

Option D is wrong because rds:DescribeEvents describes events, not logs.

Full explanation →

1392

MCQeasy

A company wants to host a static website using Amazon S3. The website files are stored in an S3 bucket. The SysOps administrator needs to make the website accessible via HTTP. Which action must be performed on the S3 bucket?

A.Enable versioning

B.Enable static website hosting

C.Configure a bucket policy to allow public read access

D.Attach a CloudFront distribution

AnswerB

Enabling static website hosting provides an HTTP endpoint and allows the bucket to serve web pages directly.

Why this answer

To host a static website on Amazon S3, you must enable the 'Static website hosting' property on the bucket. This configures the bucket to serve HTTP responses for index and error documents, and provides a regional website endpoint (e.g., http://bucket-name.s3-website-region.amazonaws.com). Without this setting, the bucket only supports REST API access (via the S3 API endpoint), not standard HTTP browser requests.

Exam trap

The trap here is that candidates often confuse the requirement for a public bucket policy (which is necessary but not sufficient) with the actual action needed to enable HTTP serving, leading them to select Option C instead of B.

How to eliminate wrong answers

Option A is wrong because enabling versioning is a data protection feature that tracks object versions; it does not enable HTTP access to the bucket. Option C is wrong because while a bucket policy granting public read access is necessary for public static websites, it alone does not make the bucket serve HTTP traffic—the static website hosting feature must be explicitly enabled to activate the website endpoint. Option D is wrong because attaching a CloudFront distribution is an optional performance and security enhancement, not a required action; the bucket can serve HTTP directly without CloudFront.

Full explanation →

1393

MCQmedium

Refer to the exhibit. A Lambda function is unable to write logs to CloudWatch Logs. The IAM role attached to the Lambda function includes the policy shown. What is the issue?

A.The log group name is incorrect.

B.The policy effect is Deny.

C.The 'logs:PutLogEvents' action is not allowed.

D.The resource ARN does not include a log-stream component.

AnswerD

PutLogEvents requires a log-stream in the resource ARN.

Why this answer

The Lambda function's IAM policy grants permissions for `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` on the resource ARN `arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/MyFunction:*`. However, this ARN only specifies the log group and a wildcard for log streams, which is insufficient for the `logs:PutLogEvents` action. The `logs:PutLogEvents` action requires a resource ARN that includes a specific log-stream component (e.g., `arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/MyFunction:log-stream:*`), because the API call targets a particular log stream within the log group.

Without this, the Lambda function cannot write logs, resulting in a permissions error.

Exam trap

The trap here is that candidates assume a wildcard on the log group ARN (e.g., `log-group:*`) covers all actions, but AWS requires the log-stream component for write operations like `PutLogEvents`, causing a subtle permissions failure.

How to eliminate wrong answers

Option A is wrong because the log group name `/aws/lambda/MyFunction` is the default naming convention for Lambda functions and is correct; the issue is not with the name but with the resource ARN structure. Option B is wrong because the policy effect is explicitly `Allow`, not `Deny`, and there is no `Deny` statement present to override permissions. Option C is wrong because the `logs:PutLogEvents` action is listed in the policy's `Action` array, so it is allowed; the problem is that the resource ARN does not match the required format for that action.

Full explanation →

1394

MCQmedium

A company is running a web application on a fleet of EC2 instances behind an Application Load Balancer. The application experiences variable traffic patterns with predictable spikes every day at 2 PM. The company wants to optimize costs while maintaining performance. Which solution is MOST cost-effective?

A.Use manual scaling by adjusting the desired capacity each day at 2 PM.

B.Purchase Reserved Instances for the entire fleet to reduce costs.

C.Use scheduled scaling to add instances before the spike and remove them after.

D.Use dynamic scaling policies based on CPU utilization.

AnswerC

Scheduled scaling adds capacity before the predictable spike and removes it after, optimizing cost and performance.

Why this answer

Scheduled scaling allows you to add capacity in advance of the predictable spike, ensuring performance during the spike and reducing costs by running only needed instances at other times. Dynamic scaling reacts to real-time metrics, which may cause a temporary performance lag. Manual scaling is not automated.

Reserved Instances provide a discount but do not adjust capacity automatically.

Full explanation →

1395

MCQhard

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The application experiences intermittent latency spikes. The SysOps administrator has enabled detailed CloudWatch metrics on the ALB and the EC2 instances. The administrator notices that during the latency spikes, the ALB's TargetResponseTime metric increases, but the EC2 instance's CPU utilization and memory usage remain normal. The administrator also observes that the number of concurrent connections to the ALB spikes during these periods. Which action should the administrator take to identify the root cause?

A.Analyze the ALB's ActiveConnectionCount and RequestCountPerTarget metrics to see if the load balancer is reaching its connection limit.

B.Check the RDS database's DatabaseConnections metric to see if the database is overwhelmed.

C.Enable VPC Flow Logs and analyze the traffic patterns for dropped packets.

D.Enable detailed monitoring on the EC2 instances to capture CPU credits for burstable instances.

AnswerA

High connection counts can cause latency even if CPU is low, due to connection queuing.

Why this answer

Option A is correct because the ALB's ActiveConnectionCount and RequestCountPerTarget metrics directly indicate whether the load balancer is approaching its connection limit (default 50,000 for ALBs). During latency spikes, if concurrent connections spike but instance CPU/memory are normal, the bottleneck is likely at the load balancer level, not the instances. Analyzing these metrics helps determine if the ALB is queuing or dropping requests due to connection limits, causing increased TargetResponseTime.

Exam trap

The trap here is that candidates assume latency spikes always indicate backend instance issues (CPU/memory) and overlook the ALB's connection limits, which can cause increased TargetResponseTime even when instances are underutilized.

How to eliminate wrong answers

Option B is wrong because the question states CPU and memory on EC2 instances remain normal, and there is no mention of database-related latency or errors; checking RDS DatabaseConnections would only be relevant if the application was database-bound, which is not indicated. Option C is wrong because VPC Flow Logs capture network traffic metadata (source/destination IPs, ports, protocol, packets) but do not measure ALB connection limits or application-layer latency; dropped packets would indicate network issues, not ALB connection saturation. Option D is wrong because detailed monitoring on EC2 instances provides 1-minute metrics (vs. 5-minute default) but does not expose CPU credit exhaustion for burstable instances; the question already has normal CPU/memory, so this would not identify the root cause of ALB-level connection spikes.

Full explanation →

1396

MCQeasy

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS DB instance and receive an alarm when CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to create this alarm?

A.AWS CloudTrail

B.Amazon CloudWatch

C.AWS Config

D.AWS Trusted Advisor

AnswerB

CloudWatch collects RDS metrics natively and supports alarms that trigger SNS notifications or other actions when a metric exceeds a threshold for a specified period.

Why this answer

Amazon CloudWatch is the native AWS monitoring service that can track RDS DB instance metrics, such as CPU utilization, and trigger alarms based on thresholds and time periods. In this scenario, you would create a CloudWatch alarm on the `CPUUtilization` metric for the specific DB instance, with a threshold of 80% and a period of 5 consecutive minutes (e.g., 5 datapoints of 1-minute periods).

Exam trap

The trap here is that candidates often confuse CloudTrail (for auditing API calls) with CloudWatch (for monitoring metrics and logs), leading them to select CloudTrail when the question explicitly asks about creating an alarm on a performance metric.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity and governance events, not real-time performance metrics like CPU utilization; it cannot create metric alarms. Option C is wrong because AWS Config evaluates resource configurations against rules and compliance standards, not operational metrics; it cannot monitor CPU utilization or trigger alarms based on threshold breaches. Option D is wrong because AWS Trusted Advisor provides best-practice recommendations and cost optimization checks, but it does not support custom metric alarms or real-time monitoring of CPU utilization.

Full explanation →

1397

MCQmedium

A company runs a production Amazon RDS for PostgreSQL DB instance. The SysOps administrator needs to ensure that in the event of a database failure, there is automatic failover to a standby instance in another Availability Zone with minimal downtime. Which deployment configuration should the administrator enable?

A.Multi-AZ deployment

B.Read Replicas

C.Automated backups with point-in-time recovery

D.Amazon RDS Proxy

AnswerA

Multi-AZ provides a standby instance with synchronous replication and automatic failover, meeting the requirement for minimal downtime.

Why this answer

A Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a database failure or an Availability Zone outage, Amazon RDS automatically fails over to the standby, typically within 60-120 seconds, without requiring manual intervention. This ensures high availability and minimal downtime for the production PostgreSQL DB instance.

Exam trap

The trap here is that candidates often confuse Read Replicas with Multi-AZ deployments, mistakenly believing that Read Replicas provide automatic failover, when in fact they only support manual promotion and are intended for read scaling, not high availability.

How to eliminate wrong answers

Option B is wrong because Read Replicas are designed for read traffic offloading and do not provide automatic failover; they require manual promotion to become the primary instance, which incurs significant downtime. Option C is wrong because automated backups with point-in-time recovery are for data durability and recovery from corruption or accidental deletion, not for automatic failover to a standby instance with minimal downtime. Option D is wrong because Amazon RDS Proxy is a connection pooling and management service that improves application scalability and resilience to database failures, but it does not replace the need for a standby instance or provide automatic failover itself.

Full explanation →

1398

MCQeasy

A SysOps administrator needs to provide a developer from another AWS account access to an S3 bucket in the administrator's account. The developer must be able to list objects and get objects from the bucket. The administrator does NOT want to share AWS access keys. Which solution meets these requirements?

A.Create an IAM user in the administrator's account and share the access key and secret key with the developer.

B.Attach a bucket policy to the S3 bucket that grants s3:ListBucket and s3:GetObject to the developer's IAM user ARN.

C.Generate pre-signed URLs for all objects and share them with the developer.

D.Grant the developer's AWS account root user access to the bucket using a bucket policy.

AnswerB

Cross-account access via bucket policy is secure and does not require sharing keys.

Why this answer

Option C is correct because an S3 bucket policy with a Principal ARN for the developer's IAM user grants cross-account access without sharing keys. Option A is wrong because sharing access keys is not recommended. Option B is wrong because pre-signed URLs are temporary and must be generated per object.

Option D is wrong because granting the developer's root user is overly permissive and not secure.

Full explanation →

1399

MCQhard

Refer to the exhibit. This bucket policy is attached to an S3 bucket that is used as an origin for a CloudFront distribution. Users are reporting Access Denied errors when accessing objects via the CloudFront URL. What is the MOST likely cause?

A.The condition is missing the aws:SourceVpce condition for VPC endpoints.

B.The bucket policy does not grant access to the CloudFront service principal.

C.The resource ARN is missing the bucket ARN for the bucket itself.

D.The condition restricts access to a specific IP range, but CloudFront requests come from its own IP addresses.

AnswerD

CloudFront uses its own IP addresses to fetch objects from the origin; the user's IP is not forwarded by default.

Why this answer

Option A is correct because when CloudFront is used to access S3, the source IP is the CloudFront edge IP, not the user's IP. The condition restricts to 192.0.2.0/24, which will not match. Option B is wrong because the bucket policy does not need to grant access to the CloudFront service principal; it can use Origin Access Identity (OAI) but not required.

Option C is wrong because the resource ARN includes /*, which is correct. Option D is wrong because the condition is not missing; it's present but incorrect for CloudFront.

Full explanation →

1400

MCQmedium

A company runs a critical web application on EC2 instances behind an Application Load Balancer in a single Availability Zone. To improve reliability, what is the MOST effective design change?

A.Place the RDS database in a Multi-AZ deployment.

B.Add a second Application Load Balancer in the same Availability Zone.

C.Increase the EC2 instance size to handle more traffic.

D.Launch EC2 instances across two or more Availability Zones.

AnswerD

Eliminates single point of failure at AZ level.

Why this answer

Option C is correct because deploying instances across multiple Availability Zones eliminates a single point of failure and is a fundamental high-availability design. Option A is wrong because increasing instance size does not provide fault tolerance. Option B is wrong because a Multi-AZ RDS instance improves database reliability but does not address the web tier's single AZ risk.

Option D is wrong because an additional load balancer in the same AZ does not protect against AZ failure.

Full explanation →

1401

MCQeasy

An EC2 instance runs a Java application. The operations team wants to monitor heap memory utilization in CloudWatch and set alarms when it exceeds 85 percent. EC2 does not natively publish memory metrics to CloudWatch. What is the simplest way to get this metric into CloudWatch?

A.Install the CloudWatch agent on the instance and configure it to collect mem_used_percent; publish JVM heap metrics from the application using PutMetricData

B.Enable detailed monitoring on the EC2 instance to increase metric resolution to 1-minute intervals

C.Configure a CloudWatch Logs metric filter on the application log stream to count lines containing 'OutOfMemoryError'

D.Use AWS Systems Manager Inventory to collect memory data and sync it to CloudWatch

AnswerA

The CloudWatch agent handles OS-level memory automatically once configured. For JVM heap, the application publishes a custom namespace metric via PutMetricData. Both appear in CloudWatch within minutes and can be graphed and alarmed like any native metric.

Why this answer

Option A is correct because the CloudWatch agent can collect custom metrics like memory utilization from the EC2 instance, and the Java application can directly publish JVM heap metrics to CloudWatch using the PutMetricData API. This combination provides the simplest and most direct way to monitor heap memory utilization and set alarms at the 85% threshold, as EC2 does not natively expose memory metrics.

Exam trap

The trap here is that candidates often assume detailed monitoring or Systems Manager Inventory can provide memory metrics, but neither feature collects or publishes memory utilization data to CloudWatch.

How to eliminate wrong answers

Option B is wrong because enabling detailed monitoring increases the resolution of standard EC2 metrics (like CPU, network) to 1-minute intervals, but it does not add memory or JVM heap metrics, which are not published by EC2 at all. Option C is wrong because a CloudWatch Logs metric filter on 'OutOfMemoryError' only detects when the application has already crashed, not proactive heap utilization levels, and it cannot measure the percentage of heap memory used. Option D is wrong because AWS Systems Manager Inventory collects software inventory and configuration data, not real-time memory utilization metrics, and it does not sync data to CloudWatch as a metric for alarm purposes.

Full explanation →

1402

MCQmedium

A company uses AWS CloudTrail to log all management events. The SysOps administrator needs to be notified when an IAM user creates a new access key. Which configuration is the MOST efficient?

A.Create a CloudWatch Logs metric filter on the CloudTrail log group for CreateAccessKey events and set an alarm.

B.Use AWS Trusted Advisor to check for excessive access keys.

C.Create a CloudWatch Events rule that matches the CreateAccessKey API call and triggers an SNS notification.

D.Use AWS Config to monitor the 'iam-user' resource type for changes to access keys.

AnswerC

CloudWatch Events can directly react to CloudTrail API calls and send notifications.

Why this answer

Option C is correct because CloudWatch Events (now Amazon EventBridge) can directly match the CreateAccessKey API call from CloudTrail in real time and trigger an SNS notification. This is the most efficient solution as it requires no additional log analysis or polling, and it reacts immediately when the API call occurs.

Exam trap

The trap here is that candidates often default to CloudWatch Logs metric filters (Option A) because they are familiar with log-based monitoring, but they overlook the more efficient and real-time event-driven approach using CloudWatch Events/EventBridge for API call notifications.

How to eliminate wrong answers

Option A is wrong because it requires creating a metric filter on CloudTrail logs in CloudWatch Logs, which introduces latency from log ingestion and metric evaluation, and is less efficient than a direct event-driven approach. Option B is wrong because AWS Trusted Advisor checks for excessive access keys based on best practices (e.g., keys older than 90 days), not for the creation event itself, so it cannot provide real-time notification when a new key is created. Option D is wrong because AWS Config monitors configuration changes and can detect access key modifications, but it is designed for compliance and resource tracking, not for real-time event notification, and it would require additional setup to trigger a notification.

Full explanation →

1403

Multi-Selecteasy

A company needs to comply with PCI DSS requirements for its AWS environment. Which TWO services should the SysOps administrator use to automate compliance checks and generate reports? (Choose TWO.)

Select 2 answers

A.Amazon CloudWatch

B.AWS Config

C.AWS CloudTrail

D.AWS Trusted Advisor

E.AWS Audit Manager

AnswersB, E

Evaluates resource configurations against compliance rules.

Why this answer

Option C is correct because AWS Config rules can be used to check resource configurations against compliance standards. Option D is correct because AWS Audit Manager helps continuously audit and generate compliance reports. Option A is wrong because CloudWatch is for monitoring.

Option B is wrong because CloudTrail is for logging API calls. Option E is wrong because Trusted Advisor provides recommendations but not compliance automation.

Full explanation →

1404

MCQeasy

A company uses Amazon CloudFront to deliver static content from an Amazon S3 bucket. Users in Europe report slow load times. Which CloudFront feature would MOST effectively improve performance for these users?

A.Enable origin shield.

B.Add additional edge locations in Europe and use regional edge caches.

C.Enable HTTP/3 (QUIC) support on the distribution.

D.Configure geo restriction to allow only European users.

AnswerB

CloudFront uses edge locations globally; adding regional edge caches in Europe caches content closer to users.

Why this answer

Adding additional edge locations in Europe and using regional edge caches (Option B) reduces latency by serving content from geographically closer points of presence (PoPs) and by caching objects at a regional layer that aggregates requests from multiple edge locations, which improves cache hit ratios and reduces the load on the origin. This directly addresses the slow load times reported by European users by minimizing the distance data must travel.

Exam trap

The trap here is that candidates often confuse performance-enhancing features like HTTP/3 or origin shield with the fundamental need to reduce geographic distance, assuming any 'optimization' will fix latency, when in fact only adding closer edge locations and regional caching directly addresses the root cause of high latency for distant users.

How to eliminate wrong answers

Option A is wrong because enabling origin shield does not add edge locations in Europe; it creates an additional caching layer in front of the origin to reduce origin load, but it does not improve latency for users far from existing edge locations. Option C is wrong because HTTP/3 (QUIC) improves connection establishment and multiplexing but does not reduce the physical distance between users and CloudFront edge locations, so it cannot fix latency caused by geographic distance. Option D is wrong because geo restriction only blocks or allows content based on user location; it does not improve performance for allowed users and may even increase latency if not configured correctly.

Full explanation →

1405

MCQhard

A SysOps administrator is designing a disaster recovery plan for a critical application that runs on EC2 instances with data stored on EBS volumes. The application requires an RPO of 15 minutes and an RTO of 2 hours. The current solution uses EBS snapshots taken every 6 hours. The administrator needs to improve the backup strategy to meet the RPO. What is the most cost-effective way to achieve this?

A.Enable EBS Recycle Bin with a retention rule of 15 minutes.

B.Change the EBS volume type to io2 Block Express.

C.Increase the snapshot frequency to every 15 minutes.

D.Use EBS Multi-Attach to attach volumes to multiple instances for redundancy.

AnswerC

More frequent snapshots reduce the potential data loss window to 15 minutes, meeting the 15-minute RPO.

Why this answer

Option D is correct because increased snapshot frequency (e.g., every 15 minutes) directly reduces RPO. Option A is incorrect because Recycle Bin only prevents accidental deletion, it does not create new snapshots. Option B is incorrect because changing volume type does not affect snapshot frequency.

Option C is incorrect because EBS Multi-Attach does not provide snapshot capabilities.

Full explanation →

1406

MCQmedium

A company runs a stateful web application on a single Amazon EC2 instance with an Elastic IP address. The SysOps administrator needs to increase availability so that if the instance fails, a new instance can be launched quickly with the same configuration and the same IP address. The administrator also needs to ensure data is not lost. Which solution meets these requirements with the least operational overhead?

A.Use an Application Load Balancer with an Auto Scaling group and a launch configuration that includes the Elastic IP

B.Create an AMI from the instance, store data on an Amazon EFS file system, and use an Auto Scaling group with a lifecycle hook to associate the Elastic IP

C.Create a CloudFormation template that launches a new instance and associates the Elastic IP

D.Place the instance in an Auto Scaling group with a minimum of 1 and a maximum of 1, and set the health check to replace unhealthy instances

AnswerB

The AMI provides a pre-configured launch template. EFS provides durable, shared storage for application data. The Auto Scaling group automatically launches a new instance if the current one fails, and the lifecycle hook script associates the Elastic IP to the new instance, ensuring continuity with the same IP.

Why this answer

Option B is correct because it separates the stateful data (stored on Amazon EFS) from the compute instance, ensuring data persistence even if the instance fails. Creating an AMI from the instance captures the configuration, and an Auto Scaling group with a lifecycle hook can associate the Elastic IP to the new instance automatically, providing a quick failover with minimal operational overhead.

Exam trap

The trap here is that candidates often assume an Auto Scaling group alone can handle Elastic IP association, but without a lifecycle hook or custom script, the new instance will not automatically receive the Elastic IP, leading to IP address changes and potential downtime.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer (ALB) does not support Elastic IP addresses; ALBs use DNS names and are designed for distributing traffic, not for preserving a static IP for a stateful application. Option C is wrong because a CloudFormation template requires manual or automated invocation to launch a new instance and associate the Elastic IP, which introduces additional operational overhead and does not automatically handle instance failure detection and replacement. Option D is wrong because placing the instance in an Auto Scaling group with a minimum and maximum of 1 does not automatically launch a new instance with the same configuration or data; it only replaces the instance if it becomes unhealthy, but without a lifecycle hook to associate the Elastic IP or a mechanism to preserve stateful data, the solution fails to meet the requirements.

Full explanation →

1407

MCQeasy

An organization wants to centrally manage access to multiple AWS accounts in an AWS Organizations setup. Which AWS service should the SysOps administrator use to define and enforce fine-grained permissions across accounts?

A.AWS Config rules

B.Service control policies (SCPs)

C.IAM roles with cross-account trust policies

D.AWS Single Sign-On (SSO)

AnswerC

IAM roles allow fine-grained permissions and can be assumed across accounts.

Why this answer

Option B is correct because AWS IAM Roles can be used with AWS Organizations to allow cross-account access with fine-grained permissions. Option A is wrong because AWS SSO is for user federation and single sign-on, not for defining fine-grained permissions. Option C is wrong because SCPs provide coarse-grained guardrails.

Option D is wrong because AWS Config is for compliance and resource tracking.

Full explanation →

1408

Multi-Selectmedium

A company has an S3 bucket that stores sensitive data. The security team requires that all access to the bucket be encrypted in transit. Which TWO actions should be taken to enforce this requirement? (Choose two.)

Select 2 answers

A.Enable default encryption (SSE-S3) on the bucket

B.Enable S3 Transfer Acceleration

C.Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm for any HTTP access

D.Create an S3 bucket policy that denies s3:GetObject and s3:PutObject if the aws:SecureTransport condition is false

E.Use S3 VPC endpoints

AnswersC, D

CloudTrail logs can be used to detect HTTP requests.

Why this answer

Options A and C are correct. A bucket policy that denies requests without HTTPS ensures all access uses TLS. AWS CloudTrail can be used to monitor and detect HTTP requests, though it does not enforce.

Option B is incorrect because enabling default encryption does not enforce in-transit encryption. Option D is incorrect because S3 Transfer Acceleration does not enforce HTTPS; it uses TLS but does not prevent HTTP. Option E is incorrect because S3 endpoints support HTTPS, but the bucket policy is needed to enforce.

Full explanation →

1409

MCQmedium

A company has a VPC with a public and private subnet. The security team wants to restrict outbound traffic from EC2 instances in the private subnet to only allow traffic to an S3 bucket in the same account. Which of the following is the MOST secure way to achieve this?

A.Use an internet gateway and a route table that directs traffic to the internet gateway, and use network ACLs to allow only S3 IP ranges

B.Configure a NAT gateway in the public subnet and update the route table to send traffic to the NAT gateway, then use security groups to restrict outbound traffic

C.Use a VPC endpoint for S3 and attach a security group to the endpoint that allows only HTTPS traffic to the S3 prefix list

D.Create a gateway VPC endpoint for S3, attach a bucket policy that allows access only from the VPC endpoint, and use a VPC endpoint policy to restrict actions to the specific bucket

AnswerD

This ensures traffic stays within AWS and is restricted to the bucket.

Why this answer

Option D is correct because using a gateway VPC endpoint for S3 with a bucket policy that allows only the VPC's endpoint ID ensures that traffic can only come from within the VPC. Additionally, a VPC endpoint policy can restrict actions to the specific bucket. Option A is incorrect because NAT gateways allow all outbound traffic, not just to S3.

Option B is incorrect because security groups cannot filter based on S3 bucket names. Option C is incorrect because an internet gateway would allow general outbound traffic.

Full explanation →

1410

MCQeasy

A SysOps administrator needs to allow a Lambda function to access a DynamoDB table in the same AWS account. Which configuration is required?

A.Create a VPC endpoint for DynamoDB and attach it to the Lambda function.

B.Configure a network ACL to allow traffic from Lambda to DynamoDB.

C.Add the Lambda function as a principal in the DynamoDB table's resource-based policy.

D.Assign an IAM role to the Lambda function with DynamoDB permissions.

AnswerD

Correct. IAM role grants permissions.

Why this answer

Lambda needs an IAM role with a policy granting DynamoDB actions. The role is assumed by the Lambda service.

Full explanation →

1411

MCQmedium

A company uses AWS CodePipeline to deploy a web application. The pipeline has a source stage (Amazon S3) and a deploy stage (AWS Elastic Beanstalk). The SysOps administrator needs to add a manual approval step before the deployment proceeds to the production environment. Which action should the administrator take?

A.Add an approval stage in the pipeline using the Amazon SNS topic as a notification method.

B.Add a manual approval action in the pipeline using the AWS CodePipeline approval action type.

C.Use an AWS CloudFormation change set to require manual approval.

D.Create a separate pipeline for production and trigger it manually.

AnswerB

CodePipeline provides a built-in approval action that can be added to any stage. When configured, the pipeline pauses and waits for manual approval, with optional SNS notifications.

Why this answer

Option B is correct because AWS CodePipeline natively supports a manual approval action type that can be added as a stage in the pipeline. This action pauses the pipeline execution until an authorized user manually approves or rejects the deployment, allowing the SysOps administrator to gate the deployment to the production environment without external services.

Exam trap

The trap here is that candidates may confuse notification mechanisms (like SNS) with the actual approval action, or assume that external tools like CloudFormation change sets can serve as manual approval gates within a pipeline.

How to eliminate wrong answers

Option A is wrong because while Amazon SNS can be used to notify approvers, the approval action itself must be the CodePipeline approval action type; adding an SNS topic alone does not create a manual approval gate. Option C is wrong because AWS CloudFormation change sets are used to review infrastructure changes before execution, not to add manual approval steps within a CodePipeline deployment workflow. Option D is wrong because creating a separate pipeline for production and triggering it manually bypasses the automated pipeline integration and does not add a manual approval step within the existing pipeline.

Full explanation →

1412

MCQmedium

An application running on Amazon ECS with Fargate launch type is experiencing intermittent failures. The tasks are spread across multiple Availability Zones. The SysOps administrator notices that failures occur only when an entire AZ becomes unavailable. What should the administrator do to improve the reliability of the application?

A.Use multiple subnets in the same AZ.

B.Use a cluster placement group.

C.Attach an Amazon EFS filesystem to all tasks.

D.Increase the desired task count to ensure sufficient capacity across AZs.

AnswerD

More tasks distributed across AZs provide redundancy.

Why this answer

Option A is correct because increasing the number of tasks ensures that even if one AZ fails, tasks in other AZs can handle the load. Option B is incorrect because using more subnets does not necessarily improve availability. Option C is incorrect because placement groups are not applicable to Fargate.

Option D is incorrect because EFS is for shared storage, not compute reliability.

Full explanation →

1413

Multi-Selecthard

Which TWO actions should a SysOps administrator take to automate the deployment of a multi-tier application with AWS CloudFormation? (Choose two.)

Select 2 answers

A.Hardcode CIDR blocks and instance types to avoid parameter input

B.Use nested stacks to separate concerns such as network, app, and database

C.Use AWS::Include to reuse snippets instead of parameters

D.Use cross-stack references to pass outputs between stacks

E.Define all resources in a single template to simplify management

AnswersB, D

Nested stacks promote reusability and manageability.

Why this answer

Options B and D are correct. Option A is incorrect because nested stacks are not always necessary. Option C is incorrect because hardcoding CIDR blocks reduces flexibility.

Option E is incorrect because parameters should be used for dynamic values.

Full explanation →

1414

MCQmedium

Refer to the exhibit. A VPC peering connection exists between VPC A (CIDR 10.0.0.0/16) and VPC B (CIDR 192.168.0.0/16). The command output shows the route table for VPC A (rtb-11111111) and VPC B (rtb-33333333). An instance in VPC A (private IP 10.0.1.5) cannot ping an instance in VPC B (private IP 192.168.1.10). What is the most likely reason?

A.The route table for VPC A is missing a route to 192.168.0.0/16 via the peering connection.

B.The security group for the instance in VPC B blocks ICMP traffic.

C.The VPC peering connection status is not active.

D.The network ACL for the subnet in VPC A blocks outbound ICMP.

AnswerA

Without this route, traffic from VPC A to VPC B is dropped.

Why this answer

The route table for VPC A does not have a route to VPC B's CIDR (192.168.0.0/16) via the peering connection (pcx-44444444). It only has routes for local and IGW. The route table for VPC B has the peering route.

Therefore, traffic from VPC A to VPC B is not routed correctly. Option B is incorrect because the peering status is active. Option C is incorrect because security groups are not shown.

Option D is incorrect because NACLs are not shown.

Full explanation →

1415

MCQhard

A company uses AWS Organizations and has multiple accounts. The security team requires that all Amazon S3 buckets across all accounts must be encrypted at rest with AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect non-compliant buckets and remediate them by enabling SSE-KMS. The solution must work across all existing and future accounts. Which AWS service should be used?

A.AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.

B.AWS CloudTrail with a metric filter and Amazon CloudWatch alarm to trigger a Lambda function.

C.AWS Trusted Advisor to check S3 bucket encryption and send notifications.

D.Amazon Macie to discover sensitive data and then manually encrypt buckets.

AnswerA

AWS Config rules can evaluate resources for compliance. Automatic remediation can invoke a Systems Manager Automation document to enable SSE-KMS on non-compliant buckets. This can be applied organization-wide using AWS Config aggregators and StackSets.

Why this answer

AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can evaluate all S3 buckets across accounts in an AWS Organization. When a non-compliant bucket is detected, an automatic remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') can enable SSE-KMS without manual intervention. This solution scales to existing and future accounts because AWS Config can be set up as an aggregator across the organization, and remediation actions apply automatically as new accounts are added.

Exam trap

The trap here is that candidates often confuse detection-only services (like Trusted Advisor or CloudTrail) with services that can both detect and automatically remediate, or they mistakenly think Macie handles encryption compliance when it actually focuses on data classification.

How to eliminate wrong answers

Option B is wrong because AWS CloudTrail with a metric filter and CloudWatch alarm only detects API calls (e.g., PutBucketEncryption) after they occur; it cannot proactively detect non-compliant buckets or automatically remediate them without a custom Lambda function, and it does not provide continuous compliance evaluation across all accounts. Option C is wrong because AWS Trusted Advisor checks S3 bucket encryption only for the root account or linked accounts in a support plan, but it does not support automatic remediation—it only sends notifications, and it cannot enforce encryption across all accounts in an organization. Option D is wrong because Amazon Macie is designed to discover sensitive data (e.g., PII) in S3 buckets, not to check or enforce encryption settings; it requires manual intervention to encrypt buckets and does not provide automated detection or remediation of non-compliant encryption.

Full explanation →

1416

MCQeasy

A company is using Amazon CloudFront to distribute content globally. The company wants to restrict access to content so that only users from specific countries can access it. Which CloudFront feature should be used?

A.AWS WAF

B.Signed URLs

C.Geo restriction

D.Origin Access Identity (OAI)

AnswerC

Geo restriction (geo-blocking) allows you to allow or deny access to content based on the viewer's country.

Why this answer

Option A is correct because CloudFront geo restriction allows you to whitelist or blacklist countries. Option B is wrong because signed URLs provide access per request. Option C is wrong because origin access identity restricts access to the origin, not users.

Option D is wrong because WAF can be used for more granular access control but geo restriction is the native feature for country-based blocking.

Full explanation →

1417

MCQmedium

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The VPC has a private subnet with EC2 instances that need to communicate with on-premises servers. The on-premises network team reports that they can ping the EC2 instances, but the EC2 instances cannot ping the on-premises servers. The SysOps administrator checks the route tables and finds that the VPC has a route to the on-premises CIDR via the virtual private gateway. The security groups allow all ICMP traffic. What is the most likely cause?

A.The security group on the EC2 instances blocks outbound ICMP

B.The network ACL for the private subnet blocks outbound traffic

C.The on-premises network does not have a route back to the VPC CIDR through the Direct Connect

D.The VPC route table does not have a route to the on-premises CIDR via the virtual private gateway

AnswerC

For two-way communication, both sides must have routes via Direct Connect.

Why this answer

Option C is correct because the on-premises servers need to have a route back to the VPC CIDR through the Direct Connect. The fact that they can ping the EC2 instances indicates that traffic from on-premises to VPC is working, but the return traffic may be going through the internet instead of Direct Connect if the on-premises route is not configured. Option A is wrong because the VPC route is present.

Option B is wrong because security groups allow ICMP. Option D is wrong because NACLs default to allow all.

Full explanation →

1418

MCQhard

A company manages multiple AWS accounts using AWS Organizations. The security team wants to restrict the use of Amazon EC2 instance types to only those that are approved for production workloads (e.g., m5.large, m5.xlarge). The policy should be applied to all member accounts in the organization, and it should prevent any non-approved instance type from being launched. The SysOps administrator should implement this with minimal operational overhead. Which solution should be used?

A.Create an IAM policy in each member account that denies ec2:RunInstances unless the instance type is in the approved list.

B.Create an AWS Organizations Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not in the approved list.

C.Use AWS Config with the managed rule 'ec2-instance-type-check' and an automatic remediation action that terminates non-compliant instances.

D.Use Amazon EventBridge to detect RunInstances API calls and invoke a Lambda function that terminates unapproved instances.

AnswerB

SCPs are applied at the organization or OU level and are inherited by all accounts. They provide preventive controls with minimal overhead.

Why this answer

Option B is correct because AWS Organizations Service Control Policies (SCPs) can centrally enforce restrictions across all member accounts without requiring per-account configuration. By creating an SCP that denies ec2:RunInstances when the instance type is not in the approved list, the security team can prevent non-approved EC2 instance types from being launched with minimal operational overhead, as SCPs are applied at the organization, OU, or account level and do not require managing IAM policies in each account.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking that SCPs grant permissions, but SCPs only act as a guardrail to restrict permissions, and they must be combined with appropriate IAM policies to allow actions; additionally, candidates may choose reactive solutions like AWS Config or EventBridge because they are familiar, but the question explicitly asks for a preventive control with minimal overhead.

How to eliminate wrong answers

Option A is wrong because creating an IAM policy in each member account introduces significant operational overhead, as it requires manual or automated deployment to every account, and IAM policies can be overridden by account administrators with full permissions, whereas SCPs provide a guardrail that cannot be bypassed by account-level IAM. Option C is wrong because AWS Config with the 'ec2-instance-type-check' rule is a detective control that only identifies non-compliant instances after launch, and automatic remediation via termination is reactive, not preventive, and can lead to resource churn and potential data loss; it also requires additional setup for remediation actions. Option D is wrong because using EventBridge to detect RunInstances API calls and invoking a Lambda function to terminate unapproved instances is a reactive, event-driven approach that still allows the instance to be launched momentarily, incurs additional cost and complexity, and does not prevent the API call from succeeding in the first place.

Full explanation →

1419

Multi-Selectmedium

A SysOps administrator is setting up centralized logging for multiple AWS accounts using CloudWatch Logs. Which TWO actions should the administrator take to ensure that logs from all accounts are aggregated in a single account?

Select 2 answers

A.In the central account, create an IAM role that trusts the source accounts and allows PutLogEvents.

B.In the central account, create a CloudWatch Logs destination and attach a resource policy that grants the source accounts permission to write logs.

C.In each source account, configure a subscription filter on the log groups to send log events to the central account's CloudWatch Logs destination.

D.In the central account, create a log group with the same name as the source accounts' log groups.

E.In each source account, create a Kinesis Data Firehose delivery stream that sends logs to the central account's S3 bucket.

AnswersB, C

The destination and resource policy are required for cross-account log delivery.

Why this answer

Option B is correct because a CloudWatch Logs destination in the central account, combined with a resource policy that grants the source accounts permission to write logs, is the standard mechanism for cross-account log aggregation. The destination acts as a target for subscription filters, and the resource policy explicitly allows the source accounts to call the PutLogEvents API against that destination. This setup ensures that log events from source accounts are delivered to the central account without requiring IAM roles or additional infrastructure.

Exam trap

The trap here is that candidates often confuse IAM cross-account roles with CloudWatch Logs destinations, assuming that a role with PutLogEvents permissions is sufficient, when in fact CloudWatch Logs requires a destination resource policy for cross-account delivery.

Full explanation →

1420

MCQmedium

A company stores sensitive data in an S3 bucket. The security team requires that all objects uploaded to the bucket be encrypted at rest using an AWS KMS customer-managed key. Which S3 bucket policy statement should be added to enforce this requirement?

A.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}

B.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

C.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}

D.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

AnswerC

This denies uploads that do not use SSE-KMS and also ensures the KMS key ID is present (though not specific key). However, to enforce a specific key, a condition on the key ID is needed. This statement is a common baseline.

Why this answer

Option C is correct because the condition 's3:x-amz-server-side-encryption-aws-kms-key-id' checks that the specific KMS key is used, and the condition 's3:x-amz-server-side-encryption' ensures encryption is enforced. Option A is wrong because it allows SSE-S3. Option B is wrong because it allows SSE-KMS but does not restrict to a specific key.

Option D is wrong because it denies all uploads without encryption, but does not require the specific KMS key.

Full explanation →

1421

MCQmedium

Refer to the exhibit. A SysOps administrator ran the describe-stack-events command for a CloudFormation stack named 'my-stack'. The stack creation failed with 'Resource creation cancelled'. What is the most likely reason?

A.The stack creation was manually cancelled by the administrator.

B.The IAM role for the stack does not have sufficient permissions.

C.The nested stack creation failed due to an invalid template.

D.The nested stack creation timed out and was cancelled.

AnswerD

The 'Resource creation cancelled' error often occurs when a nested stack times out.

Why this answer

The correct answer is C because the nested stack creation was cancelled, likely due to a timeout or user interruption. The parent stack shows CREATE_FAILED with reason 'Resource creation cancelled', and the nested stack is in CREATE_IN_PROGRESS. This indicates that the nested stack was cancelled, possibly because it exceeded a timeout.

Option A is incorrect because the event shows the nested stack is in progress, not failed. Option B is incorrect because there is no explicit cancellation event from the user. Option D is incorrect because there is no evidence of an IAM permission issue.

Full explanation →

1422

MCQmedium

A SysOps administrator needs to allow an IAM user to launch EC2 instances only in the us-east-1 region. The administrator creates a policy with a condition that uses the aws:RequestedRegion condition key. However, the user can still launch instances in other regions. What is the MOST likely reason?

A.The aws:RequestedRegion condition key is not supported for EC2

B.The condition key must be aws:Region instead of aws:RequestedRegion

C.The user has administrator access that overrides the policy

D.The policy does not include the ec2:RunInstances action with the condition

AnswerD

The policy may be missing the condition on the RunInstances action, or the condition key is not applied correctly.

Why this answer

Option A is correct because the ec2:RunInstances action is global; the aws:RequestedRegion condition works only for regional service endpoints. Some EC2 actions are global, and the condition may not apply. However, the primary reason is that the condition key aws:RequestedRegion is evaluated only for regional service calls; if the user uses a global endpoint, the condition might not match.

But more commonly, the policy might not include the condition for all EC2 actions. Option B is incorrect because the condition key is valid. Option C is incorrect because the policy can restrict to a region.

Option D is incorrect because the condition is available.

Full explanation →

1423

MCQeasy

A company runs a batch processing job every Saturday for 3 hours. The job can be interrupted and resumed at any point. The SysOps administrator wants to minimize compute costs for this workload. Which EC2 purchasing option should the administrator use?

A.On-Demand Instances

B.Reserved Instances

C.Spot Instances

D.Dedicated Hosts

AnswerC

Spot Instances offer significant discounts for workloads that can be interrupted and resumed, making them the most cost-effective option for this batch job.

Why this answer

Spot Instances are ideal for fault-tolerant, interruptible workloads like batch processing that can be resumed. They offer significant cost savings (up to 90% compared to On-Demand) because they use spare EC2 capacity, which can be reclaimed by AWS with a 2-minute interruption notice. Since the job runs only 3 hours weekly and can be interrupted and resumed, Spot Instances minimize compute costs effectively.

Exam trap

The trap here is that candidates may choose Reserved Instances because the workload runs weekly, but they overlook the fact that Reserved Instances require a long-term commitment and are not cost-effective for a short, interruptible batch job, whereas Spot Instances are specifically designed for such fault-tolerant, transient workloads.

How to eliminate wrong answers

Option A is wrong because On-Demand Instances provide no discount and are the most expensive option for a predictable, recurring 3-hour weekly workload. Option B is wrong because Reserved Instances require a 1- or 3-year commitment and are cost-effective only for steady-state, always-on usage, not for a short weekly batch job. Option D is wrong because Dedicated Hosts are a physical server dedicated to your use, incurring high costs per host regardless of usage, and are intended for licensing or compliance needs, not for minimizing compute costs on an interruptible batch job.

Full explanation →

1424

MCQhard

A SysOps administrator manages a fleet of EC2 instances that run a batch processing job. The job runs every hour and takes about 45 minutes to complete. The administrator wants to be notified if any job takes longer than 1 hour. Currently, the administrator uses CloudWatch Logs to capture job start and end times from application logs. The job writes a log message at start with 'JOB_START' and at end with 'JOB_END'. The administrator wants to create a metric filter that counts jobs that exceed 1 hour. However, the administrator is unsure how to achieve this with CloudWatch Logs. What should the administrator do?

A.Use CloudWatch Logs Insights to run a query every hour and check the duration.

B.Use CloudWatch Events to capture the log events and trigger a Lambda function to compute duration.

C.Create a metric filter that extracts the timestamp of JOB_START and JOB_END and computes the duration in a custom metric.

D.Create a Lambda function that is triggered by S3 to process the logs and publish a custom metric.

AnswerC

Metric filters can extract values from log events and create custom metrics that can be used for alarming.

Why this answer

Option C is correct because CloudWatch Logs metric filters can extract numeric values from log events and compute custom metrics. By creating a metric filter that extracts the timestamp of JOB_START and JOB_END, you can use the filter pattern to capture both events and then use a custom metric to compute the duration (e.g., by emitting a metric value representing the time difference). This allows you to set an alarm on the metric when the duration exceeds 1 hour, directly meeting the requirement without additional compute resources.

Exam trap

The trap here is that candidates may overcomplicate the solution by thinking they need external compute (Lambda) or separate query tools (Logs Insights) when CloudWatch Logs metric filters can directly extract and compute metrics from log events natively.

How to eliminate wrong answers

Option A is wrong because CloudWatch Logs Insights is a query-based analysis tool for ad-hoc or scheduled queries, but it cannot directly trigger alarms or continuously monitor for durations exceeding 1 hour without custom scripting and additional services. Option B is wrong because CloudWatch Events (now Amazon EventBridge) can capture log events and trigger a Lambda function, but this approach adds unnecessary complexity and cost compared to a native metric filter, and it requires custom code to compute duration and publish metrics. Option D is wrong because S3 is not involved in the described workflow; the logs are in CloudWatch Logs, not S3, and using S3 triggers would require exporting logs to S3 first, adding latency and complexity.

Full explanation →

1425

MCQhard

A company runs a multi-tier application that uses an Amazon RDS for PostgreSQL database. The SysOps administrator needs to monitor the database for performance anomalies, such as sudden spikes in connections or query latencies. The administrator wants to receive alerts when metrics deviate from their expected baseline. The solution must automatically adjust to changes in normal behavior over time, such as seasonal patterns. Which AWS service or feature should the administrator use?

A.Configure Amazon CloudWatch Anomaly Detection on the relevant RDS metrics (e.g., DatabaseConnections, ReadLatency, WriteLatency) and set an alarm to notify when the metric breaches the anomaly band.

B.Use Amazon RDS Performance Insights to analyze database load and set CloudWatch alarms on the DBLoad metric with static thresholds.

C.Enable Amazon CloudWatch Metrics Explorer to create a dashboard that visualizes the metrics and manually review for anomalies.

D.Use AWS X-Ray to trace database queries and set alarms on trace segment durations.

AnswerA

CloudWatch Anomaly Detection automatically builds a baseline and adapts to behavior changes over time, including seasonality. It can trigger alarms when metrics deviate significantly from predicted patterns.

Why this answer

Amazon CloudWatch Anomaly Detection uses machine learning to continuously analyze metric patterns and establish a dynamic baseline that adapts to seasonal trends and gradual changes in normal behavior. By applying anomaly detection to RDS metrics like DatabaseConnections, ReadLatency, and WriteLatency, the administrator can set an alarm that triggers when a metric deviates outside the calculated anomaly band, automatically adjusting to evolving traffic patterns without manual threshold updates.

Exam trap

The trap here is that candidates often confuse Performance Insights (a diagnostic tool for analyzing database load) with a monitoring and alerting solution, overlooking that it does not provide adaptive baselines or automatic anomaly detection.

How to eliminate wrong answers

Option B is wrong because RDS Performance Insights provides database load analysis and the DBLoad metric, but it relies on static thresholds for CloudWatch alarms, which cannot automatically adapt to changing baselines or seasonal patterns. Option C is wrong because CloudWatch Metrics Explorer is a visualization and query tool for exploring metrics, not a monitoring or alerting feature; it requires manual review and does not provide automated anomaly detection or adaptive baselines. Option D is wrong because AWS X-Ray is designed for tracing and analyzing application requests end-to-end, not for monitoring database-level metrics like connection counts or query latencies, and it cannot set alarms on RDS performance metrics.

Full explanation →

Page 19 of 21

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

Practice SOA-C02 by domain

Target a specific domain to shore up weak areas.

Monitoring, Logging, and Remediation Reliability and Business Continuity Deployment, Provisioning, and Automation Security and Compliance Networking and Content Delivery Cost and Performance Optimization

See all domains with question counts →