Courseiva

AWS Certified SysOps Administrator Associate SOA-C02 (SOA-C02) — Questions 76–150

247 questions total · 4pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 4

Page 3
76
MCQhard

The security team requires that no S3 bucket in the account ever has public read or write ACLs enabled. They want non-compliant buckets automatically remediated within 5 minutes of detection without any manual intervention. What is the correct implementation?

A.Create an AWS Config rule for s3-bucket-public-read-prohibited; configure auto-remediation using the AWS-DisableS3BucketPublicReadWrite SSM Automation document
B.Create an EventBridge rule that matches S3 PutBucketAcl API calls and triggers a Lambda function to re-apply a private ACL
C.Enable S3 Block Public Access at the account level to prevent public ACLs from being set in the first place
D.Schedule a daily Lambda function that lists all buckets, checks ACLs, and removes public grants if found
AnswerA

Config evaluates the rule within seconds of a bucket ACL change. The auto-remediation action invokes the SSM document automatically when compliance status changes to NON_COMPLIANT. The SSM document calls PutBucketAcl to remove public grants. The entire cycle completes in 1-3 minutes under normal conditions.

Why this answer

AWS Config can evaluate S3 bucket ACLs against the `s3-bucket-public-read-prohibited` managed rule and automatically trigger an AWS Systems Manager (SSM) Automation document (`AWS-DisableS3BucketPublicReadWrite`) as a remediation action. This ensures non-compliant buckets are fixed within minutes without manual intervention, meeting the 5-minute requirement.

Exam trap

The trap here is that candidates often choose Option C (Block Public Access) thinking it prevents all public access, but it does not remediate existing non-compliant buckets, which is explicitly required by the question.

How to eliminate wrong answers

Option B is wrong because EventBridge rules matching `PutBucketAcl` API calls only trigger on new ACL changes, not on existing buckets that already have public ACLs; it also cannot detect public ACLs set via other methods (e.g., S3 console or SDK) and does not provide a 5-minute remediation guarantee for all non-compliant buckets. Option C is wrong because S3 Block Public Access at the account level prevents new public ACLs from being set but does not automatically remediate existing buckets that already have public ACLs; it also does not meet the requirement for automatic remediation within 5 minutes of detection. Option D is wrong because a daily Lambda function runs only once per day, which violates the 5-minute remediation requirement; it also relies on a custom script that may miss edge cases or fail to handle all ACL configurations.

Full explanation →
77
MCQmedium

A web application publishes a custom metric 'FailedLoginAttempts' to Amazon CloudWatch. The SysOps administrator needs to be notified via Amazon SNS when the number of failed login attempts exceeds 100 within a 5-minute period. Which AWS service or feature should be used to create this notification?

A.Amazon CloudWatch Logs metric filter
B.Amazon CloudWatch alarm
C.Amazon CloudWatch dashboard
D.AWS Config rule
AnswerB

A CloudWatch alarm continuously evaluates a single metric against a defined threshold over a specified number of evaluation periods. When the metric crosses the threshold (for example, failedloginattempts exceeding a certain count within 5 minutes), the alarm state changes to ALARM and triggers an action such as publishing to an Amazon SNS topic, which can then send email or SMS notifications. This is the only option that directly monitors the existing custom metric and initiates a notification with built-in alerting logic.

Why this answer

An Amazon CloudWatch alarm is the correct service because it monitors a specific CloudWatch metric (such as 'FailedLoginAttempts') and triggers an action (such as sending an SNS notification) when the metric crosses a defined threshold over a specified period. In this case, the alarm evaluates whether the sum of 'FailedLoginAttempts' exceeds 100 within a 5-minute period, and upon breaching, it publishes to the SNS topic to notify the SysOps administrator.

Exam trap

The trap here is that candidates often confuse CloudWatch Logs metric filters (which extract metrics from logs) with CloudWatch alarms (which evaluate metrics and trigger actions), leading them to choose Option A even though the custom metric is already published to CloudWatch and does not require log extraction.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Logs metric filters are used to extract metric data from log events (e.g., from CloudWatch Logs), not to monitor a custom metric that is already published directly to CloudWatch; they cannot directly trigger SNS notifications without an alarm. Option C is wrong because an Amazon CloudWatch dashboard is a visualization tool for displaying metrics and alarms, not a service that evaluates metric thresholds or triggers notifications. Option D is wrong because AWS Config rules evaluate resource configurations for compliance against desired policies, not real-time metric values like failed login attempts, and they cannot directly trigger SNS notifications based on metric thresholds.

Full explanation →
78
MCQmedium

A company has an Amazon VPC with public and private subnets across two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an Amazon S3 bucket to upload and download files. The SysOps administrator must ensure that traffic to S3 does not traverse the internet and minimizes data transfer costs. Which solution should the administrator implement?

A.Create an S3 VPC Gateway Endpoint in the VPC and associate it with the route tables of the private subnets.
B.Create an S3 VPC Interface Endpoint in the VPC and associate it with the security groups of the private subnets.
C.Set up a NAT Gateway in the public subnets and add a route to the private subnets' route tables pointing to the NAT Gateway for S3 traffic.
D.Use AWS PrivateLink with an S3 endpoint service hosted in a different VPC.
AnswerA

Gateway Endpoints provide private connectivity to S3 at no additional cost (only standard data transfer rates apply). By adding a route for the S3 prefix list to the private subnet route tables, traffic destined for S3 is routed through the endpoint.

Why this answer

An S3 VPC Gateway Endpoint provides a private, cost-effective connection to S3 from within the VPC without traversing the internet. By associating the endpoint with the route tables of the private subnets, traffic destined for S3 is routed directly through AWS's internal network, avoiding data transfer costs and internet egress charges.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints, assuming both are equally suitable for S3, but Gateway Endpoints are free and optimized for S3 and DynamoDB, while Interface Endpoints incur costs and are better for other AWS services.

How to eliminate wrong answers

Option B is wrong because an S3 VPC Interface Endpoint uses AWS PrivateLink with an elastic network interface, incurring per-hour and per-GB data processing costs, which is more expensive than a Gateway Endpoint and unnecessary for S3 access. Option C is wrong because a NAT Gateway routes traffic through the internet to reach S3, incurring data transfer costs and internet egress charges, violating the requirement to avoid internet traversal. Option D is wrong because AWS PrivateLink with an S3 endpoint service hosted in a different VPC is not a standard or supported method for accessing S3; S3 Gateway Endpoints are designed for direct VPC-to-S3 connectivity without cross-VPC complexity.

Full explanation →
79
MCQmedium

An administrator runs the above command to list EC2 instances. The company wants to optimize costs. Which instance should the administrator consider terminating first?

A.i-0efgh5678 (t3.large, running in us-east-1b)
B.i-0abcd1234 (t3.medium, running in us-east-1a)
C.i-0mnop3456 (t3.medium, stopped in us-east-1c)
D.i-0ijkl9012 (t3.xlarge, running in us-east-1a)
AnswerC

Stopped instances still incur costs for attached resources.

Why this answer

The instance i-0mnop3456 is stopped but still incurs costs for EBS volumes and possibly Elastic IPs. Terminating it will eliminate those costs. The running instances are in use and may be necessary.

The t3.medium instances are smaller and may be needed.

Full explanation →
80
MCQmedium

A company runs a web application on Amazon EC2 instances in an Auto Scaling group that spans two Availability Zones. The application uses an Application Load Balancer (ALB) that is deployed across the same Availability Zones. The SysOps administrator wants to ensure the application remains available if an entire Availability Zone fails. Which configuration is essential for this high availability?

A.Configure the Auto Scaling group with at least one instance in each Availability Zone.
B.Enable cross-zone load balancing on the Application Load Balancer.
C.Use an Amazon Route 53 health check to route traffic away from a failed AZ.
D.Attach an Elastic IP address to each instance in the Auto Scaling group to ensure IP persistence.
AnswerA

Configuring the Auto Scaling group to maintain at least one instance in each Availability Zone (AZ) ensures that if an entire AZ becomes unavailable, the remaining AZs still have healthy instances to serve traffic. Auto Scaling also performs AZ rebalancing, which automatically detects when one AZ has fewer instances and launches replacements in that AZ to maintain a balanced distribution. This is the fundamental mechanism for achieving fault tolerance at the AZ level within a single region, which is exactly what the requirement demands.

Why this answer

For high availability across an Availability Zone (AZ) failure, the Auto Scaling group must have at least one healthy instance in each AZ. This ensures that if one AZ becomes unavailable, the ALB can route traffic to instances in the remaining AZ. Without this minimum distribution, a single AZ failure could leave the application with zero healthy targets if all instances were in the failed AZ.

Exam trap

The trap here is that candidates often confuse cross-zone load balancing (which balances traffic) with instance distribution across AZs (which ensures survival), leading them to select Option B instead of recognizing that without instances in each AZ, no load balancing can save the application.

How to eliminate wrong answers

Option B is wrong because cross-zone load balancing distributes traffic evenly across all registered instances in all AZs, but it does not protect against an entire AZ failure—it only balances load, not ensures instance survival. Option C is wrong because Route 53 health checks can route traffic away from a failed AZ at the DNS level, but they do not guarantee that instances exist in the surviving AZ; the Auto Scaling group must already have instances there. Option D is wrong because Elastic IP addresses are not used with Auto Scaling groups (which use dynamic scaling and replacement) and do not provide high availability; they are static IPs for individual instances, not for AZ failure resilience.

Full explanation →
81
Multi-Selecthard

Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Select 3 answers
A.Virtual private gateway
B.Internet gateway
C.VPN connection
D.Customer gateway
E.Direct Connect virtual interface
AnswersA, C, D

AWS-side endpoint for the VPN.

Why this answer

A virtual private gateway (VGW) is the VPN concentrator on the AWS side of a site-to-site VPN connection. It attaches to the VPC and terminates the IPsec tunnels from the on-premises network. Without a VGW, the VPC has no endpoint to receive encrypted traffic from the customer gateway.

Exam trap

The trap here is that candidates confuse an internet gateway with a virtual private gateway, thinking any gateway can serve as a VPN endpoint, but only the VGW supports IPsec termination and route propagation for site-to-site VPNs.

Full explanation →
82
MCQmedium

A SysOps administrator needs to monitor the CPU utilization of an Amazon RDS for PostgreSQL instance and receive an alert if the usage exceeds 80% for 5 consecutive minutes. The database is in a production environment. What is the MOST efficient way to achieve this?

A.Configure an Amazon Simple Notification Service (SNS) topic to subscribe to CloudWatch alarms for all RDS metrics and filter for CPUUtilization.
B.Create an AWS Lambda function that queries the RDS performance schema every minute and publishes a custom metric to CloudWatch, then set an alarm.
C.Create an Amazon CloudWatch alarm on the CPUUtilization metric with a threshold of 80 and an evaluation period of 5 minutes.
D.Use a third-party monitoring tool such as Datadog because CloudWatch cannot monitor RDS CPU utilization.
AnswerC

CloudWatch directly monitors RDS metrics and can trigger an alarm based on the metric's value over a specified period.

Why this answer

Amazon CloudWatch natively publishes the CPUUtilization metric for RDS instances every minute (standard monitoring) or every 5 minutes (enhanced monitoring). Creating a CloudWatch alarm with a threshold of 80% and an evaluation period of 5 consecutive minutes directly meets the requirement without additional infrastructure. This is the most efficient approach as it uses built-in RDS monitoring capabilities with no custom code or third-party tools.

Exam trap

The trap here is that candidates may overcomplicate the solution by assuming CloudWatch cannot natively monitor RDS CPU utilization or that custom code is required, when in fact RDS automatically publishes CPUUtilization to CloudWatch and alarms can be configured directly.

How to eliminate wrong answers

Option A is wrong because subscribing an SNS topic to all CloudWatch alarms for RDS metrics would require filtering at the SNS level, which is inefficient and does not directly create the alarm; the alarm must be created first, and SNS is a notification target, not a monitoring configuration tool. Option B is wrong because querying the RDS performance schema every minute via Lambda is unnecessarily complex, introduces latency, and incurs additional cost; CloudWatch already provides the CPUUtilization metric natively for RDS without custom instrumentation. Option D is wrong because CloudWatch fully supports monitoring RDS CPU utilization; a third-party tool like Datadog adds cost and complexity without solving the stated requirement.

Full explanation →
83
MCQeasy

A company wants to receive alerts when its AWS costs exceed a certain threshold. Which AWS service should be used?

A.Amazon CloudWatch
B.AWS Cost Explorer
C.AWS Trusted Advisor
D.AWS Budgets
AnswerD

Allows setting cost budgets and sending alerts.

Why this answer

AWS Budgets allows you to set custom cost and usage budgets and receive alerts when actual or forecasted costs exceed a defined threshold. It directly supports cost-based alerting with actions such as sending an SNS notification or applying an IAM policy to restrict resources when the budget limit is breached.

Exam trap

The trap here is that candidates confuse AWS Budgets with AWS Cost Explorer, assuming Cost Explorer can send alerts, when in fact Cost Explorer is only a reporting and analysis tool without native alerting capabilities.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch monitors AWS resource utilization and application performance metrics, not cost thresholds; while it can trigger alarms on billing metrics if you enable detailed billing metrics, it is not the primary service for cost-based budget alerts. Option B is wrong because AWS Cost Explorer provides visualization and analysis of historical cost data but does not support proactive threshold-based alerts. Option C is wrong because AWS Trusted Advisor offers cost optimization recommendations and checks for idle resources, but it does not allow you to set custom cost thresholds or send alerts when costs exceed a specific amount.

Full explanation →
84
MCQmedium

A company uses AWS Key Management Service (KMS) to encrypt data in Amazon S3. They want to ensure that the KMS key can only be used from within a specific VPC. How can this be accomplished?

A.Add a condition in the S3 bucket policy to allow only requests from the VPC.
B.Add a condition in the KMS key policy using 'aws:SourceVpc' to restrict usage to the VPC.
C.Use an IAM policy with a condition that requires the request to come from the VPC.
D.Configure a network ACL that blocks all traffic to KMS except from the VPC.
AnswerB

KMS key policy supports 'aws:SourceVpc' condition.

Why this answer

A KMS key policy can use the 'aws:SourceVpc' condition key to restrict usage of the key to requests originating from a specific VPC. Option A is incorrect because S3 bucket policies cannot directly restrict KMS key usage; they can only control access to S3 objects. Option C is incorrect because IAM policies can include conditions based on source VPC for certain services, but for KMS actions, the condition must be in the key policy itself, not an IAM policy.

Option D is incorrect because network ACLs operate at the subnet level and control network traffic, not API calls to KMS; they cannot restrict access to the KMS service.

Full explanation →
85
MCQeasy

EC2 instances in private subnets need to access S3 buckets. Currently the instances use a NAT Gateway to reach S3 over the internet. The team wants to keep S3 traffic private (within the AWS network) and reduce NAT Gateway data processing costs. What is the correct solution?

A.Create an S3 Gateway VPC endpoint and add it to the private subnet's route table; S3 traffic will bypass the NAT Gateway
B.Create an S3 Interface VPC endpoint in the private subnet to route S3 traffic privately
C.Add a route in the private subnet's route table directing all traffic (0.0.0.0/0) to an Internet Gateway
D.Use S3 Transfer Acceleration to route traffic over AWS edge locations instead of NAT
AnswerA

After the Gateway endpoint is created and the route table updated, the AWS networking layer automatically routes S3 API calls from instances in those subnets through the private endpoint path. The NAT Gateway processes zero S3 bytes, eliminating the per-GB data processing cost for S3 traffic. No code changes are required.

Why this answer

An S3 Gateway VPC endpoint allows EC2 instances in private subnets to access S3 privately using AWS’s internal network, bypassing the NAT Gateway entirely. This eliminates NAT data processing costs and keeps traffic within the AWS backbone, as the endpoint is added to the private subnet’s route table with a prefix list for S3, directing traffic directly to S3 without internet routing.

Exam trap

The trap here is that candidates confuse Gateway VPC endpoints with Interface VPC endpoints, assuming both incur costs, but S3 Gateway endpoints are free and designed specifically for S3 and DynamoDB, while Interface endpoints are for other AWS services and have associated charges.

How to eliminate wrong answers

Option B is wrong because an S3 Interface VPC endpoint uses AWS PrivateLink with an elastic network interface in the subnet, incurring hourly charges and per-GB data processing costs, which does not reduce costs compared to a NAT Gateway and is unnecessary for S3 access when a Gateway endpoint (free of charge) is available. Option C is wrong because adding a route directing all traffic (0.0.0.0/0) to an Internet Gateway would expose private instances directly to the internet, violating security requirements and not keeping traffic private within AWS. Option D is wrong because S3 Transfer Acceleration uses AWS edge locations and the public internet to speed up uploads, but it does not keep traffic private within the AWS network and still requires internet connectivity, failing to reduce NAT Gateway costs.

Full explanation →
86
MCQmedium

A SysOps administrator needs to ensure that all traffic to an Amazon S3 bucket is encrypted in transit. Which configuration should be used?

A.Use Amazon CloudFront with the S3 bucket as origin and require HTTPS.
B.Create a VPC endpoint for S3 and route all traffic through it.
C.Enable default encryption on the S3 bucket.
D.Add a bucket policy that denies requests where aws:SecureTransport is false.
AnswerD

This bucket policy explicitly denies any request for which the aws:SecureTransport condition is false, meaning the request was not made over HTTPS or TLS. Because a deny in an identity-based or bucket policy overrides any allows, every request must present a valid TLS connection or it will be rejected. This enforces encryption in transit at the S3 bucket level for all clients, including those using the public endpoint, and is the standard method for ensuring HTTPS-only access.

Why this answer

A bucket policy with a condition that denies requests when aws:SecureTransport is false (i.e., HTTP) enforces HTTPS for all access to the S3 bucket. Option A is incorrect because CloudFront with HTTPS only encrypts traffic between the viewer and CloudFront, not necessarily between CloudFront and S3 unless configured, and it does not enforce HTTPS for direct S3 access. Option B is incorrect because a VPC endpoint for S3 uses private IPs but does not enforce encryption in transit; it can still use HTTP.

Option C is incorrect because default encryption on an S3 bucket only encrypts data at rest, not in transit.

Exam trap

Candidates often confuse encryption at rest (e.g., S3 default encryption) with encryption in transit. The correct mechanism for enforcing HTTPS is a bucket policy with the `aws:SecureTransport` condition.

Full explanation →
87
MCQmedium

A company's security policy requires that all Amazon S3 buckets must be encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). A SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and automatically apply SSE-S3 encryption. The solution should leverage AWS managed services and minimize custom code. Which combination of AWS services should be used?

A.AWS Config and AWS Lambda
B.Amazon GuardDuty and AWS Lambda
C.AWS CloudTrail and Amazon EventBridge
D.Amazon Macie and AWS Step Functions
AnswerA

AWS Config continuously evaluates S3 buckets against the managed rule for encryption. Non-compliant buckets can trigger a remediation action via an AWS Lambda function that applies SSE-S3 configuration. This minimizes custom code and uses managed services.

Why this answer

AWS Config can evaluate S3 bucket configurations against a managed rule (s3-bucket-server-side-encryption-enabled) to detect non-compliant buckets. When a non-compliant bucket is detected, AWS Config can trigger an AWS Lambda function via an Amazon EventBridge rule or a custom remediation action to automatically enable SSE-S3 encryption on the bucket. This combination uses managed services and minimizes custom code, meeting the security policy requirement.

Exam trap

The trap here is that candidates may confuse AWS Config's compliance evaluation with GuardDuty's threat detection or Macie's data classification, leading them to choose a service that cannot detect or remediate encryption settings.

How to eliminate wrong answers

Option B is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for checking or enforcing S3 bucket encryption configurations. Option C is wrong because AWS CloudTrail records API activity but does not evaluate resource compliance or trigger automated remediation; Amazon EventBridge can route events but requires a separate service like AWS Config to detect non-compliance. Option D is wrong because Amazon Macie is a data discovery and protection service that uses machine learning to identify sensitive data, not to detect or enforce encryption settings; AWS Step Functions is an orchestration service that would require custom code to implement the detection logic.

Full explanation →
88
MCQhard

A company uses IAM roles to grant EC2 instances access to S3 buckets. After a recent security audit, the SysOps administrator must ensure that only instances with a specific tag (Environment=Production) can assume the role. How can this be achieved?

A.Create a new IAM role for each instance and attach the tag.
B.Use a service control policy (SCP) to deny the ec2:AssumeRole action for instances without the required tag.
C.Modify the instance profile to include the tag requirement.
D.Add a condition in the role's trust policy that checks for the instance's tag using the aws:ResourceTag condition key.
AnswerD

The trust policy can evaluate the instance's tags at the time of AssumeRole.

Why this answer

IAM role trust policies can use the aws:ResourceTag condition key to restrict which EC2 instances (based on their tags) can assume the role. Option A is wrong because tags are not automatically included in the session; the trust policy must explicitly check tags. Option B is wrong because SCPs apply to accounts, not instances.

Option C is wrong because instance profiles cannot be modified to check tags.

Full explanation →
89
MCQmedium

A company runs a batch processing job every night that takes 2 hours on a single m5.xlarge EC2 instance. The job is fault-tolerant and can be interrupted. The SysOps administrator wants to reduce costs. Which solution is MOST cost-effective?

A.Use an On-Demand instance and set up a CloudWatch alarm to stop it when the job completes.
B.Use a Spot Instance with a Spot Fleet that includes a fallback to On-Demand if Spot is not available.
C.Use a Dedicated Host to run the job.
D.Purchase a Reserved Instance for the m5.xlarge instance.
AnswerB

A Spot Fleet is the correct choice here because it lets you request Spot Instances at a significantly lower cost while maintaining reliability with an On-Demand fallback. The nightly batch job is fault-tolerant, meaning it can restart or rerun if Spot capacity is reclaimed. If Spot capacity is unavailable or gets interrupted, the Spot Fleet automatically launches an On-Demand instance to ensure the job still completes, giving you a balance of cost savings and capacity assurance.

Why this answer

The most cost-effective solution is to use a Spot Instance with a Spot Fleet that includes a fallback to On-Demand if Spot is not available (Option B). The job is fault-tolerant and can be interrupted, making it ideal for Spot Instances which offer significant cost savings (up to 90% compared to On-Demand). The Spot Fleet with an On-Demand fallback ensures the job completes even if Spot capacity is unavailable.

Option A (On-Demand with CloudWatch alarm) does not reduce costs since On-Demand is more expensive. Option C (Dedicated Host) is costly and unnecessary for a batch job. Option D (Reserved Instance) requires a 1- or 3-year commitment and is not cost-effective for a 2-hour daily job.

Full explanation →
90
Multi-Selecteasy

A SysOps administrator needs to ensure high availability for a web application running on EC2 instances across multiple Availability Zones. Which TWO actions should the administrator take?

Select 2 answers
A.Launch EC2 instances in at least two different Availability Zones.
B.Place a CloudFront distribution in front of the instances.
C.Launch all EC2 instances in a single Availability Zone for consistency.
D.Register the instances with an Application Load Balancer that has health checks enabled.
E.Attach an EBS volume to each instance and replicate data in real-time.
AnswersA, D

Distributing instances across AZs provides fault tolerance.

Why this answer

Options A and D are correct. Launching EC2 instances across multiple Availability Zones (A) provides fault isolation, and registering them with an Application Load Balancer that has health checks enabled (D) ensures traffic is routed only to healthy instances. Option B is incorrect because CloudFront is a CDN, not a load balancer; it improves performance but does not directly provide high availability by health checking instances.

Option C is incorrect because all instances in a single Availability Zone creates a single point of failure. Option E is incorrect because EBS volumes are tied to a specific Availability Zone and real-time replication does not address instance-level failures across zones.

Full explanation →
91
Drag & Dropmedium

Drag and drop the steps to migrate an on-premises application to AWS using AWS Application Migration Service (MGN) into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The correct sequence for migrating an on-premises application to AWS using AWS Application Migration Service is: first install the AWS Replication Agent on the source server, then configure the replication settings including launch settings and target VPC, then start the initial sync to replicate the entire server volume, then perform a test launch to validate the replicated environment, and finally initiate the cutover to redirect production traffic to the new AWS instance. Each step builds on the previous one to ensure a successful migration with minimal downtime.

Full explanation →
92
Multi-Selectmedium

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running in a VPC with public and private subnets. The SysOps administrator needs to update the environment to use a new platform version. Which TWO steps should be taken to ensure a smooth update with minimal downtime? (Select TWO.)

Select 2 answers
A.Update the security groups to allow traffic from the new environment.
B.Take a snapshot of the attached Amazon RDS database before starting the update.
C.Perform a blue/green deployment by cloning the environment and swapping the CNAME.
D.Enable immutable updates in the environment configuration.
E.Manually drain connections from the current environment before swapping.
AnswersC, D

Performing a blue/green deployment by cloning the environment, updating the clone to the new platform, and then swapping the CNAME is indeed a valid way to minimize downtime and lets you test the new version without affecting production. It gives you a full staging environment and an instant cutover via DNS, but it requires manual orchestration to keep the clone current and to execute the CNAME swap. While it achieves minimal downtime, it demands more operational effort than simply enabling immutable updates, which handles the entire process automatically.

Why this answer

Options C and D are correct. Option C: Performing a blue/green deployment by cloning the environment and swapping the CNAME minimizes downtime because the new environment is fully tested before traffic is switched to it. Option D: Enabling immutable updates in the environment configuration ensures that Elastic Beanstalk deploys the new platform version to a separate set of instances and then swaps traffic, reducing downtime and rollback risk.

Option A is incorrect because updating security groups is not a required step for platform updates; security groups are typically managed separately. Option B is incorrect because taking an RDS snapshot is a backup best practice, but it does not by itself minimize downtime during a platform update. Option E is incorrect because connection draining is handled automatically by Elastic Beanstalk during the CNAME swap or immutable deployment; manual draining is unnecessary.

Full explanation →
93
MCQmedium

A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?

A.AWS Config with a custom rule and AWS Lambda
B.AWS CloudTrail and Amazon CloudWatch Events
C.AWS Service Catalog and AWS Organizations
D.Amazon Inspector and AWS Systems Manager
AnswerA

A custom AWS Config rule can evaluate EC2 instances when they are created (configuration change trigger) and invoke an AWS Lambda function to terminate instances lacking the required tag or having an invalid value. This provides continuous compliance enforcement.

Why this answer

AWS Config with a custom rule can evaluate EC2 instances for the required 'Environment' tag with valid values. When a non-compliant instance is detected, AWS Config triggers an AWS Lambda function that terminates the instance within the required five-minute window. This combination provides automated, event-driven enforcement with minimal manual intervention.

Exam trap

The trap here is that candidates may think CloudTrail and CloudWatch Events alone can enforce tag compliance, but they lack the evaluation logic and automated remediation that AWS Config with a custom Lambda rule provides.

How to eliminate wrong answers

Option B is wrong because AWS CloudTrail records API calls and CloudWatch Events can trigger on those events, but they lack native tag validation logic; you would still need a Lambda function to evaluate tag values and terminate instances, making this an incomplete solution. Option C is wrong because AWS Service Catalog enforces compliance at provisioning time through predefined products, but it cannot retroactively terminate instances launched outside the catalog or enforce tag compliance on existing instances. Option D is wrong because Amazon Inspector is a vulnerability assessment service and AWS Systems Manager is for operational management; neither service has the capability to evaluate tags or terminate instances based on tag compliance.

Full explanation →
94
MCQeasy

A company stores large volumes of log data in Amazon S3. The logs are accessed frequently for the first 30 days, then occasionally for the next 60 days, and after 90 days they are rarely accessed but must be retained for 7 years for compliance. The SysOps administrator wants to minimize storage costs while ensuring data is available when needed. Which S3 lifecycle policy configuration should be applied?

A.Transition objects to S3 Standard-IA after 30 days, and to S3 Glacier after 60 days. Delete after 7 years.
B.Transition objects to S3 Glacier Deep Archive after 30 days, and delete after 7 years.
C.Transition objects to S3 One Zone-IA after 30 days, and to S3 Glacier Deep Archive after 90 days. Delete after 7 years.
D.Transition objects to S3 Standard-IA after 30 days, and to S3 Glacier Deep Archive after 90 days. Delete after 7 years.
AnswerD

This lifecycle policy matches the access patterns: frequent access -> Standard-IA after 30 days, occasional access for next 60 days (still in IA), then rarely accessed -> Deep Archive after 90 days. Deep Archive is the lowest-cost storage option for long-term retention. Deleting after 7 years meets compliance. This is the most cost-effective configuration.

Why this answer

It aligns the lifecycle transitions with the access patterns: frequent access for the first 30 days (S3 Standard), occasional access for the next 60 days (S3 Standard-IA), and rare access after 90 days (S3 Glacier Deep Archive, the lowest-cost storage class for long-term retention). The deletion after 7 years meets compliance requirements while minimizing costs by using progressively cheaper storage classes.

Exam trap

The trap here is that candidates may choose Option A because they think S3 Glacier is the standard archival tier, but they overlook that S3 Glacier Deep Archive is cheaper for 7-year retention and that the occasional-access period (days 31–90) is better served by S3 Standard-IA, not S3 Glacier.

How to eliminate wrong answers

Option A is wrong because transitioning to S3 Glacier after 60 days (instead of 90) would incur unnecessary retrieval costs and slower access during the occasional-access period (days 31–90), and S3 Glacier is more expensive than S3 Glacier Deep Archive for long-term retention. Option B is wrong because moving directly to S3 Glacier Deep Archive after 30 days ignores the frequent-access period, causing high retrieval costs and latency for logs that are still accessed often. Option C is wrong because S3 One Zone-IA is not resilient to AZ failures and is unsuitable for compliance data that must be retained for 7 years; also, transitioning after 30 days to One Zone-IA does not match the occasional-access pattern (days 31–90) as well as Standard-IA.

Full explanation →
95
MCQhard

A company runs a production Amazon DynamoDB table with provisioned capacity of 1000 write capacity units (WCU). The table experiences unpredictable spikes up to 2000 WCU, causing throttling. The SysOps administrator wants to minimize cost while handling the spikes. Which solution should be used?

A.Switch to on-demand capacity mode.
B.Increase provisioned WCU to 2000 to cover the peak.
C.Enable DynamoDB Auto Scaling with minimum 1000, maximum 2000 WCU.
D.Use a DynamoDB Accelerator (DAX) cache.
AnswerA

Switch to on-demand capacity mode: On-demand mode instantly accommodates usage spikes without requiring capacity planning or pre-provisioning. You pay per request, so there is no charge for unused provisioned capacity, making it highly cost-effective for unpredictable write traffic. It eliminates throttling errors because DynamoDB automatically scales write and read capacity to match your application's actual demand, even during sudden bursts.

Why this answer

Switching to on-demand capacity mode eliminates throttling during unpredictable spikes by automatically scaling write capacity up to the required 2000 WCU without any manual intervention or pre-provisioning. This minimizes cost because you pay only for the actual reads and writes consumed, avoiding the fixed cost of over-provisioning for peak capacity that may be rarely used.

Exam trap

The trap here is that candidates often choose DynamoDB Auto Scaling (Option C) thinking it handles spikes instantly, but they overlook the inherent scaling delay and the fact that it still requires a maximum capacity setting that may not cover sudden bursts, leading to throttling.

How to eliminate wrong answers

Option B is wrong because increasing provisioned WCU to 2000 permanently incurs higher base costs even during low-traffic periods, which contradicts the goal of minimizing cost. Option C is wrong because DynamoDB Auto Scaling adjusts capacity based on utilization metrics, but it cannot react instantly to sudden spikes up to 2000 WCU, leading to throttling during the scaling delay. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that improves read performance, not write capacity, and does not address write throttling caused by insufficient WCU.

Full explanation →
96
MCQhard

A SysOps team manages a fleet of EC2 instances used for batch processing. The workload runs daily, taking approximately 6 hours. The instances are launched via an Auto Scaling group using On-Demand instances from a custom AMI. The team has noticed that while the instances are running, the CPU utilization is moderate, but the memory usage is high. After the batch completes, the instances are terminated. The team wants to reduce costs without changing the architecture. Which solution would be MOST cost-effective?

A.Modify the Auto Scaling group to use a mixed instances policy with a percentage of Spot Instances and a fallback to On-Demand.
B.Use a Compute Savings Plan covering the entire compute usage across the account.
C.Change the instance type to a memory-optimized family to reduce the number of instances needed.
D.Purchase Reserved Instances for the expected daily usage to get a lower hourly rate.
AnswerA

Spot Instances are ideal for fault-tolerant workloads like batch processing, offering large discounts.

Why this answer

Spot Instances can provide significant discounts (up to 90%) for fault-tolerant batch workloads, and the team can use a mixed instances policy with On-Demand as a fallback. Option B (memory optimized instances) would likely increase cost. Option C (reserved instances) is not suitable for short-lived, sporadic workloads.

Option D (savings plan) could help but still requires committing to a consistent amount, which may not align with the varying batch size. Option A offers the most flexibility and cost savings.

Full explanation →
97
Multi-Selectmedium

A company wants to monitor AWS API calls for suspicious activity. Which TWO AWS services can be used together to achieve this?

Select 2 answers
A.VPC Flow Logs
B.Amazon CloudWatch Logs
C.Amazon Inspector
D.AWS Config
E.AWS CloudTrail
AnswersB, E

CloudWatch Logs can analyze CloudTrail logs for suspicious patterns.

Why this answer

Options B and E are correct. AWS CloudTrail logs all API calls made to the AWS environment, providing an audit trail. Amazon CloudWatch Logs can ingest CloudTrail logs and use metric filters to detect patterns indicative of suspicious activity.

Option A (VPC Flow Logs) captures IP traffic information, not API calls. Option C (Amazon Inspector) is a vulnerability assessment service. Option D (AWS Config) records resource configuration changes, not API calls.

Full explanation →
98
MCQhard

A SysOps administrator is investigating a cost increase in a production AWS account. They notice that an EC2 instance with a Reservation has been running continuously for months. The instance type is m5.large in us-east-1. The administrator sees that the instance is using a Standard Reserved Instance (RI) that was purchased 6 months ago for a 1-year term. However, the current utilization shows that the instance is only used for 4 hours per day. What should the administrator do to optimize costs without affecting availability?

A.Stop the instance during off-hours using Instance Scheduler, but keep the RI as-is.
B.Sell the current RI on the Reserved Instance Marketplace and purchase a new Convertible RI for a smaller instance type.
C.Modify the existing RI to a smaller instance size (e.g., m5.large to m5.xlarge? no, smaller: e.g., t3.medium) and use Auto Scaling with a schedule to start/stop the instance during business hours.
D.Convert the RI to a Convertible RI and exchange it for a larger instance family to get more compute per hour.
AnswerC

Modifying RI to a smaller size matches usage; scheduled stop reduces running hours.

Why this answer

By modifying the existing Standard RI to a smaller instance size (e.g., within the same family or by converting to a Convertible RI to allow family changes), the administrator can better match the actual low utilization pattern. Additionally, using Auto Scaling with a scheduled scaling policy to start and stop the instance during business hours ensures availability during needed times and reduces waste. Option A is incorrect because stopping the instance does not stop the RI charges; Reserved Instance benefits are applied only to running instances, so the RI would be wasted during off-hours.

Option B is incorrect because selling the RI on the Reserved Instance Marketplace typically incurs a loss of the upfront payment and does not directly address the over-provisioning issue. Option D is incorrect because converting to a larger instance family would increase compute capacity per hour, leading to higher costs and even more waste given the low utilization.

Full explanation →
99
Multi-Selecthard

A SysOps administrator is designing a monitoring solution for a critical application running on EC2 instances. The application requires that all API calls to the environment are logged for security analysis. Which TWO services should the administrator use to meet this requirement?

Select 2 answers
A.Amazon GuardDuty
B.Amazon CloudWatch Logs
C.AWS CloudTrail
D.AWS Config
E.VPC Flow Logs
AnswersB, C

CloudWatch Logs can store and monitor CloudTrail log files.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including calls made via the AWS Management Console, AWS CLI, SDKs, and other services. CloudTrail logs provide the identity of the caller, the time of the call, the source IP address, and the request parameters, which are essential for security analysis. Option B (Amazon CloudWatch Logs) is also correct because CloudTrail logs can be delivered to CloudWatch Logs for centralized monitoring, alerting, and retention, enabling real-time analysis and integration with other AWS services.

Exam trap

The trap here is confusing AWS CloudTrail (which logs API calls) with VPC Flow Logs (which log network traffic) or GuardDuty (which detects threats but does not generate logs), leading candidates to select services that analyze logs rather than capture them.

Full explanation →
100
MCQmedium

A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a deployment stage that uses AWS CloudFormation to deploy infrastructure. The company wants to add a manual approval step before the CloudFormation deployment. How should this be configured?

A.Add a CloudFormation change set action before the deployment.
B.Configure an Amazon SNS topic to send a notification and require a confirmation.
C.Add a manual approval action in the pipeline before the CloudFormation deployment stage.
D.Use an AWS Lambda function to send an email and wait for a response.
AnswerC

In CodePipeline, a manual approval action is a stage action with category Approval that pauses the pipeline execution at that point. Once the action is reached, the pipeline enters a Wait state and notifies designated approvers via SNS; deployment to CloudFormation proceeds only after an authorized IAM user or role approves the change. This is the native mechanism designed to block progression until human sign-off, making it the correct way to require confirmation before deployment.

Why this answer

AWS CodePipeline has a built-in approval action that pauses the pipeline at a specified stage until a manual approval is granted. This allows a human to review and approve before the CloudFormation deployment proceeds. Option A is wrong because a CloudFormation change set action creates a change set for review but does not pause the pipeline; the pipeline continues unless manually stopped separately.

Option B is wrong because Amazon SNS alone sends notifications but does not pause the pipeline; you would need an approval action to block execution. Option D is wrong because an AWS Lambda function cannot block the pipeline; it can notify but the pipeline will continue unless an approval action is used.

Full explanation →
101
MCQmedium

A SysOps administrator uses AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and a security group. The administrator wants to ensure that when the stack is updated, the security group is not accidentally replaced if its properties change. The administrator wants to receive a failure if an update would require replacement of the security group. Which CloudFormation feature should the administrator use?

A.Add a 'DeletionPolicy' attribute set to 'Retain' on the security group resource.
B.Add a 'CreationPolicy' attribute to the security group resource.
C.Define a stack policy that denies replacement of the security group resource.
D.Use an 'UpdatePolicy' attribute with 'AutoScalingReplacingUpdate' on the security group.
AnswerC

A stack policy can specify the allowed update actions per resource. By denying the 'Replace' action for the security group, CloudFormation will fail updates that would require recreating the security group, protecting it from accidental replacement.

Why this answer

A stack policy can explicitly deny update actions that would replace a resource, such as the security group. By defining a stack policy with a Deny statement for the 'Replace' effect on the security group's logical resource ID, CloudFormation will fail the update if any property change triggers a replacement, preventing accidental deletion and recreation.

Exam trap

The trap here is that candidates confuse 'DeletionPolicy' (which only applies on stack deletion) with preventing replacement during updates, or mistakenly think 'UpdatePolicy' or 'CreationPolicy' can control resource replacement behavior.

How to eliminate wrong answers

Option A is wrong because the 'DeletionPolicy' attribute set to 'Retain' only preserves the security group when the stack is deleted, not during an update; it does not prevent replacement during an update. Option B is wrong because 'CreationPolicy' is used to wait for signals or resource creation success, not to control update behavior or prevent replacement. Option D is wrong because 'UpdatePolicy' with 'AutoScalingReplacingUpdate' is specific to Auto Scaling groups to control rolling updates, not applicable to security groups.

Full explanation →
102
Multi-Selectmedium

Which TWO actions can be taken to improve the availability of a web application hosted on EC2 instances behind an Application Load Balancer? (Select two.)

Select 2 answers
A.Configure an Auto Scaling group with health checks to replace unhealthy instances.
B.Use larger EC2 instance types.
C.Deploy the EC2 instances across multiple Availability Zones.
D.Use a single AWS Region for all instances.
E.Place all EC2 instances in a single subnet.
AnswersA, C

Auto Scaling automatically replaces unhealthy instances.

Why this answer

An Auto Scaling group with health checks can automatically replace unhealthy EC2 instances, improving availability. Option C is correct because deploying instances across multiple Availability Zones provides fault tolerance; if one AZ fails, your application continues to run in another. Option B is incorrect because using larger instance types improves performance, not availability.

Option D is incorrect because using a single region makes the application vulnerable to region-wide failures, reducing availability. Option E is incorrect because placing all instances in a single subnet creates a single point of failure; distributing across AZs is necessary for high availability.

Full explanation →
103
MCQmedium

A company hosts a web application behind an Application Load Balancer (ALB) in us-east-1. Users in Europe report high latency. The SysOps administrator decides to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. However, the application logs require the original client IP addresses of users. The ALB currently provides the client IP via the X-Forwarded-For header, but the development team warns that Global Accelerator may change the source IP. Which configuration should the administrator choose to meet both performance and logging requirements?

A.Configure Global Accelerator with an endpoint group that points directly to the ALB. The ALB will continue to receive the original client IP in the X-Forwarded-For header.
B.Place a Network Load Balancer (NLB) in front of the ALB, and configure Global Accelerator to point to the NLB. The NLB preserves the client IP, and the ALB can still see it in the X-Forwarded-For header.
C.Enable Proxy Protocol v2 on the ALB to ensure client IP addresses are preserved through Global Accelerator.
D.Use Amazon CloudFront instead of Global Accelerator and configure it to forward the client IP in a custom header.
AnswerB

Global Accelerator preserves the client source IP when the endpoint is an NLB. The NLB passes traffic to the ALB, which can see the original client IP in the X-Forwarded-For header. This satisfies both performance (using Global Accelerator) and logging requirements.

Why this answer

Placing a Network Load Balancer (NLB) in front of the ALB allows Global Accelerator to terminate the TCP connection at the edge, then forward traffic to the NLB. The NLB preserves the original client IP address by default (since it operates at Layer 4 and does not terminate the connection), and the ALB can still read the client IP from the X-Forwarded-For header. This setup meets both the performance requirement (via Global Accelerator's edge routing) and the logging requirement (preserving the original client IP).

Exam trap

The trap here is that candidates assume Global Accelerator preserves the client IP like a transparent proxy, but in reality it terminates the TCP connection at the edge, so the source IP changes unless an NLB is used to preserve it.

How to eliminate wrong answers

Option A is wrong because Global Accelerator terminates the TCP connection at the edge location and then creates a new connection to the ALB, so the source IP seen by the ALB becomes the Global Accelerator's internal IP, not the original client IP; the X-Forwarded-For header will contain the Global Accelerator's IP, not the user's IP. Option C is wrong because Proxy Protocol v2 is a feature of Network Load Balancers and TCP listeners, not Application Load Balancers; ALBs do not support Proxy Protocol v2, and enabling it on the ALB would not preserve client IP through Global Accelerator. Option D is wrong because CloudFront does not preserve the original client IP in the X-Forwarded-For header by default; it adds the CloudFront edge IP as the last entry, and while you can forward a custom header, this requires additional configuration and does not guarantee the original client IP is preserved in the same way as the NLB+ALB solution.

Full explanation →
104
MCQmedium

A SysOps administrator manages a fleet of Amazon EC2 instances. The administrator needs to identify underutilized instances and receive recommendations for instance type changes to reduce costs. Which AWS service should be used to provide these rightsizing recommendations?

A.AWS Cost Explorer
B.AWS Trusted Advisor
C.AWS Compute Optimizer
D.Amazon CloudWatch Dashboard
AnswerC

AWS Compute Optimizer uses machine learning to analyze historical utilization metrics — including CPU, memory, EBS volume I/O, and network throughput — over a 14-day period and delivers specific recommendations for right-sizing EC2 instances, Auto Scaling groups, and EBS volumes. It provides a projected monthly cost savings estimate and a performance risk score for each recommendation, helping you balance cost and performance. You can also enable enhanced infrastructure metrics for even more precise suggestions, making it the appropriate tool for rightsizing EC2 instances.

Why this answer

AWS Compute Optimizer is the correct service because it uses machine learning to analyze historical utilization metrics (CPU, memory, network, and storage) of EC2 instances and generates rightsizing recommendations, including instance type changes, to reduce costs and improve performance. It directly addresses the need to identify underutilized instances and provide actionable recommendations for cost optimization.

Exam trap

The trap here is that candidates often confuse AWS Compute Optimizer with AWS Trusted Advisor, because both offer cost optimization checks, but Compute Optimizer is the only service that provides detailed, ML-driven rightsizing recommendations for EC2 instance types based on historical utilization data.

How to eliminate wrong answers

Option A is wrong because AWS Cost Explorer provides cost and usage data visualization and forecasting, but it does not analyze instance utilization metrics or generate specific rightsizing recommendations for EC2 instance types. Option B is wrong because AWS Trusted Advisor offers general best-practice checks, including cost optimization, but its EC2-specific recommendations are limited to idle instances and reserved instance utilization, not detailed rightsizing recommendations based on historical utilization patterns. Option D is wrong because Amazon CloudWatch Dashboard is a monitoring and visualization tool for metrics and logs, but it does not automatically analyze utilization data to produce instance type change recommendations; it requires manual setup and interpretation.

Full explanation →
105
MCQmedium

A company has an on-premises data center connected to AWS via an AWS Direct Connect private virtual interface (VIF). The SysOps administrator needs to ensure that all traffic between the on-premises network and Amazon S3 in the same AWS Region stays within the AWS network and does not traverse the internet. Which solution should the administrator implement?

A.Use a Direct Connect gateway and a public VIF with a route to S3 prefix lists
B.Use a Direct Connect gateway and a private VIF with VPC endpoints for S3
C.Use a VPN connection over Direct Connect to access S3
D.Use a Transit Gateway with a private VIF and route S3 traffic through a NAT instance
AnswerB

A private VIF creates a dedicated private network connection between your on-premises data center and a VPC, while a VPC Gateway Endpoint for S3 privately connects the VPC to S3 without traversing the internet. Traffic from on-premises flows via the private VIF into the VPC and then through the Gateway Endpoint directly to S3 over AWS's internal network, successfully meeting the requirement for high-bandwidth, fully private S3 access. This is the recommended AWS architecture for private S3 connectivity over Direct Connect.

Why this answer

A private VIF with VPC endpoints for S3 (Gateway Endpoints) ensures that traffic from on-premises to S3 stays within the AWS network. The private VIF provides connectivity to the VPC, and the Gateway Endpoint routes S3 traffic through the AWS backbone without traversing the internet. This combination meets the requirement of keeping traffic within the AWS network.

Exam trap

The trap here is that candidates often confuse public VIF with private VIF, thinking a public VIF is required for AWS service access, but Gateway Endpoints allow private VIF to access S3 without internet exposure.

How to eliminate wrong answers

Option A is wrong because a public VIF with a route to S3 prefix lists would still route traffic over the public internet (via the Direct Connect public VIF), which does not guarantee that traffic stays within the AWS network; it also requires routing over the internet gateway. Option C is wrong because a VPN connection over Direct Connect would encrypt traffic but still uses the public VIF or internet path, and it does not inherently keep traffic within the AWS network; it adds unnecessary complexity and does not meet the requirement of staying within the AWS network. Option D is wrong because a Transit Gateway with a private VIF and routing S3 traffic through a NAT instance would force traffic through a NAT instance, which typically uses an internet gateway to reach S3, thus traversing the internet; this violates the requirement.

Full explanation →
106
MCQmedium

A company runs a REST API on Amazon EC2 instances behind an Application Load Balancer. The SysOps administrator needs to monitor the API endpoint from multiple geographic locations and receive an alarm if the p90 latency exceeds 2 seconds for two consecutive checks. The solution must use AWS managed services and not require custom code running on EC2. Which approach should the administrator use?

A.Set up Amazon CloudWatch Synthetics canaries to run from multiple AWS Regions and publish custom metrics. Create a CloudWatch alarm on the p90 latency metric.
B.Configure VPC Flow Logs on the Application Load Balancer and use Amazon CloudWatch Logs Insights to query for high-latency requests.
C.Enable Amazon CloudWatch RUM (Real User Monitoring) on the client side and create a CloudWatch alarm on the Duration metric.
D.Use AWS CloudTrail to log API calls and set a CloudWatch alarm on the event count for errors.
AnswerA

CloudWatch Synthetics canaries execute Node.js or Python scripts on AWS-managed Lambda functions, and by configuring them in multiple Regions you can actively probe the REST API from geographically distributed vantage points. Each canary can record HTTP response time and success/failure, then publish those measurements as custom metrics to CloudWatch. Because the metric supports percentile statistics, you can create an alarm on the p90 latency (e.g., p90 over 5 minutes) to detect regional or global slowdowns, making this the only option that provides synthetic, multi-region, application-level latency monitoring.

Why this answer

Amazon CloudWatch Synthetics canaries are AWS-managed Node.js scripts that run on a schedule to monitor endpoints from multiple AWS Regions, capturing metrics like duration and latency. By configuring canaries to report p90 latency as a custom metric, you can create a CloudWatch alarm that triggers when p90 exceeds 2 seconds for two consecutive data points, meeting all requirements without custom EC2 code.

Exam trap

The trap here is that candidates may confuse VPC Flow Logs or CloudTrail with application-layer monitoring, but neither provides request-level latency metrics; CloudWatch Synthetics is the only AWS-managed service that can synthetically test an HTTP endpoint from multiple geographic locations and publish percentile latency metrics without custom EC2 code.

How to eliminate wrong answers

Option B is wrong because VPC Flow Logs capture network-level metadata (IPs, ports, protocols) but do not measure application-layer latency like p90; they cannot be used to query for request duration or percentile latencies. Option C is wrong because Amazon CloudWatch RUM collects client-side performance data from actual user browsers, which introduces variability from network conditions and device performance, and it requires client-side JavaScript injection, not a pure AWS-managed service for synthetic monitoring from multiple geographic locations. Option D is wrong because AWS CloudTrail logs API calls to the AWS management plane (e.g., EC2 API calls), not the application-layer REST API requests; it cannot measure p90 latency or trigger alarms on performance metrics.

Full explanation →
107
MCQhard

A SysOps administrator is investigating a security breach. An IAM user 'Bob' is suspected of performing unauthorized actions. The administrator needs to determine the source IP addresses from which Bob's access keys were used in the last 30 days. Which AWS service or feature should be used?

A.AWS CloudTrail event history.
B.VPC Flow Logs.
C.Amazon CloudWatch Logs.
D.AWS IAM credential report.
AnswerA

CloudTrail records API calls with source IP.

Why this answer

AWS CloudTrail event history provides a record of all API calls made by IAM users, including the source IP address from which the request originated. By filtering the event history for the IAM user 'Bob' and the time range of the last 30 days, the administrator can identify the source IP addresses associated with each API call made using Bob's access keys. This directly meets the requirement to determine the source IP addresses of unauthorized actions.

Exam trap

The trap here is that candidates may confuse the IAM credential report (which shows credential metadata) with CloudTrail (which records actual API call details), leading them to choose the credential report for investigating source IPs when it only provides static credential status, not historical usage data.

How to eliminate wrong answers

Option B is wrong because VPC Flow Logs capture network traffic at the IP level (source/destination IPs, ports, protocols) but do not log IAM user identity or access key usage; they are used for analyzing network traffic patterns, not for tracking API calls by specific IAM users. Option C is wrong because Amazon CloudWatch Logs can store log data from various sources (e.g., application logs, system logs) but does not natively capture IAM user API call details or source IPs unless custom logging is configured; it is not the primary service for auditing IAM user activity. Option D is wrong because AWS IAM credential report provides information about the status of IAM user credentials (e.g., password last used, access key age, rotation status) but does not include source IP addresses or a history of API calls; it is used for credential auditing, not for investigating specific actions or source IPs.

Full explanation →
108
MCQmedium

A company has two Amazon VPCs: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16) in the same AWS Region. The SysOps administrator needs to enable private IP connectivity between the two VPCs without using the public internet. The solution must be simple, low-cost, and provide high throughput. Which AWS service should the administrator use?

A.VPC peering
B.AWS Site-to-Site VPN
C.AWS Direct Connect
D.AWS Transit Gateway
AnswerA

VPC peering establishes a direct, private network connection between two VPCs using the AWS backbone. It is simple to set up, has low cost (no hourly fees, only data transfer charges), and provides high throughput with no bandwidth constraints.

Why this answer

VPC peering is the correct choice because it enables direct private IP connectivity between two VPCs using the AWS global network, without requiring internet gateways, VPNs, or physical connections. It is simple to set up (no additional hardware or software), low-cost (no per-hour charges, only data transfer costs), and provides high throughput (bandwidth is limited only by the instance types, not by the peering connection itself).

Exam trap

The trap here is that candidates often over-engineer the solution by choosing AWS Transit Gateway (Option D) for its advanced features, forgetting that for a simple two-VPC connection, VPC peering is the most cost-effective and straightforward option without unnecessary complexity.

How to eliminate wrong answers

Option B (AWS Site-to-Site VPN) is wrong because it requires a virtual private gateway on each VPC and an on-premises VPN endpoint, adding complexity and cost (per-hour charges) while throughput is limited by the VPN tunnel (typically up to 1.25 Gbps per tunnel). Option C (AWS Direct Connect) is wrong because it is designed for dedicated on-premises to AWS connectivity, not for VPC-to-VPC peering, and involves high cost, long provisioning times, and physical infrastructure. Option D (AWS Transit Gateway) is wrong because while it can connect multiple VPCs, it introduces additional cost (per-hour and per-GB charges) and complexity (requires transit gateway attachments and route table management) that is unnecessary for a simple two-VPC scenario.

Full explanation →
109
MCQmedium

A company runs a global e-commerce application that uses Amazon DynamoDB as its primary database. The application requires single-digit millisecond read and write latency from any region and must continue to operate during a regional outage with minimal data loss. Which DynamoDB feature should the SysOps administrator enable to meet these requirements?

A.DynamoDB Accelerator (DAX)
B.DynamoDB global tables
C.DynamoDB Point-in-Time Recovery (PITR)
D.DynamoDB Auto Scaling
AnswerB

DynamoDB global tables automatically replicate each item write to all selected AWS Regions, creating active-active replica tables with multi-region read and write capability. This cross-region replication gives users low-latency access because they can be served by a nearby replica, and it provides business continuity by allowing another Region to continue serving traffic during a Regional outage without manual data restore. Because every replica holds a full copy of the data, a Region failure is effectively transparent at the table level, assuming your application can reroute traffic.

Why this answer

DynamoDB global tables provide multi-Region, multi-active replication, enabling single-digit millisecond reads and writes from any Region while offering automatic failover and recovery during a regional outage. This feature uses DynamoDB Streams to replicate data across Regions with eventual consistency, meeting the requirement for continued operation with minimal data loss.

Exam trap

The trap here is that candidates often confuse DynamoDB Accelerator (DAX) with global tables, assuming a caching layer can provide multi-Region availability, but DAX is Region-specific and does not replicate data across Regions.

How to eliminate wrong answers

Option A is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency but does not provide multi-Region replication or write availability during a regional outage. Option C is wrong because Point-in-Time Recovery (PITR) enables backup restoration to any point within the last 35 days but does not provide real-time failover or cross-Region read/write capability. Option D is wrong because Auto Scaling adjusts provisioned throughput based on traffic but does not replicate data across Regions or ensure availability during a regional outage.

Full explanation →
110
MCQeasy

A SysOps administrator is troubleshooting an application that runs on an EC2 instance. The application is experiencing high latency, and the administrator suspects a memory leak. Which metrics should the administrator examine first?

A.Custom CloudWatch metrics published by the CloudWatch agent, such as mem_used_percent.
B.CloudWatch metrics from the Detailed Monitoring feature, such as DiskReadOps.
C.CloudWatch metrics for the instance's Elastic Network Interface.
D.CloudWatch default EC2 metrics, such as CPUUtilization and NetworkIn.
AnswerA

The CloudWatch agent runs inside the EC2 instance as an OS-level service, so it can read the guest operating system's /proc/meminfo and report memory utilization as a custom metric in the CWAgent namespace (e.g., mem_used_percent). It uses the PutMetricData API and requires an IAM role with CloudWatchAgentServerPolicy to publish metrics. Default hypervisor-level EC2 metrics never expose guest memory, which is why installing the agent is the standard way to get memory utilization in CloudWatch.

Why this answer

A memory leak causes the application to consume increasing amounts of memory over time, leading to high latency as the OS begins swapping or the kernel reclaims memory. The CloudWatch agent can publish custom metrics like `mem_used_percent`, which directly tracks memory usage percentage and is the most relevant metric to confirm a memory leak. Default EC2 metrics do not include memory utilization, so the administrator must rely on custom metrics from the CloudWatch agent.

Exam trap

The trap here is that candidates assume default EC2 metrics include memory utilization, but AWS does not provide guest OS memory metrics by default; you must install the CloudWatch agent to capture them.

How to eliminate wrong answers

Option B is wrong because DiskReadOps measures disk I/O operations, not memory usage; it would not help identify a memory leak. Option C is wrong because Elastic Network Interface metrics track network throughput and packet counts, which are unrelated to memory consumption. Option D is wrong because default EC2 metrics like CPUUtilization and NetworkIn do not include memory metrics; EC2 does not expose guest OS memory usage without the CloudWatch agent.

Full explanation →
111
MCQeasy

A company has multiple on-premises branch offices, each with a site-to-site VPN connection to a single VPC in AWS. The SysOps administrator needs to enable communication between the branch offices using the AWS cloud as a hub. Which configuration should be implemented to achieve this with the least operational overhead?

A.Configure static routes in the VPC route table pointing to each VPN connection.
B.Use dynamic routing (BGP) on all VPN connections and enable route propagation on the virtual private gateway (VGW).
C.Create a separate Transit VPC with EC2-based VPN appliances to route traffic between branch offices.
D.Place all branch offices in the same IPsec tunnel by configuring identical pre-shared keys.
AnswerB

Configuring BGP on every Site-to-Site VPN connection and enabling route propagation on the VPC route table for the virtual private gateway (VGW) allows the VGW to automatically exchange route information between all attached VPN connections. Each branch's BGP session advertises its local CIDRs, and those routes are installed into the VPC route table via route propagation, so traffic from one branch to another is forwarded through the VGW without manual entries. This is the native AWS mechanism for a hub-and-spoke setup where the VPC is the hub and branch offices are spokes, enabling dynamic, self-updating inter-branch communication.

Why this answer

Enabling dynamic routing (BGP) on all VPN connections and propagating routes from the virtual private gateway (VGW) into the VPC route table allows each branch office to learn the CIDR blocks of all other branch offices automatically. This eliminates the need for manual static route entries and ensures that traffic between branch offices is routed through the VPC hub with minimal operational overhead, as BGP handles failover and route updates dynamically.

Exam trap

The trap here is that candidates often assume static routes are simpler and sufficient for hub-and-spoke communication, overlooking that BGP route propagation on the VGW provides automated, scalable route exchange with minimal ongoing management, which is the key to reducing operational overhead.

How to eliminate wrong answers

Option A is wrong because configuring static routes in the VPC route table pointing to each VPN connection would require manual updates whenever a branch office subnet changes or a VPN connection is added/removed, increasing operational overhead and not scaling well. Option C is wrong because creating a separate Transit VPC with EC2-based VPN appliances introduces significant complexity, cost, and maintenance overhead compared to using the native VGW with BGP route propagation. Option D is wrong because placing all branch offices in the same IPsec tunnel by configuring identical pre-shared keys is not a valid configuration; each site-to-site VPN connection must have unique tunnel settings, and this approach would cause routing conflicts and security issues, not enable inter-branch communication.

Full explanation →
112
MCQeasy

Developers are allowed to create IAM roles for their Lambda functions. However, the security team is concerned that developers could create roles with Administrator access, granting Lambda functions more permissions than the developers themselves have. What IAM feature prevents privilege escalation in this scenario?

A.Attach a permission boundary to each developer IAM user that limits them to creating roles with only the permissions they are allowed to grant
B.Enable IAM Access Analyzer to detect when developers create overly permissive roles
C.Require MFA for all IAM API calls so developers must re-authenticate before creating roles
D.Enable CloudTrail logging for all IAM API calls and set up a CloudWatch alarm for iam:CreateRole events
AnswerA

The permission boundary on the developer prevents them from passing permissions they do not have (iam:PassRole with a role whose boundary exceeds their own). When combined with an IAM policy that requires any role they create to have the same boundary attached, privilege escalation is prevented systematically.

Why this answer

Permission boundaries are an IAM feature that allow you to set the maximum permissions that an identity-based policy can grant to a principal. By attaching a permission boundary to each developer IAM user that restricts them to creating roles with only the permissions they are allowed to grant, you prevent the developer from creating a Lambda execution role with AdministratorAccess or any other policy that exceeds the boundary. This directly addresses the privilege escalation concern because the boundary acts as a ceiling on the permissions the developer can delegate to the role.

Exam trap

The trap here is that candidates often confuse detective controls (like Access Analyzer, CloudTrail, or alarms) with preventive controls, thinking that monitoring or alerting can stop the action, when only a preventive mechanism like a permission boundary can block the creation of an overly permissive role at the time of the API call.

How to eliminate wrong answers

Option B is wrong because IAM Access Analyzer is a post-creation analysis tool that identifies resources shared with external principals; it does not prevent a developer from creating an overly permissive role in the first place. Option C is wrong because requiring MFA for IAM API calls adds an authentication step but does not restrict the permissions that can be assigned to a role; a developer with valid MFA could still create an AdministratorAccess role. Option D is wrong because CloudTrail logging and CloudWatch alarms are detective controls that only alert after the role has been created; they do not prevent the privilege escalation from occurring.

Full explanation →
113
MCQmedium

A SysOps administrator needs to monitor application logs stored in Amazon CloudWatch Logs for the term 'CRITICAL'. When more than 5 'CRITICAL' entries appear in a 5-minute window, the administrator wants to automatically restart the underlying Amazon EC2 instance. Which solution should the administrator implement?

A.Create a CloudWatch Logs metric filter, then a CloudWatch alarm that triggers an AWS Systems Manager Automation document to restart the instance.
B.Create a CloudWatch Logs metric filter, then a CloudWatch alarm that triggers an EC2 Reboot Instances action.
C.Create a CloudWatch Logs metric filter, then use Amazon CloudWatch Events (Amazon EventBridge) to trigger an AWS Lambda function that restarts the instance.
D.Use Amazon CloudWatch Synthetics canary to monitor the logs and automatically stop the instance.
AnswerB

A CloudWatch Logs metric filter parses each log event and publishes a custom metric whenever a 'CRITICAL' pattern is matched. A CloudWatch alarm then evaluates that metric over a specified period and, when it enters the ALARM state, can directly trigger the built-in 'Reboot Instances' EC2 action. This is the most direct and reliable solution because it uses a native CloudWatch alarm action to restart the instance, requiring no custom code, Lambda functions, or extra orchestration layers.

Why this answer

CloudWatch Logs metric filters can count occurrences of the term 'CRITICAL' in log data, and a CloudWatch alarm can be configured to trigger an EC2 Reboot Instances action directly when the metric exceeds a threshold of 5 in a 5-minute period. This provides a native, simple, and fully managed solution without requiring additional services like Lambda or Systems Manager.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing Lambda or Systems Manager, not realizing that CloudWatch alarms have a built-in EC2 action for reboot, stop, terminate, or recover, which is the simplest and most cost-effective method for this use case.

How to eliminate wrong answers

Option A is wrong because while a CloudWatch alarm can trigger an AWS Systems Automation document, the EC2 Reboot Instances action is a direct alarm target and does not require Systems Manager Automation, which adds unnecessary complexity and potential latency. Option C is wrong because using CloudWatch Events (EventBridge) to invoke a Lambda function to restart the instance is an over-engineered approach; the EC2 Reboot Instances action is a built-in alarm target that eliminates the need for custom code. Option D is wrong because CloudWatch Synthetics canaries are designed for synthetic monitoring of endpoints and web applications, not for analyzing existing CloudWatch Logs for specific terms like 'CRITICAL'.

Full explanation →
114
MCQeasy

A company uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. Which configuration step is required?

A.Configure the ALB listener to use HTTPS with a security policy.
B.Configure the target group to use HTTPS protocol and install SSL/TLS certificates on the instances.
C.Place the instances in a private subnet and use a NAT gateway for outbound traffic.
D.Create a security group rule that allows only HTTPS traffic from the ALB to the instances.
AnswerB

This ensures traffic from ALB to instances is encrypted over HTTPS.

Why this answer

Configuring the target group to use the HTTPS protocol ensures that the ALB encrypts traffic to the instances using SSL/TLS. The instances must have valid certificates installed to terminate the HTTPS connection. Option A is incorrect because the ALB listener handles encryption between clients and the ALB, not between the ALB and instances.

Option C is incorrect because placing instances in a private subnet and using a NAT gateway affects outbound internet access, not encryption between the ALB and instances. Option D is incorrect because a security group rule can allow only HTTPS traffic, but it does not enforce encryption; the traffic protocol must also be HTTPS.

Full explanation →
115
MCQeasy

A SysOps administrator wants to deploy a new version of an application to an existing Auto Scaling group of Amazon EC2 instances. The deployment must minimize disruption by launching new instances, performing health checks, and shifting traffic to the new instances before terminating the old ones. Which AWS CodeDeploy deployment configuration should the administrator choose?

A.Blue/green
B.Rolling
C.AllAtOnce
D.Canary
AnswerA

Blue/green in CodeDeploy for EC2 Auto Scaling groups provisions a separate, temporary 'green' replacement fleet alongside the original 'blue' fleet. After the green instances pass the configured health checks and tests, the load balancer or target group shifts production traffic from blue to green, enabling an immediate, nearly zero-downtime release. Because the blue fleet remains untouched until deployment completion, rollback is trivial: just flip traffic back and terminate green. This is the only option that both eliminates downtime and provides a built-in instant rollback path.

Why this answer

The blue/green deployment configuration in AWS CodeDeploy is designed to minimize disruption by provisioning a new set of instances (green environment), performing health checks against them, and then shifting traffic from the old instances (blue environment) to the new ones before terminating the old instances. This matches the requirement of launching new instances, health-checking, and shifting traffic before termination, which is not possible with in-place deployment types like rolling or all-at-once.

Exam trap

The trap here is that candidates often confuse 'rolling' with 'blue/green' because both involve gradual updates, but rolling updates modify the existing Auto Scaling group in-place without creating a separate environment or shifting traffic before termination.

How to eliminate wrong answers

Option B (Rolling) is wrong because it performs an in-place update by gradually replacing instances within the existing Auto Scaling group without creating a separate environment, so traffic is not shifted before termination and health checks occur on the same instances. Option C (AllAtOnce) is wrong because it deploys to all instances simultaneously in-place, causing full downtime or disruption during the update. Option D (Canary) is wrong because it is a traffic-shifting pattern used in AWS CodeDeploy for Lambda or ECS deployments, not for EC2 Auto Scaling groups, and it does not launch new instances in a separate environment.

Full explanation →
116
MCQeasy

A production RDS MySQL database stores financial records. The team needs the ability to restore the database to any point within the last 7 days in case of accidental data deletion. Automated backups are currently disabled. What must be configured?

A.Enable automated backups and set the backup retention period to 7 days
B.Create a manual DB snapshot every night using the AWS CLI on a schedule
C.Enable Multi-AZ to maintain a synchronous standby replica in a second Availability Zone
D.Enable RDS read replicas and promote one if data deletion occurs
AnswerA

Automated backups with a 7-day retention period keep daily snapshots and transaction logs for 7 days. Any point within the retention window is recoverable. Transaction logs allow recovery to any 5-minute interval within that window. Setting the period to 0 disables automated backups and PITR entirely.

Why this answer

To restore an RDS MySQL database to any point within the last 7 days, you must enable automated backups and set the backup retention period to 7 days. Automated backups enable point-in-time recovery (PITR), which allows restoration to any second within the retention window using binary logs. Without automated backups, RDS cannot perform PITR, even if manual snapshots exist.

Exam trap

The trap here is that candidates often confuse manual snapshots with automated backups, not realizing that only automated backups enable point-in-time recovery, while manual snapshots are static and cannot be used for granular restoration.

How to eliminate wrong answers

Option B is wrong because manual DB snapshots capture only a single point in time and do not provide the continuous binary log data needed for point-in-time recovery to any arbitrary moment within 7 days. Option C is wrong because Multi-AZ provides high availability and automatic failover, but it does not create backups or enable point-in-time recovery; it only maintains a synchronous standby replica. Option D is wrong because RDS read replicas are designed for read scaling and, while they can be promoted to a standalone instance, they do not provide point-in-time recovery capabilities and rely on the same backup configuration as the source instance.

Full explanation →
117
MCQeasy

Refer to the exhibit. A SysOps Administrator runs the above command and sees that an EC2 instance is unhealthy. The health check is configured to check the HTTP endpoint '/health' on port 80. The instance's security group allows inbound HTTP traffic from the ALB's security group. What is the MOST likely cause?

A.The instance is not associated with the target group.
B.The application on the instance is not configured to respond to the '/health' path.
C.The target group is configured to use port 8080 instead of port 80.
D.The security group on the instance does not allow inbound traffic from the ALB.
AnswerB

Correct. The health check endpoint '/health' is not properly handled by the application, causing the health check to fail.

Why this answer

The health check path is '/health', but the application on the instance might not have that endpoint configured, causing the health check to fail. Option A is incorrect because the instance is associated with the target group; otherwise it would not appear in the health check results. Option C is incorrect because the target group is configured to use port 80, as stated in the scenario.

Option D is incorrect because the security group on the instance does allow inbound HTTP traffic from the ALB's security group, as stated in the scenario.

Full explanation →
118
MCQhard

A SysOps administrator is configuring an Application Load Balancer to route traffic to multiple target groups based on the URL path. The ALB is not routing traffic correctly. Which listener rule configuration should be used to route requests with path /api/* to target group A and all other requests to target group B?

A.Create a rule with a host header condition matching 'api.example.com' and forward to target group A, and a default rule forward to target group B.
B.Create one rule with a condition that matches /api/* and forward to target group A, and another condition in the same rule for /* to forward to target group B.
C.Create a rule with path pattern /api/* and forward to target group A with priority 10, and a default rule with path pattern /* and forward to target group B with priority 20.
D.Create two rules with path patterns /api/* and /*, and set priority based on the pattern length.
AnswerC

Correct. Path pattern /api/* matches requests starting with /api/, and the default rule with /* catches all others. Priority determines evaluation order; higher priority rules are evaluated first.

Why this answer

The ALB listener rules are evaluated in order; the first rule with a path pattern /api/* will match, and then a default rule (catch-all) is needed for all other paths. Option A is incorrect because order is not automatically prioritized by pattern. Option B is incorrect because a single rule cannot have two conditions with different paths to different target groups.

Option D is incorrect because while both rules with path patterns are valid, the priority must be explicitly set; the ALB does not automatically prioritize based on pattern length.

Full explanation →
119
MCQhard

An application running on EC2 instances behind an Application Load Balancer (ALB) sends custom metrics to CloudWatch. The team wants to set an alarm that triggers when the error rate exceeds 5% over a 5-minute period. The alarm must evaluate the metric every minute. Which configuration is required?

A.Period = 300 seconds, Statistic = Average, Evaluation Periods = 1, Datapoints to Alarm = 1
B.Period = 300 seconds, Statistic = Sum, Evaluation Periods = 1, Datapoints to Alarm = 1
C.Period = 60 seconds, Statistic = Average, Evaluation Periods = 5, Datapoints to Alarm = 5
D.Period = 60 seconds, Statistic = Sum, Evaluation Periods = 5, Datapoints to Alarm = 5
AnswerC

This checks that all 5 datapoints exceed 5% over 5 minutes.

Why this answer

The alarm must evaluate the error rate every minute (period = 60 seconds) over a 5-minute window. With evaluation periods = 5 and datapoints to alarm = 5, the alarm requires all five 1-minute datapoints to exceed the 5% threshold, ensuring the error rate is sustained for the full 5-minute period. The Average statistic is appropriate because the error rate is a percentage metric that should be averaged over each period.

Exam trap

The trap here is that candidates often confuse 'period' with the total evaluation window, selecting period = 300 seconds (option A or B) thinking it covers the 5-minute window, but this fails the requirement to evaluate every minute, and they may also incorrectly choose Sum instead of Average for a percentage metric.

How to eliminate wrong answers

Option A is wrong because period = 300 seconds means the metric is evaluated only once every 5 minutes, not every minute as required, and evaluation periods = 1 would trigger the alarm on a single 5-minute datapoint, not a sustained condition. Option B is wrong because period = 300 seconds again fails the 1-minute evaluation requirement, and using Sum for a percentage metric would incorrectly aggregate error counts rather than averaging the rate. Option D is wrong because while period = 60 seconds and evaluation periods = 5 are correct, using Sum instead of Average would sum the error rate values across datapoints, which is meaningless for a percentage metric and would not correctly reflect the 5% threshold.

Full explanation →
120
MCQeasy

Refer to the exhibit. An IAM policy is attached to an IAM user. Which action can the user perform?

A.Start an EC2 instance.
B.Describe EC2 instances.
C.Stop an EC2 instance.
D.Terminate an EC2 instance.
AnswerC

StopInstances is explicitly allowed and not denied.

Why this answer

The IAM policy grants the ec2:StopInstances action, which allows the user to stop EC2 instances. The condition restricts the action to instances with a specific tag, but the core permission is for stopping instances, making option C correct.

Exam trap

The trap here is that candidates may confuse the ec2:StopInstances action with ec2:TerminateInstances, as both involve changing instance state, but only StopInstances is granted in the policy.

How to eliminate wrong answers

Option A is wrong because the policy does not include ec2:RunInstances, which is required to start a new EC2 instance. Option B is wrong because the policy does not include ec2:DescribeInstances, which is needed to list or describe EC2 instances. Option D is wrong because the policy does not include ec2:TerminateInstances, which is required to terminate an EC2 instance.

Full explanation →
121
Drag & Dropmedium

Drag and drop the steps to configure an Amazon Route 53 failover routing policy into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Create health checks first, then create primary and secondary records with failover types, then test.

Full explanation →
122
MCQeasy

A SysOps administrator needs to deploy an application to a set of EC2 instances in an Auto Scaling group. The deployment must be performed in batches, with each batch health-checked before proceeding. Which AWS CodeDeploy deployment configuration should be used?

A.CodeDeployDefault.OneAtATime
B.CodeDeployDefault.AllAtOnce
C.CodeDeployDefault.HalfAtATime
D.CodeDeployDefault.Custom
AnswerA

OneAtATime deploys to one instance at a time, with health checks between each.

Why this answer

CodeDeployDefault.OneAtATime is the correct deployment configuration because it deploys the application revision to one EC2 instance at a time, waiting for the instance to pass health checks before proceeding to the next. This ensures that the deployment is performed in batches of one, with each batch health-checked before moving on, which aligns with the requirement for batch-based, health-checked deployments.

Exam trap

The trap here is that candidates often confuse 'HalfAtATime' with a batch-based approach, but it does not health-check each individual instance before proceeding to the next batch; it only checks the overall health of the fleet after each batch, which can mask failures in specific instances.

How to eliminate wrong answers

Option B (CodeDeployDefault.AllAtOnce) is wrong because it deploys to all instances simultaneously, which does not perform health checks between batches and violates the requirement for batch-based deployment. Option C (CodeDeployDefault.HalfAtATime) is wrong because it deploys to half the instances at a time, but it does not health-check each individual batch before proceeding; it only checks overall success after the batch completes, which may not meet the strict per-batch health-check requirement. Option D (CodeDeployDefault.Custom) is wrong because it is not a predefined configuration; it requires manual creation of a custom deployment configuration, which is unnecessary when a predefined configuration meets the requirement.

Full explanation →
123
MCQhard

An organization uses AWS Systems Manager to manage a fleet of EC2 instances. The SysOps administrator needs to run a script on all instances that have a specific tag (Environment: Production). The script must be executed immediately and only once. Which approach should be used?

A.Use Patch Manager to apply the script as a patch baseline.
B.Create an Automation document and execute it.
C.Use Run Command with a target based on the tag.
D.Create a State Manager association with the script.
AnswerC

Run Command's SendCommand API accepts a target that can be a tag key-value pair, like tag:Environment=Production, and every SSM agent that matches will execute the AWS-RunShellScript or AWS-RunPowerShellScript document immediately in a one-time, unmanaged fashion. This satisfies the requirement of running a script once across the fleet, with output optionally streamed to S3 or CloudWatch Logs for auditing. Because no association, schedule, or patch baseline is involved, it is the simplest and most direct SSM primitive for this task.

Why this answer

Run Command enables you to run commands on EC2 instances immediately and only once, using tags to target specific instances. Option A is incorrect because Patch Manager is designed for applying patches, not running arbitrary scripts. Option B is incorrect because Automation documents are for multi-step workflow orchestration, not simple one-time script execution.

Option D is incorrect because State Manager is for recurring configurations or ensuring a desired state over time, not immediate one-time execution.

Full explanation →
124
MCQhard

A company uses AWS CloudTrail to log API activity. The security team needs to be alerted when an IAM user creates a new access key. Which combination of services should the SysOps administrator use to meet this requirement?

A.CloudWatch Logs Insights query on CloudTrail logs with an alarm
B.An AWS Config rule that checks for new access keys and sends an SNS notification
C.A CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification
D.S3 event notifications to an SNS topic
AnswerC

Amazon EventBridge (formerly CloudWatch Events) can consume CloudTrail events as a built-in event source, so a rule with an event pattern tailored to `AWS API Call via CloudTrail` and `eventName` `CreateAccessKey` fires whenever that API is invoked. The rule can target an SNS topic as the action, delivering a near-real-time notification that includes the full event detail such as the IAM user, source IP, and user agent. This is the direct, native mechanism for alerting on specific API calls.

Why this answer

CloudWatch Events (now Amazon EventBridge) can match CloudTrail events (like CreateAccessKey) and trigger an SNS notification. Option A is wrong because CloudWatch Logs Insights is a query tool for analyzing logs, not a real-time alerting mechanism; although metric filters and alarms can be set up, CloudWatch Events provides a more direct solution. Option B is wrong because AWS Config rules evaluate resource configurations and compliance, not real-time API calls.

Option D is wrong because S3 event notifications trigger on object-level events in S3 buckets, not on specific API calls within CloudTrail logs.

Full explanation →
125
MCQmedium

A company uses S3 to store sensitive data. To meet compliance requirements, all S3 buckets must be encrypted at rest. The security team notices that some objects in a bucket are not encrypted. What is the MOST efficient way to enforce encryption for all future objects?

A.Use AWS Config managed rule to identify unencrypted objects and re-upload them manually
B.Use S3 Inventory to list unencrypted objects and apply encryption via S3 Batch Operations
C.Enable default encryption on the bucket using AES-256
D.Create an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption header is not present
AnswerD

Bucket policy enforces encryption at upload time, rejecting unencrypted requests.

Why this answer

A bucket policy that denies PutObject unless the `x-amz-server-side-encryption` header is present enforces encryption at the API level, preventing any unencrypted object from being uploaded. This is the most efficient approach as it proactively blocks non-compliant uploads without requiring post-upload remediation or manual intervention.

Exam trap

The trap here is that candidates confuse default encryption (which is a bucket-level setting that can be overridden by the client) with a bucket policy (which enforces encryption at the request level and cannot be bypassed by the uploader).

How to eliminate wrong answers

Option A is wrong because AWS Config managed rules can detect unencrypted objects but cannot re-upload them; manual re-upload is inefficient and does not prevent future violations. Option B is wrong because S3 Inventory lists objects but S3 Batch Operations apply encryption to existing objects, not to future uploads, and this is a reactive, not proactive, solution. Option C is wrong because enabling default encryption on the bucket applies server-side encryption only when the upload request does not specify encryption headers; a client can still override or omit the header and upload unencrypted objects, bypassing the default.

Full explanation →
126
MCQmedium

A company uses AWS CloudFormation to deploy its infrastructure. The SysOps administrator needs to ensure that the application stack can be recreated in another AWS Region in the event of a disaster. The stack includes an RDS MySQL database and an EC2 instance running a web server. The administrator wants to automate the backup of the RDS database and the EC2 instance configuration. What is the MOST efficient way to achieve this?

A.Use S3 to store database dump files and instance configuration scripts.
B.Create manual snapshots of the RDS database and EC2 instance every day and copy them to the secondary region.
C.Store the CloudFormation template in S3 and use it to recreate the stack in the secondary region.
D.Use AWS Backup to create backup plans that include the RDS instance and EC2 instance, and copy backups to the secondary region.
AnswerD

AWS Backup provides a fully managed, policy-based backup solution that can target both RDS instances and EC2 instances (via Amazon Machine Images) within a single backup plan. You can schedule automated backups, apply retention and lifecycle policies, and configure cross-region replication to the secondary region, ensuring consistent disaster recovery without custom scripting or manual snapshots. This is the most efficient and reliable approach because it centralizes backup management and automates the entire DR copy process.

Why this answer

AWS Backup provides a centralized, automated backup service that can back up RDS databases (with automated backups) and EC2 instances (via AMIs). It supports cross-region copy, making it ideal for disaster recovery. Option A is wrong because storing database dump files and scripts in S3 is not a fully automated or integrated solution; it requires custom scripting and does not capture incremental changes efficiently.

Option B is wrong because manual snapshots require manual intervention and are not automated. Option C is wrong because the CloudFormation template only captures infrastructure configuration, not the database data or EC2 instance state.

Full explanation →
127
MCQhard

A company operates a web application behind an Application Load Balancer (ALB). The SysOps administrator needs to block incoming requests from specific geographic locations (countries X and Y) and also enforce a rate limit of 100 requests per IP address per 5-minute window to mitigate DDoS attacks. The solution must be centrally configured and apply to all requests handled by the ALB. Which AWS service should be used to implement these requirements?

A.AWS WAF
B.Amazon CloudFront geo restriction
C.AWS Shield Advanced
D.Security Groups
AnswerA

AWS WAF offers both geo-match conditions to block requests from specific countries and rate-based rules to limit request rates from an IP address. It integrates directly with ALB and provides a single, centrally managed solution.

Why this answer

AWS WAF is the correct service because it provides both geographic (geo-match) blocking and rate-based rules that can be associated directly with an Application Load Balancer. Geo-match conditions allow you to block requests from specific countries (X and Y), while rate-based rules can limit requests to 100 per 5-minute window per source IP. This solution is centrally configured at the ALB level, applying to all incoming requests without requiring additional infrastructure.

Exam trap

The trap here is that candidates often confuse AWS WAF with CloudFront geo restriction or AWS Shield Advanced, not realizing that only WAF provides both geo-blocking and rate-based rules that can be directly associated with an ALB without requiring CloudFront.

How to eliminate wrong answers

Option B (Amazon CloudFront geo restriction) is wrong because CloudFront geo restriction only works when CloudFront is the front-end service, not directly with an ALB; it cannot be applied to an ALB alone and does not support rate limiting. Option C (AWS Shield Advanced) is wrong because while it provides enhanced DDoS protection and cost protection, it does not offer granular geo-blocking or configurable rate-based rules; it is a managed threat protection service, not a web application firewall. Option D (Security Groups) is wrong because security groups operate at the network layer (Layer 3/4) and cannot inspect application-layer attributes like geographic origin or enforce rate limits based on HTTP request counts.

Full explanation →
128
MCQmedium

A company has an S3 bucket policy as shown. A developer tries to upload an object using the AWS CLI without the --no-verify-ssl flag. What will happen?

A.The upload will succeed only if the developer uses HTTP.
B.The upload will fail because the policy denies all s3:* actions.
C.The upload will fail because the policy requires explicit HTTPS.
D.The upload will succeed because the CLI uses HTTPS by default.
AnswerD

The bucket policy allows s3:PutObject only when the request is made over a secure transport, as captured by the aws:SecureTransport condition key. The AWS CLI uses the HTTPS endpoint by default, so the request's SecureTransport value is true and the Allow branch applies. Consequently the upload is authorized and completes successfully.

Why this answer

The bucket policy denies requests that do not use secure transport (HTTP) but allows HTTPS requests. The AWS CLI uses HTTPS by default, and since the developer did not use --no-verify-ssl, the request is made over HTTPS. Therefore, the upload succeeds.

Option D is correct. Option A is incorrect because the CLI uses HTTPS, not HTTP. Option B is incorrect because the policy does not deny all s3:* actions; it only denies requests over HTTP.

Option C is incorrect because the policy requires HTTPS, and the CLI complies, so the upload does not fail.

Full explanation →
129
MCQmedium

A company runs an e-commerce application on Amazon EC2 instances behind an Auto Scaling group. The application has a predictable baseline load from 8 AM to 8 PM daily and low load overnight. The SysOps administrator wants to optimize costs while ensuring sufficient capacity for the baseline load. Which purchasing option and scaling strategy should the administrator use?

A.Use On-Demand instances for the baseline and Spot Instances for any additional capacity.
B.Use Reserved Instances for the predicted baseline and On-Demand for any unexpected spikes.
C.Use Dedicated Hosts for all instances to maximize cost savings.
D.Use Spot Instances for all instances to minimize costs.
AnswerB

Reserved Instances should back the predictable baseline because they offer a substantial discount (up to 72% compared to On-Demand) for a commitment you know you will use, while On-Demand covers unexpected spikes without requiring a long-term contract. This combination minimizes cost on the steady-state load while retaining the flexibility to launch extra capacity at any moment, and it avoids the interruption risk of Spot for the mission-critical spikes.

Why this answer

Reserved Instances provide a significant discount (up to 72%) over On-Demand for predictable, steady-state workloads like the 8 AM to 8 PM baseline. On-Demand instances then cover any unexpected spikes without requiring upfront commitment, ensuring cost optimization while maintaining capacity for the predictable load.

Exam trap

The trap here is that candidates assume Spot Instances are always the cheapest option, but they fail to recognize that the predictable baseline load requires guaranteed availability, which Spot Instances cannot provide due to potential interruptions.

How to eliminate wrong answers

Option A is wrong because Spot Instances can be interrupted with a 2-minute warning when AWS needs capacity back, making them unsuitable for a baseline load that must be reliably available during business hours. Option C is wrong because Dedicated Hosts are a physical server dedicated to your use, which is far more expensive than Reserved Instances and provides no cost optimization benefit for a standard e-commerce application that does not require license compliance or physical isolation. Option D is wrong because Spot Instances are not suitable for all instances due to their potential for interruption, which would cause the application to fail during the predictable baseline load.

Full explanation →
130
MCQmedium

A company uses AWS CodePipeline to deploy a web application. The pipeline includes a stage that runs a database migration script. The SysOps administrator wants to ensure that if the migration script fails, the entire pipeline stops and the previous version of the application remains deployed. Which pipeline stage configuration should be used to achieve this behavior?

A.Use a parallel action group for the migration step so other steps continue.
B.Configure the migration step as a sequential action and set the OnFailure to ABORT.
C.Configure the migration step as a sequential action and set the OnFailure to ROLLBACK.
D.Use a manual approval step after the migration to verify success.
AnswerB

Configuring the migration step as a sequential action with OnFailure set to ABORT causes CodePipeline to immediately stop the pipeline execution when that action fails, without running any subsequent actions or stages. The existing deployment remains untouched because no further deployment stages are triggered after the failure. This matches the requirement precisely: the pipeline halts and the prior version stays in place.

Why this answer

Setting the migration step as a sequential action with OnFailure set to ABORT ensures that if the migration script fails, the pipeline immediately stops and does not proceed to any subsequent stages. This prevents the deployment of a new application version that depends on a failed database migration, thereby keeping the previous version deployed.

Exam trap

The trap here is that candidates confuse the OnFailure ROLLBACK option with a full infrastructure rollback (like AWS CloudFormation stack rollback), not realizing that CodePipeline's ROLLBACK only affects the pipeline execution state and does not automatically revert the deployed application or database changes.

How to eliminate wrong answers

Option A is wrong because using a parallel action group would allow other steps to continue even if the migration fails, which contradicts the requirement to stop the entire pipeline and preserve the previous deployment. Option C is wrong because setting OnFailure to ROLLBACK would attempt to revert the pipeline to a previous state, but CodePipeline does not natively support automatic rollback of deployed application versions; ROLLBACK only retries the failed action or transitions to a failed state without restoring the prior application version. Option D is wrong because a manual approval step after the migration only adds a gate to verify success but does not automatically stop the pipeline or prevent deployment if the migration fails; it relies on human intervention and does not enforce the required behavior.

Full explanation →
131
MCQmedium

A company has an Application Load Balancer (ALB) in the us-east-1 region. Users in Asia report high latency. The SysOps administrator wants to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. Which step is required to integrate Global Accelerator with the ALB?

A.Create a CloudFront distribution and point it to the ALB as an origin.
B.Configure the ALB as an endpoint group in a Global Accelerator accelerator.
C.Set up a Route 53 geoproximity routing policy for the ALB.
D.Use AWS WAF to allow traffic from Global Accelerator edge locations.
AnswerB

Global Accelerator is a networking service that provides two static anycast IP addresses at AWS edge locations and routes traffic over the AWS global network to the ALB endpoint. By adding the ALB as an endpoint in an endpoint group for the us-east-1 region, user traffic from Asia enters the AWS backbone at the nearest edge and traverses the private, low-latency AWS network instead of the congested public internet. This also brings health checking, automatic failover, and consistent performance even during internet disruptions.

Why this answer

AWS Global Accelerator uses the AWS global network to route traffic to the closest edge location, then forwards it over the AWS backbone to the ALB endpoint. To integrate, you must configure the ALB as an endpoint in an endpoint group within the accelerator, which allows Global Accelerator to direct traffic to the ALB based on proximity and health. This reduces latency for users in Asia by minimizing internet hops.

Exam trap

The trap here is that candidates often confuse Global Accelerator with CloudFront or Route 53 routing policies, assuming any CDN or DNS-based solution can achieve the same latency reduction, but Global Accelerator uniquely provides static IP addresses and optimized network pathing without caching or DNS caching delays.

How to eliminate wrong answers

Option A is wrong because CloudFront is a content delivery network (CDN) optimized for caching static and dynamic content, not for TCP/UDP traffic acceleration to an ALB; it adds unnecessary complexity and does not provide the anycast IP-based global acceleration that Global Accelerator offers. Option C is wrong because Route 53 geoproximity routing is a DNS-based routing policy that can direct users to different endpoints based on geographic location, but it does not provide the static anycast IP addresses or the optimized network path that Global Accelerator uses to reduce latency; DNS-based routing is also subject to client-side caching and does not offer the same performance improvements. Option D is wrong because AWS WAF is a web application firewall that filters HTTP/S traffic based on rules, not a mechanism to integrate or allow traffic from Global Accelerator edge locations; Global Accelerator automatically handles traffic routing without requiring WAF configuration for integration.

Full explanation →
132
MCQmedium

A security policy prohibits opening SSH port 22 on any EC2 instance. The operations team needs to run a shell script on 150 Linux instances to collect configuration inventory data. The script output must be captured for review. How should the team execute the script?

A.Use SSM Run Command with the AWS-RunShellScript document targeting all 150 instances; send output to an S3 bucket
B.Create a bastion host with SSH access and use a for loop to SSH into each instance and run the script
C.Use EC2 Instance Connect to establish a temporary SSH session for each instance and run the script
D.Terminate all instances and re-launch them from a new AMI that includes the configuration inventory already baked in
AnswerA

Run Command invocations use the SSM Agent's existing outbound HTTPS connection (port 443) — no inbound rule changes are needed. The command output for each instance is stored separately in S3, allowing the team to review per-instance results. Commands can target instances by tag (e.g., Environment=production) to avoid listing all 150 instance IDs manually.

Why this answer

SSM Run Command with the AWS-RunShellScript document allows you to execute shell scripts on multiple EC2 instances without opening SSH port 22, as it operates over the AWS Systems Manager agent (SSM Agent) using HTTPS (port 443). The output can be directed to an S3 bucket for centralized review, satisfying both the security policy and the requirement to capture script output.

Exam trap

The trap here is that candidates may assume EC2 Instance Connect or a bastion host are acceptable workarounds, but both still rely on SSH (port 22), which is explicitly prohibited by the security policy, whereas SSM Run Command operates over HTTPS and fully complies.

How to eliminate wrong answers

Option B is wrong because it requires opening SSH port 22 on the instances or the bastion host, which directly violates the security policy prohibiting SSH access. Option C is wrong because EC2 Instance Connect still relies on SSH (port 22) to establish a temporary session, which is also prohibited by the policy. Option D is wrong because terminating and re-launching instances from a new AMI is an overly destructive and inefficient approach that does not capture runtime configuration inventory data from the existing instances.

Full explanation →
133
MCQhard

A SysOps administrator uses AWS CloudFormation to deploy infrastructure. The admin has a template that creates an EC2 instance with a custom software stack. The software stack must be installed and configured using PowerShell scripts. The admin wants to minimize operational overhead by automating the creation of an AMI that includes the software stack, and the AMI should be rebuilt on a weekly basis to include the latest security patches. Which combination of AWS services should be used?

A.Use EC2 Image Builder to define a component with the PowerShell scripts, create a recipe, and schedule a pipeline to run weekly.
B.Use AWS Systems Manager Automation to run a PowerShell script on an existing EC2 instance, then manually create an AMI each week.
C.Use AWS CodePipeline with CodeBuild to run the PowerShell scripts and create an AMI using the AWS CLI, triggered by a weekly CloudWatch Events schedule.
D.Use Amazon EC2 Auto Scaling with a lifecycle hook to run the PowerShell script on instance launch, and schedule a weekly instance refresh.
AnswerA

EC2 Image Builder is the purpose-built AWS service for producing golden AMIs. A component encapsulates the PowerShell script logic, a recipe bundles that component with a base image and OS settings, and a pipeline can be scheduled to run weekly to automatically build, validate, and register the AMI. It also supports post-build testing and cross-account/region distribution, giving a fully managed, auditable image lifecycle with minimal operational overhead.

Why this answer

EC2 Image Builder is purpose-built for automating the creation, patching, and testing of custom AMIs. By defining a component that encapsulates the PowerShell scripts, creating a recipe that references that component, and scheduling a pipeline to run weekly, the administrator achieves fully automated, repeatable AMI builds with minimal operational overhead. This directly meets the requirement for weekly rebuilds with the latest security patches.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing a multi-service orchestration (like CodePipeline + CodeBuild) when a single, purpose-built service (EC2 Image Builder) is designed exactly for this use case, leading to unnecessary complexity and operational overhead.

How to eliminate wrong answers

Option B is wrong because it requires manual intervention each week to create the AMI, which contradicts the goal of minimizing operational overhead and does not provide automation. Option C is wrong because while CodePipeline and CodeBuild can automate AMI creation, they are not the simplest or most purpose-built solution for this task; EC2 Image Builder is specifically designed for image lifecycle management, reducing complexity and maintenance. Option D is wrong because EC2 Auto Scaling with lifecycle hooks and instance refresh is designed for managing running instances and fleet updates, not for building and maintaining a golden AMI; it does not provide a mechanism to create a new AMI on a weekly schedule.

Full explanation →
134
MCQmedium

A SysOps administrator needs to monitor AWS CloudTrail logs for any calls to the 'CreateUser' API in AWS Identity and Access Management (IAM). When such an API call is detected, the administrator wants to receive a notification within a few minutes and also log the event to a central log group in Amazon CloudWatch Logs. The solution should use minimal custom code. Which combination of services should be used?

A.Configure AWS CloudTrail to deliver logs to Amazon CloudWatch Logs, create a metric filter for the 'CreateUser' API call, and set up a CloudWatch alarm that sends an Amazon SNS notification.
B.Use AWS CloudTrail with Amazon EventBridge by creating an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and set the targets to an Amazon SNS topic and a CloudWatch Logs log group.
C.Write an AWS Lambda function that is triggered by Amazon S3 events when a new CloudTrail log is delivered to S3. The Lambda parses the log file for 'CreateUser' and if found, sends an SNS notification.
D.Enable AWS Config and create a custom rule that evaluates CloudTrail trail configurations for events.
AnswerB

Amazon EventBridge natively listens for AWS service events, including CloudTrail API calls. By creating a rule with a custom event pattern that matches the specific API call, you can directly send the event to multiple targets (SNS, CloudWatch Logs, Lambda, etc.) without needing metric filters or alarms. This is the recommended low-overhead solution.

Why this answer

Amazon EventBridge can directly consume CloudTrail events in near-real time via the 'aws.cloudtrail' event source, allowing you to create a rule that matches the 'CreateUser' API call. This rule can then target both an Amazon SNS topic for immediate notification and a CloudWatch Logs log group for centralized logging, all without custom code.

Exam trap

The trap here is that candidates often assume CloudTrail-to-CloudWatch Logs delivery is the fastest method, but they overlook the inherent delivery latency and the fact that EventBridge provides a more immediate, event-driven path for real-time monitoring.

How to eliminate wrong answers

Option A is wrong because while CloudTrail can deliver logs to CloudWatch Logs, this delivery has a latency of up to 15 minutes, which does not meet the 'within a few minutes' requirement; also, metric filters and alarms operate on the delivered logs, not on the event stream. Option C is wrong because it requires custom Lambda code to parse S3-delivered CloudTrail logs, which violates the 'minimal custom code' requirement and introduces additional latency and complexity. Option D is wrong because AWS Config evaluates resource configurations, not real-time API call events; a custom Config rule cannot detect individual 'CreateUser' API calls as they occur.

Full explanation →
135
MCQmedium

A company requires that all Amazon S3 buckets in its AWS account must be encrypted using AWS KMS (SSE-KMS). The SysOps administrator needs to detect any bucket that does not have KMS encryption enabled and automatically remediate it by enabling encryption. Which AWS service should be used to implement this automated compliance enforcement?

A.AWS Config
B.AWS CloudTrail
C.Amazon GuardDuty
D.AWS Trusted Advisor
AnswerA

AWS Config can continuously monitor and evaluate S3 bucket configurations. With a managed rule for server-side encryption, it can detect non-compliant buckets. Combined with automatic remediation actions, AWS Config can enable encryption on non-compliant buckets without manual intervention.

Why this answer

AWS Config is the correct service because it can continuously monitor S3 bucket configurations against a desired encryption state using managed rules like 's3-bucket-server-side-encryption-enabled' or custom Lambda rules. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation to enable SSE-KMS encryption, enforcing compliance without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Config's detective and remediation capabilities with CloudTrail's logging or Trusted Advisor's advisory-only checks, assuming any 'security' service can enforce compliance, but only AWS Config provides automated remediation via rules and Systems Manager.

How to eliminate wrong answers

Option B is wrong because AWS CloudTrail is a service for auditing API calls and logging activity, not for detecting or remediating configuration drift in real time. Option C is wrong because Amazon GuardDuty is a threat detection service that analyzes DNS, VPC flow logs, and CloudTrail events for malicious activity, not for enforcing encryption policies on S3 buckets. Option D is wrong because AWS Trusted Advisor provides best-practice recommendations and checks for cost optimization, security, and performance, but it cannot automatically remediate non-compliant resources; it only reports findings.

Full explanation →
136
MCQhard

A SysOps administrator notices that an S3 bucket's storage costs have increased significantly. The bucket stores log files and is configured with S3 Standard storage class. Most logs are accessed only once after 30 days. Which action will reduce costs without affecting data retrieval?

A.Create a lifecycle policy to transition objects to S3 Standard-IA after 30 days.
B.Create a lifecycle policy to transition objects to S3 Glacier Deep Archive after 30 days.
C.Create a lifecycle policy to transition objects to S3 Glacier Instant Retrieval after 30 days.
D.Create a lifecycle policy to transition objects to S3 One Zone-IA after 30 days.
AnswerC

S3 Glacier Instant Retrieval reduces storage cost while maintaining millisecond access.

Why this answer

Transitioning to S3 Glacier Instant Retrieval after 30 days reduces storage cost while maintaining millisecond access. Option A is wrong because S3 Standard-IA has retrieval fees that might increase cost for single access. Option B is wrong because S3 Glacier Deep Archive has long retrieval times (hours), making it unsuitable for logs that may need to be accessed occasionally.

Option D is wrong because S3 One Zone-IA is less durable (does not replicate across AZs) and may not be appropriate for log data.

Full explanation →
137
MCQeasy

A company hosts a static website on Amazon S3. Users access the website from around the world. The SysOps administrator needs to deliver content with low latency and support HTTPS with a custom domain. Which AWS service should be used?

A.AWS Global Accelerator
B.Amazon CloudFront
C.Amazon Route 53 latency-based routing
D.S3 Transfer Acceleration
AnswerB

CDN with edge caching, HTTPS, and custom domain support.

Why this answer

Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for global users. It natively supports HTTPS with custom domains via SSL/TLS certificates from AWS Certificate Manager (ACM) and integrates with S3 as an origin. This combination of low-latency delivery and HTTPS termination makes CloudFront the correct choice for this scenario.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator with CloudFront because both improve performance, but Global Accelerator does not cache content or terminate HTTPS for static websites, making it unsuitable for this use case.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves TCP/UDP traffic performance using the AWS global network but does not cache content or terminate HTTPS for static website delivery; it is designed for dynamic applications, not static content caching. Option C is wrong because Amazon Route 53 latency-based routing only directs DNS queries to the region with the lowest latency, but it does not cache content or provide HTTPS termination; the origin S3 bucket would still serve content directly without edge caching. Option D is wrong because S3 Transfer Acceleration speeds up uploads to S3 using edge locations, but it does not cache content for downloads, does not support custom domain HTTPS, and is intended for large object uploads, not global static website delivery.

Full explanation →
138
Multi-Selectmedium

A company is designing a backup strategy for its on-premises file servers to AWS. Which TWO services can be used to back up data to AWS? (Choose TWO.)

Select 2 answers
A.AWS Backup
B.AWS Snowball
C.AWS Storage Gateway (File Gateway)
D.Amazon EFS
E.S3 Transfer Acceleration
AnswersA, C

AWS Backup is the correct answer because it natively supports backing up on-premises workloads via the AWS Backup Gateway, which connects your on-premises virtual machines to AWS Backup. This service allows you to define backup policies, retention rules, and lifecycle management in a single place, covering both cloud and on-premises resources. Unlike simple data replication or file syncing tools, AWS Backup provides a centralized, scheduled, and auditable backup solution that ensures recoverability of on-premises VMs.

Why this answer

AWS Backup is correct because it provides a fully managed, policy-based backup service that can centrally automate and manage backups for on-premises file servers via the AWS Backup Gateway (formerly Storage Gateway Virtual Tape Library). It integrates with AWS Storage Gateway to back up on-premises data to S3 and Glacier, supporting file-level recovery without needing custom scripts.

Exam trap

The trap here is that candidates confuse data transport services (Snowball) or storage targets (EFS) with backup services, or mistake a performance feature (S3 Transfer Acceleration) for a backup solution, when the question specifically asks for services that can be used to back up data to AWS.

Full explanation →
139
MCQeasy

A company runs 200 EC2 Linux instances across three accounts. The security team requires that critical OS patches are applied automatically every Sunday at 2 AM UTC. Currently patches are applied manually and inconsistently. What is the recommended AWS-native solution?

A.Configure a Patch Manager patch baseline and maintenance window scheduled for Sunday 02:00 UTC; associate the Run Patch Baseline task with all EC2 instance targets
B.Create a cron job on each instance that runs 'yum update -y' every Sunday at 2 AM
C.Use AWS Config managed rules to detect unpatched instances and send SNS notifications for manual remediation
D.Build a CodePipeline that runs weekly, creates new AMIs with the latest patches, and replaces all instances via an Auto Scaling instance refresh
AnswerA

The patch baseline filters patch approvals by severity (e.g., CRITICAL, IMPORTANT). The maintenance window triggers the AWS-RunPatchBaseline SSM document on schedule. All 200 instances receive the same baseline and schedule, replacing manual inconsistency with automated consistency. Patch compliance is recorded in the Patch Manager compliance dashboard.

Why this answer

AWS Systems Manager Patch Manager, combined with a Maintenance Window, provides a fully AWS-native, automated solution for patching EC2 instances on a schedule. The Patch Manager service uses a patch baseline to define which patches are approved (e.g., critical OS patches), and the Maintenance Window triggers the 'AWS-RunPatchBaseline' SSM document at the specified time (Sunday 02:00 UTC) against all targeted instances. This eliminates manual effort and ensures consistent, auditable patching across multiple accounts and instances.

Exam trap

The trap here is that candidates may choose Option D (AMI refresh) because it seems more 'complete' for patching, but they overlook that Patch Manager with Maintenance Windows is the simplest, most direct AWS-native solution for scheduled patching, and the question explicitly asks for the 'recommended' solution, not the most elaborate one.

How to eliminate wrong answers

Option B is wrong because it requires manual creation and maintenance of cron jobs on each instance, which is not a centralized, AWS-native solution and does not scale across 200 instances and three accounts; it also lacks auditing and compliance tracking. Option C is wrong because AWS Config rules can only detect unpatched instances and send notifications, but they do not automatically apply patches, leaving remediation to manual action, which fails the requirement for automatic application. Option D is wrong because while CodePipeline and AMI refresh can achieve patching, it is an overly complex, non-native approach that requires building and maintaining a pipeline, creating new AMIs, and performing instance refreshes, which is not the recommended AWS-native solution for simple scheduled patching.

Full explanation →
140
MCQhard

An organization is using AWS CodeDeploy with a blue/green deployment configuration for an EC2/On-Premises compute platform. During a deployment, the new instances pass all health checks, but the old instances are not terminated after the deployment completes. What is the most likely cause?

A.The Auto Scaling group has a cooldown period that prevents termination.
B.The new instances failed the initial health check.
C.The deployment configuration specifies 'Reroute traffic to new instances and keep old instances running' with no termination.
D.The deployment was rolled back automatically.
AnswerC

Blue/green deployments can be configured to not terminate old instances automatically.

Why this answer

In AWS CodeDeploy blue/green deployments for the EC2/On-Premises compute platform, the deployment configuration determines the lifecycle of the original (old) instances. Option C is correct because the deployment configuration explicitly specifies 'Reroute traffic to new instances and keep old instances running' with no termination, which instructs CodeDeploy to leave the old instances running after traffic is rerouted. This behavior is controlled by the deployment group's configuration, not by Auto Scaling or health check failures.

Exam trap

The trap here is that candidates assume old instances are always terminated after a successful blue/green deployment, overlooking the deployment configuration option that explicitly allows keeping old instances running with no termination.

How to eliminate wrong answers

Option A is wrong because Auto Scaling cooldown periods prevent scaling activities, not CodeDeploy's termination of old instances in a blue/green deployment; CodeDeploy manages instance termination independently via its own lifecycle hooks. Option B is wrong because the question states that new instances pass all health checks, so a failed initial health check is not applicable. Option D is wrong because a rollback would revert the deployment to the old instances, not leave the old instances running alongside the new ones; the scenario describes old instances not being terminated, not a rollback.

Full explanation →
141
MCQmedium

A SysOps administrator is troubleshooting slow application performance. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Amazon CloudWatch metrics show that the average CPU utilization across the instances is below 20%, but the application is still slow. What is the MOST likely cause of the performance issue?

A.The Auto Scaling group is scaling too aggressively, causing thrashing.
B.The Application Load Balancer has a sticky session configuration that is not distributing traffic evenly.
C.The application database is under-provisioned and is causing slow query responses.
D.The EC2 instances are using burstable performance and have exhausted their CPU credits.
AnswerC

An under-provisioned database can directly cause slow application responses while keeping EC2 CPU low because the application nodes spend most of their time blocked on database queries. Inadequate IOPS, insufficient memory for the buffer cache, or a suboptimal schema can lead to high query latency and connection queueing, which is not reflected in the web-tier CloudWatch CPU metric. The low average CPU is a classic sign of an external dependency bottleneck, making the database the most plausible root cause for the degraded user experience.

Why this answer

The most likely cause is that the application database is under-provisioned, leading to slow query responses. Even though EC2 CPU utilization is low, the application performance is bottlenecked by database latency. This is a common scenario where the database tier is the constraint, not the compute tier.

Exam trap

Candidates may assume low CPU means the compute layer is fine, but the real bottleneck could be the database tier. Don't automatically rule out downstream components.

Full explanation →
142
Multi-Selecthard

A company is using Amazon Route 53 as its DNS service. The SysOps team needs to route traffic to multiple resources based on the geographic location of the users. Which TWO routing policies can achieve this? (Select TWO.)

Select 2 answers
A.Geoproximity routing
B.Simple routing
C.Failover routing
D.Latency-based routing
E.Geolocation routing
AnswersA, E

Geoproximity routing uses the geographic location of both the user and the AWS resource to route traffic, and it supports an optional bias value that expands or shrinks the route-to-resource region. For example, you can set a positive bias to direct more traffic to a specific AWS Region, or a negative bias to move traffic away from it. This makes it ideal for gradually shifting traffic between regions while still basing routing on physical proximity.

Why this answer

The question asks for two routing policies that route traffic based on geographic location. Geoproximity routing (Option A) and Geolocation routing (Option E) are the correct choices. Geoproximity routing considers both geographic location and optional bias, while Geolocation routing uses strict geographic boundaries.

Latency-based routing (Option D) routes based on network latency, not geography, even if latency often correlates with distance. Simple routing (Option B) and Failover routing (Option C) do not use geographic information at all.

Exam trap

The question asks for two geographic routing policies, but only Geoproximity routing and Geolocation routing are based on geographic location. Candidates might mistakenly think there is a third correct option, such as latency-based routing, but that uses network latency, not geography. This can cause confusion.

Full explanation →
143
MCQmedium

A SysOps administrator is configuring a VPC with a public subnet and a private subnet. The private subnet needs to access the internet to download patches. The administrator creates a NAT Gateway in the public subnet and updates the private subnet route table. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

A.The network ACL for the private subnet blocks outbound traffic.
B.The route table for the public subnet does not have a route to an Internet Gateway.
C.The NAT Gateway does not have an Elastic IP address attached.
D.The security group associated with the NAT Gateway blocks outbound traffic.
AnswerB

This is correct: the public subnet's route table must have a route to an Internet Gateway for the NAT Gateway to send traffic to the internet.

Why this answer

The most likely cause is that the route table associated with the public subnet does not have a route to an Internet Gateway. A NAT Gateway must be placed in a public subnet, and that subnet's route table must have a default route (0.0.0.0/0) pointing to an Internet Gateway for the NAT Gateway to connect to the internet. Without this route, the NAT Gateway cannot send traffic to the internet.

Options A, C, and D are incorrect: (A) While network ACLs can impact traffic, the scenario suggests the issue is routing, not ACLs; (C) NAT Gateways do require an Elastic IP, but if the administrator created the NAT Gateway, they likely attached one; (D) Security groups do not apply to NAT Gateways, as they are managed AWS services.

Full explanation →
144
MCQmedium

A media company stores millions of video files in S3. Some files are accessed heavily after upload (when new) and rarely afterward; others are accessed unpredictably across months. The team cannot predict which files will be accessed and when. They want to minimize storage costs without risking retrieval latency penalties or per-object retrieval fees. Which storage class is appropriate?

A.Use S3 Intelligent-Tiering so objects automatically move between Frequent and Infrequent Access tiers based on access patterns, with no retrieval fees
B.Use S3 Standard-IA and configure a lifecycle policy to move objects back to Standard after every access
C.Use S3 Glacier Instant Retrieval for all objects because it offers the lowest storage cost with millisecond retrieval
D.Use S3 Standard for all objects because it has no retrieval fees and provides the best availability
AnswerA

Intelligent-Tiering handles the unpredictable access pattern automatically. Objects accessed within 30 days stay in Frequent Access. Unaccessed objects move to Infrequent Access (40 percent lower cost). No retrieval fee ensures there is no cost penalty when an old file is accessed unexpectedly. The per-object monitoring fee is offset by storage savings for objects over 128 KB.

Why this answer

S3 Intelligent-Tiering is the correct choice because it automatically moves objects between Frequent Access and Infrequent Access tiers based on changing access patterns, with no retrieval fees and no performance impact (millisecond latency). This matches the unpredictable access pattern described, as the service monitors access at the object level and adjusts storage tier without manual lifecycle rules or retrieval costs.

Exam trap

The trap here is that candidates often confuse S3 Intelligent-Tiering with S3 Standard-IA, assuming both have retrieval fees, or they incorrectly believe Glacier Instant Retrieval is always cheaper despite its retrieval fees and minimum storage duration penalties.

How to eliminate wrong answers

Option B is wrong because S3 Standard-IA charges a per-object retrieval fee (per GB retrieved) and a minimum storage duration fee (30 days), and moving objects back to Standard after every access would incur repeated retrieval fees and lifecycle transition costs, defeating cost minimization. Option C is wrong because S3 Glacier Instant Retrieval has a higher storage cost than Intelligent-Tiering for frequently accessed data and still incurs retrieval fees (per GB) for every access, plus a minimum 90-day storage charge, making it unsuitable for unpredictable access patterns. Option D is wrong because S3 Standard has the highest storage cost among the options, and while it has no retrieval fees, it does not optimize costs for files that become rarely accessed over time, leading to unnecessary expense.

Full explanation →
145
MCQhard

A company uses Amazon S3 to serve large files to users. The files are accessed frequently for the first 30 days after upload, then access drops significantly. The SysOps administrator wants to minimize storage costs while ensuring low-latency access for frequently accessed files and automatic optimization for changing access patterns. Which S3 storage class configuration should be used?

A.Use S3 Standard for 30 days, then transition to S3 Glacier Deep Archive.
B.Use S3 Intelligent-Tiering.
C.Use S3 Standard then transition to S3 Glacier Flexible Retrieval after 30 days.
D.Use S3 One Zone-IA for the first 30 days, then transition to S3 Standard-IA.
AnswerB

S3 Intelligent-Tiering is the correct choice because it automatically monitors access patterns at the object level and moves data between Frequent Access, Infrequent Access, and Archive Instant Access tiers without any retrieval fees or user action. This provides low-latency access for actively requested large files while silently reducing storage cost for objects that become cold. It is ideal for unknown, unpredictable, or changing access patterns because there is no static lifecycle rule to misjudge when data will be accessed again. A small monthly monitoring and automation fee per object applies, but it is typically negligible compared to the savings and avoids the risk of archive-tier retrieval delays.

Why this answer

S3 Intelligent-Tiering is the correct choice because it automatically moves objects between three access tiers (frequent, infrequent, and archive instant) based on changing access patterns, without any lifecycle rules or performance impact. This meets the requirement for low-latency access for frequently accessed files and automatic optimization, while minimizing storage costs as access drops after 30 days.

Exam trap

The trap here is that candidates often choose a lifecycle-based solution (like S3 Standard to Glacier) thinking it is automatic, but they overlook that lifecycle rules are static and do not adapt to changing access patterns, whereas S3 Intelligent-Tiering dynamically optimizes without manual intervention.

How to eliminate wrong answers

Option A is wrong because S3 Glacier Deep Archive has a retrieval time of 12-48 hours, which does not provide low-latency access for frequently accessed files, and it requires manual lifecycle rules rather than automatic optimization. Option C is wrong because S3 Glacier Flexible Retrieval has retrieval times of minutes to hours (typically 1-5 minutes for expedited, but with additional cost), which does not guarantee low-latency access, and it requires a lifecycle policy rather than automatic pattern adaptation. Option D is wrong because S3 One Zone-IA does not provide the durability of multiple Availability Zones and is not suitable for frequently accessed files due to retrieval costs, and transitioning to S3 Standard-IA after 30 days still requires manual lifecycle rules and does not automatically optimize for changing access patterns.

Full explanation →
146
MCQmedium

The finance team was surprised by a $12,000 spike in EC2 costs last month caused by a runaway Auto Scaling group. They want to receive an email alert within hours whenever any AWS service cost behaves unexpectedly, without manually setting fixed dollar thresholds for each service. Which AWS cost management feature provides this?

A.Enable Cost Anomaly Detection with an AWS services monitor and create an alert subscription to email the finance team when an anomaly is detected
B.Create an AWS Budget with a monthly EC2 cost threshold of $10,000 and an alert at 80 percent of the threshold
C.Enable AWS Cost Explorer and review the daily cost breakdown each morning to spot unexpected charges
D.Configure CloudWatch Billing alarms with a static threshold for each AWS service individually
AnswerA

Cost Anomaly Detection's ML model learns the historical spending pattern for each service. When EC2 (or any service) starts spending at an anomalous rate, the model detects it within hours. The alert subscription can notify via email or SNS with the anomaly amount, affected service, and percentage deviation. No manual threshold tuning is needed — the model self-calibrates.

Why this answer

Cost Anomaly Detection uses machine learning to model historical spending patterns for each AWS service and automatically detects unusual spikes without requiring manual thresholds. By creating an AWS services monitor and linking an alert subscription, the finance team receives email notifications within hours when any service deviates from its expected cost behavior, directly addressing the need for service-agnostic, threshold-free alerts.

Exam trap

The trap here is that candidates often confuse AWS Budgets or CloudWatch Billing alarms with anomaly detection, but those tools require manual static thresholds and do not automatically adapt to changing spending patterns across multiple services.

How to eliminate wrong answers

Option B is wrong because an AWS Budget with a fixed monthly EC2 cost threshold of $10,000 and an 80% alert requires manual threshold setting and only monitors EC2, not all services, and cannot detect unexpected behavior that stays under the threshold. Option C is wrong because manually reviewing AWS Cost Explorer daily is not an automated alerting mechanism and does not provide timely notification within hours of a spike. Option D is wrong because CloudWatch Billing alarms require configuring a static dollar threshold for each individual service, which is exactly what the finance team wants to avoid, and they do not adapt to changing spending patterns.

Full explanation →
147
MCQmedium

A company has an S3 bucket that stores sensitive data. The security team requires an alert whenever an object in the bucket is deleted. What is the MOST efficient way to achieve this?

A.Configure S3 access logs and stream them to CloudWatch Logs, then create a metric filter.
B.Use S3 Inventory to generate a daily report and check for deletes.
C.Enable AWS CloudTrail data events for the S3 bucket and create a CloudWatch metric filter.
D.Enable S3 event notifications and send them to Amazon EventBridge, then create a rule to publish to SNS.
AnswerD

S3 events can be sent to EventBridge with low overhead and trigger notifications.

Why this answer

S3 event notifications can be sent directly to Amazon EventBridge, which allows you to create a rule that triggers an SNS topic for real-time alerts on object deletions. This approach is the most efficient as it avoids the overhead of log analysis or polling, providing immediate notification with minimal latency.

Exam trap

The trap here is that candidates often assume CloudTrail data events (Option C) are the best for monitoring S3 operations, but they overlook the latency and cost implications, whereas S3 event notifications via EventBridge provide the most efficient real-time alerting for object deletions.

How to eliminate wrong answers

Option A is wrong because S3 access logs are delivered on a best-effort basis, typically with a delay of several hours, making them unsuitable for real-time alerting on deletions. Option B is wrong because S3 Inventory generates daily or weekly CSV reports, which are not real-time and cannot trigger immediate alerts for individual delete events. Option C is wrong because while CloudTrail data events can capture S3 object-level operations, they are not the most efficient due to the overhead of enabling data events across all objects and the potential cost of CloudTrail logs; moreover, CloudTrail logs are typically delivered with a delay of up to 15 minutes, whereas EventBridge provides near-instantaneous notification.

Full explanation →
148
MCQhard

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The security team reports that the ALB is receiving a high number of requests with suspicious User-Agent strings. The SysOps team needs to block these requests at the load balancer level without changing the application code. Which action should be taken?

A.Modify the security group of the ALB to deny traffic from User-Agent strings.
B.Update the target group health check to filter out suspicious User-Agent strings.
C.Add a listener rule on the ALB that checks the User-Agent header and returns a fixed response.
D.Deploy AWS WAF and associate it with the ALB.
AnswerC

ALB listener rules can evaluate header conditions such as User-Agent at the application layer. By configuring a rule that matches specific User-Agent patterns and setting the action to 'Return fixed response' with a 403 status, the ALB blocks those requests before they reach target instances. This approach avoids modifying application code and directly uses the ALB's built-in routing capabilities, making it the most efficient and load-balancer-level solution.

Why this answer

ALB listener rules can evaluate conditions like the User-Agent header and perform actions such as returning a fixed response, which effectively blocks requests. Option A is incorrect because security groups operate at the network layer and cannot inspect HTTP headers; they filter traffic based on IP addresses and ports. Option B is incorrect because target group health checks determine instance health and do not filter incoming requests based on headers.

Option D is incorrect because while AWS WAF can inspect headers and block requests, it is a separate service that adds complexity and cost; the question asks for an action at the load balancer level, and ALB rules provide a simpler direct solution.

Full explanation →
149
Multi-Selectmedium

A SysOps administrator is designing a highly available web application across multiple AWS regions. The application uses an Application Load Balancer in each region. Which TWO services can be used to route traffic to the closest regional load balancer based on latency?

Select 2 answers
A.AWS Global Accelerator
B.Amazon Route 53 geoproximity routing
C.Amazon Route 53 weighted routing
D.Amazon Route 53 latency-based routing
E.Amazon CloudFront with origin groups
AnswersA, D

Global Accelerator uses Anycast IPs, not latency routing.

Why this answer

For routing traffic to the closest regional load balancer based on latency, two appropriate services are AWS Global Accelerator (option A) and Amazon Route 53 latency-based routing (option D). AWS Global Accelerator uses anycast IPs to direct users to the nearest edge location, then routes traffic over the AWS global network to the closest regional load balancer, providing latency-based routing. Amazon Route 53 latency-based routing directs traffic to the AWS region with the lowest latency for the user.

Geoproximity routing (option B) routes based on geographic location, not primarily latency. Weighted routing (option C) distributes traffic by weight, and CloudFront with origin groups (option E) is for failover and content delivery, not latency-based routing.

Full explanation →
150
MCQhard

A company runs a critical stateful web application on Amazon EC2 instances in a single AWS region. The application stores user session data in an Amazon ElastiCache for Redis cluster. The SysOps administrator must design a disaster recovery (DR) strategy that can survive a complete regional outage with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The application must be able to redirect users to the DR region with minimal manual effort. Which combination of actions meets these requirements?

A.Use Amazon Route 53 with weighted routing to distribute traffic between the two regions. Use a global DynamoDB table for session data, and launch EC2 instances in the DR region only when a failure is detected using AWS CloudFormation StackSets.
B.Create a read replica of the ElastiCache Redis cluster in the DR region using the native cross-region replication feature. Use Route 53 with failover routing to point to the DR region ALB when the primary health check fails. Pre-configure EC2 instances in an Auto Scaling group in the DR region.
C.Use an Amazon CloudFront distribution with multiple origins (primary and DR). Enable session stickiness at the CloudFront level. Use EC2 instances in both regions behind separate ALBs. No special data replication is needed because sessions are stored in Redis.
D.Use EC2 instances with an Auto Scaling group in both regions. Schedule a Lambda function to take snapshots of the Redis cluster every 15 minutes and copy them to the DR region. Use Route 53 latency routing to direct users to the nearest region.
AnswerB

Global Datastore for Redis provides cross-Region replication with low RPO. Pre-configured Auto Scaling groups in the DR region ensure that compute capacity is ready. Route 53 failover routing automatically redirects traffic when the primary ALB health check fails. This combination meets the RPO and RTO requirements with minimal manual effort.

Why this answer

ElastiCache for Redis supports cross-region replication via a read replica in the DR region, which can keep session data synchronized with minimal lag, meeting the 15-minute RPO. Route 53 failover routing with health checks on the primary region's ALB automatically redirects traffic to the pre-configured DR region EC2 instances and ALB, achieving the 1-hour RTO with minimal manual effort. Pre-configuring the DR region with an Auto Scaling group ensures compute capacity is ready, while the read replica provides the required data availability.

Exam trap

The trap here is that candidates may assume snapshot-based replication (Option D) is sufficient for a 15-minute RPO, but they overlook the inherent latency and potential data loss from periodic snapshots, and that latency routing (Option D) does not provide health-based failover, while weighted routing (Option A) lacks automatic failover capability.

How to eliminate wrong answers

Option A is wrong because weighted routing does not automatically fail over during a regional outage; it distributes traffic based on weights, not health, and using a global DynamoDB table for session data is unnecessary since the application uses ElastiCache for Redis, not DynamoDB. Option C is wrong because CloudFront does not natively support session stickiness based on ElastiCache session data, and without cross-region replication of Redis, the DR region would have no session data, violating the RPO. Option D is wrong because scheduling snapshots every 15 minutes and copying them to the DR region cannot guarantee an RPO of 15 minutes due to snapshot timing and transfer delays, and latency routing does not provide automatic failover during a regional outage; it routes based on latency, not health.

Full explanation →
Page 1

Page 2 of 4

Page 3

All pages

1234

Practice SOA-C02 by domain

Target a specific domain to shore up weak areas.

Monitoring, Logging, and RemediationReliability and Business ContinuityDeployment, Provisioning, and AutomationSecurity and ComplianceNetworking and Content DeliveryCost and Performance Optimization
See all domains with question counts →