Courseiva

AWS Certified SysOps Administrator Associate SOA-C02 (SOA-C02) — Questions 151–225

247 questions total · 4pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 4

Page 4
151
MCQmedium

A company runs a stateless web application on Amazon EC2 instances in an Auto Scaling group across two Availability Zones. The SysOps administrator needs to ensure that the application can tolerate a failure of an entire Availability Zone. Which configuration is required?

A.Use an Application Load Balancer (ALB) that spans both Availability Zones with health checks enabled.
B.Enable termination protection on all Amazon EC2 instances.
C.Place the Amazon EC2 instances in a cluster placement group.
D.Associate an Elastic IP address with the primary instance.
AnswerA

An Application Load Balancer (ALB) is a regional service that spans all Availability Zones (AZs) in its subnet configuration and actively sends health-check requests to each registered target. When an EC2 instance or an entire AZ fails health checks, the ALB automatically stops routing new traffic to that target and continues serving requests from healthy instances in other AZs. Coupled with an Auto Scaling group that spans multiple AZs, this design provides both elasticity and zone-failure tolerance, because the ALB constantly updates its target membership based on instance health and scaling events.

Why this answer

An Application Load Balancer (ALB) that spans both Availability Zones with health checks enabled distributes incoming traffic across EC2 instances in multiple AZs. If an entire AZ fails, the ALB automatically routes traffic only to healthy instances in the remaining AZ, ensuring the stateless web application remains available. Health checks detect instance or AZ failure and remove unhealthy targets from the load balancer's target group, which is essential for fault tolerance.

Exam trap

The trap here is that candidates often confuse high availability with data durability or instance protection, leading them to choose termination protection or Elastic IPs, when the core requirement is automatic traffic rerouting across AZs, which only a load balancer with health checks can provide.

How to eliminate wrong answers

Option B is wrong because termination protection prevents accidental deletion of an instance but does not provide any resilience against an Availability Zone failure; it does not reroute traffic or maintain application availability. Option C is wrong because a cluster placement group is designed for low-latency, high-throughput networking within a single AZ; it actually increases the risk of simultaneous failure if that AZ goes down, as all instances are in the same AZ. Option D is wrong because associating an Elastic IP with the primary instance only provides a static public IP, which does not survive an AZ failure and does not offer automatic failover or load balancing across AZs.

Full explanation →
152
MCQhard

A company uses Amazon S3 for static website hosting. The website serves thousands of users globally, and the company wants to reduce latency and lower data transfer costs. Which solution should the SysOps administrator implement?

A.Set up Amazon CloudFront as a content delivery network (CDN) in front of the S3 bucket.
B.Use S3 Intelligent-Tiering storage class.
C.Enable cross-region replication and serve from multiple buckets.
D.Enable S3 Transfer Acceleration on the bucket.
AnswerA

CloudFront caches content at edge locations, reducing latency and data transfer costs.

Why this answer

Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations closer to users, reducing latency and lowering data transfer costs by minimizing direct requests to the S3 origin. By serving cached objects from edge locations, CloudFront also reduces the amount of data transferred from S3, which can significantly decrease S3 data transfer egress charges.

Exam trap

The trap here is that candidates confuse S3 Transfer Acceleration (which speeds up uploads) with a CDN solution for download performance, or they think cross-region replication alone solves latency without considering the need for a global caching layer.

How to eliminate wrong answers

Option B is wrong because S3 Intelligent-Tiering optimizes storage costs by moving objects between access tiers based on usage patterns, but it does not reduce latency or data transfer costs for global users. Option C is wrong because cross-region replication creates copies in multiple regions, but users still access a single bucket directly unless a routing mechanism like Route 53 latency-based routing is added, and it increases storage costs without providing edge caching benefits. Option D is wrong because S3 Transfer Acceleration uses AWS edge locations to speed up uploads to S3 over long distances, but it does not cache content for downloads or reduce latency for end users retrieving static website content.

Full explanation →
153
MCQhard

An EC2 instance runs a database on a 2 TB EBS gp3 volume. After a corruption event, the team must restore from a snapshot. When they detach the corrupted volume, attach a new volume restored from the snapshot, and start the database, performance is 10 to 20 times lower than normal for the first two hours. What causes this behavior, and what feature eliminates it?

A.Enable Fast Snapshot Restore (FSR) on the snapshot in the target Availability Zone before creating the replacement volume
B.Use a Provisioned IOPS (io2) volume type instead of gp3 to get higher IOPS during initialization
C.Run a full dd or fio pre-warm pass over the volume after attaching it but before starting the database
D.Increase the EBS volume size to 4 TB when restoring from the snapshot to get double the throughput baseline
AnswerA

FSR fully initializes the volume's block index immediately upon creation. The first I/O to any block is served from EBS at full throughput rather than waiting for lazy initialization from S3. For a 2 TB database volume where I/O latency determines restore time, FSR eliminates the 2-hour performance degradation period entirely.

Why this answer

When you create an EBS volume from a snapshot, the volume's data blocks are lazily loaded from Amazon S3 on first access. This causes high latency and low IOPS until all blocks are fetched. Fast Snapshot Restore (FSR) pre-initializes the volume in a specific Availability Zone, eliminating the need for lazy loading and providing full performance immediately.

Exam trap

The trap here is that candidates assume performance issues are due to volume type (gp3 vs io2) or size, rather than recognizing the fundamental lazy-load initialization behavior of EBS snapshots and the specific feature (FSR) designed to mitigate it.

How to eliminate wrong answers

Option B is wrong because Provisioned IOPS (io2) volumes do not eliminate the lazy-load initialization penalty; they only provide consistent IOPS after the volume is fully initialized, but the initial access still suffers from the same on-demand fetch from S3. Option C is wrong because running dd or fio pre-warms the volume manually, but this is a workaround, not a feature that eliminates the behavior, and it still requires the same time-consuming initialization process. Option D is wrong because increasing the volume size to 4 TB does not change the lazy-load behavior; it only increases the baseline throughput for the volume after initialization, but the initial performance degradation remains until all blocks are loaded.

Full explanation →
154
MCQeasy

A company's security policy requires that all IAM user passwords must be at least 12 characters long. The SysOps administrator needs to enforce this requirement across the AWS account. Which action should the administrator take?

A.Create an AWS Config rule to check password length and auto-remediate.
B.Update the IAM account password policy to require a minimum length of 12 characters.
C.Enable AWS CloudTrail to monitor for password changes and alert the administrator.
D.Attach a service control policy (SCP) that denies IAM user creation if the password is less than 12 characters.
AnswerB

The IAM account password policy is the native, preventative control that enforces password requirements at the account level for all IAM users. When you set a minimum length of 12 characters, IAM rejects any password creation or change that does not meet this threshold, ensuring compliance before the password is ever stored. This is the intended mechanism that directly satisfies the security policy requirement.

Why this answer

The IAM account password policy is the native AWS mechanism for enforcing password requirements across all IAM users in an account. By updating this policy to require a minimum length of 12 characters, the administrator ensures that any new or changed password must comply, and existing passwords are not affected until the next change. This is a direct, account-wide setting that requires no additional services or custom logic.

Exam trap

The trap here is that candidates confuse AWS Config (which can detect but not enforce password length at creation time) with the IAM password policy (which is the correct, built-in enforcement mechanism), or they mistakenly think SCPs can inspect password content when they only control API actions at a high level.

How to eliminate wrong answers

Option A is wrong because AWS Config rules can detect noncompliant passwords but cannot directly enforce password length at the point of creation or change; auto-remediation would require a custom Lambda function to modify the password policy, which is unnecessary when the native IAM password policy already exists. Option C is wrong because CloudTrail logs API calls but does not enforce password requirements; it only provides auditing after the fact, which does not prevent users from setting short passwords. Option D is wrong because service control policies (SCPs) apply to AWS Organizations and can restrict IAM user creation actions, but they cannot evaluate or enforce password length at the time of password creation or change; SCPs operate at the API level and lack the granularity to inspect password content.

Full explanation →
155
MCQeasy

Refer to the exhibit. The command returns no datapoints for CPUUtilization for the specified instance. What is the most likely reason?

A.The instance was stopped or did not emit metrics during the specified time range.
B.The metric name is incorrect.
C.The instance does not have detailed monitoring enabled.
D.The period of 300 seconds is too short.
AnswerA

If the instance is stopped, no metrics are emitted.

Why this answer

The most likely reason for no datapoints is that the instance was stopped or did not emit metrics during the specified time range. CloudWatch only retains and returns metric data when the instance is running and the CloudWatch agent or EC2 hypervisor is actively publishing CPUUtilization. If the instance was in a stopped state, no metrics are generated, resulting in an empty response from the GetMetricStatistics API call.

Exam trap

The trap here is that candidates often assume missing datapoints are due to a configuration issue (like detailed monitoring not enabled or wrong period), when in fact the instance simply wasn't running during the queried time window.

How to eliminate wrong answers

Option B is wrong because CPUUtilization is a standard EC2 metric name; if the metric name were incorrect, the API would return an error message (e.g., 'InvalidParameterValue') rather than an empty dataset. Option C is wrong because basic monitoring (5-minute granularity) still emits CPUUtilization datapoints; detailed monitoring only affects the frequency (1-minute granularity), not the existence of data. Option D is wrong because a period of 300 seconds is a valid and common value for basic monitoring (matching the default 5-minute interval) and does not cause missing datapoints.

Full explanation →
156
MCQmedium

A company uses Amazon CloudFront to deliver content from an Application Load Balancer (ALB) origin. The SysOps administrator needs to restrict access to the content so that only users from a specific geographic location can view it. Which CloudFront feature should be used?

A.Geographic restrictions (geo-blocking) in CloudFront
B.Origin Access Identity (OAI)
C.Signed URLs
D.AWS WAF web ACL associated with the CloudFront distribution
AnswerA

CloudFront's native geo-restriction feature allows you to configure an allowlist or blocklist of two-letter ISO country codes directly in the distribution's settings. When a viewer in a denied country requests content, CloudFront's edge locations reject the request with an HTTP error before it ever reaches the origin. This works at the edge, requires no code or additional AWS services, and precisely matches the requirement of restricting access by geographic location. Because this feature is built into CloudFront itself, it is the correct choice among the options.

Why this answer

CloudFront's geographic restrictions (geo-blocking) feature allows you to restrict access to content based on the geographic location of the viewer's IP address. This is the simplest and most direct method to ensure only users from a specific country or region can access the content delivered through CloudFront, without requiring any changes to the origin or additional authentication mechanisms.

Exam trap

The trap here is that candidates often confuse AWS WAF's geo-match rules with CloudFront's built-in geographic restrictions, but the question asks for a CloudFront feature, and the native geo-blocking feature is the correct, simpler answer without requiring an additional service.

How to eliminate wrong answers

Option B is wrong because Origin Access Identity (OAI) is used to restrict access to an S3 bucket origin, not to an ALB origin, and it controls access based on identity rather than geography. Option C is wrong because Signed URLs provide time-limited access to individual files for specific users, but they do not restrict access based on geographic location; they are used for authorization, not geo-blocking. Option D is wrong because while AWS WAF can be used with CloudFront to create geo-match conditions, it is an additional service that incurs extra cost and complexity; CloudFront's built-in geographic restrictions are the native, simpler solution for this requirement.

Full explanation →
157
Multi-Selectmedium

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the instances do not have the CodeDeploy agent installed. Which THREE actions are required to resolve this issue?

Select 3 answers
A.Install the CodeDeploy agent on the instances using user data in the launch configuration.
B.Create a new AMI that includes the CodeDeploy agent.
C.Use AWS Systems Manager Run Command to install the agent on existing instances.
D.Change the deployment configuration to 'OneAtATime'.
E.Update the Auto Scaling group's launch configuration to use a different instance type.
AnswersA, B, C

User data can install the agent at launch.

Why this answer

Specifying the CodeDeploy agent installation script in the user data of a launch configuration ensures that any new instance launched by the Auto Scaling group automatically installs and starts the agent. This is a common practice to bootstrap instances with the required software before they register with CodeDeploy.

Exam trap

The trap here is that candidates may confuse deployment configuration settings (like 'OneAtATime') with the fundamental requirement of having the agent installed, or think that changing the instance type will somehow resolve the agent dependency.

Full explanation →
158
MCQhard

Refer to the exhibit. A SysOps administrator has attached the bucket policy shown to an S3 bucket. Users from the IP range 192.0.2.0/24 report that they can access objects, but users from other IP ranges also report they can access objects. What is the most likely reason?

A.The bucket is not configured to use the bucket policy.
B.The bucket policy is malformed and is not being applied.
C.The Condition element in the Allow statement is incorrectly formatted.
D.The bucket ACL allows public read access, overriding the bucket policy Deny.
AnswerD

Bucket ACLs are evaluated before bucket policies, and if an ACL grants access, it can override a Deny in the policy.

Why this answer

The bucket policy shown only allows access from the 192.0.2.0/24 IP range. However, if the bucket also has a bucket ACL that grants public read access to everyone, users from other IP ranges can read objects via the ACL. Bucket policies and ACLs are evaluated independently; an Allow in the ACL can grant access even if the policy does not explicitly deny it.

Since there is no explicit Deny in the bucket policy against other IPs, the ACL's public read grant allows access from all IP ranges, overriding the intent of the policy's Allow restriction.

Full explanation →
159
MCQmedium

A SysOps administrator is updating an AWS CloudFormation stack that contains an Amazon RDS DB instance. The administrator wants to prevent accidental replacement of the database during the update. Which CloudFormation feature should be used?

A.Change sets
B.Stack policies
C.Resource signals
D.Nested stacks
AnswerB

Stack policies are JSON-based IAM-style policies attached to a CloudFormation stack that act as an explicit guard against certain update actions. By configuring a stack policy that denies the Update:Replace action for the RDS DB instance resource (using "Effect": "Deny" and "Action": ["Update:Replace"]), CloudFormation will refuse to replace the database during any stack update. This is exactly the protection the administrator needs to ensure the database is not inadvertently replaced.

Why this answer

Stack policies are the correct feature because they allow you to define explicit deny statements that prevent CloudFormation from updating or replacing specific resources, such as an RDS DB instance, during a stack update. By setting a stack policy that denies replacement actions on the database resource, the administrator ensures that even if the template changes would normally trigger a replacement, the update will fail rather than accidentally recreate the database.

Exam trap

The trap here is that candidates often confuse change sets (which only preview changes) with stack policies (which enforce guardrails), leading them to incorrectly select change sets as the mechanism to prevent accidental replacement.

How to eliminate wrong answers

Option A is wrong because change sets allow you to preview the changes that will be made to a stack before executing them, but they do not prevent the changes from being applied; they only provide visibility. Option C is wrong because resource signals are used to coordinate the creation or update of resources by sending success/failure signals (e.g., via cfn-signal), but they have no mechanism to block replacement of a specific resource. Option D is wrong because nested stacks help organize and reuse templates by embedding one stack within another, but they do not provide any resource-level protection against accidental replacement during updates.

Full explanation →
160
MCQeasy

A company wants to provide temporary credentials to an application running on an on-premises server so it can access AWS resources. The credentials must be rotated automatically. Which IAM feature should be used?

A.Use an EC2 instance profile and attach it to the on-premises server.
B.Configure a SAML 2.0 identity provider and federate the application.
C.Create an IAM user with programmatic access and share the access key.
D.Use IAM Roles Anywhere with a certificate authority to issue temporary credentials.
AnswerD

IAM Roles Anywhere enables on-premises applications to safely obtain temporary AWS credentials by presenting an X.509 certificate issued by a trusted certificate authority (CA). The service uses the certificate's subject and issuer information to match the workload to an IAM role, then calls AWS STS to return temporary credentials that automatically expire after a configurable duration. This approach eliminates the need for long-term access keys and is the recommended pattern for non-AWS servers or hybrid workloads. It is the only option listed that directly satisfies the company's need for temporary credentials for an on-premises application.

Why this answer

IAM Roles Anywhere allows workloads running outside of AWS, such as on-premises servers, to assume IAM roles and obtain temporary credentials using X.509 certificates. The credentials are automatically rotated by the service. Option A is wrong because an EC2 instance profile can only be used for EC2 instances, not on-premises servers.

Option B is wrong: SAML 2.0 federation is typically used for federating user identities (e.g., SSO), not for application or machine identities. Option C is wrong because IAM users with programmatic access have long-term access keys that do not rotate automatically.

Full explanation →
161
MCQmedium

A SysOps administrator needs to automatically restart an Amazon RDS DB instance when the 'DatabaseConnections' metric exceeds a threshold of 200 for 5 consecutive minutes. The administrator wants a solution that uses minimal custom code and leverages AWS managed services. Which combination of services should be used?

A.Amazon CloudWatch alarm with an Auto Scaling policy.
B.Amazon CloudWatch alarm with an Amazon Simple Notification Service (SNS) topic that triggers an AWS Lambda function to restart the instance.
C.Amazon CloudWatch alarm with an AWS Systems Manager Automation action.
D.Amazon RDS event subscription that triggers an AWS Lambda function.
AnswerC

CloudWatch alarms support a native 'Systems Manager Automation' action that directly invokes an SSM automation runbook, such as the pre-built AWS-RestartRDSInstance runbook, when the alarm enters an alarm state. This runbook encapsulates the RDS reboot API call and includes appropriate wait/verify steps, all without requiring you to write or maintain any custom code. The integration is purpose-built for metric-driven remediation and is the minimal-effort, fully managed way to automatically restart an RDS DB instance.

Why this answer

AWS Systems Manager Automation provides a built-in 'AWSSupport-StartRDSInstance' or 'AWSSystemsManager-RestartRDSInstance' runbook that can be triggered directly by a CloudWatch alarm action, requiring no custom code. This leverages a managed service to restart the RDS instance automatically when the 'DatabaseConnections' metric exceeds 200 for 5 consecutive minutes, meeting the minimal custom code requirement.

Exam trap

The trap here is that candidates often assume a Lambda function is always required for custom remediation actions, but AWS Systems Manager Automation provides a no-code alternative for many common operations like restarting RDS instances, which directly meets the 'minimal custom code' constraint.

How to eliminate wrong answers

Option A is wrong because Auto Scaling policies are designed to scale EC2 instances or other Auto Scaling group resources, not to restart RDS instances; they cannot directly trigger a database restart. Option B is wrong because while it uses a Lambda function to restart the instance, it introduces custom code (the Lambda function logic) which violates the 'minimal custom code' requirement. Option D is wrong because RDS event subscriptions are for notification of events like instance creation or failure, not for triggering automated remediation based on CloudWatch metric thresholds; they lack the direct integration with CloudWatch alarms needed for this metric-based condition.

Full explanation →
162
MCQeasy

A security team applied Network ACL rules to a subnet to allow inbound TCP traffic on port 443 (HTTPS). Users connecting from the internet can initiate connections, but they never receive responses. The NACL is applied to the subnet containing the web servers. What is missing?

A.Add an outbound NACL rule allowing TCP on destination ports 1024–65535 to permit response traffic to clients' ephemeral ports
B.Enable stateful packet inspection on the NACL by toggling the 'track connections' setting in the VPC console
C.Add a security group outbound rule allowing all traffic because NACL rules only apply to inbound traffic
D.Change port 443 to allow both TCP and UDP protocols in the inbound NACL rule
AnswerA

Ephemeral ports are the temporary high-numbered ports clients open for receiving responses. Because NACLs are stateless, return traffic must be explicitly allowed by an outbound rule. The rule 'Allow TCP outbound to 0.0.0.0/0 on ports 1024–65535' covers all client ephemeral port ranges and allows the web server's responses to flow back to the client.

Why this answer

Network ACLs are stateless, meaning they evaluate each packet independently without tracking connection state. While the inbound rule allows HTTPS traffic (TCP 443) to reach the web servers, the outbound response traffic from the servers to the clients' ephemeral ports (typically 1024–65535) is blocked by the default deny-all outbound rule. Adding an outbound NACL rule allowing TCP traffic on destination ports 1024–65535 permits the response traffic to flow back to the clients, resolving the issue.

Exam trap

The trap here is that candidates often confuse stateless NACLs with stateful security groups, assuming that allowing inbound traffic automatically permits outbound responses, when in fact NACLs require explicit outbound rules for return traffic.

How to eliminate wrong answers

Option B is wrong because NACLs are inherently stateless and do not support a 'track connections' setting; stateful packet inspection is a feature of security groups, not NACLs. Option C is wrong because NACL rules apply to both inbound and outbound traffic; adding a security group outbound rule would not affect NACL behavior, and the statement that NACL rules only apply to inbound traffic is factually incorrect. Option D is wrong because HTTPS uses TCP only (port 443), and adding UDP would not fix the missing outbound response rule; the issue is statelessness, not protocol mismatch.

Full explanation →
163
MCQeasy

A company hosts a web application on Amazon EC2 instances in two AWS regions: us-east-1 and eu-west-1. The application is behind an Application Load Balancer (ALB) in each region. The SysOps administrator wants to direct users to the region that provides the lowest latency, automatically routing traffic away from a region if it becomes unhealthy. Which Amazon Route 53 routing policy should be used?

A.Geolocation routing
B.Latency routing
C.Weighted routing
D.Failover routing
AnswerB

Latency routing uses measurements of latency between AWS regions and the user to direct traffic to the region with the lowest latency. When health checks are attached to the ALBs, latency routing automatically avoids unhealthy endpoints by excluding them from responses.

Why this answer

Latency routing (B) is correct because it directs users to the region with the lowest network latency based on real-time measurements between the user and the AWS endpoints. When a region becomes unhealthy, Route 53 automatically stops routing traffic to that region's ALB, ensuring failover to the next lowest-latency healthy region. This meets the requirement of both low-latency and automatic health-based rerouting.

Exam trap

The trap here is that candidates often confuse Geolocation routing with Latency routing, assuming geographic proximity equals low latency, but Geolocation routing does not measure actual network performance and lacks automatic health-based rerouting without additional failover records.

How to eliminate wrong answers

Option A (Geolocation routing) is wrong because it routes traffic based on the user's geographic location (e.g., country or continent), not on actual network latency, and it does not automatically reroute traffic away from an unhealthy region unless a failover record is explicitly configured. Option C (Weighted routing) is wrong because it distributes traffic based on assigned weights to multiple records, not on latency or health status; it does not automatically shift traffic away from an unhealthy region. Option D (Failover routing) is wrong because it uses an active-passive model with a primary and secondary record, but it does not consider latency; it only fails over to the secondary when the primary is unhealthy, which does not satisfy the requirement to direct users to the lowest-latency region.

Full explanation →
164
MCQmedium

A company uses AWS CodeDeploy to deploy a web application to a fleet of Amazon EC2 instances. The SysOps administrator needs to implement a deployment strategy that ensures zero downtime by creating a new set of instances alongside the current ones, then gradually shifting traffic to the new instances after they pass health checks. If a problem is detected, traffic can be instantly redirected back to the original instances. Which deployment configuration should the administrator use?

A.Rolling update
B.Blue/green deployment
C.All at once deployment
D.Canary deployment
AnswerB

Blue/green deployment provisions a complete second environment (green) alongside the current production environment (blue), allowing you to run tests against the new version while old traffic continues to flow. Once the new environment is validated, you shift traffic at the load balancer or DNS level—either all at once or gradually—making the cutover near-instantaneous. If the new environment fails, you simply switch traffic back to the still-available blue environment, enabling instant rollback with zero downtime, which is why this is the correct choice for high-availability web applications.

Why this answer

Blue/green deployment is the correct choice because it creates a completely new set of instances (green environment) alongside the existing ones (blue environment), shifts traffic gradually to the new instances after health checks pass, and allows instant rollback by redirecting traffic back to the original instances. AWS CodeDeploy supports this strategy natively with a blue/green deployment configuration, ensuring zero downtime during the transition.

Exam trap

The trap here is that candidates often confuse canary deployments with blue/green deployments, but canary deployments do not create a full parallel environment and lack the instant, full-traffic rollback capability that blue/green provides.

How to eliminate wrong answers

Option A is wrong because a rolling update replaces instances incrementally, which can cause temporary capacity reduction and does not guarantee zero downtime or instant rollback to the original fleet. Option C is wrong because an all-at-once deployment updates all instances simultaneously, causing downtime during the deployment and no ability to instantly redirect traffic back. Option D is wrong because a canary deployment shifts a small percentage of traffic to new instances gradually, but it does not create a full parallel environment for instant rollback; it typically requires manual or automated traffic shifting and may not provide the same instant rollback capability as blue/green.

Full explanation →
165
MCQeasy

A company has an on-premises data center connected to an AWS VPC via an AWS Direct Connect connection. The company's SysOps administrator wants to ensure that traffic from the VPC destined for the on-premises network uses the Direct Connect connection instead of the internet. Which configuration should be used?

A.Add a route in the VPC route table pointing to the on-premises network via a virtual private gateway (VGW)
B.Add a route in the VPC route table pointing to the on-premises network via a NAT gateway
C.Add a route in the VPC route table pointing to the on-premises network via an internet gateway
D.Add a route in the VPC route table pointing to the on-premises network via a VPC peering connection
AnswerA

The VGW is attached to the VPC and is the entry/exit point for Direct Connect. By adding a route with the on-premises destination and the VGW as the target, traffic is forced through the Direct Connect connection.

Why this answer

A virtual private gateway (VGW) is the AWS-side endpoint for an AWS Direct Connect connection when using a private virtual interface. By adding a route in the VPC route table that points the on-premises network CIDR to the VGW, all traffic destined for the on-premises network is forced over the Direct Connect link, bypassing the internet. This ensures private, low-latency, and consistent connectivity as required.

Exam trap

The trap here is that candidates often confuse the VGW with a NAT gateway or internet gateway, mistakenly thinking any gateway can route to on-premises, when only the VGW is designed for private connectivity via Direct Connect or VPN.

How to eliminate wrong answers

Option B is wrong because a NAT gateway is used to enable outbound internet traffic from private subnets, not to route traffic to an on-premises network over Direct Connect; it would send traffic to the internet, not the on-premises network. Option C is wrong because an internet gateway is designed for internet-bound traffic; routing on-premises traffic via an IGW would send it over the public internet, defeating the purpose of using Direct Connect. Option D is wrong because a VPC peering connection allows routing between two VPCs, not between a VPC and an on-premises network; it cannot be used to reach on-premises resources.

Full explanation →
166
MCQmedium

A company has two VPCs in the same AWS account and Region: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The SysOps administrator needs to establish connectivity between these VPCs so that resources in VPC-A can reach resources in VPC-B using private IP addresses. The solution must be highly available and not involve a third-party appliance. Which solution should the administrator implement?

A.Create an AWS Transit Gateway and attach both VPCs to it. Configure route tables to allow communication.
B.Create a VPC Peering connection between VPC-A and VPC-B. Update the route tables in each VPC to add routes to the other VPC's CIDR.
C.Attach an internet gateway to each VPC and use Amazon Route 53 to resolve private DNS names over the internet.
D.Set up a site-to-site VPN connection between the two VPCs using AWS Virtual Private Gateway.
AnswerB

VPC Peering is a one-to-one networking connection between two VPCs that enables direct traffic using private IPv4 or IPv6 addresses. Because the peering connection uses AWS's existing global network, traffic never traverses the public internet, and there are no additional hourly costs for the peering itself, aside from data transfer. After the peering request is accepted, you must add explicit routes in each VPC's route table pointing to the other VPC's CIDR block, and update the security group and network ACL rules to allow the traffic. For a simple two-VPC scenario in the same account and region, this is the most straightforward and cost-effective solution.

Why this answer

VPC Peering provides direct, private IP connectivity between two VPCs using the AWS global network, with no bandwidth bottleneck or single point of failure. By creating a peering connection and adding routes to the other VPC's CIDR in each VPC's route table, resources can communicate privately and the solution is highly available as the peering connection itself is redundant within AWS's infrastructure. No third-party appliance is required, and the setup is fully managed by AWS.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing Transit Gateway (Option A) for high availability, forgetting that VPC Peering is inherently highly available within a region and is the simplest, most cost-effective option for connecting just two VPCs.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway, while capable of connecting multiple VPCs, introduces an additional cost and complexity that is unnecessary for a simple two-VPC scenario, and it is not the simplest highly available solution without a third-party appliance. Option C is wrong because attaching internet gateways and using Route 53 to resolve private DNS names over the internet would expose traffic to the public internet, violating the requirement to use private IP addresses and introducing security risks and potential availability issues. Option D is wrong because a site-to-site VPN connection requires a Virtual Private Gateway and a Customer Gateway, which adds complexity and potential single points of failure, and it is not the most straightforward highly available solution for VPC-to-VPC connectivity within the same region and account.

Full explanation →
167
MCQhard

A SysOps administrator notices that traffic from an Application Load Balancer to EC2 instances is failing intermittently. Security groups for the instances allow traffic from the ALB security group on port 80. The ALB target group health checks are failing. What is the most likely cause?

A.The network ACL for the instance's subnet is blocking inbound traffic from the ALB's subnet.
B.The instance security group does not allow outbound traffic to the ALB.
C.The ALB security group does not allow outbound traffic to the instances.
D.The ALB is in a public subnet without an internet gateway.
AnswerA

Network ACLs are stateless; if they deny inbound health check traffic from the ALB subnet, health checks will fail.

Why this answer

Network ACLs are stateless, so the subnet's NACL must explicitly allow inbound traffic from the ALB's subnet CIDR. If it does not, health check traffic from the ALB will be blocked. Option B is incorrect because the instance's security group allows inbound traffic from the ALB security group, and security groups are stateful, so return traffic is allowed automatically.

Option C is incorrect because the ALB security group does not need an outbound rule; security groups are stateful, and the ALB initiates connections to the instances. Option D is incorrect because the ALB can communicate within the VPC regardless of whether it is in a public subnet; an internet gateway is only needed for internet traffic, not for internal ALB-to-instance traffic.

Full explanation →
168
MCQmedium

Refer to the exhibit. A SysOps administrator runs this CloudWatch Logs Insights query against an application log group. The query returns no results, even though the administrator knows that errors occurred in the last hour. What is the most likely cause?

A.The 'stats' command requires a 'by' clause with a field name, but 'bin(5m)' is invalid.
B.The log group contains too many log events, causing the query to time out.
C.The @message field is not a valid field in CloudWatch Logs Insights.
D.The log group's retention policy is set to 1 day and the data is older than the retention period.
AnswerB

CloudWatch Logs Insights queries have a maximum execution time of 60 seconds, and when a log group contains a very high volume of log events within the queried time range, the query engine may exceed that limit. A timeout causes the query to return no results, even though the data exists. This matches the symptom described in the question, making it the correct explanation.

Why this answer

In CloudWatch Logs Insights, `stats count() by bin(5m)` is valid syntax; `bin()` does not require a preceding field. Therefore option A is not the cause. The most likely cause among the options is that the log group contains too many log events, causing the query to time out before results are returned.

Retention policy does not affect events from the last hour, and `@message` is a valid field.

Exam trap

Candidates often assume a query returning no results is due to a syntax error. However, CloudWatch Logs Insights queries can time out on very large log groups, and a timeout may produce no results; `bin(5m)` is valid syntax.

How to eliminate wrong answers

Option A is wrong because the 'stats' command in CloudWatch Logs Insights does not require a 'by' clause; 'bin(5m)' is a valid function that groups timestamps into 5-minute intervals, so the syntax is correct. Option B is wrong because CloudWatch Logs Insights queries have a 10,000-event limit per query, but they do not time out due to too many log events; instead, they return partial results or a message indicating the limit was reached. Option C is wrong because @message is a reserved field in CloudWatch Logs Insights that contains the raw log event text, and it is always available for querying.

Full explanation →
169
Multi-Selecthard

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Linux 2 AMI with specific security agents installed. The company wants to ensure that all environment instances use this custom AMI. Which combination of steps should be taken? (Choose two.)

Select 2 answers
A.Set the AMI ID in a CloudFormation template and associate it with the environment.
B.Use AWS CodeDeploy to deploy the application to the custom AMI.
C.Create a custom AMI using the Elastic Beanstalk platform as the base.
D.Configure the .ebextensions folder to set the AMI ID for the Auto Scaling launch configuration.
E.Use Packer to create the custom AMI from any base image.
AnswersC, D

This ensures compatibility with the platform.

Why this answer

To ensure all environment instances use a custom AMI with specific security agents, you must create the custom AMI from the Elastic Beanstalk platform (C) to maintain compatibility. Then configure the .ebextensions folder to set the AMI ID in the Auto Scaling launch configuration using the aws:autoscaling:launchconfiguration namespace (D). Option A is incorrect because the AMI ID is set in the environment configuration, not a CloudFormation template.

Option B is incorrect because CodeDeploy deploys application code, not the AMI itself. Option E is incorrect because while Packer can be used to create AMIs, it is not required; the custom AMI must be based on the Elastic Beanstalk platform, not any base image.

Full explanation →
170
MCQeasy

A company needs to retain API call logs for 7 years for compliance. Which AWS service should be used to store these logs?

A.AWS CloudTrail
B.AWS Config
C.Amazon CloudWatch Logs
D.Amazon VPC Flow Logs
AnswerA

CloudTrail records API activity and can deliver logs to S3 for long-term retention.

Why this answer

AWS CloudTrail is the correct service because it records API activity across your AWS infrastructure and can be configured to store logs in an S3 bucket with lifecycle policies that retain data for 7 years. CloudTrail is specifically designed for auditing and compliance, capturing management and data plane API calls, and supports long-term retention via S3 object locking or lifecycle rules.

Exam trap

The trap here is that candidates confuse CloudTrail (API auditing) with CloudWatch Logs (operational logs) or Config (configuration history), but only CloudTrail captures the specific API call logs required for compliance retention.

How to eliminate wrong answers

Option B (AWS Config) is wrong because it tracks resource configuration changes and compliance over time, not API call logs; it stores configuration history, not API activity. Option C (Amazon CloudWatch Logs) is wrong because it is intended for real-time monitoring and operational logging from applications and services, with a default retention of indefinite but not optimized for 7-year compliance archiving; it lacks native long-term retention controls like S3 lifecycle policies. Option D (Amazon VPC Flow Logs) is wrong because it captures IP traffic metadata (source/destination IPs, ports, protocols) for network analysis, not API call logs; it is not designed for auditing API-level actions.

Full explanation →
171
MCQeasy

A company uses AWS Elastic Beanstalk for application deployments. The administrator needs to update the environment's configuration to use a larger instance type. Which method should be used to minimize downtime?

A.Terminate all instances and let the Auto Scaling group launch new ones.
B.Perform an immutable update.
C.Clone the environment with the new configuration and swap URLs.
D.Perform a rolling update based on health.
AnswerD

Rolling updates replace instances in batches, minimizing downtime.

Why this answer

A rolling update based on health (Option D) is the correct method to minimize downtime when updating an instance type in Elastic Beanstalk. This approach updates instances in batches, replacing them with the new instance type only after the previous batch passes health checks, ensuring application availability throughout the process. Elastic Beanstalk's rolling update with health-based batching terminates and launches instances incrementally, avoiding full environment disruption.

Exam trap

The trap here is that candidates often confuse 'immutable update' (Option B) as the best minimal-downtime method, but for a simple instance type change, a rolling update based on health is more appropriate because it avoids the overhead of provisioning a full parallel environment and the potential for brief traffic interruption during the swap.

How to eliminate wrong answers

Option A is wrong because terminating all instances and relying on the Auto Scaling group to launch new ones causes complete downtime until all instances are replaced and pass health checks, which is not minimal. Option B is wrong because an immutable update launches a full new set of instances in a separate Auto Scaling group, then swaps them in, which can cause a brief traffic interruption during the DNS swap and is not the most minimal-downtime approach for a simple instance type change. Option C is wrong because cloning the environment and swapping URLs introduces additional complexity and potential DNS propagation delays, and while it can achieve zero downtime, it is overkill for a simple configuration change and not the recommended minimal-downtime method for this specific task.

Full explanation →
172
MCQeasy

A company runs a mix of Amazon EC2 instances and AWS Fargate tasks that are used for both production and development workloads. The usage is steady and predictable. The SysOps administrator wants to maximize cost savings across both compute services without having to manage specific instances or sizes. Which purchasing option should the administrator recommend?

A.Purchase Compute Savings Plans for a 1-year or 3-year term with a commitment that covers the expected compute spend.
B.Purchase EC2 Instance Savings Plans for the most commonly used instance family and region.
C.Purchase Standard Reserved Instances for the EC2 instances and convert Fargate tasks to use Spot Instances.
D.Use On-Demand instances for both EC2 and Fargate because the administrator does not want to make a commitment.
AnswerA

Compute Savings Plans are the right choice for a mixed EC2 and Fargate environment because the hourly commitment automatically applies to eligible compute usage across EC2 instances, Fargate tasks, and Lambda functions within the chosen region. Unlike EC2 Instance Savings Plans, they do not lock you to an instance family or size, so you can change instance types or refactor to containers without losing the discounted rate. A 1-year or 3-year term with a commitment that matches steady-state spend yields significant savings over On-Demand.

Why this answer

Compute Savings Plans offer the most flexibility, automatically applying to EC2 instances (regardless of instance family, size, or region) and Fargate tasks. Since the company has a mix of both services and wants to maximize savings without managing specific instances or sizes, a 1-year or 3-term Compute Savings Plan with a commitment matching expected spend provides up to 66% savings while covering all compute usage. This aligns with the steady and predictable workload described.

Exam trap

AWS often tests the distinction between Compute Savings Plans and EC2 Instance Savings Plans, where candidates mistakenly choose the latter thinking it covers all EC2 usage, but fail to recognize that Compute Savings Plans also include Fargate and Lambda, making them the only option for a mixed compute environment.

How to eliminate wrong answers

Option B is wrong because EC2 Instance Savings Plans are restricted to a specific instance family within a region, which does not cover Fargate tasks and would not provide the cross-service flexibility needed for the mixed workload. Option C is wrong because Standard Reserved Instances apply only to EC2 instances and require a specific instance family and size commitment, while converting Fargate tasks to Spot Instances introduces interruption risk and does not guarantee cost savings for steady workloads. Option D is wrong because On-Demand pricing offers no discount, and the administrator explicitly wants to maximize cost savings, which requires a commitment-based purchasing option.

Full explanation →
173
Multi-Selectmedium

A company wants to reduce costs for a production Amazon RDS for MySQL DB instance that is running 24/7 but only heavily used during business hours (9 AM to 5 PM). Which TWO actions would be MOST effective in optimizing costs without significantly impacting performance during peak hours?

Select 2 answers
A.Enable Multi-AZ deployment for high availability.
B.Purchase Reserved Instances for the DB instance.
C.Migrate from Provisioned IOPS (io1) storage to General Purpose (gp3) storage.
D.Use AWS Application Auto Scaling to schedule scale-down of the instance size outside business hours.
E.Enable Auto Scaling for the DB instance.
AnswersB, D

Reserved Instances provide a discount for consistent usage, reducing cost.

Why this answer

(Multi-AZ) increases cost and is not needed for cost optimization. Option B (reserved instances) provides a discount for consistent usage. Option C (Migrate to gp3 storage) can be more cost-effective than provisioned IOPS for many workloads, but it is not the most effective action because the instance is only heavily used during business hours.

Option D (scheduled scaling) can reduce instance size during off-peak hours, saving cost. Option E (Auto Scaling) is not applicable to standard RDS without additional services like Aurora Auto Scaling. Correct answers: B and D.

Full explanation →
174
MCQmedium

A company has an AWS account that contains multiple Amazon S3 buckets with sensitive data. A SysOps administrator needs to ensure that all S3 buckets in the account have versioning enabled to protect against accidental deletions. The administrator wants to automatically remediate any bucket that is created without versioning enabled. Which solution should be used?

A.Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning
B.Use Amazon CloudWatch Events to detect CreateBucket API calls and trigger an AWS Lambda function to enable versioning
C.Use AWS CloudTrail to monitor CreateBucket events and send an alert to the SysOps administrator for manual action
D.Use AWS Service Catalog to enforce versioning on all buckets provisioned through it
AnswerA

AWS Config's s3-bucket-versioning-enabled managed rule continuously evaluates every bucket in the account, including both existing resources and newly created ones. When a bucket is found noncompliant—whether it never had versioning or had it disabled—an automatic remediation action invokes an AWS Systems Manager Automation document (such as AWS-EnableS3BucketVersioning) to enable versioning immediately. This closed-loop approach ensures ongoing compliance without manual effort, and it covers all buckets regardless of how they were created or modified. AWS Config evaluates configuration changes in near real time, making this a truly detective and corrective control.

Why this answer

AWS Config with the managed rule `s3-bucket-versioning-enabled` continuously evaluates S3 buckets against the desired configuration. When a noncompliant bucket is detected, an automatic remediation action can be configured to invoke an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven remediation without manual intervention, ensuring all buckets—including those created outside of AWS Config's initial evaluation—are brought into compliance.

Exam trap

The trap here is that candidates often choose CloudWatch Events + Lambda (Option B) thinking it provides real-time remediation, but they overlook that it only catches new buckets and fails to remediate existing noncompliant buckets or buckets that have versioning disabled after creation, whereas AWS Config provides continuous compliance monitoring and automatic remediation for both new and existing resources.

How to eliminate wrong answers

Option B is wrong because Amazon CloudWatch Events (now Amazon EventBridge) can detect `CreateBucket` API calls, but triggering a Lambda function to enable versioning only remediates buckets at creation time; it does not detect or fix buckets that were created before the rule was enabled or buckets that have versioning disabled after creation. Option C is wrong because AWS CloudTrail monitoring and sending an alert requires manual action by the SysOps administrator, which is not an automatic remediation and does not meet the requirement to automatically remediate. Option D is wrong because AWS Service Catalog only enforces versioning on buckets provisioned through it; buckets created directly via the S3 console, CLI, or SDK bypass Service Catalog and remain noncompliant.

Full explanation →
175
MCQmedium

Refer to the exhibit. An IAM user has this policy attached. What is the effect when the user attempts to get an object from my-bucket from an IP address in the range 198.51.100.0/24?

A.Allowed because the Deny condition does not match
B.Denied because there is no explicit Allow for that IP range
C.Allowed because there is an Allow statement
D.Denied because the Deny statement applies
AnswerD

The Deny statement explicitly denies access from IPs not in the range.

Why this answer

The policy includes an Allow statement that grants s3:GetObject only from the IP range 192.0.2.0/24. It also includes a Deny statement that denies s3:GetObject from any IP address not in that range (using the NotIpAddress condition). The user's request comes from an IP in the 198.51.100.0/24 range, which is not included in the allowed range.

Therefore, the Deny condition matches, and the Deny statement applies. In AWS IAM, an explicit Deny overrides any Allow, so the request is denied. Option D is correct.

Option A is incorrect because the Deny does match. Option B is incorrect because there is an explicit Allow for a different IP range, but the Deny overrides it. Option C is incorrect because the Allow only applies to the specified range, and the Deny overrides it.

Full explanation →
176
Multi-Selectmedium

A company is designing a highly available architecture for a web application. The application uses an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. Which TWO steps should the company take to ensure the architecture is resilient to an Availability Zone failure? (Select TWO.)

Select 2 answers
A.Set the Auto Scaling group's desired capacity to a high number.
B.Create a CloudWatch alarm that triggers if the ALB has elevated 5xx errors.
C.Configure the Auto Scaling group to launch instances in at least two Availability Zones.
D.Use a single EC2 instance type for all instances.
E.Configure the ALB to be internet-facing and enable cross-zone load balancing.
AnswersC, E

Distributing instances across AZs ensures availability if one AZ fails.

Why this answer

Launching EC2 instances in at least two Availability Zones (AZs) ensures that if one AZ fails, the Auto Scaling group can continue to serve traffic from instances in the remaining AZ(s). This is a fundamental design pattern for high availability within a single AWS Region, as it distributes the application across physically separate data centers.

Exam trap

The trap here is that candidates often confuse scaling capacity (Option A) or monitoring (Option B) with the architectural requirement of distributing resources across multiple Availability Zones, which is the only way to survive an AZ failure.

Full explanation →
177
Drag & Dropmedium

Drag and drop the steps to enable AWS CloudTrail logging for a specific S3 bucket into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create a log bucket with proper policy, then create the trail and configure it to log events for the target bucket.

Full explanation →
178
Multi-Selecteasy

A SysOps administrator needs to reduce data transfer costs for a web application hosted on EC2 instances in a VPC. The application serves content to users over the internet. Which TWO actions will help reduce data transfer costs? (Choose TWO.)

Select 2 answers
A.Move all instances to private subnets and use AWS Direct Connect for user access.
B.Use a VPC Gateway Endpoint for Amazon S3 to keep S3 traffic within AWS.
C.Use Amazon CloudFront to cache and serve static content.
D.Use an Application Load Balancer to distribute traffic.
E.Use a larger NAT Gateway to improve throughput.
AnswersB, C

Gateway endpoints are free and reduce data transfer costs to S3.

Why this answer

The correct answers are B and C. Using a VPC Gateway Endpoint for Amazon S3 allows instances to access S3 over the AWS network without traversing the internet, reducing data transfer costs. Amazon CloudFront caches content at edge locations worldwide, so users receive content from edge locations instead of the EC2 origin, reducing data transfer from EC2 to the internet.

Option A is incorrect because migrating to private subnets and using AWS Direct Connect does not serve users over the internet; Direct Connect is a dedicated network connection that does not reduce data transfer costs for internet users. Option D is incorrect because an Application Load Balancer distributes traffic but does not inherently reduce data transfer costs; it may even add cost. Option E is incorrect because a larger NAT Gateway increases cost and does not reduce data transfer costs for outbound traffic.

Full explanation →
179
MCQmedium

The CISO asks for a centralized dashboard showing security findings from GuardDuty, Macie, Inspector, and Firewall Manager across 30 AWS accounts. Findings must be normalized into a single format so they can be prioritized by severity without switching between services. Which AWS service provides this capability?

A.Enable AWS Security Hub with an administrator account in the organization; integrate GuardDuty, Macie, Inspector, and Firewall Manager as finding providers
B.Deploy a custom Lambda function that polls each service's API and writes findings to a DynamoDB table for a custom dashboard
C.Enable Amazon Detective to investigate and correlate security findings across all accounts
D.Configure AWS Config conformance packs to evaluate security compliance checks across all accounts and report to an aggregator account
AnswerA

Security Hub's organization integration automatically enables member accounts and routes their findings to the designated administrator account. All findings — regardless of source service — are normalized to ASFF with a consistent severity schema. The security team sees one consolidated dashboard instead of five separate consoles.

Why this answer

AWS Security Hub is designed to aggregate, normalize, and prioritize security findings from multiple AWS services (GuardDuty, Macie, Inspector, Firewall Manager) and third-party tools across accounts. By designating an administrator account in AWS Organizations, you can centrally view all findings in a single dashboard, with a standardized findings format (AWS Security Finding Format, ASFF) that includes severity, resource, and remediation fields. This directly meets the CISO's requirement for a centralized, normalized, severity-prioritized view without switching between services.

Exam trap

The trap here is that candidates often confuse Amazon Detective (a visualization/investigation tool) with Security Hub (a centralized finding aggregation and prioritization service), or they assume a custom Lambda solution is acceptable despite the exam's emphasis on managed, scalable services that reduce operational burden.

How to eliminate wrong answers

Option B is wrong because deploying a custom Lambda function to poll APIs and write to DynamoDB is a manual, brittle approach that does not provide the native normalization, cross-account aggregation, or built-in severity prioritization that Security Hub offers out of the box; it also introduces operational overhead and potential latency. Option C is wrong because Amazon Detective is a service for investigating and visualizing security data (e.g., VPC Flow Logs, GuardDuty findings) but it does not aggregate findings from multiple services into a single normalized dashboard for prioritization; it focuses on root-cause analysis after an alert. Option D is wrong because AWS Config conformance packs evaluate resource compliance against rules (e.g., PCI DSS, CIS benchmarks) and report compliance status, but they do not ingest or normalize security findings from GuardDuty, Macie, Inspector, or Firewall Manager; they are for configuration compliance, not security finding aggregation.

Full explanation →
180
MCQmedium

A SysOps administrator manages a CloudFormation stack that deploys a web application. The stack includes an Amazon EC2 instance and an Amazon RDS DB instance. The administrator needs to update the stack to change the EC2 instance type. The administrator wants to ensure that the update does not accidentally replace the RDS database. Which CloudFormation feature should the administrator use to protect the RDS resource from being replaced during the stack update?

A.Use a DeletionPolicy of Retain on the RDS resource.
B.Use a stack policy that denies updates to the RDS resource.
C.Use the Resource Signal and CreationPolicy attributes.
D.Use a Change Set to review changes before executing.
AnswerB

A stack policy can explicitly deny update, replace, or delete actions on specific resources. By applying a policy that denies update to the RDS resource, the CloudFormation update will fail if it attempts to modify the RDS instance, thus protecting it from accidental replacement.

Why this answer

A stack policy is an AWS CloudFormation feature that explicitly denies update or replacement actions on specified resources. By applying a stack policy that denies updates to the RDS resource, the administrator prevents any stack update operation (including changing the EC2 instance type) from modifying or replacing the database, even if the template changes would otherwise affect it. This is the correct approach because it provides a guardrail specifically against accidental replacement during updates.

Exam trap

The trap here is that candidates often confuse DeletionPolicy (which only applies on stack deletion) with stack policies (which control updates), leading them to incorrectly choose Option A as a safety measure during updates.

How to eliminate wrong answers

Option A is wrong because a DeletionPolicy of Retain only protects the resource when the stack is deleted, not during a stack update; it does not prevent replacement or modification during an update. Option C is wrong because Resource Signal and CreationPolicy are used to control stack creation behavior (e.g., waiting for signals before marking a resource as created), not to protect resources from being replaced during updates. Option D is wrong because a Change Set only allows you to review proposed changes before executing them; it does not prevent the update from being executed or protect the RDS resource from replacement if the update is applied.

Full explanation →
181
Drag & Dropmedium

Drag and drop the steps to troubleshoot high CPU usage on an Amazon EC2 instance into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The correct order for troubleshooting high CPU usage on an EC2 instance starts with checking CloudWatch metrics to confirm the issue and gain initial insights. Next, connect to the instance using SSH or Systems Manager to access the operating system. Then, identify the process causing high CPU using tools like top or ps.

After identification, analyze the process to understand its behavior, such as checking logs or memory usage. Finally, take corrective action, which may include stopping, killing, or optimizing the process, or scaling the instance up. This sequence ensures efficient and accurate troubleshooting.

Full explanation →
182
MCQhard

A company runs a web application on Amazon EC2 instances in an Auto Scaling group. The application uses Amazon EBS volumes (gp2) for data storage. The SysOps administrator notices that the storage costs are high, and the application's IOPS requirements are consistently below 3000. The administrator wants to reduce storage costs without affecting performance. Which action should the administrator take?

A.Modify the EBS volumes to use Provisioned IOPS (io1) volumes and set IOPS to 2000.
B.Convert the EBS volumes from gp2 to gp3 volume type.
C.Implement an Amazon EBS snapshot lifecycle policy to delete old snapshots and reduce storage costs.
D.Enable EBS optimization on the EC2 instances to improve throughput and reduce costs.
AnswerB

gp3 volumes provide a baseline of 3000 IOPS and 125 MB/s throughput for every volume, independent of size, and the per-GB price is roughly 20% lower than gp2. This makes gp3 both cheaper and more predictable for workloads under 3000 IOPS, as it does not rely on burst credits like gp2. Converting existing gp2 volumes to gp3 can be performed non-disruptively, and would reduce the running EBS cost while still exceeding the application's performance requirements.

Why this answer

Gp3 volumes offer a baseline performance of 3000 IOPS and 125 MB/s throughput at a lower cost than gp2 volumes, making them ideal for workloads with IOPS requirements consistently below 3000. By converting from gp2 to gp3, the administrator can reduce storage costs without any performance impact, as gp3 provides the same or better baseline performance at a lower price per GB.

Exam trap

The trap here is that candidates may confuse cost reduction strategies for EBS volumes with snapshot management or instance-level optimizations, failing to recognize that gp3 is the direct, cost-effective replacement for gp2 when IOPS requirements are below the gp3 baseline.

How to eliminate wrong answers

Option A is wrong because Provisioned IOPS (io1) volumes are designed for high-performance workloads requiring more than 16,000 IOPS and are significantly more expensive than gp2 or gp3, so using io1 with only 2000 IOPS would increase costs unnecessarily. Option C is wrong because deleting old snapshots reduces snapshot storage costs, not the cost of the EBS volumes themselves, and the question specifically asks about reducing storage costs for the EBS volumes used by the application. Option D is wrong because EBS optimization is a feature that provides dedicated network bandwidth for EBS traffic, improving throughput and reducing latency, but it does not directly reduce storage costs; it may even incur additional costs if the instance type requires it.

Full explanation →
183
MCQhard

Refer to the exhibit. An IAM policy is attached to a user. Which statement about the user's access is correct?

A.The user can get objects over HTTP.
B.The user can list objects in the bucket over HTTP.
C.The user can list objects only over HTTPS.
D.The user can get objects only over HTTPS.
AnswerD

GetObject requires SecureTransport true.

Why this answer

The GetObject action has a condition requiring SecureTransport to be true, meaning only HTTPS is allowed. Option A is incorrect because HTTP is not allowed for GetObject. Option B is incorrect because ListBucket does not have the SecureTransport condition, so HTTP is allowed for listing objects.

Option C is incorrect because listing objects is allowed over HTTP.

Full explanation →
184
MCQhard

The monitoring team needs to collect per-process CPU and memory utilization for a specific Java process (named 'app.jar') running on EC2 Linux instances. Standard EC2 metrics show aggregate CPU but not per-process details. Which CloudWatch agent configuration section enables this?

A.Add a procstat section under metrics_collected in the CloudWatch agent config, specifying process_name = 'app.jar' to collect per-process CPU and memory
B.Enable enhanced monitoring on the EC2 instance and select 'per-process metrics' from the console
C.Configure a CloudWatch Logs metric filter on the Java GC log output to derive CPU and memory figures
D.Use the aws ec2 describe-instance-status API on a schedule to pull process metrics from the instance's system status checks
AnswerA

The procstat plugin uses the Linux /proc filesystem to sample per-process resource usage. With process_name set to 'app.jar', the agent matches the running JVM process and publishes metrics like procstat_cpu_usage and procstat_memory_rss to CloudWatch every collection interval. These metrics carry instance ID and process name dimensions.

Why this answer

The CloudWatch agent's `procstat` plugin is specifically designed to collect per-process metrics such as CPU and memory utilization. By adding a `procstat` section under `metrics_collected` in the agent configuration file and specifying the process name (e.g., `process_name = 'app.jar'`), the agent will gather the required per-process metrics and send them to CloudWatch. This is the only native method within the CloudWatch ecosystem to achieve per-process monitoring on EC2 Linux instances.

Exam trap

The trap here is that candidates may confuse 'enhanced monitoring' (a hypervisor-level feature) with OS-level per-process monitoring, or incorrectly assume that CloudWatch Logs metric filters can derive CPU/memory metrics from application logs, when in fact only the CloudWatch agent's `procstat` plugin can collect actual OS-level per-process resource utilization.

How to eliminate wrong answers

Option B is wrong because 'enhanced monitoring' is a feature of EC2 that provides additional hypervisor-level metrics (e.g., CPU credit usage, network throughput) but does not expose per-process metrics; it cannot see inside the guest OS. Option C is wrong because CloudWatch Logs metric filters can parse log patterns and create numerical metrics from log data, but Java GC logs do not contain CPU or memory utilization figures for the process; they only contain garbage collection timing and heap usage, not OS-level resource consumption. Option D is wrong because the `aws ec2 describe-instance-status` API returns instance health and status checks (e.g., system reachability, instance status) and has no capability to retrieve per-process metrics from within the instance.

Full explanation →
185
MCQmedium

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB) in the us-west-2 Region. Users are distributed globally and experience high latency. The SysOps administrator wants to improve latency and offload SSL termination to the edge. Which AWS service should be used with the ALB as the origin?

A.Amazon CloudFront
B.AWS Global Accelerator
C.AWS WAF (Web Application Firewall)
D.Amazon Route 53 with Latency Based Routing
AnswerA

Amazon CloudFront is a content delivery network that caches both static and dynamic content at edge locations geographically closer to users, reducing latency and offloading requests from the origin EC2 instances. It also terminates SSL/TLS at the edge, so decrypted traffic is forwarded over the AWS network to the origin, reducing the TLS handshake and encryption workload on the application servers. Additionally, CloudFront supports origin shielding, connection keep-alives, and multiple SSL/TLS protocols to further optimize delivery and reduce origin load.

Why this answer

Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations worldwide, reducing latency for global users. It can offload SSL termination at the edge by accepting HTTPS requests from clients and forwarding them to the ALB over HTTP or HTTPS, thereby reducing the load on the origin. This directly addresses the requirements of improving latency and offloading SSL termination.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator with CloudFront, thinking both provide caching, but Global Accelerator only optimizes network path routing and does not cache content or terminate SSL at the edge.

How to eliminate wrong answers

Option B (AWS Global Accelerator) is wrong because it improves latency by routing traffic over the AWS global network using Anycast IPs, but it does not cache content or offload SSL termination at the edge; SSL termination still occurs at the ALB or EC2 instances. Option C (AWS WAF) is wrong because it is a web application firewall that filters malicious traffic, not a service for reducing latency or offloading SSL termination. Option D (Amazon Route 53 with Latency Based Routing) is wrong because it only directs DNS queries to the lowest-latency endpoint, but it does not cache content or terminate SSL at the edge; the actual traffic still goes directly to the ALB, and SSL termination remains at the origin.

Full explanation →
186
MCQmedium

A company's security policy requires that all Amazon S3 buckets must have server-side encryption with AWS Key Management Service (SSE-KMS) enabled. The SysOps administrator needs to automatically detect any existing or new S3 bucket that does not have SSE-KMS enabled and automatically apply the encryption configuration. The solution must use managed AWS services with minimal custom code. Which combination of AWS services should be used?

A.Use AWS Config with a custom rule backed by an AWS Lambda function that checks if the S3 bucket has default SSE-KMS encryption enabled, and auto-remediates by enabling SSE-KMS default encryption (e.g., calling the PutBucketEncryption API).
B.Enable default encryption on the AWS account's S3 buckets using an S3 account-level setting in the S3 console, which automatically applies SSE-KMS to all new buckets.
C.Create an AWS CloudTrail event that triggers an AWS Lambda function when a bucket is created, and the Lambda applies SSE-KMS encryption. Use AWS Config to periodically scan existing buckets and apply encryption.
D.Use AWS Identity and Access Management (IAM) with a Service Control Policy (SCP) that denies any S3 bucket creation without SSE-KMS enabled, and use AWS Config to detect and notify on non-compliance.
AnswerA

This uses AWS Config for detection and Lambda for remediation, which is a standard pattern. Bucket policy approach prevents future unencrypted uploads but does not encrypt existing objects; however, the requirement is to apply encryption configuration, which can be done via put-bucket-encryption API. The Lambda can call that API. This is a valid solution with managed services and minimal custom code (only the Lambda).

Why this answer

It uses AWS Config with a custom Lambda-backed rule to detect non-compliant S3 buckets (those missing SSE-KMS) and auto-remediate by calling the PutBucketEncryption API to enable default SSE-KMS encryption on the bucket. This satisfies the requirement for minimal custom code (only the Lambda function) and uses managed AWS services (AWS Config, Lambda, S3) to automatically detect and fix both existing and new buckets, ensuring that all S3 buckets have SSE-KMS enabled as per the security policy.

Exam trap

The trap here is that candidates often confuse S3 default encryption settings (which apply to objects, not buckets) with bucket policies or AWS Config rules, leading them to choose Option B or D, which cannot automatically remediate existing non-compliant buckets.

How to eliminate wrong answers

Option B is wrong because S3 account-level default encryption settings apply only to new objects uploaded to existing buckets, not to new buckets themselves, and cannot retroactively enforce encryption on existing buckets or detect non-compliant buckets. Option C is wrong because it requires creating a CloudTrail event trigger and a separate AWS Config periodic scan, which introduces more custom code and complexity than necessary, and the CloudTrail approach only catches bucket creation events, not modifications to existing buckets. Option D is wrong because IAM Service Control Policies (SCPs) can only deny bucket creation based on tags or conditions at creation time, but they cannot detect or remediate existing buckets that lack SSE-KMS, and AWS Config alone without a remediation action cannot automatically apply encryption.

Full explanation →
187
MCQeasy

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The SysOps administrator receives reports that some users are experiencing intermittent HTTP 503 errors. What is the most likely cause?

A.The security group attached to the ALB does not allow inbound traffic on port 443.
B.The health checks are failing for the target group, causing the ALB to stop sending traffic to all instances.
C.The EC2 instances do not have the correct IAM role to register with the ALB.
D.The ALB idle timeout is set too low.
AnswerB

If all targets are unhealthy, ALB returns 503.

Why this answer

HTTP 503 errors from an Application Load Balancer typically indicate that the target group has no healthy registered targets. When health checks fail for all instances in the target group, the ALB cannot route traffic to any backend, resulting in a 503 response. This is the most common cause of intermittent 503 errors in ALB architectures.

Exam trap

The trap here is that candidates often confuse HTTP 503 errors with connectivity or timeout issues, but the ALB specifically returns 503 only when no healthy targets exist, not for security group or timeout misconfigurations.

How to eliminate wrong answers

Option A is wrong because if the ALB security group did not allow inbound traffic on port 443, users would receive connection timeouts or 504 errors, not HTTP 503 errors. Option C is wrong because EC2 instances do not require an IAM role to register with an ALB; registration is handled by the Auto Scaling group or manual attachment, and IAM roles are used for API calls, not for target registration. Option D is wrong because a low idle timeout would cause the ALB to close idle connections, resulting in 504 Gateway Timeout errors, not 503 Service Unavailable errors.

Full explanation →
188
MCQmedium

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts have encryption enabled. What is the most efficient way to enforce this policy?

A.Apply a service control policy (SCP) to the root organizational unit that denies S3 actions without encryption.
B.Configure an IAM role in the master account to enforce encryption via cross-account access.
C.Create an IAM policy in each account that denies s3:PutObject without encryption.
D.Use AWS CloudFormation StackSets to deploy a bucket policy to each account.
AnswerA

Applying an SCP at the root organizational unit is the correct centralized method because SCPs act as guardrails that restrict the maximum permissions available to all IAM principals in every account under that OU, including the account root user. An SCP can, for example, use a condition like `s3:x-amz-server-side-encryption` or `aws:SecureTransport` to deny `s3:PutObject` calls that do not include encryption parameters, and because SCPs cannot be overridden by individual account administrators, this enforces encryption uniformly across the entire organization.

Why this answer

A service control policy (SCP) applied to the root organizational unit in AWS Organizations can centrally enforce encryption requirements for all S3 buckets across every member account. By denying S3 actions (such as s3:PutObject) unless the request includes encryption parameters (e.g., x-amz-server-side-encryption), the SCP acts as a guardrail that cannot be overridden by account-level IAM policies, ensuring compliance without per-account configuration.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, assuming that IAM policies in each account are sufficient, but SCPs provide centralized, unoverridable enforcement across all accounts in an organization.

How to eliminate wrong answers

Option B is wrong because an IAM role in the master account cannot enforce encryption on S3 actions performed by principals in other accounts; cross-account access via roles requires explicit trust and does not prevent unencrypted operations initiated by users in member accounts. Option C is wrong because creating an IAM policy in each account is not the most efficient approach—it requires manual deployment and maintenance across potentially hundreds of accounts, and IAM policies can be overridden by account administrators. Option D is wrong because CloudFormation StackSets deploy resources (like bucket policies) but cannot enforce encryption on existing buckets or future actions across all accounts without additional mechanisms; bucket policies also apply only to specific buckets, not globally.

Full explanation →
189
MCQhard

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application reads data from an Amazon RDS for MySQL database. During peak hours, the database CPU utilization is consistently high, and the application experiences increased latency. The SysOps administrator observes that 90% of database queries are read-only. Which combination of actions will both improve performance and optimize costs?

A.Enable Multi-AZ for the RDS instance and scale up the instance size
B.Implement a read replica for the RDS instance and modify the application to route read queries to the read replica
C.Enable Amazon RDS Performance Insights and increase the storage allocation
D.Implement Amazon ElastiCache for Memcached in front of the database and migrate read-heavy queries to cache
AnswerB

Implementing a read replica creates a separate RDS instance that uses asynchronous replication to maintain a copy of the primary database, and it has its own endpoint that can handle read traffic. By modifying the application to route SELECT queries to the read replica (and keeping write operations on the primary), you offload CPU-intensive read workloads from the primary instance, directly alleviating high CPU utilization. This is a proven pattern for read-heavy applications because it scales read capacity independently and is more cost-effective than scaling up the primary, as you only size the primary for write throughput.

Why this answer

Implementing a read replica offloads read-heavy (90%) queries from the primary RDS instance, reducing CPU utilization and latency. Modifying the application to route read queries to the replica distributes the workload, improving performance while avoiding costly vertical scaling. This optimizes costs by using a smaller primary instance and paying only for the replica's resources.

Exam trap

The trap here is that candidates often confuse Multi-AZ (high availability) with read replicas (performance scaling), or assume caching (ElastiCache) is always the best choice for read-heavy workloads without considering the simplicity and cost-effectiveness of read replicas for database-level offloading.

How to eliminate wrong answers

Option A is wrong because enabling Multi-AZ provides high availability, not performance improvement, and scaling up the instance size increases costs without addressing the read-heavy workload. Option C is wrong because Performance Insights is a monitoring tool that does not reduce CPU utilization or latency, and increasing storage allocation does not improve query performance. Option D is wrong because ElastiCache for Memcached is a caching layer that can reduce database load, but it requires application code changes to cache read queries and does not directly offload read queries like a read replica; it is more suitable for caching specific data, not all read queries.

Full explanation →
190
MCQhard

A company runs a critical MySQL database on an Amazon RDS DB instance in a single Availability Zone. The SysOps administrator needs to implement a disaster recovery solution with a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour, while minimizing costs. Which solution meets these requirements?

A.Enable Multi-AZ deployment with a synchronous standby replica in another Availability Zone
B.Create a cross-Region read replica and promote it to a standalone DB instance during a disaster
C.Enable cross-Region automated backups to another Region
D.Take daily automated snapshots and copy them to another Region manually
AnswerC

Enabling cross-Region automated backups continuously replicates both automated snapshots and transaction logs to a chosen destination Region without running any compute resources there. This service-managed feature provides a typical RPO of about 5 minutes because transaction logs are shipped frequently, and an RTO of under 1 hour by restoring the latest snapshot and rolling forward logs. Since you only pay for storage in the destination Region until you actually perform a restore, this is the most cost-effective and operationally simple way to meet the stated DR requirements.

Why this answer

Cross-Region automated backups replicate transaction logs to another AWS Region with a typical lag of a few minutes, enabling point-in-time recovery (PITR) that can meet an RPO of 5 minutes. When a disaster occurs, you can restore the automated backup to a new DB instance in the destination Region, and the RTO depends on the restore time, which can be under 1 hour for a properly sized instance. This solution minimizes costs by avoiding the continuous compute and storage overhead of a standby replica or read replica.

Exam trap

The trap here is that candidates often confuse cross-Region read replicas (asynchronous, higher RPO) with cross-Region automated backups (log-based, lower RPO), or assume Multi-AZ provides cross-Region disaster recovery when it only covers AZ failures within a single Region.

How to eliminate wrong answers

Option A is wrong because Multi-AZ with a synchronous standby replica only protects against an Availability Zone failure within the same Region, not a cross-Region disaster, and it incurs the cost of a full standby instance. Option B is wrong because a cross-Region read replica is asynchronous and can have replication lag exceeding 5 minutes, making it unable to guarantee an RPO of 5 minutes; additionally, promoting a read replica to a standalone instance can take longer than 1 hour due to the need to stop replication and apply pending changes. Option D is wrong because daily automated snapshots provide an RPO of up to 24 hours, far exceeding the required 5-minute RPO, and manual copying adds operational overhead and delay.

Full explanation →
191
MCQeasy

A SysOps administrator uses AWS CloudFormation to manage a stack that includes an Amazon EC2 instance. The administrator wants to update the instance type from t3.medium to t3.large without recreating the instance. The instance type change is supported as a simple update in CloudFormation. Which stack update method should the administrator use to apply this change with the least disruption?

A.Directly update the stack by modifying the template and submitting the update via the AWS Management Console, AWS CLI, or API.
B.Create a change set to review the changes, then execute the change set.
C.Apply a stack policy to the EC2 instance to allow the update, then update the stack.
D.Delete the existing stack and create a new stack with the updated instance type.
AnswerA

A direct stack update is the correct method because CloudFormation compares the modified template against the current stack and applies the changed InstanceType property to the existing EC2 instance without replacement. The update can be submitted via the AWS Management Console, AWS CLI, or API, and because this is a simple, in-place attribute change, it minimizes downtime and avoids extra operational overhead. This approach is the fastest and least disruptive way to achieve the desired configuration.

Why this answer

Changing an EC2 instance type from t3.medium to t3.large is a supported simple update in CloudFormation, meaning the resource can be updated in-place without replacement. By directly updating the stack via the AWS Management Console, AWS CLI, or API, the administrator applies the change immediately with minimal disruption, as CloudFormation will stop the instance, modify the instance type, and restart it. This method avoids the overhead of creating a change set or deleting and recreating the stack, which would cause unnecessary downtime or complexity.

Exam trap

The trap here is that candidates often assume a change set is required for all updates or that it reduces disruption, when in fact it is only a review mechanism and does not change the update behavior; the direct update is equally safe and faster for simple, supported changes.

How to eliminate wrong answers

Option B is wrong because creating a change set is an optional review step that adds delay and does not reduce disruption; executing a change set still performs the same in-place update as a direct update, so it is not the least disruptive method. Option C is wrong because stack policies are used to prevent updates to specific resources, not to allow them; applying a stack policy to allow the update is unnecessary and could inadvertently block other updates if misconfigured. Option D is wrong because deleting and recreating the stack would destroy the existing EC2 instance and create a new one, causing complete disruption and data loss (unless data is stored externally), which is far more disruptive than an in-place update.

Full explanation →
192
MCQmedium

A company has an Amazon CloudFront distribution that delivers static content from an Amazon S3 bucket. The SysOps administrator needs to ensure that the content can only be accessed through CloudFront and not directly from the S3 bucket URL. The solution should use AWS managed services with minimal configuration. Which solution should the administrator implement?

A.Configure the S3 bucket policy to deny all access except from the CloudFront distribution's origin access identity (OAI).
B.Make the S3 bucket private and use pre-signed URLs for CloudFront.
C.Use AWS WAF on CloudFront to block direct access to S3 by checking the Referer header.
D.Create a VPC endpoint for S3 and restrict access to the bucket from the CloudFront IP addresses.
AnswerA

An Origin Access Identity (OAI) is a special CloudFront identity that can be assigned to a distribution, and the S3 bucket policy can explicitly grant read permission to that OAI's principal while using an explicit deny for all other principals. Since CloudFront signs requests as the OAI, only the distribution can fetch objects from the bucket; direct access to the S3 website or REST endpoint is rejected. This is the recommended AWS pattern because it relies on IAM evaluation of the caller identity rather than a client-controlled header or an IP-based allow list.

Why this answer

Configuring the S3 bucket policy to deny all access except from the CloudFront distribution's origin access identity (OAI) ensures that only CloudFront can retrieve objects from the S3 bucket. The OAI is a special CloudFront user that authenticates requests to S3, and the bucket policy explicitly grants GetObject access only to that principal, blocking any direct S3 URL access. This uses AWS managed services (CloudFront and S3) with minimal configuration—no custom code or additional infrastructure.

Exam trap

The trap here is that candidates often choose Option C (AWS WAF with Referer header) because it seems like a simple web-application-layer control, but they overlook that the Referer header is easily spoofed and does not provide cryptographic authentication, unlike the OAI-based approach which uses AWS Signature Version 4 to verify the request origin.

How to eliminate wrong answers

Option B is wrong because making the S3 bucket private and using pre-signed URLs for CloudFront adds unnecessary complexity; CloudFront does not natively generate pre-signed URLs for origin requests, and this would require custom logic to sign each request, defeating the 'minimal configuration' requirement. Option C is wrong because using AWS WAF to block direct access by checking the Referer header is unreliable—the Referer header can be spoofed or omitted by clients, and it does not prevent direct S3 URL access from scripts or tools that don't send a Referer. Option D is wrong because creating a VPC endpoint for S3 and restricting access to CloudFront IP addresses is not feasible; CloudFront uses a large, dynamic set of global IP addresses that are not static, and maintaining an allow list of those IPs would require constant updates and is not a 'minimal configuration' solution.

Full explanation →
193
MCQmedium

Regulatory requirements mandate that all RDS and EBS backups are replicated to a secondary AWS region within 24 hours of creation. The company has workloads in us-east-1 and must replicate backups to eu-west-1. Restoring from the secondary region must be possible without manual copying steps during a disaster. What service and configuration implements this requirement?

A.Create an AWS Backup plan with a cross-Region copy rule that replicates recovery points to a backup vault in eu-west-1 within 24 hours
B.Schedule a Lambda function that calls CreateDBSnapshot and CopyDBSnapshot to replicate RDS snapshots, and CreateSnapshot and CopySnapshot for EBS volumes to eu-west-1
C.Enable RDS automated backups with cross-region replication and configure EBS snapshot copy separately using Data Lifecycle Manager
D.Use S3 Cross-Region Replication to replicate the backup bucket containing RDS and EBS snapshots to eu-west-1
AnswerA

AWS Backup's cross-Region copy rule runs automatically after each successful backup job. The copy is encrypted with the destination vault's KMS key. In a disaster, operators restore directly from the eu-west-1 vault — no manual cross-region data transfer is needed. A single backup plan can cover multiple resource types (RDS and EBS), satisfying the consolidated requirement.

Why this answer

AWS Backup is the correct service because it natively supports cross-Region copy rules that automatically replicate recovery points (including RDS snapshots and EBS snapshots) to a backup vault in a secondary Region within a specified time window. This meets the 24-hour replication requirement and enables direct restores from the secondary Region without manual copying, as the backup vault in eu-west-1 contains the replicated recovery points ready for use.

Exam trap

The trap here is that candidates often assume they need to use separate services (like Lambda or DLM) for each resource type, missing that AWS Backup provides a unified, managed solution that handles both RDS and EBS snapshots with cross-Region replication and direct restore capabilities.

How to eliminate wrong answers

Option B is wrong because while a Lambda function could technically replicate snapshots, it requires custom code, error handling, and scheduling, and does not provide the native, managed cross-Region restore capability without manual steps; it also lacks the built-in compliance tracking of AWS Backup. Option C is wrong because RDS automated backups with cross-Region replication only apply to RDS, not EBS volumes, and Data Lifecycle Manager (DLM) for EBS snapshots does not support cross-Region copy natively; DLM only copies within the same Region, so EBS snapshots would not be replicated to eu-west-1. Option D is wrong because S3 Cross-Region Replication replicates objects in an S3 bucket, but RDS and EBS snapshots are not stored as S3 objects by default; they are stored in AWS-managed snapshot storage, and even if you manually copy snapshots to S3, the replication would not create usable snapshots in the secondary Region for direct restore.

Full explanation →
194
MCQhard

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The operations team uses CloudWatch alarms to monitor the application's health. Recently, they noticed that the application's error rate has increased sporadically, but the CPU utilization and memory usage remain normal. The team suspects that the issue is related to a specific HTTP endpoint returning 5xx errors. They want to set up monitoring that will alert them when the error rate exceeds 5% of total requests over a 5-minute period. The application logs are already sent to CloudWatch Logs. Which combination of steps should the SysOps administrator take to meet this requirement?

A.Create a metric filter in CloudWatch Logs to extract error codes and total requests from the application logs. Create two custom metrics: one for error count and one for total requests. Then create a CloudWatch alarm using a math expression that calculates error rate (error count / total requests) and triggers when >0.05 for 5 minutes.
B.Enable AWS X-Ray on the application to trace requests and identify error patterns. Create a CloudWatch alarm on the X-Ray error rate metric.
C.Install the CloudWatch agent on the EC2 instances to collect application-level metrics. Configure the agent to emit a custom metric for error rate. Then create an alarm on that metric.
D.Enable detailed monitoring on the ALB and create a CloudWatch alarm on the HTTPCode_ELB_5XX metric with a threshold of 5% of the request count. Use the ALB's RequestCount metric to compute the percentage.
AnswerA

This is the correct approach because the application logs are already flowing into CloudWatch Logs, and a metric filter can parse them in real time to extract both the number of error codes (e.g., status codes or application-specific errors) and the total request count. By creating two custom metrics—ErrorCount and TotalRequests—you can then define a CloudWatch alarm using a metrics math expression such as e1/e2, with the alarm triggering when the ratio exceeds 0.05 for a 5-minute period. This leverages the existing log data without requiring additional instrumentation or external services, and it accurately reflects application-level error rates as observed in the logs.

Why this answer

It creates a metric filter on the log group to count errors and total requests, then an alarm on the error rate. Option B is wrong because AWS X-Ray is for tracing, not for error rate monitoring from logs. Option C is wrong because it relies on the CloudWatch agent to generate metrics, which is not already set up.

Option D is wrong because it uses the ALB's HTTPCode_ELB_5XX metric, but the issue is application-specific, not ALB-level.

Full explanation →
195
MCQhard

A company has an S3 bucket that stores sensitive customer data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS with a specific customer managed key. Which bucket policy condition should be used to enforce this?

A."Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}
B."Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms", "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}
C."Condition": {"StringEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}
D."Condition": {"Null": {"s3:x-amz-server-side-encryption": "false"}}
AnswerB

Combines both conditions to enforce KMS encryption and the specific customer managed key, meeting the requirement.

Why this answer

It uses both conditions: 's3:x-amz-server-side-encryption' set to 'aws:kms' ensures that objects are encrypted with SSE-KMS, and 's3:x-amz-server-side-encryption-aws-kms-key-id' set to the specific key ARN ensures that only the designated customer managed key is used. Option A enforces KMS encryption but does not restrict which KMS key, allowing any managed key. Option C enforces a specific key ARN but does not require the encryption header to be present, which could allow objects without encryption if the key ID header is omitted (though in practice, the key ID is only valid with SSE-KMS, the condition alone is not sufficient to guarantee encryption).

Option D uses a 'Null' condition incorrectly and would not properly enforce encryption.

Full explanation →
196
MCQhard

A SysOps administrator is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 healthy instances. What should the administrator check FIRST?

A.The CodeDeploy agent version on the instances
B.The Auto Scaling group's minimum size
C.The load balancer health check configuration
D.The ApplicationStop lifecycle event hook script in the AppSpec file
AnswerD

The ApplicationStop lifecycle event hook script in the AppSpec file is the correct cause. This hook runs on each instance before the new application revision is installed, and if it exits with a non-zero code or hangs, CodeDeploy marks that instance's deployment as failed. Each failed instance reduces the count of healthy instances, and once that count falls below the minimum healthy threshold, the overall deployment fails with the exact error observed. Therefore, checking this script for syntax errors, missing dependencies, or permission issues is the first troubleshooting step.

Why this answer

The ApplicationStop lifecycle event hook script in the AppSpec file often fails with a non-zero exit code, causing the deployment to fail with this error. The error indicates that too many instances failed or are unhealthy, and the most common cause is a faulty script. Option A is incorrect because the CodeDeploy agent version is not the first thing to check; the error is about instance failures during deployment, not agent issues.

Option B is incorrect because the Auto Scaling group's minimum size is already set to 2, and the error is not about group size but about individual instance health. Option C is incorrect because a load balancer health check configuration problem would result in a different error related to health check failures, not the specific message about instance deployment failures.

Full explanation →
197
MCQeasy

A company runs a batch processing application on Amazon EC2 that runs for 2 hours every night. The workload can tolerate interruptions. Which EC2 purchasing option provides the lowest cost for this use case?

A.On-Demand Instances
B.Reserved Instances
C.Spot Instances
D.Dedicated Hosts
AnswerC

Spot Instances operate using spare EC2 capacity that AWS makes available at a significantly reduced hourly rate—often up to 90% off On-Demand pricing. This is the best fit here because the nightly 2-hour batch is both short and fault-tolerant: if capacity is reclaimed, work can be re-queued or resumed without violating the batch window. You can further reduce interruption risk by using a Spot Fleet with multiple instance types and by implementing checkpointing so progress is saved between runs. The result is a dramatic cost reduction for a workload that would otherwise be idling and paying full price.

Why this answer

Spot Instances are the correct choice because the workload is fault-tolerant, runs for a fixed 2-hour window nightly, and can tolerate interruptions. Spot Instances offer significant cost savings (up to 90% off On-Demand) by using spare EC2 capacity, which aligns perfectly with a batch job that can be retried if interrupted.

Exam trap

The trap here is that candidates may choose Reserved Instances because they see a predictable nightly schedule, but they overlook that Reserved Instances are cost-effective only for 24/7 workloads, not for short, interruptible batch jobs where Spot Instances provide far greater savings.

How to eliminate wrong answers

Option A is wrong because On-Demand Instances provide no discount and are not cost-optimal for a predictable, interruptible workload. Option B is wrong because Reserved Instances require a 1- or 3-year commitment and are designed for steady-state, always-on workloads, not a short 2-hour nightly batch job. Option D is wrong because Dedicated Hosts are a physical server dedicated to a single customer, incurring high costs for licensing or compliance needs, and are overkill for a batch processing application that can tolerate interruptions.

Full explanation →
198
MCQmedium

A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB terminates SSL/TLS and forwards traffic to the instances over HTTP. The SysOps administrator needs to capture the original client IP address in the instance logs. How should the administrator configure this?

A.Enable stickiness on the ALB target group.
B.Enable the X-Forwarded-For header on the ALB.
C.Configure the ALB to use Proxy Protocol v2.
D.Enable access logs on the ALB and store them in Amazon S3.
AnswerB

The ALB automatically adds the X-Forwarded-For header to each HTTP/HTTPS request as it passes through, containing the original client IP address in a comma-separated list. Since the ALB terminates the client's TLS connection and opens a new connection to the target, the EC2 instance must read this header to record the client IP in its logs. By default, the ALB overwrites any existing X-Forwarded-For header to prevent client spoofing, and you should configure your web server or application to log the first IP in the header, which is the true client IP.

Why this answer

When an Application Load Balancer terminates SSL/TLS and forwards traffic to EC2 instances over HTTP, the original client IP address is preserved by the ALB in the X-Forwarded-For header. By enabling this header on the ALB, the SysOps administrator ensures that the web server or application can log the true client IP, which is essential for analytics, security, and troubleshooting.

Exam trap

The trap here is that candidates confuse Proxy Protocol v2 (used for NLB TCP/UDP listeners) with the X-Forwarded-For header (used for ALB HTTP/HTTPS listeners), leading them to select option C even though it is not applicable to ALB's HTTP-based forwarding.

How to eliminate wrong answers

Option A is wrong because enabling stickiness (session affinity) on the ALB target group only ensures that requests from the same client are routed to the same target instance; it does not capture or forward the original client IP address. Option C is wrong because Proxy Protocol v2 is used with Network Load Balancers (NLB) or TCP listeners, not with Application Load Balancers (ALB) which use HTTP/HTTPS listeners and rely on the X-Forwarded-For header for client IP preservation. Option D is wrong because enabling ALB access logs and storing them in Amazon S3 captures request details including client IP, but it does not inject the original client IP into the instance logs; the instance logs still see the ALB's private IP unless the X-Forwarded-For header is used.

Full explanation →
199
MCQhard

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway. The private subnet has an EC2 instance that needs to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely cause?

A.The network ACL for the private subnet blocks outbound HTTP traffic.
B.The security group of the EC2 instance blocks outbound traffic.
C.The NAT Gateway is deployed in a private subnet.
D.The NAT Gateway does not have an Elastic IP address.
AnswerC

Correct. A NAT Gateway must be deployed in a public subnet with a route to an Internet Gateway. If it is in a private subnet, it cannot access the internet, breaking the connectivity for instances using it.

Why this answer

A NAT Gateway must be deployed in a public subnet with a route to an Internet Gateway. If the NAT Gateway is in a private subnet, it cannot access the internet, and thus the instances in the private subnet cannot reach the internet via it. Option A is incorrect because network ACLs by default allow all outbound traffic; even if they block HTTP, the instance might still reach other services, but the core issue is the NAT Gateway placement.

Option B is incorrect because security groups by default allow all outbound traffic; unless explicitly modified, outbound is not blocked. Option D is incorrect because while a NAT Gateway does require an Elastic IP to communicate with the internet, the more fundamental and likely cause is that the NAT Gateway is in a private subnet, which renders it non-functional regardless of Elastic IP.

Full explanation →
200
MCQmedium

Refer to the exhibit. The alarm has been in INSUFFICIENT_DATA state for several hours. What is the most likely cause?

A.The alarm evaluation period is too long.
B.The EC2 instance is stopped or terminated.
C.The instance has no CloudWatch agent installed.
D.The instance is running but the CPU utilization is below the threshold.
AnswerB

If the instance is stopped, no metrics are emitted.

Why this answer

The INSUFFICIENT_DATA state for several hours indicates that CloudWatch has not received any metric data points for the specified period. If the EC2 instance is stopped or terminated, the CloudWatch agent stops sending metrics, and the default CPU utilization metric (which is published by AWS, not the agent) also ceases because the instance is no longer running. This causes the alarm to remain in INSUFFICIENT_DATA indefinitely until the instance is started again or the metric resumes.

Exam trap

The trap here is that candidates often confuse INSUFFICIENT_DATA with ALARM or OK states, mistakenly thinking low CPU utilization or missing CloudWatch agent would cause this state, when in fact INSUFFICIENT_DATA strictly means no metric data has been received at all for the evaluation period.

How to eliminate wrong answers

Option A is wrong because the alarm evaluation period being too long would only delay transitions between states, but it would not cause a permanent INSUFFICIENT_DATA state; data would still be collected and eventually evaluated. Option C is wrong because the CPU utilization metric is a default EC2 metric published by AWS automatically without requiring the CloudWatch agent; the agent is only needed for custom or OS-level metrics. Option D is wrong because if the instance is running and CPU utilization is below the threshold, the alarm would be in ALARM or OK state (depending on the comparison operator), not INSUFFICIENT_DATA; INSUFFICIENT_DATA specifically means no data points are available, not that data exists but is below a threshold.

Full explanation →
201
MCQhard

A company has a production environment with multiple EC2 instances running a web application. The SysOps administrator wants to automate the remediation of instances that fail the EC2 status check. Which approach should the administrator use?

A.Create a CloudWatch alarm on the StatusCheckFailed metric and configure an SNS notification to alert the team.
B.Use AWS Systems Manager Automation to create a document that runs a script on the instance to fix the issue.
C.Create an Amazon EventBridge rule that matches EC2 status check failures and triggers an AWS Lambda function to terminate the instance and launch a new one.
D.Configure the Auto Scaling group's health check to use EC2 status checks and set a custom termination policy.
AnswerC

EventBridge can detect failures and Lambda can automate replacement.

Why this answer

It provides a fully automated, event-driven remediation workflow. When an EC2 instance fails a status check, an EventBridge rule detects the state change and triggers a Lambda function that terminates the unhealthy instance and launches a replacement. This approach directly addresses the requirement to automate remediation without manual intervention.

Exam trap

The trap here is that candidates often choose Option A (SNS alerting) because they think notification is sufficient, but the question explicitly asks for 'automate the remediation,' which requires an action beyond alerting.

How to eliminate wrong answers

Option A is wrong because SNS notifications only alert the team; they do not automate any remediation action. Option B is wrong because Systems Manager Automation documents can run scripts on an instance, but if the instance has failed a status check (e.g., impaired networking or OS-level failure), the SSM agent may be unreachable or unable to execute commands, making this approach unreliable for remediation. Option D is wrong because while Auto Scaling group health checks can use EC2 status checks, a custom termination policy does not exist as a native feature; termination policies are predefined (e.g., OldestInstance, NewestInstance) and cannot be custom-coded to trigger instance replacement based on status check failures alone.

Full explanation →
202
MCQhard

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?

A.The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.
B.The NAT Gateway has an Elastic IP assigned.
C.The security group for the NAT Gateway allows inbound traffic from the private subnet.
D.The internet gateway is attached to the VPC.
AnswerA

Without this route, traffic from private instances cannot reach the NAT Gateway, so they cannot access the internet.

Why this answer

The first thing to check when private instances cannot reach an external service is the route table for the private subnet. The private subnet must have a route 0.0.0.0/0 pointing to the NAT Gateway to route internet-bound traffic through it. Option B is incorrect because the NAT Gateway must have an Elastic IP to be reachable from the internet, but the issue described is outbound access from private instances; the NAT Gateway's Elastic IP is necessary but not the first check.

Option C is incorrect because security groups for NAT Gateways are not used; NAT Gateways do not have security groups; instead, network ACLs on the subnets control traffic. Option D is incorrect because the internet gateway must be attached to the VPC for the NAT Gateway to work, but if private instances cannot reach the external service, the routing from the private subnet to the NAT Gateway is the primary suspect.

Full explanation →
203
MCQmedium

Operators have been making direct changes to AWS resources (security group rules, IAM policy modifications) that were originally created by CloudFormation stacks. The team wants to identify which stacks and specific resources have drifted from their template definitions. What is the correct tool and operation sequence?

A.Run drift detection on each CloudFormation stack; review the results in the Drift status panel to see which resources have MODIFIED or DELETED status
B.Enable AWS Config conformance packs that check CloudFormation stack compliance against desired template states
C.Re-deploy all stacks with the original templates using CloudFormation update-stack to overwrite any manual changes
D.Use AWS Trusted Advisor to identify resources that have been modified outside of their originating CloudFormation stacks
AnswerA

Drift detection calls AWS APIs to read the current configuration of each resource and compares it to the template. Resources with live configurations differing from the template are marked MODIFIED. Deleted resources outside the stack are marked DELETED. The results show the exact property-level differences, enabling targeted remediation.

Why this answer

AWS CloudFormation drift detection is the correct tool because it directly compares the current state of resources in a stack (including security group rules and IAM policies) against the stack's template definitions. Running drift detection on each stack and reviewing the Drift status panel reveals which resources have been modified or deleted outside of CloudFormation, providing the exact identification the team needs.

Exam trap

The trap here is that candidates may confuse drift detection with compliance checks (AWS Config) or remediation actions (update-stack), but the question specifically asks for identification of drifted stacks and resources, not remediation or compliance evaluation.

How to eliminate wrong answers

Option B is wrong because AWS Config conformance packs evaluate resource compliance against rules, not against CloudFormation template states; they cannot detect drift from a specific stack template. Option C is wrong because re-deploying stacks with update-stack overwrites manual changes but does not identify which stacks or resources have drifted; it is a remediation action, not a detection tool. Option D is wrong because AWS Trusted Advisor checks for best practices and cost optimization, not for drift between CloudFormation templates and actual resource configurations.

Full explanation →
204
MCQmedium

A company is running a web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent latency spikes. The SysOps administrator needs to identify the root cause. Which set of CloudWatch metrics should be analyzed first?

A.ALB TargetResponseTime and EC2 CPUUtilization
B.EC2 CPUUtilization and NetworkIn
C.EC2 StatusCheckFailed and ALB UnhealthyHostCount
D.ALB RequestCount and HealthyHostCount
AnswerA

TargetResponseTime directly measures latency; CPUUtilization may indicate resource contention.

Why this answer

Intermittent latency spikes in a web application behind an Application Load Balancer (ALB) are most directly investigated by correlating ALB TargetResponseTime (which measures the time taken for the target to respond to the ALB) with EC2 CPUUtilization (which indicates whether the instance is under compute pressure). A spike in TargetResponseTime alongside high CPUUtilization suggests the EC2 instance is struggling to process requests, pointing to a compute bottleneck as the root cause.

Exam trap

The trap here is that candidates often confuse latency metrics with availability metrics, choosing options like C or D that indicate failures or traffic volume, rather than the performance-specific metrics needed to diagnose intermittent slowness.

How to eliminate wrong answers

Option B is wrong because while EC2 CPUUtilization is relevant, NetworkIn alone does not directly indicate latency; high network input could be normal traffic and does not measure response time or processing delays. Option C is wrong because EC2 StatusCheckFailed and ALB UnhealthyHostCount indicate instance or health check failures, not intermittent latency spikes; these metrics would show binary health states, not gradual performance degradation. Option D is wrong because ALB RequestCount and HealthyHostCount measure traffic volume and target health, not response latency; high request count alone does not explain why responses are slow.

Full explanation →
205
MCQeasy

A company has an application running on EC2 instances in a VPC. The application needs to access an S3 bucket in the same AWS region. Which configuration provides the MOST secure and cost-effective access?

A.Make the S3 bucket publicly accessible and use the public endpoint from the EC2 instances.
B.Set up a NAT Gateway in a public subnet and route traffic from the EC2 instances through it to the S3 endpoint.
C.Create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets.
D.Create an Internet Gateway and route traffic from the EC2 instances through it to a public S3 endpoint.
AnswerC

Gateway Endpoint provides private, secure, and free connectivity to S3 within the same region.

Why this answer

A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 directly over the AWS network without traversing the internet, eliminating the need for a NAT Gateway or Internet Gateway. This provides the most secure and cost-effective access by keeping traffic within the AWS backbone and avoiding data transfer costs associated with NAT Gateways or public endpoints.

Exam trap

The trap here is that candidates often confuse VPC Gateway Endpoints with VPC Interface Endpoints (powered by AWS PrivateLink), but for S3, a Gateway Endpoint is the correct and most cost-effective choice because it does not require an Elastic Network Interface or incur hourly charges, unlike an Interface Endpoint.

How to eliminate wrong answers

Option A is wrong because making the S3 bucket publicly accessible exposes it to the entire internet, violating security best practices and potentially leading to unauthorized access or data breaches. Option B is wrong because a NAT Gateway incurs hourly charges and data processing costs, and it routes traffic through the internet unnecessarily, making it less cost-effective and less secure than a VPC Gateway Endpoint. Option D is wrong because an Internet Gateway is designed for public internet access, and routing EC2 traffic through it to a public S3 endpoint exposes the traffic to the internet, increasing latency and security risks while adding unnecessary complexity and cost.

Full explanation →
206
MCQmedium

A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application stores session state in memory on each instance. The SysOps administrator wants to make the application highly available across multiple Availability Zones without losing session data when instances are terminated or replaced. The solution must minimize application changes. Which approach should the administrator take?

A.Use sticky sessions (session affinity) on the ALB and configure the Auto Scaling group with a larger min size.
B.Store session data in a shared Amazon ElastiCache cluster and modify the application to read/write session state to ElastiCache.
C.Deploy the application in multiple AWS Regions and use Amazon Route 53 with latency-based routing.
D.Store session data in an Amazon RDS for MySQL database and configure the application to read/write session state to the database.
AnswerB

ElastiCache provides a centralized, in-memory data store (such as Redis) that can be shared by all EC2 instances in the Auto Scaling group. By moving session state to ElastiCache, the application becomes stateless at the instance level, so any instance can serve any user request without losing session data. ElastiCache supports replication and automatic failover, making session data highly available across Availability Zones. This directly satisfies the HA requirement and is the best practice for a decoupled web tier.

Why this answer

Storing session state in a shared Amazon ElastiCache cluster decouples session data from individual EC2 instances, allowing any instance in the Auto Scaling group to serve any user request without losing session data when instances are terminated or replaced. This approach requires minimal application changes (only modifying the session handler to point to ElastiCache) and supports high availability across multiple Availability Zones by using a replicated ElastiCache cluster (e.g., Redis with replication).

Exam trap

The trap here is that candidates often choose sticky sessions (Option A) because they seem to solve session affinity without code changes, but they fail to realize that sticky sessions do not persist session data across instance terminations, which is the core requirement for high availability without data loss.

How to eliminate wrong answers

Option A is wrong because sticky sessions (session affinity) bind a user's session to a specific EC2 instance; if that instance is terminated or replaced, the session data stored in memory is lost, violating the requirement to not lose session data. Option C is wrong because deploying across multiple AWS Regions with Route 53 latency-based routing does not address session state persistence within a single region; it introduces cross-region latency and complexity without solving the fundamental issue of in-memory session loss on instance termination. Option D is wrong because while storing session data in Amazon RDS for MySQL would persist session state, it introduces significant overhead (e.g., database connection management, schema design, and slower read/write compared to in-memory caching) and requires more extensive application changes than using ElastiCache, which is purpose-built for session storage.

Full explanation →
207
MCQeasy

A company wants to ensure that its Amazon RDS database can withstand the loss of an entire Availability Zone. Which feature should the SysOps administrator enable?

A.Enable automated backups with a retention period of 35 days.
B.Enable Multi-AZ deployment.
C.Take manual snapshots and copy them to another Region.
D.Create a read replica in a different Availability Zone.
AnswerB

Multi-AZ provides automatic failover to a standby in another AZ.

Why this answer

Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary AZ fails, Amazon RDS automatically fails over to the standby, ensuring database availability without manual intervention. This is the only option that directly protects against an entire AZ loss by maintaining a hot standby in a separate AZ.

Exam trap

The trap here is that candidates often confuse a read replica with a Multi-AZ standby, assuming that a read replica in a different AZ can be promoted for failover, but read replicas are asynchronous and require manual promotion, whereas Multi-AZ provides automatic synchronous failover.

How to eliminate wrong answers

Option A is wrong because automated backups with a retention period of 35 days only provide point-in-time recovery to a specific time, not automatic failover or high availability; they do not protect against AZ loss as they are stored within the same Region but not in a separate AZ for immediate failover. Option C is wrong because manual snapshots copied to another Region provide disaster recovery across Regions, not high availability within a Region; they require manual restoration and do not offer automatic failover if an AZ fails. Option D is wrong because a read replica in a different AZ is an asynchronous copy used for offloading read traffic, not for automatic failover; it does not provide synchronous replication or automatic promotion to primary in case of AZ failure, and promoting it requires manual intervention.

Full explanation →
208
MCQhard

An organization uses AWS OpsWorks for configuration management. The SysOps administrator notices that a stack's instances are not receiving the updated custom cookbooks after a new deployment. The cookbooks are stored in a private GitHub repository. What is the most likely cause?

A.The cookbooks are not stored in an S3 bucket.
B.The OpsWorks agent is not running on the instances.
C.The instances do not have internet access.
D.The SSH key for the Git repository is not configured in the stack.
AnswerD

Correct. AWS OpsWorks uses the SSH key stored in the stack configuration to authenticate with private GitHub repositories. If the key is missing or invalid, the instances cannot download the updated cookbooks, causing the failure.

Why this answer

AWS OpsWorks uses the SSH key configured in the stack to clone private Git repositories. Without a valid SSH key, the cookbook update fails silently. Option A is incorrect because cookbooks can be stored in S3 or Git; S3 is not required.

Option B is incorrect because the OpsWorks agent must be running, but the symptom of a missing SSH key is specific to private repositories. Option C is incorrect while instances need internet access to reach GitHub, a missing SSH key is a more specific cause for private repos.

Full explanation →
209
MCQmedium

A company runs a batch processing application on Amazon EC2 instances every night. The job takes exactly 1 hour to complete and is time-sensitive. The SysOps administrator wants to minimize compute costs while ensuring the job can be interrupted and resumed if needed. Which EC2 purchasing option is most cost-effective?

A.On-Demand Instances
B.Reserved Instances (Standard 1-year)
C.Spot Instances
D.Dedicated Hosts
AnswerC

Spot Instances let you bid for unused EC2 capacity at discounts of up to 90% compared to On-Demand pricing. AWS can reclaim that capacity with a two-minute interruption notice, but because this batch processing job is checkpointed and resumable, an interruption simply means restarting from the last saved state and continuing toward completion. This makes Spot the most cost-effective option for this workload, especially since the job is inherently fault-tolerant and runs only for short periods.

Why this answer

Spot Instances are the most cost-effective option because the batch job is fault-tolerant (can be interrupted and resumed) and runs for exactly 1 hour nightly. Spot Instances offer up to 90% discount compared to On-Demand, and with the ability to handle interruptions via checkpointing, they meet the requirement for cost minimization while supporting resumption.

Exam trap

The trap here is that candidates often assume Spot Instances are unsuitable for time-sensitive jobs due to potential interruptions, but the question explicitly states the job can be interrupted and resumed, making Spot the correct cost-effective choice over Reserved Instances or On-Demand.

How to eliminate wrong answers

Option A is wrong because On-Demand Instances provide no discount and are the most expensive option for a predictable nightly workload, failing to minimize costs. Option B is wrong because Reserved Instances require a 1-year commitment and are not cost-effective for a job that runs only 1 hour per night, as the upfront cost would not be amortized efficiently. Option D is wrong because Dedicated Hosts are designed for licensing or compliance requirements, not for cost savings, and are significantly more expensive than other options for this use case.

Full explanation →
210
Multi-Selecteasy

Which TWO security measures should be implemented to protect a VPC from DDoS attacks? (Choose two.)

Select 2 answers
A.Use AWS WAF with rate-based rules
B.Enable AWS Shield Advanced
C.Apply network ACLs with deny rules
D.Use restrictive security groups
E.Enable VPC Flow Logs
AnswersA, B

AWS WAF rate-based rules are specifically engineered to mitigate application-layer DDoS attacks by tracking the number of requests from a single client IP within a set time window. When the request count exceeds the configured threshold, AWS WAF blocks subsequent traffic from that IP for the rule's duration, effectively limiting the volume of requests that can reach your origin. This provides an automated, scalable defense that can be attached to Amazon CloudFront, ALB, or API Gateway, and it allows you to fine-tune thresholds based on your normal traffic baseline.

Why this answer

AWS Shield Advanced provides DDoS protection. Using a web application firewall (WAF) at the edge helps filter malicious traffic. Security groups and NACLs are not effective against DDoS at scale.

Full explanation →
211
MCQmedium

A company's security policy requires that all Amazon RDS for PostgreSQL instances be encrypted at rest using AWS Key Management Service (KMS) customer managed keys and have automated backups enabled with a retention period of at least 30 days. A SysOps administrator needs to use AWS Config to automatically detect any RDS instance that is non-compliant with either requirement and automatically remediate it. Which combination of AWS Config managed rules and remediation actions should be used?

A.Use two AWS Config managed rules: 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure each rule with an automatic remediation action that triggers an Amazon CloudWatch alarm, which then invokes an AWS Lambda function to enable encryption and backups.
B.Create custom AWS Config rules as AWS Lambda functions that evaluate the RDS instance configuration. In the Lambda function, if a resource is non-compliant, call the RDS API to enable encryption and modify backup settings.
C.Use the AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure automatic remediation for each rule using the corresponding AWS Systems Manager Automation runbook: 'AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup'.
D.Use a single custom AWS Config rule that checks both encryption and backup settings. If non-compliant, trigger an AWS Lambda function that uses the RDS API to configure both settings.
AnswerC

This is the correct approach. Managed rules evaluate compliance, and automatic remediation using Systems Manager Automation runbooks applies the fix without custom code. The runbooks perform the necessary API calls to enable encryption and backups, meeting the policy requirements.

Why this answer

AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled' natively evaluate encryption and backup compliance. The corresponding AWS Systems Manager Automation runbooks ('AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup') provide built-in, automatic remediation without custom code, aligning with the requirement to use managed rules and automatic remediation.

Exam trap

The trap here is that candidates may assume custom Lambda functions are required for complex remediation, but AWS provides pre-built Systems Manager Automation runbooks that integrate directly with AWS Config managed rules for common RDS compliance issues, making custom code unnecessary.

How to eliminate wrong answers

Option A is wrong because triggering a CloudWatch alarm to invoke a Lambda function is an indirect, custom remediation path; AWS Config supports direct automatic remediation via Systems Manager Automation runbooks, making this approach unnecessarily complex and not leveraging native capabilities. Option B is wrong because creating custom AWS Config rules as Lambda functions violates the requirement to use AWS Config managed rules; the question explicitly asks for managed rules, not custom ones. Option D is wrong because using a single custom rule that checks both encryption and backups is not a managed rule, and it requires custom Lambda code for remediation, which contradicts the directive to use managed rules and automatic remediation actions.

Full explanation →
212
MCQmedium

A company hosts a critical web application on Amazon EC2 instances in a single AWS Region (us-east-1). The SysOps administrator needs to implement a Disaster Recovery (DR) solution using a different AWS Region (us-west-2). The DR plan requires a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 15 minutes. The application uses an Amazon Aurora MySQL DB cluster and static assets stored in an Amazon S3 bucket. Which combination of actions should the administrator take to meet these requirements?

A.Create an Aurora cross-Region read replica in us-west-2. Configure S3 Cross-Region Replication from the source bucket to a destination bucket in us-west-2. During DR, promote the read replica to a primary cluster and update DNS.
B.Take a manual snapshot of the Aurora DB cluster every 15 minutes and copy it to us-west-2. Use S3 batch operations to copy assets to us-west-2 daily.
C.Enable Aurora Multi-AZ in us-east-1 and configure S3 transfer acceleration to us-west-2.
D.Use AWS Database Migration Service (DMS) for continuous replication to a DB instance in us-west-2. Use S3 versioning to keep previous object versions.
AnswerA

A cross-Region read replica provides continuous replication for the database, achieving RPO seconds. Promoting it can be done in minutes, meeting RTO of 1 hour. S3 CRR replicates objects asynchronously, typically within minutes, satisfying the RPO.

Why this answer

Aurora cross-Region read replicas provide asynchronous replication with an RPO typically under 1 second, easily meeting the 15-minute RPO requirement. Promoting the read replica to a primary cluster in us-west-2 can be completed within minutes, satisfying the 1-hour RTO. S3 Cross-Region Replication (CRR) automatically replicates static assets to the destination bucket in us-west-2 with near-real-time latency, ensuring the S3 data is also current within the RPO window.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which provides high availability within a single region) with cross-region disaster recovery, or they assume manual snapshots and DMS are simpler alternatives without considering the RPO/RTO constraints and operational overhead.

How to eliminate wrong answers

Option B is wrong because taking manual snapshots every 15 minutes is operationally impractical and cannot guarantee an RPO of 15 minutes due to snapshot creation and copy latency; also, copying assets daily via S3 batch operations far exceeds the 15-minute RPO. Option C is wrong because Aurora Multi-AZ in us-east-1 only provides high availability within a single region, not cross-region disaster recovery, and S3 Transfer Acceleration only improves upload speed to a single bucket, not replication to another region. Option D is wrong because AWS DMS for continuous replication to a DB instance in us-west-2 introduces additional complexity and potential lag that may not meet the 15-minute RPO as reliably as Aurora native replication; S3 versioning alone does not replicate objects to another region, so it fails to provide cross-region DR for static assets.

Full explanation →
213
MCQeasy

An organization is using AWS CloudFormation to manage its infrastructure. The SysOps administrator wants to update a stack that includes an Amazon RDS DB instance. The update requires changing the DB instance class. However, the administrator wants to minimize downtime. What should the administrator do?

A.Use CloudFormation's 'DeletionPolicy' attribute to retain the database during updates.
B.Enable Multi-AZ on the DB instance (if not already enabled) before performing the stack update.
C.Update the stack directly with 'ApplyImmediately' set to true.
D.Create a read replica, promote it, and then delete the original DB instance.
AnswerB

Enabling Multi-AZ gives the DB instance a standby replica in a different Availability Zone, which RDS can fail over to during maintenance. When a stack update changes the DB instance class, RDS applies the modification to the standby first, performs a failover, and then updates the former primary—this keeps the database available during the transition. Because the failover only causes a brief connection interruption rather than a full shutdown, Multi-AZ is the correct way to minimize downtime during an instance class update.

Why this answer

Enabling Multi-AZ allows the RDS instance to have a standby in a different Availability Zone. When updating the DB instance class, CloudFormation can modify the standby first, then fail over to it, minimizing downtime. Options A, C, and D are incorrect: A (DeletionPolicy) controls resource retention on stack deletion, not updates; C (ApplyImmediately) may cause a brief outage; D (read replica promotion) is for scaling reads, not for minimizing downtime during instance class changes.

Full explanation →
214
MCQeasy

A company wants to establish a dedicated, low-latency, private connection between its on-premises data center and an AWS VPC. The company does not want to use the public internet. Which AWS service should be used to meet this requirement?

A.AWS Direct Connect
B.AWS Virtual Private Gateway
C.AWS Transit Gateway
D.VPC Peering
AnswerA

Correct. AWS Direct Connect provides a dedicated private connection between on-premises and AWS, avoiding the public internet.

Why this answer

AWS Direct Connect is the correct service because it provides a dedicated, private, low-latency network connection from an on-premises data center to AWS, bypassing the public internet entirely. It uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a VPC, ensuring consistent network performance and reduced latency.

Exam trap

The trap here is that candidates often confuse AWS Virtual Private Gateway (a required attachment for Direct Connect) with the Direct Connect service itself, or they assume VPC Peering can extend to on-premises networks, but VPC Peering is strictly limited to inter-VPC connectivity within AWS.

How to eliminate wrong answers

Option B (AWS Virtual Private Gateway) is wrong because it is a logical component that attaches to a VPC to enable VPN or Direct Connect connections, but it is not a service that itself provides a dedicated private connection; it requires Direct Connect or a VPN to function. Option C (AWS Transit Gateway) is wrong because it is a network transit hub used to interconnect multiple VPCs and on-premises networks, but it does not provide the dedicated physical connection itself; it relies on Direct Connect or VPN for the on-premises link. Option D (VPC Peering) is wrong because it only connects two VPCs within AWS using the AWS global network, and it cannot be used to connect an on-premises data center to a VPC.

Full explanation →
215
MCQhard

A company uses AWS Direct Connect to connect its on-premises network to AWS. The SysOps team notices that traffic from the on-premises network to a VPC is not using the Direct Connect connection but instead is going over the internet. The VPC has a virtual private gateway attached and the on-premises router is advertising a specific route. What is the most likely cause?

A.The on-premises network does not have a route to the VPC CIDR.
B.The VPC route table has a more specific route (e.g., 0.0.0.0/0) pointing to an Internet Gateway.
C.The BGP session between the on-premises router and the Direct Connect router is down.
D.The virtual private gateway is not attached to the VPC.
AnswerC

If the BGP session is down, the on-premises router cannot exchange routes with the Direct Connect router, so it loses the Direct Connect path to the VPC and falls back to internet routing. This is the most likely cause.

Why this answer

The BGP session between the on-premises router and the Direct Connect router is down. When BGP is down, the on-premises router cannot exchange routes with the AWS side over Direct Connect. Even though the on-premises router may be advertising a specific route, without an active BGP session, that route is not received by the Direct Connect router, and the virtual private gateway does not propagate it into the VPC.

As a result, traffic from the on-premises network to the VPC falls back to using the internet route instead of Direct Connect. Option B is incorrect because the VPC route table controls outbound traffic from the VPC, not inbound traffic from on-premises; a default route to an Internet Gateway would cause asymmetric routing for return traffic but would not prevent inbound traffic from using Direct Connect if the BGP session is active.

Exam trap

The trap is that candidates often suspect VPC route misconfigurations or virtual private gateway attachment issues, but the core problem is a failed BGP session on the Direct Connect link, which stops route exchange between on-premises and AWS.

How to eliminate wrong answers

Option A is wrong because if the on-premises network lacked a route to the VPC CIDR, traffic would not reach the VPC at all, but the scenario states traffic is going over the internet, indicating a route exists but is misdirected. Option C is wrong because if the BGP session were down, the on-premises router would not advertise any routes, and the VPC would have no learned route to the on-premises network, causing traffic to fail or use the internet gateway as a default; however, the question states the on-premises router is advertising a specific route, implying BGP is up. Option D is wrong because if the virtual private gateway were not attached to the VPC, the VPC would have no connectivity to Direct Connect, and traffic would either fail or use the internet gateway, but the scenario specifically mentions a virtual private gateway is attached, making this option incorrect.

Full explanation →
216
MCQhard

A company is using Amazon S3 to store historical data. The data is accessed frequently for the first 30 days, then accessed infrequently for the next 90 days, and after 120 days it is rarely accessed but must be retained for 7 years for compliance. Which S3 lifecycle policy provides the LOWEST cost while meeting these requirements?

A.Standard for 30 days, then transition to Standard-IA for 90 days, then to Glacier Deep Archive.
B.Standard for 30 days, then transition to One Zone-IA for 90 days, then to Glacier Deep Archive.
C.Standard for 120 days, then transition to Glacier Deep Archive.
D.Standard for 30 days, then transition to Glacier for the remaining life.
AnswerA

Optimizes cost by using appropriate storage classes for each access pattern.

Why this answer

It aligns the storage class transitions precisely with the access patterns: Standard for frequent access (first 30 days), Standard-IA for infrequent access (next 90 days), and Glacier Deep Archive for long-term retention (after 120 days). This minimizes cost by avoiding paying for premium storage when data is rarely accessed, while still meeting the 7-year compliance requirement at the lowest possible storage cost.

Exam trap

The trap here is that candidates often overlook the compliance durability requirement and choose One Zone-IA for cost savings, or they fail to optimize the infrequent access period and keep data in Standard too long, both of which increase cost or risk data loss.

How to eliminate wrong answers

Option B is wrong because One Zone-IA is not designed for data that must be retained for compliance; it offers no resilience against the loss of a single Availability Zone, which violates the durability requirement for long-term retention. Option C is wrong because keeping data in Standard for 120 days incurs higher costs than transitioning to Standard-IA after 30 days, as the data is infrequently accessed during days 31–120, making it a more expensive choice. Option D is wrong because transitioning directly to Glacier (now S3 Glacier Flexible Retrieval) after 30 days ignores the infrequent access period (days 31–120) where Standard-IA would be cheaper than Glacier, and Glacier Deep Archive is the lowest-cost option for the rarely accessed 7-year retention period.

Full explanation →
217
MCQmedium

A SysOps administrator is troubleshooting an issue where an IAM user can launch EC2 instances but cannot terminate them. The user's permissions are based on an IAM group policy. Which action should the administrator take to resolve this?

A.Attach a managed policy that includes ec2:TerminateInstances directly to the user
B.Add the user to a different IAM group that has the required permissions
C.Check the user's permissions boundary for any restrictions
D.Review and modify the IAM group policy to include ec2:TerminateInstances action
AnswerD

The most likely root cause is that the IAM group policy attached to the user's group does not include an ec2:TerminateInstances action, so modifying that policy to allow the API call resolves the issue for every member of the group. Use a statement with "Effect": "Allow" for ec2:TerminateInstances on the appropriate resource, then test with the IAM policy simulator to verify effective access.

Why this answer

The administrator should review the group policy to ensure it includes ec2:TerminateInstances. The issue is likely a missing action in the policy, not a service control policy (SCP) or session policy issue, and simply adding the user to a new group won't fix the underlying policy gap.

Full explanation →
218
Drag & Dropmedium

Drag and drop the steps to set up an Amazon S3 bucket policy to grant cross-account access into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Identify the bucket and account, write the policy with correct principal and actions, save, and test.

Full explanation →
219
MCQmedium

An Auto Scaling group launches new EC2 instances when CPU exceeds 70 percent. The instances take 4 minutes to bootstrap (install software, register with a service discovery system, and warm up caches). Without a hook, the load balancer routes traffic to new instances before they are ready, causing 503 errors. What is the correct solution?

A.Add a lifecycle hook on the autoscaling:EC2_INSTANCE_LAUNCHING transition; signal CompleteLifecycleAction(CONTINUE) when bootstrap finishes
B.Increase the load balancer health check grace period to 10 minutes to give instances time to bootstrap
C.Increase the warm-up time in the Auto Scaling group's instance refresh configuration
D.Use a weighted target group with 0 weight for new instances until they are confirmed healthy
AnswerA

The hook holds the instance in Pending:Wait, outside the target group, until the signal arrives. The load balancer never routes traffic to the instance during its Pending:Wait phase. After the CONTINUE signal, the instance enters InService and the load balancer registers it normally. The heartbeat timeout (default 1 hour, configurable) should exceed the bootstrap time.

Why this answer

Lifecycle hooks allow the Auto Scaling group to pause instance launch until a custom action (e.g., bootstrap completion) is finished. By adding a hook on the autoscaling:EC2_INSTANCE_LAUNCHING transition, the instance is held in a 'pending:wait' state. Once the bootstrap script calls CompleteLifecycleAction with the CONTINUE result, the instance transitions to 'InService' and can then be registered with the load balancer, preventing premature traffic and 503 errors.

Exam trap

The trap here is that candidates often confuse the health check grace period (which only delays health checks, not registration) with lifecycle hooks (which actually control when the instance becomes available to the load balancer).

How to eliminate wrong answers

Option B is wrong because increasing the load balancer health check grace period only delays when the load balancer starts checking health; it does not prevent the load balancer from routing traffic to the instance before it is ready. The instance is still added to the target group immediately, and the grace period only affects health check status, not registration. Option C is wrong because the warm-up time in an instance refresh configuration controls how long new instances are given to become healthy during a rolling update, not the initial launch or bootstrap process for a scaling event triggered by CPU.

Option D is wrong because weighted target groups distribute traffic based on weights; setting 0 weight for new instances would prevent all traffic, but the instances would still be registered and could receive traffic if the weight is later changed manually, and this approach does not automatically signal readiness after bootstrap.

Full explanation →
220
MCQeasy

An EC2 instance runs a Java application. The operations team wants to monitor heap memory utilization in CloudWatch and set alarms when it exceeds 85 percent. EC2 does not natively publish memory metrics to CloudWatch. What is the simplest way to get this metric into CloudWatch?

A.Install the CloudWatch agent on the instance and configure it to collect mem_used_percent; publish JVM heap metrics from the application using PutMetricData
B.Enable detailed monitoring on the EC2 instance to increase metric resolution to 1-minute intervals
C.Configure a CloudWatch Logs metric filter on the application log stream to count lines containing 'OutOfMemoryError'
D.Use AWS Systems Manager Inventory to collect memory data and sync it to CloudWatch
AnswerA

The CloudWatch agent handles OS-level memory automatically once configured. For JVM heap, the application publishes a custom namespace metric via PutMetricData. Both appear in CloudWatch within minutes and can be graphed and alarmed like any native metric.

Why this answer

The CloudWatch agent can collect custom metrics like memory utilization from the EC2 instance, and the Java application can directly publish JVM heap metrics to CloudWatch using the PutMetricData API. This combination provides the simplest and most direct way to monitor heap memory utilization and set alarms at the 85% threshold, as EC2 does not natively expose memory metrics.

Exam trap

The trap here is that candidates often assume detailed monitoring or Systems Manager Inventory can provide memory metrics, but neither feature collects or publishes memory utilization data to CloudWatch.

How to eliminate wrong answers

Option B is wrong because enabling detailed monitoring increases the resolution of standard EC2 metrics (like CPU, network) to 1-minute intervals, but it does not add memory or JVM heap metrics, which are not published by EC2 at all. Option C is wrong because a CloudWatch Logs metric filter on 'OutOfMemoryError' only detects when the application has already crashed, not proactive heap utilization levels, and it cannot measure the percentage of heap memory used. Option D is wrong because AWS Systems Manager Inventory collects software inventory and configuration data, not real-time memory utilization metrics, and it does not sync data to CloudWatch as a metric for alarm purposes.

Full explanation →
221
Multi-Selecteasy

A company needs to comply with PCI DSS requirements for its AWS environment. Which TWO services should the SysOps administrator use to automate compliance checks and generate reports? (Choose TWO.)

Select 2 answers
A.Amazon CloudWatch
B.AWS Config
C.AWS CloudTrail
D.AWS Trusted Advisor
E.AWS Audit Manager
AnswersB, E

AWS Config continuously records the configuration state of supported AWS resources and evaluates those configurations against AWS-managed or custom rules. For PCI DSS, you can use the managed rule pack to check for requirements like encrypted storage, restricted security group rules, and MFA on root accounts, then view the overall compliance snapshot over time. It generates a compliance timeline and aligned findings, making it the core service for automated configuration compliance.

Why this answer

(AWS Config) is correct because AWS Config provides managed rules that evaluate resource configurations against compliance standards like PCI DSS, and can trigger auto-remediation or generate compliance reports via AWS Config conformance packs. Option E (AWS Audit Manager) is correct because it helps continuously audit your AWS usage, automate evidence collection, and generate compliance reports for PCI DSS. Option A (Amazon CloudWatch) is incorrect because it is focused on monitoring metrics and logs, not on compliance checks or automated reporting.

Option C (AWS CloudTrail) is incorrect because it records API activity for auditing but does not perform compliance checks or generate compliance reports. Option D (AWS Trusted Advisor) is incorrect because it provides best-practice recommendations but does not automate compliance checks or generate detailed compliance reports required by PCI DSS.

Full explanation →
222
MCQmedium

A company runs a stateful web application on a single Amazon EC2 instance with an Elastic IP address. The SysOps administrator needs to increase availability so that if the instance fails, a new instance can be launched quickly with the same configuration and the same IP address. The administrator also needs to ensure data is not lost. Which solution meets these requirements with the least operational overhead?

A.Use an Application Load Balancer with an Auto Scaling group and a launch configuration that includes the Elastic IP
B.Create an AMI from the instance, store data on an Amazon EFS file system, and use an Auto Scaling group with a lifecycle hook to associate the Elastic IP
C.Create a CloudFormation template that launches a new instance and associates the Elastic IP
D.Place the instance in an Auto Scaling group with a minimum of 1 and a maximum of 1, and set the health check to replace unhealthy instances
AnswerB

The AMI provides a pre-configured launch template. EFS provides durable, shared storage for application data. The Auto Scaling group automatically launches a new instance if the current one fails, and the lifecycle hook script associates the Elastic IP to the new instance, ensuring continuity with the same IP.

Why this answer

It separates the stateful data (stored on Amazon EFS) from the compute instance, ensuring data persistence even if the instance fails. Creating an AMI from the instance captures the configuration, and an Auto Scaling group with a lifecycle hook can associate the Elastic IP to the new instance automatically, providing a quick failover with minimal operational overhead.

Exam trap

The trap here is that candidates often assume an Auto Scaling group alone can handle Elastic IP association, but without a lifecycle hook or custom script, the new instance will not automatically receive the Elastic IP, leading to IP address changes and potential downtime.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer (ALB) does not support Elastic IP addresses; ALBs use DNS names and are designed for distributing traffic, not for preserving a static IP for a stateful application. Option C is wrong because a CloudFormation template requires manual or automated invocation to launch a new instance and associate the Elastic IP, which introduces additional operational overhead and does not automatically handle instance failure detection and replacement. Option D is wrong because placing the instance in an Auto Scaling group with a minimum and maximum of 1 does not automatically launch a new instance with the same configuration or data; it only replaces the instance if it becomes unhealthy, but without a lifecycle hook to associate the Elastic IP or a mechanism to preserve stateful data, the solution fails to meet the requirements.

Full explanation →
223
MCQhard

A company uses AWS Organizations and has multiple accounts. The security team requires that all Amazon S3 buckets across all accounts must be encrypted at rest with AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect non-compliant buckets and remediate them by enabling SSE-KMS. The solution must work across all existing and future accounts. Which AWS service should be used?

A.AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.
B.AWS CloudTrail with a metric filter and Amazon CloudWatch alarm to trigger a Lambda function.
C.AWS Trusted Advisor to check S3 bucket encryption and send notifications.
D.Amazon Macie to discover sensitive data and then manually encrypt buckets.
AnswerA

AWS Config's managed rule s3-bucket-server-side-encryption-enabled continuously evaluates whether every S3 bucket has default encryption configured. When a bucket is found non-compliant, Config's automatic remediation feature can invoke an AWS Systems Manager Automation document (e.g., AWS-EnableS3BucketEncryption) to apply SSE-KMS to that bucket. Because Config is state-based, it detects both pre-existing non-compliant buckets and buckets that drift after creation. With AWS Organizations, you can deploy the rule and remediation across all accounts using CloudFormation StackSets, and aggregators centralize compliance visibility.

Why this answer

AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can evaluate all S3 buckets across accounts in an AWS Organization. When a non-compliant bucket is detected, an automatic remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') can enable SSE-KMS without manual intervention. This solution scales to existing and future accounts because AWS Config can be set up as an aggregator across the organization, and remediation actions apply automatically as new accounts are added.

Exam trap

The trap here is that candidates often confuse detection-only services (like Trusted Advisor or CloudTrail) with services that can both detect and automatically remediate, or they mistakenly think Macie handles encryption compliance when it actually focuses on data classification.

How to eliminate wrong answers

Option B is wrong because AWS CloudTrail with a metric filter and CloudWatch alarm only detects API calls (e.g., PutBucketEncryption) after they occur; it cannot proactively detect non-compliant buckets or automatically remediate them without a custom Lambda function, and it does not provide continuous compliance evaluation across all accounts. Option C is wrong because AWS Trusted Advisor checks S3 bucket encryption only for the root account or linked accounts in a support plan, but it does not support automatic remediation—it only sends notifications, and it cannot enforce encryption across all accounts in an organization. Option D is wrong because Amazon Macie is designed to discover sensitive data (e.g., PII) in S3 buckets, not to check or enforce encryption settings; it requires manual intervention to encrypt buckets and does not provide automated detection or remediation of non-compliant encryption.

Full explanation →
224
MCQeasy

A company is using Amazon CloudFront to distribute content globally. The company wants to restrict access to content so that only users from specific countries can access it. Which CloudFront feature should be used?

A.AWS WAF
B.Signed URLs
C.Geo restriction
D.Origin Access Identity (OAI)
AnswerC

Geo restriction (geo-blocking) allows you to allow or deny access to content based on the viewer's country.

Why this answer

CloudFront's geo restriction feature (also known as geo-blocking) allows you to allow or block access to your content based on the geographic location of the viewer's IP address. This is the correct choice because the requirement is specifically to restrict access by country, which is exactly what geo restriction does by using a country-level allowlist or blocklist.

Exam trap

The trap here is that candidates often confuse geo restriction with AWS WAF's geo-match conditions, but the question explicitly asks for a CloudFront feature, and geo restriction is the native, simpler option that does not require WAF integration.

How to eliminate wrong answers

Option A is wrong because AWS WAF is a web application firewall that filters traffic based on rules like SQL injection or IP addresses, but it does not natively provide country-level access control without additional configuration (though it can be integrated with CloudFront for geo-matching via IP sets, the question asks for the CloudFront feature itself). Option B is wrong because Signed URLs provide temporary access to individual files by requiring a cryptographic signature, but they do not restrict access based on the viewer's geographic location. Option D is wrong because Origin Access Identity (OAI) is used to restrict access to an S3 origin so that only CloudFront can fetch content, but it does not control which end users can access the content based on their country.

Full explanation →
225
MCQmedium

A company stores sensitive data in an S3 bucket. The security team requires that all objects uploaded to the bucket be encrypted at rest using an AWS KMS customer-managed key. Which S3 bucket policy statement should be added to enforce this requirement?

A.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}
B.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}
C.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}
D.{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}
AnswerC

This denies uploads that do not use SSE-KMS and also ensures the KMS key ID is present (though not specific key). However, to enforce a specific key, a condition on the key ID is needed. This statement is a common baseline.

Why this answer

It denies any PutObject request that does not use KMS encryption (s3:x-amz-server-side-encryption != 'aws:kms') OR that does not include a KMS key ID (s3:x-amz-server-side-encryption-aws-kms-key-id is null). This enforces that objects are encrypted with a KMS customer-managed key. Option A is incorrect because it denies only if encryption is not KMS, but allows KMS without requiring a key ID, which could permit using the default AWS-managed KMS key rather than a customer-managed key.

Option B is incorrect because it denies only if no encryption header is present, but allows any encryption type including SSE-S3 or SSE-KMS without a key ID. Option D is incorrect because it denies encryption that is not AES256, which is SSE-S3, and would incorrectly allow SSE-KMS.

Full explanation →
Page 2

Page 3 of 4

Page 4

All pages

1234

Practice SOA-C02 by domain

Target a specific domain to shore up weak areas.

Monitoring, Logging, and RemediationReliability and Business ContinuityDeployment, Provisioning, and AutomationSecurity and ComplianceNetworking and Content DeliveryCost and Performance Optimization
See all domains with question counts →