Practice Exams: AWS Certified SysOps Administrator Associate

Practice Test 4: Practice Test #4 - AWS Certified SysOps Administrator Associate
Open

Practice Test 3: Practice Test #3 - AWS Certified …

Finish course

Set a certification due date

AWS Certified SysOps Administrator – Associate

Course content

AI Assistant

Practice tests

Start

Practice Test 1: Practice Test #1 - AWS Certified SysOps Administrator Associate

Start

Practice Test 2: Practice Test #2 - AWS Certified SysOps Administrator Associate

Start

Practice Test 3: Practice Test #3 - AWS Certified SysOps Administrator Associate

Start

Practice Test 4: Practice Test #4 - AWS Certified SysOps Administrator Associate

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

AWS Certified SysOps Administrator Associate SOA-C02 tests: 195 high-quality mock questions with detailed explanations!

Rating: 4.4 out of 54.4
1,667 ratings

22,969

Students

260 questions

Total

Last updated April 2024

English

What you'll learn

Guaranteed chance to pass the exam if you score 90%+ on each practice exam

Ace your AWS Certified SysOps Administrator Associate (SOA-C02) exam

Practice with high quality practice exams alongside detailed explanation to learn concepts

The SOA-C02 practice exams have been written from scratch

Perfect companion to the "Ultimate AWS Certified SysOps Administrator Associate" course by Stephane Maarek

Description

Preparing for AWS Certified SysOps Administrator Associate SOA-C02? This is THE practice exams course to give you the winning edge.

These practice exams have been co-authored by Stephane Maarek and Abhishek Singh who bring their collective experience of passing 18 AWS Certifications to the table.

The tone and tenor of the questions mimic the real exam. Along with the detailed description and “exam alert” provided within the explanations, we have also extensively referenced AWS documentation to get you up to speed on all domain areas being tested for the SOA-C02 exam.

We want you to think of this course as the final pit-stop so that you can cross the winning line with absolute confidence and get AWS Certified! Trust our process, you are in good hands.

All questions have been written from scratch! You can see for yourself some of the amazing testimonials from our students who have aced the real exam:

=======

You will get THREE high-quality 65-questions practice exams to be ready for your certification

=======

Quality speaks for itself...

SAMPLE QUESTION:

A retail company stores its business critical files on an Amazon S3 bucket that is also configured as a website endpoint. The company needs a robust configuration that will allow access only through CloudFront. No user or team member should be able to access the files directly from Amazon S3 URL.

As a SysOps Administrator, which of the following would you suggest to address this requirement?

Create an Origin Access Identity (OAI) and configure S3 bucket permissions so that CloudFront can use the OAI to access the files in your bucket

Configure a Security Group with CloudFront to restrict access to users

Configure a Network Access Control List (ACL) with CloudFront to restrict access to users

Setup the Amazon S3 bucket as a custom origin with CloudFront. Restrict the access to content by setting up custom headers

What's your guess? Scroll below for the answer...

Correct: 4.

Correct option:

Setup the Amazon S3 bucket as a custom origin with CloudFront. Restrict the access to content by setting up custom headers

If you use an Amazon S3 bucket configured as a website endpoint, you must set it up with CloudFront as a custom origin. You can’t use the origin access identity feature. However, you can restrict access to content on a custom origin by setting up custom headers and configuring your origin to require them.

To require that users access content through CloudFront, change the following settings in your CloudFront distributions:

1. Origin Custom Headers : Configure CloudFront to forward custom headers to your origin.

2. Viewer Protocol Policy : Configure your distribution to require viewers to use HTTPS to access CloudFront.

3. Origin Protocol Policy : Configure your distribution to require CloudFront to use the same protocol as viewers to forward requests to the origin.

After you've made these changes, update your application on your custom origin to only accept requests that include the custom headers that you’ve configured CloudFront to send.

More info on restricting access to files on custom origins:

<reference links in the practice exams>

Incorrect options:

**Create an Origin Access Identity (OAI) and configure S3 bucket permissions so that CloudFront can use the OAI to access the files in your bucket** - As explained above, if you use an Amazon S3 bucket configured as a website endpoint, you can’t use the origin access identity feature.

**Configure a Security Group with CloudFront to restrict access to users** - A Security Group acts as a virtual firewall for Amazon EC2 instances to control incoming and outgoing traffic. Security Groups cannot be used with CloudFront.

**Configure a Network Access Control List (ACL) with CloudFront to restrict access to users** - A Network Access Control List (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. Network ACLs are not used with CloudFront.

And reference links to help you learn further!

=======

Instructor

My name is Stéphane Maarek, I am passionate about Cloud Computing, and I will be your instructor in this course. I teach about AWS certifications, focusing on helping my students improve their professional proficiencies in AWS.

I have already taught 1,500,000+ students and gotten 500,000+ reviews throughout my career in designing and delivering these certifications and courses!

I'm delighted to welcome Abhishek Singh as my co-instructor for these practice exams!

=======

Welcome to the best practice exams to help you prepare for your AWS Certified SysOps Administrator Associate exam.

You can retake the exams as many times as you want

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app

30-days money-back guarantee if you're not satisfied

We hope that by now you're convinced!... And there are a lot more questions inside the course.

Happy learning and best of luck for your AWS Certified SysOps Administrator Associate!

Who this course is for:

Anyone preparing for the AWS Certified SysOps Administrator Associate (SOA-C02)

Show moreShow less

Instructors

Stephane Maarek | AWS Certified Cloud Practitioner,Solutions Architect,Developer

Best Selling Instructor, 11x AWS Certified, Kafka Guru

Stephane is a solutions architect, consultant and software developer that has a particular interest in all things related to Cloud & Big Data. He's also a many-times best seller instructor on Udemy for his courses in AWS and Apache Kafka.

[See FAQ below to see in which order you can take my courses]

Stéphane is recognized as an AWS Hero and is an AWS Certified Solutions Architect Professional & AWS Certified DevOps Professional. He loves to teach people how to use the AWS properly, to get them ready for their AWS certifications, and most importantly for the real world.

He also loves Apache Kafka. He used on the Program Committee organizing the Kafka Summit in New York, London and San Francisco. He also was an active member of the Apache Kafka community, and has authored blogs on Medium and the guest blog for Confluent. He also has co-founded Conduktor, a prominent company in the Kafka ecosystem.

During his spare time he enjoys cooking, practicing yoga, surfing, watching TV shows, and traveling to awesome destinations!

FAQ: In which order should you learn?...

AWS Cloud: Start with AWS Certified Cloud Practitioner or AWS Certified Solutions Architect Associate, then move on to AWS Certified Developer Associate and then AWS Certified SysOps Administrator. Afterwards you can either do AWS Certified Solutions Architect Professional or AWS Certified DevOps Professional, or a specialty certification of your choosing. You can also learn about AI with the AWS Certified AI Practitioner course!

Apache Kafka: Start with Apache Kafka for Beginners, then you can learn Connect, Streams and Schema Registry if you're a developer, and Setup and Monitoring courses if you're an admin. Both tracks are needed to pass the Confluent Kafka certification.

Show moreShow less

Abhishek Singh

Cloud Evangelist

Abhishek is an AWS veteran and has built successful SaaS and consumer solutions using AWS services since 2012. Over the course of his professional career, Abhishek has interviewed and mentored hundreds of candidates for entry-level and lateral positions for Cloud based IT solutions development. Abhishek is passionate about sharing his knowledge on AWS Cloud, Machine Learning and Big Data. He wants to help his fellow IT Professionals level-up their skills to ace the AWS Certifications and above all, get ready for the real world AWS ecosystem.

He is an AWS Certified Solutions Architect Professional, AWS Certified DevOps Engineer Professional, AWS Certified Machine Learning Specialist, AWS Certified Big Data Specialist and AWS Certified Database Specialist.

Overall, Abhishek has over 15 years of experience working on a diverse range of Enterprise Technologies based on AI/ML, Big Data and Analytics. He runs a successful AI/ML and Big Data Consultancy advocating solutions on AWS Cloud and has advised multiple clients in the US to architect and implement their AI/ML and Big Data solutions using the AWS suite of services.

Show moreShow less

Requirements

Recommended: Preparing for the exam with "Ultimate AWS Certified SysOps Administrator Associate" course by Stephane Maarek

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Practice Test 1: Practice Test #1 - AWS Certified SysOps Administrator Associate

Practice Test 2: Practice Test #2 - AWS Certified SysOps Administrator Associate

Practice Test 3: Practice Test #3 - AWS Certified SysOps Administrator Associate

Practice Test 4: Practice Test #4 - AWS Certified SysOps Administrator Associate

Practice Test 4: Practice Test #4 - AWS Certified SysOps Administrator Associate

Practice Test #4 - AWS Certified SysOps Administrator Associate - Results

Back to result overview
Attempt 1

All domains

All domains

Domain 4: Security and Compliance

Domain 5: Networking and Content Delivery

Domain 3: Deployment, Provisioning, and Automation

Domain 1: Monitoring, Logging, and Remediation

Domain 2: Reliability and Business Continuity

Domain 6: Cost and Performance Optimization

65 all

32 correct

33 incorrect

0 skipped

0 marked

Collapse all questions

Question 1Correct

A company is looking to protect data stored on S3 via a solution that supports lifecycle management and audit for the cryptographic key material used for encryption of data on S3.

Which of the following options represents the best solution with the least development and maintenance effort?

Use Amazon S3-Managed Keys (SSE-S3) for encrypting objects in Amazon S3 buckets

Your answer is correct

Use AWS Key Management Service (SSE-KMS) for encrypting objects in Amazon S3 buckets

Use client-side encryption to have full control over encryption and decryption process

Use Customer-Provided Keys (SSE-C) for encrypting objects in Amazon S3 buckets

Overall explanation

Correct option:

Use AWS Key Management Service (SSE-KMS) for encrypting objects in Amazon S3 buckets - When you use server-side encryption with AWS KMS (SSE-KMS), you can use the default AWS managed CMK, or you can specify a customer-managed CMK that you have already created. If you want to use a customer-managed CMK for SSE-KMS, create the CMK before you configure SSE-KMS. Then, when you configure SSE-KMS for your bucket, specify the existing customer-managed CMK.

Creating your own customer-managed CMK gives you more flexibility and control. For example, you can create, rotate, and disable customer-managed CMKs. You can also define access controls and audit the customer-managed CMKs that you use to protect your data. You can use AWS KMS to manage the lifecycle of the key material within AWS.

When you configure server-side encryption using AWS KMS (SSE-KMS), you can configure your bucket to use S3 Bucket Keys for SSE-KMS. This bucket-level key for SSE-KMS can reduce your KMS request costs by up to 99 percent by decreasing the request traffic from Amazon S3 to AWS KMS.

via - https://docs.aws.amazon.com/whitepapers/latest/kms-best-practices/aws-managed-and-customer-managed-cmks.html

Incorrect options:

Use Amazon S3-Managed Keys (SSE-S3) for encrypting objects in Amazon S3 buckets - Server-side encryption protects data at rest. Amazon S3 encrypts each object with a unique key. As an additional safeguard, it encrypts the key itself with a key that it rotates regularly. Amazon S3 server-side encryption uses one of the strongest block ciphers available to encrypt your data, 256-bit Advanced Encryption Standard (AES-256).

There are no new charges for using server-side encryption with Amazon S3-managed keys (SSE-S3). However, requests to configure and use SSE-S3 incur standard Amazon S3 request charges. Audit trail and lifecycle management is not possible with SSE-S3. So this option is incorrect.

Use Customer-Provided Keys (SSE-C) for encrypting objects in Amazon S3 buckets - Using server-side encryption with customer-provided encryption keys (SSE-C) allows you to set your own encryption keys. With the encryption key you provide as part of your request, Amazon S3 manages the encryption as it writes to disks and decryption when you access your objects.

When you upload an object, Amazon S3 uses the encryption key you provide to apply AES-256 encryption to your data and removes the encryption key from memory. When you retrieve an object, you must provide the same encryption key as part of your request. Amazon S3 first verifies that the encryption key you provided matches and then decrypts the object before returning the object data to you. In SSE-C, the customer needs to manage and maintain encryption keys and decryption keys, which are passed with every request. Although you could develop a solution on client side that supports lifecycle management and audit for the cryptographic key material, however, it would take significant development and maintenance time. Hence this option is not the right fit for the given use case.

Use client-side encryption to have full control over encryption and decryption process - Server-side encryption is the encryption of data at its destination by the application or service that receives it. Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it.

Whereas, in client-side Encryption, you encrypt data on the client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools. The given use case mandates that the encryption should happen on S3, so this option is ruled out.

References:

https://docs.aws.amazon.com/whitepapers/latest/kms-best-practices/aws-managed-and-customer-managed-cmks.html

https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html

https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingEncryption.html

Domain

Domain 4: Security and Compliance

Question 2Correct

An internet-facing Network Load Balancer (NLB) has been configured for cross-zone load balancing. The NLB is configured for three different Availability Zones (AZs). One of the AZs needs to be disabled for some testing by the development team.

Which of the following represents an optimal way of disabling an AZ without disrupting the traffic flow?

All the targets in the Availability Zone need to be deleted so that the Availability Zone can be disabled for the NLB

The subnet specified for the given Availability Zone needs to be deleted in order to disable the Availability Zone

The Elastic IP address of the subnet specified for the Availability Zone needs to be detached in order to disable the Availability Zone

Your answer is correct

You cannot disable Availability Zones for a Network Load Balancer after you create it

Overall explanation

Correct option:

You cannot disable Availability Zones for a Network Load Balancer after you create it - You enable one or more Availability Zones for your load balancer when you create it. If you enable multiple Availability Zones for your load balancer, this increases the fault tolerance of your applications. You cannot disable Availability Zones for a Network Load Balancer after you create it, but you can enable additional Availability Zones.

Incorrect options:

The Elastic IP address of the subnet specified for the Availability Zone needs to be detached in order to disable the Availability Zone - When you create an internet-facing load balancer, you can optionally specify one Elastic IP address per subnet. You cannot change these Elastic IP addresses after you create the load balancer.

The subnet specified for the given Availability Zone needs to be deleted in order to disable the Availability Zone - When you enable an Availability Zone, you specify one subnet from that Availability Zone. Elastic Load Balancing creates a load balancer node in the Availability Zone and a network interface for the subnet. Deleting a subnet will not disable the AZ.

All the targets in the Availability Zone need to be deleted so that the Availability Zone can be disabled for the NLB - This is incorrect. Deleting the targets will not disable the AZ.

Reference:

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html

Domain

Domain 5: Networking and Content Delivery

Question 3Incorrect

A SysOps Administrator has come across this CloudFormation template while doing the general maintenance work on the AWS resources used by his team.

What does this template represent? (Select three)

AWSTemplateFormatVersion: 2010-09-09
Resources:
S3Bucket:
Type: AWS::S3::Bucket
Properties:
AccessControl: PublicRead
WebsiteConfiguration:
IndexDocument: index.html
ErrorDocument: error.html
DeletionPolicy: Retain
BucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
PolicyDocument:
Id: MyPolicy
Version: 2012-10-17
Statement:
- Sid: PublicReadForGetBucketObjects
Effect: Allow
Principal: '*'
Action: 's3:GetObject'
Resource: !Join
- ''
- - 'arn:aws:s3:::'
- !Ref S3Bucket
- /*
Bucket: !Ref S3Bucket
Outputs:
WebsiteURL:
Value: !GetAtt
- S3Bucket
- WebsiteURL
Description: URL for website hosted on S3
S3BucketSecureURL:
Value: !Join
- ''
- - 'https://'
- !GetAtt
- S3Bucket
- DomainName
Description: Name of S3 bucket to hold website content

The S3 bucket created is configured to store objects from the PublicRead API of Amazon RDS

Your selection is correct

AWS CloudFormation will not delete this bucket when it deletes the stack

Your selection is correct

This template creates a bucket as a website

AWS CloudFormation will delete this bucket when it deletes the stack

Your selection is incorrect

The output section takes the website URL and bucket URL for another stack, that is part of the nested stack configuration

Correct selection

When run from AWS CLI, URL of the website hosted on S3 will be displayed as output

Overall explanation

Correct option:

AWS CloudFormation will not delete this bucket when it deletes the stack

This template creates a bucket as a website

When run from AWS CLI, URL of the website hosted on S3 will be displayed as output

The template above creates a bucket as a website. The AccessControl property is set to the canned ACL PublicRead (public read permissions are required for buckets set up for website hosting). Because this bucket resource has a DeletionPolicy attribute set to Retain, AWS CloudFormation will not delete this bucket when it deletes the stack. The Output section uses Fn::GetAtt to retrieve the WebsiteURL attribute and DomainName attribute of the S3Bucket resource.

Incorrect options:

AWS CloudFormation will delete this bucket when it deletes the stack

The output section takes the website URL and bucket URL for another stack, that is part of the nested stack configuration

The S3 bucket created is configured to store objects from the PublicRead API of Amazon RDS

These three options contradict the explanation above, so these options are incorrect.

Reference:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-s3.html

Domain

Domain 3: Deployment, Provisioning, and Automation

Question 4Incorrect

While migrating the DynamoDB tables from one AWS account to another, a team had exported the DynamoDB table data in account A into an Amazon S3 bucket in account B. The users in account B are unable to access or perform any operation on this data.

What should be done to fix this issue?

Use AWS Glue crawler to directly import the data into DynamoDB tables of account B

Your answer is incorrect

Configure the export function to write data with the access control list (ACL) bucket-owner-full-control

Correct answer

Include the PutObjectAcl permission on all exported objects after the export is complete

Use AWS Data Pipeline to export account A DynamoDB table to an S3 bucket in account B

Overall explanation

Correct option:

Include the PutObjectAcl permission on all exported objects after the export is complete

When you export your DynamoDB tables from Account A to an S3 bucket in Account B, the objects are still owned by Account A. The AWS Identify Access Management (IAM) users in Account B can't access the objects by default. The export function doesn't write data with the access control list (ACL) bucket-owner-full-control. As a workaround to this object ownership issue, include the PutObjectAcl permission on all exported objects after the export is complete. This workaround grants access to all exported objects for the bucket owners in Account B.

Incorrect options:

Configure the export function to write data with the access control list (ACL) bucket-owner-full-control - This is incorrect. The export function doesn't write data with the access control list (ACL) bucket-owner-full-control.

Use AWS Data Pipeline to export account A DynamoDB table to an S3 bucket in account B - You can also use AWS Data Pipeline to move DynamoDB tables to another AWS account. Data Pipeline is the easiest method to move the tables but provides fewer options for customization. But, this choice is incorrect since the question is about fixing access issues and not about migration.

Use AWS Glue crawler to directly import the data into DynamoDB tables of account B - Cross-account access to the Data Catalog is not supported when using an AWS Glue crawler.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/dynamodb-cross-account-migration/

https://docs.aws.amazon.com/glue/latest/dg/cross-account-access.html

Domain

Domain 1: Monitoring, Logging, and Remediation

Question 5Incorrect

A company wants to build a highly scalable web application using Amazon ElastiCache for Redis. The SysOps Administrator at the company is tasked with configuring Redis as a Multi-AZ deployment.

Which of the following represent the key characteristics of Redis Multi-AZ? (Select two)

Correct selection

When choosing the replica to promote to primary, ElastiCache for Redis chooses the replica with the least replication lag

Your selection is incorrect

A customer-initiated reboot of a primary node can trigger automatic failover. Hence, automatic failover should be disabled before initiating reboot

Your selection is incorrect

Redis replication is synchronous in multi-AZ configuration

When the primary node is rebooted, it's cleared of data when it comes back online. In such a scenario, the primary fills its cache with data from the most recent replica

Correct selection

You can manually promote read replicas to primary on Redis (when cluster mode is disabled) only when Multi-AZ and automatic failover are disabled

Overall explanation

Correct options:

You can manually promote read replicas to primary on Redis (cluster mode disabled), only when Multi-AZ and automatic failover are disabled - When you manually promote read replicas to primary on Redis (cluster mode disabled), you can do so only when Multi-AZ and automatic failover are disabled.

When choosing the replica to promote to primary, ElastiCache for Redis chooses the replica with the least replication lag - When choosing the replica to promote to primary, ElastiCache for Redis chooses the replica with the least replication lag. In other words, it chooses the replica that is most current. Doing so helps minimize the amount of lost data. The replica with the least replication lag can be in the same or different Availability Zone from the failed primary node.

Incorrect options:

Redis replication is synchronous in multi-AZ configuration - Redis replication is asynchronous. Therefore, when a primary node fails over to a replica, a small amount of data might be lost due to replication lag.

A customer-initiated reboot of a primary node can trigger automatic failover. Hence, automatic failover should be disabled before initiating reboot - A customer-initiated reboot of a primary doesn't trigger automatic failover. Other reboots and failures do trigger automatic failover.

When the primary node is rebooted, it's cleared of data when it comes back online. In such a scenario, the primary fills its cache with data from the most recent replica - When the primary is rebooted, it's cleared of data when it comes back online. When the read replicas see the cleared primary cluster, they clear their copy of the data, which causes data loss.

Reference:

https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/AutoFailover.html#AutoFailover.Notes

Domain

Domain 2: Reliability and Business Continuity

Question 6Correct

A company uses Amazon S3 to store shared data that is aggregated and accessed by different applications, teams, and individuals for analytics. Managing access to this shared bucket requires a single bucket policy that controls access for dozens to hundreds of applications with different permission levels. The company wants to make sure that any changes to the bucket policy don’t have an unexpected impact on another application.

What is the best way to build a solution for this requirement?

Configure Amazon S3 VPC Endpoints for the buckets

Your answer is correct

Configure Amazon S3 Access Points on S3 buckets

Configure S3 Acceleration on the S3 bucket

Configure S3 Batch Operations to manage access to shared data on S3

Overall explanation

Correct option:

Configure Amazon S3 Access Points on S3 buckets - Amazon S3 Access Points is a feature of S3 that simplifies managing data access at scale for applications using shared data sets on S3. Access points are unique hostnames that customers create to enforce distinct permissions and network controls for any request made through the access point. Customers with shared data sets including data lakes, media archives, and user-generated content can easily scale access for hundreds of applications by creating individualized access points with names and permissions customized for each application. Any access point can be restricted to a Virtual Private Cloud (VPC) to firewall S3 data access within customers’ private networks, and AWS Service Control Policies can be used to ensure all access points are VPC restricted. S3 Access Points are now available in all regions at no additional cost.

Each S3 Access Point is configured with an access policy specific to a use case or application. For example, you can create an access point for your S3 bucket that grants access to groups of users or applications for your data lake. An S3 Access Point could support a single user or application, or groups of users or applications, allowing separate management of each access point.

Every access point is associated with a single bucket and contains a network origin control and a Block Public Access control. For example, you can create an access point with a network origin control that only permits storage access from your Virtual Private Cloud, a logically isolated section of the AWS Cloud. You can also create an access point with the access point policy configured to only allow access to objects with a defined prefix, such as “finance”.

Because each access point contains a unique DNS name, you can now address existing and new buckets with any name of your choice that is unique within the AWS account and region. Using access points that are restricted to a VPC, you can now have an easy, auditable way to make sure S3 data stays within your VPC. Additionally, you can now use AWS Service Control Policies to require any new access point in their organization to be restricted to VPC only access.

How S3 Access Points work:

via - https://aws.amazon.com/s3/features/access-points/

When to use S3 Access Points:

via - https://aws.amazon.com/s3/features/access-points/

Incorrect options:

Configure Amazon S3 VPC Endpoints for the buckets - A VPC endpoint enables private connections between your VPC and supported AWS services and VPC endpoint services powered by AWSPrivateLink. A VPC endpoint does not require an internet gateway, virtual private gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service. VPC endpoints cannot be used to manage access to shared data on S3.

Configure S3 Acceleration on the S3 bucket - Amazon S3 Transfer Acceleration can speed up content transfers to and from Amazon S3 by as much as 50%-500% for long-distance transfer of larger objects. Customers who have either web or mobile applications with widespread users or applications hosted far away from their S3 bucket can experience long and variable upload and download speeds over the Internet. S3 Transfer Acceleration (S3TA) reduces the variability in Internet routing, congestion, and speeds that can affect transfers, and logically shortens the distance to S3 for remote applications. S3TA cannot be used to manage access to shared data on S3.

Configure S3 Batch Operations to manage access to shared data on S3 - S3 Batch Operations is an Amazon S3 data management feature that lets you manage billions of objects at scale with just a few clicks in the Amazon S3 Management Console or a single API request. With this feature, you can make changes to object metadata and properties or perform other storage management tasks, such as copying objects between buckets, replacing object tag sets, modifying access controls, and restoring archived objects from S3 Glacier — instead of taking months to develop custom applications to perform these tasks. S3 Batch Operations cannot be used to manage access to shared data on S3.

Reference:

https://aws.amazon.com/s3/features/access-points/

Domain

Domain 4: Security and Compliance

Question 7Incorrect

A SysOps Administrator has configured Amazon CloudFront for improving latency experienced by the end-users located across multiple AWS Regions. Users are complaining about CloudFront returning 404 responses for a few objects.

Which of the following represents the best reason for this behavior?

Your answer is incorrect

The object(s) requested were not found by CloudFront and CloudFront generated the 404 error to be returned to the requesting service

Correct answer

The object(s) requested were not found on the origin server and origin server generated the 404 error, which is returned by CloudFront

CloudFront distribution is unable to connect to the origin server to fetch the requested objects

404 error is generated by cache miss on CloudFront distribution

Overall explanation

Correct option:

The object(s) requested were not found on the origin server and the origin server generated the 404 error, which is returned by CloudFront - CloudFront always caches a few of the HTTP 4xx and 5xx status codes returned by your origin. CloudFront doesn't generate 404 responses. If a requested object isn't found in a CloudFront cache, the request is sent to the origin and the origin generates the 404 response if the object is not found on the origin server as well.

Incorrect options:

The object(s) requested were not found by CloudFront and CloudFront generated the 404 error to be returned to the requesting service - 404 error is not generated by CloudFront, it is generated by the origin server when it cannot find the requested object.

404 error is generated by cache miss on CloudFront distribution - If the requested object is not in the cache (a cache miss), then CloudFront sends a request to the origin to get the object. After getting the object, CloudFront returns it to the viewer and stores it in the edge location’s cache. A cache miss does not result in an error.

CloudFront distribution is unable to connect to the origin server to fetch the requested objects - An HTTP 502 status code (Bad Gateway) is generated when CloudFront isn't able to serve the requested object because it is unable to connect to the origin server.

Reference:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HTTPStatusCodes.html

Domain

Domain 5: Networking and Content Delivery

Question 8Incorrect

A company stores all of its data on Amazon EFS that is accessed by different applications hosted on Amazon EC2 instances. The company's new security policy mandates encrypting all data-at-rest.

How will you enforce the creation of the Amazon EFS file system that is encrypted at rest? (Select two)

Encryption at rest is enabled by default when creating a new EFS file system using the AWS SDKs. Mandate usage of SDKs for creating new EFS file systems

Your selection is incorrect

Use AWS Config to enforce the creation of only encrypted EFS file systems

Your selection is correct

Define Service Control Policies (SCPs) inside AWS Organizations to enforce EFS encryption for all AWS accounts in your organization

Correct selection

Use the elasticfilesystem:Encrypted IAM condition key in AWS IAM identity-based policies to mandate users for creating only encrypted-at-rest Amazon EFS file systems

Encryption at rest is enabled by default when creating a new EFS file system using the AWS CLI. Mandate usage of CLI for creating new EFS file systems

Overall explanation

Correct options:

Use the elasticfilesystem:Encrypted IAM condition key in AWS IAM identity-based policies to mandate users for creating only encrypted-at-rest Amazon EFS file systems

You can create an AWS Identity and Access Management (IAM) identity-based policy to control whether users can create Amazon EFS file systems that are encrypted at rest. The Boolean condition key elasticfilesystem:Encrypted specifies the type of file system, encrypted or unencrypted, that the policy applies to. You use the condition key with the elasticfilesystem:CreateFileSystem action and the policy effect, allow or deny, to create a policy for creating encrypted or unencrypted file systems.

Define Service Control Policies (SCPs) inside AWS Organizations to enforce EFS encryption for all AWS accounts in your organization

Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization.

An SCP restricts permissions for IAM users and roles in member accounts, including the member account's root user. If a user or role has an IAM permission policy that grants access to an action that is either not allowed or explicitly denied by the applicable SCPs, the user or role can't perform that action. You can also define service control policies (SCPs) inside AWS Organizations to enforce EFS encryption for all AWS accounts in your organization.

Incorrect options:

Encryption at rest is enabled by default when creating a new EFS file system using the AWS CLI. Mandate usage of CLI for creating new EFS file systems - This statement is incorrect. Encryption at rest is not enabled by default when creating a new file system using the AWS CLI.

Encryption at rest is enabled by default when creating a new EFS file system using the AWS SDKs. Mandate usage of SDKs for creating new EFS file systems - This statement is incorrect. Encryption at rest is not enabled by default when creating a new file system using the SDKs or the API.

Use AWS Config to enforce the creation of only encrypted EFS file systems - AWS Config rules and conformance packs provide information about whether your resources are compliant with the configuration rules you specify. They will evaluate resource configurations against the Config rules either periodically or upon detecting configuration changes, or both, depending upon how you have configured the rule. They do not guarantee that resources will be compliant or prevent users from taking non-compliant actions.

References:

https://docs.aws.amazon.com/efs/latest/ug/using-iam-to-enforce-encryption-at-rest.html

https://docs.aws.amazon.com/efs/latest/ug/encryption-at-rest.html

Domain

Domain 3: Deployment, Provisioning, and Automation

Question 9Correct

To provide a directly manageable security layer, a company has enabled encryption of CloudTrail log files using server-side encryption with AWS KMS–managed keys (SSE-KMS). However, the digest files seem to use a different encryption scheme.

Which of the following would you identify as the underlying reason for this behavior?

Your answer is correct

Digest files are encrypted with Amazon S3-managed encryption keys (SSE-S3)

The log files are created in a different region from the digest files

AWS KMS–managed key (SSE-KMS) is different for log files and digest files

Per the default configuration, different S3 buckets are used for log and digest files

Overall explanation

Correct option:

Digest files are encrypted with Amazon S3-managed encryption keys (SSE-S3)

When you enable log file integrity validation, CloudTrail creates a hash for every log file that it delivers. Every hour, CloudTrail also creates and delivers a file that references the log files for the last hour and contains a hash of each. This file is called a digest file.

By default, the log files delivered by CloudTrail to your bucket are encrypted by Amazon server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a directly manageable security layer, you can instead use server-side encryption with AWS KMS–managed keys (SSE-KMS) for your CloudTrail log files.

Enabling server-side encryption encrypts the log files but not the digest files with SSE-KMS. Digest files are encrypted with Amazon S3-managed encryption keys (SSE-S3).

Incorrect options:

AWS KMS–managed key (SSE-KMS) is different for log files and digest files - As mentioned above, the digest files are encrypted with Amazon S3-managed encryption keys (SSE-S3).

Per the default configuration, different S3 buckets are used for log and digest files - The digest files are delivered to the same Amazon S3 bucket associated with your trail as your CloudTrail log files, so this option is incorrect. If your log files are delivered from all regions or multiple accounts into a single Amazon S3 bucket, CloudTrail will deliver the digest files from those regions and accounts into the same bucket.

The log files are created in a different region from the digest files - Digest files are created in the same region as the log files. So, this statement is incorrect.

References:

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html

Domain

Domain 1: Monitoring, Logging, and Remediation

Question 10Correct

Your company's main website is deployed on Amazon S3, and distributed by CloudFront. You have set up bucket policies on S3 to ensure only CloudFront can access your bucket. You would like your website URL to be https://johntrucks.com/ .

In Route 53, which type of record should you use?

CNAME

Your answer is correct

Alias

AAAA

A

Overall explanation

Correct option:

Alias

Amazon Route 53 alias records provide a Route 53–specific extension to DNS functionality. Alias records let you route traffic to selected AWS resources, such as CloudFront distributions and Amazon S3 buckets. They also let you route traffic from one record in a hosted zone to another record.

Unlike a CNAME record, you can create an alias record at the top node of a DNS namespace, also known as the zone apex. For example, if you register the DNS name example.com, the zone apex is example.com. You can't create a CNAME record for example.com, but you can create an alias record for example.com that routes traffic to www.example.com.

Incorrect options:

CNAME - A CNAME record maps DNS queries for the name of the current record, such as acme.example.com, to another domain (example.com or example.net) or subdomain (acme.example.com or zenith.example.org). You cannot use a CNAME record for root domains, so this option is ruled out.

A - You use an A record to route traffic to a resource, such as a web server, using an IPv4 address in dotted-decimal notation.

AAAA - You use an AAAA record to route traffic to a resource, such as a web server, using an IPv6 address in colon-separated hexadecimal format.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html

Domain

Domain 5: Networking and Content Delivery

Question 11Incorrect

A heavily used web application needs an in-memory caching solution/service that is simple to use and has the ability to scale out or scale in by adding or removing nodes as the demand on the system increases or decreases.

Which AWS caching solution is the right fit for this requirement?

Your answer is incorrect

Amazon ElastiCache for Redis

Correct answer

Amazon ElastiCache for Memcached

Amazon CloudFront

Amazon DynamoDB Accelerator (DAX)

Overall explanation

Correct option:

Amazon ElastiCache for Memcached - Amazon ElastiCache is a web service that makes it easy to deploy, operate, and scale an in-memory data store and cache in the cloud. The service improves the performance of web applications by allowing you to retrieve information from fast, managed, in-memory data stores, instead of relying entirely on slower disk-based databases.

Memcached is a widely adopted memory object caching system. ElastiCache is protocol compliant with Memcached, so popular tools that you use today with existing Memcached environments will work seamlessly with the service.

Amazon ElastiCache automatically detects and replaces failed nodes, reducing the overhead associated with self-managed infrastructures and providing a resilient system that mitigates the risk of overloaded databases, which slow website and application load times. Through integration with Amazon CloudWatch, Amazon ElastiCache provides enhanced visibility into key performance metrics associated with your Redis or Memcached nodes.

Amazon ElastiCache supports the Memcached and Redis cache engines. Each engine provides some advantages. Choose Memcached if the following apply to you: 1. You need the simplest model possible. 2. You need to run large nodes with multiple cores or threads. 3. You need the ability to scale out and in, adding and removing nodes as demand on your system increases and decreases. 4. You need to cache objects.

Comparing caching solutions from AWS:

via - https://aws.amazon.com/caching/

Incorrect options:

Amazon ElastiCache for Redis Redis is a fast, open-source, in-memory data store and cache. Amazon ElastiCache for Redis is a Redis-compatible in-memory service that delivers the ease-of-use and power of Redis along with the availability, reliability, and performance suitable for the most demanding applications. Redis is extremely powerful and offers a lot of features compared to Memcached. Therefore, it's a little complex compared to Memcached.

Amazon DynamoDB Accelerator (DAX) - Amazon DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache for DynamoDB that delivers up to a 10x performance improvement – from milliseconds to microseconds – even at millions of requests per second. DAX does all the heavy lifting required to add in-memory acceleration to your DynamoDB tables, without requiring developers to manage cache invalidation, data population, or cluster management.

Amazon CloudFront - Amazon CloudFront is a global content delivery network (CDN) service that accelerates the delivery of your websites, APIs, video content, or other web assets. It integrates with other Amazon Web Services products to give developers and businesses an easy way to accelerate content to end-users with no minimum usage commitments. CloudFront offers caching solutions at the web application level, whereas Amazon ElastiCache offers at database level too, which is the current requirement.

References:

https://aws.amazon.com/caching/

https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/SelectEngine.html

Domain

Domain 5: Networking and Content Delivery

Question 12Correct

As a SysOps Administrator, you have configured a Network ACL and a Security Group for the load balancer and Amazon EC2 instances to allow inbound traffic on port 80. However, users are still unable to connect to the website after launch.

Which additional configuration is required to make the website accessible to all users over the internet?

Add a rule to the Network ACLs to allow outbound traffic on ports 1025 - 5000

Add a rule to the Network ACLs to allow outbound traffic on ports 32768 - 61000

Your answer is correct

Add a rule to the Network ACLs to allow outbound traffic on ports 1024 - 65535

Add a rule to the Security Group allowing outbound traffic on port 80

Overall explanation

Correct option:

Add a rule to the Network ACLs to allow outbound traffic on ports 1024 - 65535

A Network Access Control List (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC.

When you create a custom Network ACL and associate it with a subnet, by default, this custom Network ACL denies all inbound and outbound traffic until you add rules. A network ACL has separate inbound and outbound rules, and each rule can either allow or deny traffic. Network ACLs are stateless, which means that responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa).

The client that initiates the request chooses the ephemeral port range. The range varies depending on the client's operating system. Requests originating from Elastic Load Balancing use ports 1024-65535. List of ephemeral port ranges:

Many Linux kernels (including the Amazon Linux kernel) use ports 32768-61000.

Requests originating from Elastic Load Balancing use ports 1024-65535.

Windows operating systems through Windows Server 2003 use ports 1025-5000.

Windows Server 2008 and later versions use ports 49152-65535.

A NAT gateway uses ports 1024-65535.

AWS Lambda functions use ports 1024-65535.

Incorrect options:

Add a rule to the Network ACLs to allow outbound traffic on ports 1025 - 5000 - As discussed above, Windows operating systems through Windows Server 2003 use ports 1025-5000. ELB uses the port range 1024-65535.

Add a rule to the Network ACLs to allow outbound traffic on ports 32768 - 61000 - As discussed above, Linux kernels (including the Amazon Linux kernel) use ports 1025-5000. ELB uses the port range 1024-65535.

Add a rule to the Security Group allowing outbound traffic on port 80 - A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. Security groups act at the instance level, not the subnet level. Security groups are stateful — if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. Responses to allowed inbound traffic are allowed to flow out, regardless of outbound rules.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

Domain

Domain 5: Networking and Content Delivery

Question 13Correct

A developer has configured inbound traffic for the relevant ports in both the Security Group of the EC2 instance as well as the Network Access Control List (NACL) of the subnet for the EC2 instance. The developer is, however, unable to connect to the service running on the Amazon EC2 instance.

As a SysOps Administrator, how will you fix this issue?

Network ACLs are stateful, so allowing inbound traffic to the necessary ports enables the connection. Security Groups are stateless, so you must allow both inbound and outbound traffic

Your answer is correct

Security Groups are stateful, so allowing inbound traffic to the necessary ports enables the connection. Network ACLs are stateless, so you must allow both inbound and outbound traffic

Rules associated with Network ACLs should never be modified from the command line. An attempt to modify rules from the command line blocks the rule and results in an erratic behavior

IAM Role defined in the Security Group is different from the IAM Role that is given access in the Network ACLs

Overall explanation

Correct option:

Security Groups are stateful, so allowing inbound traffic to the necessary ports enables the connection. Network ACLs are stateless, so you must allow both inbound and outbound traffic - Security groups are stateful, so allowing inbound traffic to the necessary ports enables the connection. Network ACLs are stateless, so you must allow both inbound and outbound traffic.

To enable the connection to a service running on an instance, the associated network ACL must allow both inbound traffic on the port that the service is listening on as well as allow outbound traffic from ephemeral ports. When a client connects to a server, a random port from the ephemeral port range (1024-65535) becomes the client's source port.

The designated ephemeral port then becomes the destination port for return traffic from the service, so outbound traffic from the ephemeral port must be allowed in the network ACL.

By default, network ACLs allow all inbound and outbound traffic. If your network ACL is more restrictive, then you need to explicitly allow traffic from the ephemeral port range.

If you accept traffic from the internet, then you also must establish a route through an internet gateway. If you accept traffic over VPN or AWS Direct Connect, then you must establish a route through a virtual private gateway.

Incorrect options:

Network ACLs are stateful, so allowing inbound traffic to the necessary ports enables the connection. Security Groups are stateless, so you must allow both inbound and outbound traffic - This is incorrect as already discussed.

IAM Role defined in the Security Group is different from the IAM Role that is given access in the Network ACLs - This is a made-up option and just added as a distractor.

Rules associated with Network ACLs should never be modified from the command line. An attempt to modify rules from the command line blocks the rule and results in an erratic behavior - This option is a distractor. AWS does not support modifying rules of Network ACLs from the command line tool.

Reference:

https://aws.amazon.com/premiumsupport/knowledge-center/resolve-connection-sg-acl-inbound/

Domain

Domain 5: Networking and Content Delivery

Question 14Incorrect

For a throughput intensive workload, a company wants a low-cost storage volume that can be attached to the Amazon EC2 instances.

Which of the following is the right choice for this requirement?

Your answer is incorrect

EBS SSD volume - gp2

EBS HDD volume - sc1

Correct answer

EBS HDD volume - st1

EBS SSD volume - io1

Overall explanation

Correct option:

EBS HDD volume - st1 - Amazon EBS allows you to create storage volumes and attach them to Amazon EC2 instances. Once attached, you can create a file system on top of these volumes, run a database, or use them in any other way you would use block storage.

Amazon EBS provides a range of options that allow you to optimize storage performance and cost for your workload. These options are divided into two major categories: SSD-backed storage for transactional workloads, such as databases and boot volumes (performance depends primarily on IOPS), and HDD-backed storage for throughput intensive workloads, such as MapReduce and log processing (performance depends primarily on MB/s).

ST1 is backed by hard disk drives (HDDs) and is ideal for frequently accessed, throughput intensive workloads with large datasets and large I/O sizes, such as MapReduce, Kafka, log processing, data warehouse, and ETL workloads. These volumes deliver performance in terms of throughput, measured in MB/s, and include the ability to burst up to 250 MB/s per TB, with a baseline throughput of 40 MB/s per TB and a maximum throughput of 500 MB/s per volume.

Incorrect options:

EBS SSD volume - io1 - When attached to EBS-optimized EC2 instances, io1 and io2 volumes are designed to achieve single-digit millisecond latencies, as well as deliver the provisioned performance 99.9% of the time. This is costlier than Throughput Optimized HDD (st1) and hence is not the right choice for the current use-case (there is no need for single-digit millisecond latencies).

EBS SSD volume - gp2 - General-purpose volumes (gp3 and gp2) are backed by solid-state drives (SSDs) and are suitable for a broad range of transactional workloads, virtual desktops, medium-sized single instance databases, latency-sensitive interactive applications, dev/test environments, and boot volumes. gp2 ts priced at $0.08/GB-month, whereas st1 is $0.045/GB-month, making it a better fit for the current use case.

EBS HDD volume - sc1 - SC1 is backed by hard disk drives (HDDs) and provides the lowest cost per GB of all EBS volume types. It is ideal for less frequently accessed workloads with large, cold datasets. sc1 is cheaper than st1, but not ideal for frequently accessed data, which will be the case in the current use case. Hence, sc1 is not an option.

Reference:

https://aws.amazon.com/ebs/features/

Domain

Domain 6: Cost and Performance Optimization

Question 15Correct

A digital marketing company that manages customer data for its clients has seen a spike in traffic that seems to be malicious. The traffic is served via the Amazon CloudFront service. The company wants to set up strong security to keep their server instances and databases secure and also be able to replicate the same security processes across multiple AWS accounts that the company holds.

As a SysOps Administrator, which of these would you suggest as an optimal solution that can be quickly implemented and replicated?

Configure Security Groups on CloudFront to deny access to IP addresses that seem to send the malicious traffic. The Security Group settings can be exported out to another AWS account for easy replication

Your answer is correct

Configure AWS Web Application Firewall (WAF) on CloudFront to keep the AWS infrastructure safe from malicious attacks. Use AWS Firewall Manager to replicate and manage the WAF configurations across AWS accounts

Configure AWS Firewall Manager to create a secure barrier on CloudFront. Settings can be replicated across accounts by manually exporting the Firewall Manager configuration

Configure AWS Web Application Firewall (WAF) on Amazon EC2 instances to keep the instances as well as the databases safe. WAF configured on CloudFront increases latency for users accessing the application. WAF configuration can be replicated using CloudFormation templates

Overall explanation

Correct option:

Configure AWS Web Application Firewall (WAF) on CloudFront to keep the AWS infrastructure safe from malicious attacks. Use AWS Firewall Manager to replicate and manage the WAF configurations across AWS accounts

AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to an Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer, or an AWS AppSync GraphQL API.

At the simplest level, AWS WAF lets you choose one of the following behaviors:

Allow all requests except the ones that you specify – This is useful when you want Amazon CloudFront, Amazon API Gateway, Application Load Balancer, or AWS AppSync to serve content for a public website, but you also want to block requests from attackers.

Block all requests except the ones that you specify – This is useful when you want to serve content for a restricted website whose users are readily identifiable by properties in web requests, such as the IP addresses that they use to browse to the website.

Count the requests that match the properties that you specify – When you want to allow or block requests based on new properties in web requests, you first can configure AWS WAF to count the requests that match those properties without allowing or blocking those requests. This lets you confirm that you didn't accidentally configure AWS WAF to block all the traffic to your website. When you're confident that you specified the correct properties, you can change the behavior to allow or block requests.

AWS Firewall Manager is a security management service that allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations. As new applications are created, the Firewall Manager makes it easy to bring new applications and resources into compliance by enforcing a common set of security rules. Now you have a single service to build firewall rules, create security policies, and enforce them in a consistent, hierarchical manner across your entire infrastructure, from a central administrator account.

Incorrect options:

Configure Security Groups on CloudFront to deny access to IP addresses that seem to send the malicious traffic. The Security Group settings can be exported out to another AWS account for easy replication - A Security Group acts as a virtual firewall for your EC2 instances to control incoming and outgoing traffic. CloudFront does not support security groups.

Configure AWS Web Application Firewall (WAF) on Amazon EC2 instances to keep the instances as well as the databases safe. WAF configured on CloudFront increases latency for users accessing the application. WAF configuration can be replicated using CloudFormation templates - AWS WAF can only be configured with Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer, or an AWS AppSync GraphQL API. Amazon EC2 instances cannot be directly configured with WAF, they need to be behind a CloudFront distribution or an Application Load Balancer.

Configure AWS Firewall Manager to create a secure barrier on CloudFront. Settings can be replicated across accounts by manually exporting the Firewall Manager configuration - It's AWS WAF (NOT Firewall Manager) that can create a secure barrier on CloudFront. AWS Firewall Manager is a security management service that allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations.

AWS Firewall Manager is integrated with AWS Organizations so you can enable AWS WAF rules, AWS Shield Advanced protection, security groups, and AWS Network Firewall rules for your Amazon VPC across multiple AWS accounts and resources from a single place. The Firewall Manager is a management service to manage security resources under one umbrella. There is no need to manually export configurations.

References:

https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html

https://aws.amazon.com/firewall-manager/

Domain

Domain 4: Security and Compliance

Question 16Correct

A SysOps Administrator has been tasked with copying AMIs from one Region to another. While doing this task, the following error message popped up: Linux error message "This AMI was copied from an AMI with a kernel that is unavailable in the destination Region: {Image ID}"

Which of the following would you identify as the root cause behind the issue?

The error is a general indication of AMI not being provisioned correctly

Your answer is correct

Linux paravirtual (PV) AMIs aren't supported in all AWS Regions and copying these across unsupported Regions results in this error

Linux hardware virtual machine (HVM) AMIs aren't supported in all AWS Regions and copying these across unsupported Regions results in this error

Linux AMIs do not support copy across Regions

Overall explanation

Correct option:

Linux paravirtual (PV) AMIs aren't supported in all AWS Regions and copying these across unsupported Regions results in this error

Linux Amazon Machine Images use one of two types of virtualization: paravirtual (PV) or hardware virtual machine (HVM). The main differences between PV and HVM AMIs are how they boot and whether they can take advantage of special hardware extensions (CPU, network, and storage) for better performance.

Linux paravirtual (PV) AMIs aren't supported in all AWS Regions. If you receive this message, you can create a new HVM instance, and then attach new EBS volumes to the HVM instance. Then, copy over data from the EBS volumes attached to the old PV instance.

Incorrect options:

Linux hardware virtual machine (HVM) AMIs aren't supported in all AWS Regions and copying these across unsupported Regions results in this error - All Regions support HVM AMIs.

Linux AMIs do not support copy across Regions - This statement is incorrect as you can indeed copy AMIs across Regions.

The error is a general indication of AMI not being provisioned correctly - This has been added as a distractor.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/copy-ami-region/

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/virtualization_types.html

Domain

Domain 3: Deployment, Provisioning, and Automation

Question 17Correct

A web application is hosted on an Amazon S3 bucket. To provide access over the internet, the DNS record in Amazon Route 53 has been configured to point to the static website. However, the domain is not resolving thereby resulting in an error.

Which of the following could be the most plausible reason for the error?

Your answer is correct

You must give the S3 bucket the same name as the record that you want to use to route traffic to the bucket

Confirm that the HOSTNAME record for the domain is pointing to the correct website endpoint

Amazon S3 website endpoints need SSL certificate for supporting HTTPS requests. Check the certificate expiry and validation

The domain should resolve to the same IP address every time, check if this works

Overall explanation

Correct option:

You must give the S3 bucket the same name as the record that you want to use to route traffic to the bucket

When you configure an Amazon S3 bucket for website hosting, you must give the bucket the same name as the record that you want to use to route traffic to the bucket. For example, to route traffic for "example.com" to an Amazon S3 bucket that's configured for website hosting, the bucket name must be "example.com".

Incorrect options:

Amazon S3 website endpoints need an SSL certificate for supporting HTTPS requests. Check the certificate expiry and validation - Amazon S3 website endpoints don't support HTTPS.

Confirm that the HOSTNAME record for the domain is pointing to the correct website endpoint - The alias or CNAME (not HOSTNAME) record for the domain should be pointing to the correct website endpoint.

The domain should resolve to the same IP address every time, check if this works - The DNS query must be directed to the correct set of name servers to answer the DNS query. The Resolving IP address will not be static.

Reference:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/troubleshooting-s3-bucket-website-hosting.html

Domain

Domain 5: Networking and Content Delivery

Question 18Incorrect

A company stores its data on Amazon S3 Glacier. For last month's billing cycle, the manager has noticed some retrieval charges for data on S3 Glacier, although, data has always been retrieved from Glacier with no charges for the earlier billing cycles.

As a SysOps Administrator, which of the following represents the underlying reason for this behavior?

Amazon S3 Glacier offers free retrieval for three months from starting of the service

Your answer is incorrect

You can retrieve 5 GB of your Amazon S3 Glacier data per month for free

Correct answer

You can retrieve 10 GB of your Amazon S3 Glacier data per month for free

The AWS account holding S3 Glacier resources is member of more than one AWS organization

Overall explanation

Correct option:

You can retrieve 10 GB of your Amazon S3 Glacier data per month for free

Amazon S3 Glacier and S3 Glacier Deep Archive are designed to be the lowest-cost Amazon S3 storage classes, allowing you to archive large amounts of data at a very low cost. This makes it feasible to retain all the data you want for use cases like data lakes, analytics, IoT, machine learning, compliance, and media asset archiving. You pay only for what you need, with no minimum commitments or up-front fees.

Amazon S3 Glacier offers a 10 GB retrieval free tier. You can retrieve 10 GB of your Amazon S3 Glacier data per month for free. The free tier allowance can be used at any time during the month and applies to Standard retrievals.

Incorrect options:

You can retrieve 5 GB of your Amazon S3 Glacier data per month for free - As discussed above, you can retrieve 10 GB of your Amazon S3 Glacier data per month for free.

Amazon S3 Glacier offers free retrieval for three months from starting of the service - As discussed above, you can retrieve 10 GB of your Amazon S3 Glacier data per month for free.

The AWS account holding S3 Glacier resources is a member of more than one AWS organization - This statement is incorrect. An AWS account can be a member of only one organization at a time.

Reference:

https://aws.amazon.com/s3/glacier/faqs/#dataretrievals

Domain

Domain 6: Cost and Performance Optimization

Question 19Incorrect

A company centrally manages all of its Amazon EC2 instances and the corresponding configurations using AWS Systems Manager. The company wants a similar centrally managed service to maintain their on-premises servers which also include Raspbian systems.

Which AWS service is the right choice for managing these systems?

Amazon Inspector

Your answer is incorrect

AWS Control Tower

AWS Service Catalog

Correct answer

AWS Systems Manager

Overall explanation

Correct option:

AWS Systems Manager - AWS Systems Manager allows you to centralize operational data from multiple AWS services and automate tasks across your AWS resources. You can create logical groups of resources such as applications, different layers of an application stack, or production versus development environments. With Systems Manager, you can select a resource group and view its recent API activity, resource configuration changes, related notifications, operational alerts, software inventory, and patch compliance status.

With AWS Systems Manager, you can manage servers running on AWS, in your on-premises data center, and devices such as Raspberry Pi through a single interface. Systems Manager securely communicates with a lightweight agent installed on your servers and devices to execute management tasks. This helps you manage resources for Windows, Linux, and Raspbian operating systems.

Incorrect options:

Amazon Inspector - Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices. After performing an assessment, Amazon Inspector produces a detailed list of security findings prioritized by level of severity.

AWS Control Tower - AWS Control Tower offers the easiest way to set up and govern a secure, multi-account AWS environment. It establishes a landing zone that is based on the best-practices blueprints and enables governance using guardrails you can choose from a pre-packaged list. The landing zone is a well-architected, multi-account baseline that follows AWS best practices. Guardrails implement governance rules for security, compliance, and operations.

AWS Service Catalog - AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS. These IT services can include everything from virtual machine images, servers, software, and databases to complete multi-tier application architectures. AWS Service Catalog allows you to centrally manage deployed IT services and your applications, resources, and metadata. This helps you achieve consistent governance and meet your compliance requirements while enabling users to quickly deploy only the approved IT services they need.

References:

https://aws.amazon.com/systems-manager/features/

https://aws.amazon.com/blogs/mt/manage-raspberry-pi-devices-using-aws-systems-manager/

Domain

Domain 3: Deployment, Provisioning, and Automation

Question 20Incorrect

A heavily used application needs to be built on an Amazon Aurora DB cluster. The connections to the DB instance will be secured using Transport Layer Security (TLS) and the database needs to be publicly accessible.

Which of the following steps are needed to connect to an Amazon Aurora DB cluster from outside a VPC? (Select three)

Your selection is correct

Enable the VPC attributes DNS hostnames and DNS resolution

Disable the VPC attributes DNS hostnames and DNS resolution

Your selection is incorrect

A publicly accessible Aurora DB instance cannot be launched into the default VPC. Choose a non-default VPC while creating the DB instance

Correct selection

Configure a DB subnet group for public subnets and create the Aurora DB instance from this subnet group

Your selection is correct

The Aurora DB instance must have a public IP address

Choose a public subnet while creating the Aurora DB instance for ensuring public access

Overall explanation

Correct options:

The Aurora DB instance must have a public IP address

Configure a DB subnet group for public subnets and create the Aurora DB instance from this subnet group

Enable the VPC attributes DNS hostnames and DNS resolution

To connect to an Amazon Aurora DB cluster directly from outside the VPC, the instances in the cluster must meet the following requirements:

The DB instance must have a public IP address

The DB instance must be running in a publicly accessible subnet

For Amazon Aurora DB instances, you can't choose a specific subnet. Instead, choose a DB subnet group when you create the instance. Create a DB subnet group with subnets of similar network configuration. For example, a DB subnet group for Public subnets.

If you want your DB instance in the VPC to be publicly accessible, you must enable the VPC attributes DNS hostnames and DNS resolution.

Aurora DB Public Access:

via - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html

Incorrect options:

Choose a public subnet while creating the Aurora DB instance for ensuring public access - For Amazon Aurora DB instances, you can't choose a specific subnet. Instead, choose a DB subnet group when you create the instance. A DB subnet group is a collection of subnets that belong to a VPC. When it creates the underlying host, Amazon RDS randomly chooses a subnet from the DB subnet group.

A publicly accessible Aurora DB instance cannot be launched into the default VPC. Choose a non-default VPC while creating the DB instance - You can create an Aurora DB cluster in the default VPC for your AWS account, or you can create a user-defined VPC.

Disable the VPC attributes DNS hostnames and DNS resolution - As mentioned in the explanation above, you must enable the VPC attributes DNS hostnames and DNS resolution if you want your DB instance in the VPC to be publicly accessible.

Reference:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html

Domain

Domain 4: Security and Compliance

Question 21Correct

Among the following actions, what action is the IAM policy allowing you to do?

{
"Version": "2012-10-17",
"Id": "Secret Policy",
"Statement": [
{
"Sid": "EC2",
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
},
{
"Sid": "Passrole",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": "arn:aws:iam:::role/RDS-*"
}
]
}

Allowing you to give any role to RDS instances

Allowing you to give any role to EC2 instances

Your answer is correct

Allowing you to assign IAM Roles to EC2 if they start with RDS-

Allowing you to give RDS full access to EC2 instances

Overall explanation

Correct option:

Allowing you to assign IAM Roles to EC2 if they start with RDS-

To configure many AWS services, you must pass an IAM role to the service. This allows the service to later assume the role and perform actions on your behalf. You only have to pass the role to the service once during set-up, and not every time that the service assumes the role.

To pass a role (and its permissions) to an AWS service, a user must have permission to pass the role to the service. This helps administrators ensure that only approved users can configure a service with a role that grants permissions. To allow a user to pass a role to an AWS service, you must grant the PassRole permission to the user's IAM user, role, or group.

For the given policy, the first statement block applies only to EC2 specific actions, and the second statement block applies to roles only starting with RDS-, so the overall policy allows you to assign IAM Roles to EC2 if they start with "RDS-".

Incorrect options:

Allowing you to give any role to RDS instances

Allowing you to give any role to EC2 instances

Allowing you to give RDS full access to EC2 instances

These three options contradict the explanation above, so all three options are incorrect.

Reference:

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html

Domain

Domain 3: Deployment, Provisioning, and Automation

Question 22Correct

A company uses a wide variety of AWS Snow family devices. The company wants to move to a service that can easily manage these devices, unlike the CLI that is used to work with the AWS Snow family.

Which AWS service can be used to manage AWS Snowball devices?

AWS Control Tower

Your answer is correct

AWS OpsHub

Service Workbench on AWS

AWS OpsWorks

Overall explanation

Correct option:

AWS OpsHub

The Snow Family Devices offers a user-friendly tool, AWS OpsHub for Snow Family, that you can use to manage your devices and local AWS services. You use AWS OpsHub on a client computer to perform tasks such as unlocking and configuring single or clustered devices, transferring files, and launching and managing instances running on Snow Family Devices. You can use AWS OpsHub to manage both the Storage Optimized and Compute Optimized device types and the Snow device. The AWS OpsHub application is available at no additional cost to you.

AWS OpsHub takes all the existing operations available in the Snowball API and presents them as a graphical user interface. This interface helps you quickly migrate data to the AWS Cloud and deploy edge computing applications on Snow Family Devices.

When your Snow device arrives at your site, you download, install, and launch the AWS OpsHub application on a client machine, such as a laptop. After installation, you can unlock the device and start managing it and using supported AWS services locally. AWS OpsHub provides a dashboard that summarizes key metrics such as storage capacity and active instances on your device. It also provides a selection of AWS services that are supported on the Snow Family Devices. Within minutes, you can begin transferring files to the device.

Incorrect options:

AWS Control Tower - For customers with multiple AWS accounts and teams, cloud setup and governance can be complex and time-consuming, slowing down the very innovation you’re trying to speed up. AWS Control Tower provides the easiest way to set up and govern a secure, multi-account AWS environment, called a landing zone. AWS Control Tower creates your landing zone using AWS Organizations, bringing ongoing account management and governance as well as implementation best practices based on AWS’s experience working with thousands of customers as they move to the cloud. With AWS Control Tower, builders can provision new AWS accounts in a few clicks, while you have peace of mind knowing that your accounts conform to company-wide policies.

Service Workbench on AWS - Service Workbench on AWS is a cloud solution that enables IT teams, to provide secure, repeatable, and federated control of access to data, tooling, and compute power that researchers need. research missions and completing essential work in minutes, not months, in configured research environments.

With Service Workbench on AWS, researchers can quickly and securely stand up research environments and conduct experiments with peers from other institutions. By automating the creation of baseline research setups, simplifying data access, and providing price transparency, researchers and IT departments save time, which they can reinvest in following cloud best practices and achieving research reproducibility.

AWS OpsWorks - AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet. Chef and Puppet are automation platforms that allow you to use code to automate the configurations of your servers. OpsWorks lets you use Chef and Puppet to automate how servers are configured, deployed and managed across your Amazon EC2 instances or on-premises compute environments.

Reference:

https://docs.aws.amazon.com/snowball/latest/developer-guide/aws-opshub.html

Domain

Domain 1: Monitoring, Logging, and Remediation

Question 23Incorrect

A SysOps Administrator has created AWS CloudFormation StackSets to be used in different target accounts spread across AWS Regions.

Which of the following statements are correct for creating and configuring the StackSets (Select two)?

Correct selection

For stack sets created with service-managed permissions, you don't have to create the necessary IAM roles

Your selection is correct

You must set up a trust relationship between the administrator and target accounts before creating stacks in target accounts

Your selection is incorrect

Stack sets can be created using either self-managed, service-managed or resource-managed permissions

For stack sets created using self-managed permissions, you don't have to create the necessary IAM roles

When you delete stacks from your stack set but save them to run independently, such stacks need to be maintained at individual resource level and are unavailable in CloudFormation

Overall explanation

Correct options:

For stack sets created with service-managed permissions, you don't have to create the necessary IAM roles - Stack sets can be created using either self-managed permissions or service-managed permissions. With service-managed permissions, you can deploy stack instances to accounts managed by AWS Organizations. Using this permissions model, you don't have to create the necessary IAM roles; StackSets creates the IAM roles on your behalf. With this model, you can also enable automatic deployments to accounts that are added to your organization in the future.

You must set up a trust relationship between the administrator and target accounts before creating stacks in target accounts - An administrator account is the AWS account in which you create stack sets. For stack sets with service-managed permissions, the administrator account is either the organization's management account or a delegated administrator account. A target account is an account into which you create, update, or delete one or more stacks in your stack set. Before you can use a stack set to create stacks in a target account, you must set up a trust relationship between the administrator and target accounts.

Incorrect options:

Stack sets can be created using either self-managed, service-managed, or resource-managed permissions - This statement is incorrect. Stack sets can be created using either self-managed permissions or service-managed permissions.

When you delete stacks from your stack set but save them to run independently, such stacks need to be maintained at individual resource level and are unavailable in CloudFormation - When you delete stacks, you are removing a stack and all its associated resources from the target accounts you specify, within the Regions you specify. Delete stacks from your stack set, but save them so they continue to run independently of your stack set by choosing the Retain Stacks option. Retained stacks are managed in AWS CloudFormation outside of your stack set.

For stack sets created using self-managed permissions, you don't have to create the necessary IAM roles - With self-managed permissions, you create the IAM roles required by StackSets to deploy across accounts and Regions. These roles are necessary to establish a trusted relationship between the account you're administering the stack set from and the account you're deploying stack instances to.

Reference:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html

Domain

Domain 3: Deployment, Provisioning, and Automation

Question 24Incorrect

A fleet of Amazon EC2 instances uses a single Amazon Elastic File System (Amazon EFS) through shared usage. An administrator has been asked to track the number of Amazon EC2 instances connected to a file system for a particular time period.

Which EFS metric will help fetch the necessary data?

Your answer is incorrect

Calculate the sum of 'InstanceConnections' metric to know the number of instances connected

Correct answer

Calculate the sum of 'ClientConnections' metric to know the number of instances connected

Calculate the average of 'TotalIOBytes' metric to know the number of active connections

Calculate the mean of 'BurstCreditBalance' metric to know the number of instances connected

Overall explanation

Correct option:

Calculate the sum of 'ClientConnections' metric to know the number of instances connected - To track the number of Amazon EC2 instances that are connected to a file system, you can monitor the Sum statistic of the ClientConnections metric. To calculate the average ClientConnections for periods greater than one minute, divide the sum by the number of minutes in the period.

Incorrect options:

Calculate the average of the 'TotalIOBytes' metric to know the number of active connections - To determine the throughput, you can monitor the daily Sum statistic of the TotalIOBytes metric to see your throughput.

Calculate the mean of the 'BurstCreditBalance' metric to know the number of instances connected - You can see your burst credit balance by monitoring the BurstCreditBalance metric for your file system.

Calculate the sum of 'InstanceConnections' metric to know the number of instances connected - There is no such thing as 'InstanceConnections' metric, this option has been added as a distractor.

Reference:

https://docs.aws.amazon.com/efs/latest/ug/how_to_use_metrics.html

Domain

Domain 6: Cost and Performance Optimization

Question 25Incorrect

As a SysOps Administrator, you have been asked to set up a private network connection between a File Gateway and Amazon S3 for secure access.

How will you configure this requirement cost-effectively?

Correct answer

Setup the private connection within an Amazon Virtual Private Cloud (Amazon VPC) by using VPC endpoints

Setup AWS Direct Connect for accessing S3 privately

Your answer is incorrect

Setup AWS Transit Gateway for accessing S3 privately from File Gateway

Use VPC Peering to set up a private connection between on-premises and AWS Cloud resources

Overall explanation

Correct option:

Setup the private connection within an Amazon Virtual Private Cloud (Amazon VPC) by using VPC endpoints

You can set up a private network connection between a file gateway and Amazon S3 within an Amazon Virtual Private Cloud (Amazon VPC). To set up this private connection within a VPC, you must:

Create a VPC endpoint for Amazon S3

Create a file gateway using a VPC endpoint

Complete steps for configuring the requirement:

via - https://aws.amazon.com/premiumsupport/knowledge-center/storage-gateway-file-gateway-private-s3/

Incorrect options:

Setup AWS Direct Connect for accessing S3 privately - AWS Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS. Using AWS Direct Connect, you create a private connection between AWS and your data center, office, or colocation environment. However, Direct Connect is not cost-effective for this requirement and an overkill too.

Use VPC Peering to set up a private connection between on-premises and AWS Cloud resources - A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. Instances in either VPC can communicate with each other as if they are within the same network. You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account. VPC peering is not helpful for on-premises connectivity with Cloud. You cannot use VPC Peering for a private network connection between a File Gateway and Amazon S3.

Setup AWS Transit Gateway for accessing S3 privately from File Gateway - AWS Transit Gateway connects VPCs and on-premises networks through a central hub. This simplifies your network and puts an end to complex peering relationships. It acts as a cloud router – each new connection is only made once. You will still need a VPN or a Direct Connect connection between your on-premises and AWS Cloud connectivity. You cannot use AWS Transit Gateway for a private network connection between a File Gateway and Amazon S3.

Reference:

https://aws.amazon.com/fsx/windows/faqs/

Domain

Domain 6: Cost and Performance Optimization

Question 26Correct

A serverless application having unpredictable workloads uses Amazon RDS. When the workloads are high, the database memory and compute resources are getting drained resulting in a bad user experience. Upon investigation, the development team has realized that during peak traffic hours, a burst of new database connections is being requested resulting in slow database performance.

What is the most optimal plan of action to address this issue?

Your answer is correct

Configure Amazon RDS Proxy to pool and share database connections

Use AWS Lambda Functions to maintain and manage the RDS connections as per workload

Use RDS 'Enhanced Monitoring' option to manage DB connection pools

Run the DB instance as a Multi-AZ deployment to improve the database performance

Overall explanation

Correct option:

Configure Amazon RDS Proxy to pool and share database connections - Many applications, including those built on modern serverless architectures, can have a large number of open connections to the database server, and may open and close database connections at a high rate, exhausting database memory and compute resources. Amazon RDS Proxy allows applications to pool and share connections established with the database, improving database efficiency and application scalability. With RDS Proxy, failover times for Aurora and RDS databases are reduced by up to 66%, and database credentials, authentication, and access can be managed through integration with AWS Secrets Manager and AWS Identity and Access Management (IAM).

Amazon RDS Proxy can be enabled for most applications with no code changes, and you don’t need to provision or manage any additional infrastructure.

Applications that support highly variable workloads may attempt to open a burst of new database connections. RDS Proxy’s connection governance allows customers to gracefully scale applications dealing with unpredictable workloads by efficiently reusing database connections. First, RDS Proxy enables multiple application connections to share a database connection for efficient use of database resources. Second, RDS Proxy allows customers to maintain predictable database performance by regulating the number of database connections that are opened. Third, RDS Proxy removes unserviceable application requests to preserve the overall performance and availability of the application.

Incorrect options:

Use AWS Lambda Functions to maintain and manage the RDS connections as per workload - Using AWS Lambda function for managing RDS connections is not an optimal solution and might not always improve performance as expected. It also involves significant development effort, thereby making it a less optimal option.

Run the DB instance as a Multi-AZ deployment to improve the database performance - When you run your DB instance as a Multi-AZ deployment, Amazon RDS automatically provisions and maintains a synchronous “standby” replica in a different Availability Zone. Multi-AZ deployments are for the high availability of the resources but do not address any performance issues.

Use RDS 'Enhanced Monitoring' option to manage DB connection pools - Enhanced Monitoring for RDS gives you deeper visibility into the health of your RDS instances. Enhanced Monitoring captures your RDS instance system-level metrics such as the CPU, memory, file system, and disk I/O among others. You can use this feature to create CloudWatch alarms for monitoring the database instance. 'Enhanced Monitoring' cannot address the given issue.

Reference:

https://aws.amazon.com/rds/proxy/

Domain

Domain 6: Cost and Performance Optimization

Question 27Incorrect

AWS Secrets Manager enables you to replace long-term secrets with short-term ones. Secrets Manager can automatically rotate the secrets for you according to a specified schedule.

AWS Secrets Manager has built-in rotation support for which of the following services?

Amazon EMR, Amazon Redshift clusters

Amazon Elastic Container Service (Amazon ECS), Amazon DocumentDB databases

Correct answer

Amazon RDS databases, Amazon Redshift clusters

Your answer is incorrect

AWS CloudFormation, Amazon RDS databases

Overall explanation

Correct option:

Amazon RDS databases, Amazon Redshift clusters

To help keep your secrets secure, Secrets Manager can automatically rotate them on a schedule. When it rotates a secret, Secrets Manager updates the credentials in both the secret and the database or service so that you don't have to manually change the credentials. Secrets Manager uses a Lambda rotation function to communicate with both Secrets Manager and the database or service.

AWS Secrets Manager has built-in rotation support for secrets for the following:

Amazon RDS databases

Amazon DocumentDB databases

Amazon Redshift clusters

via - https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

Incorrect options:

Amazon EMR, Amazon Redshift clusters - Amazon EMR is a managed cluster platform that simplifies running big data frameworks, such as Apache Hadoop and Apache Spark, on AWS to process and analyze vast amounts of data. Amazon EMR is integrated with Secrets Manager. You can store your private Git-based registry credentials using Secrets Manager.

AWS CloudFormation, Amazon RDS databases - AWS CloudFormation is integrated with Secrets Manager. You can use AWS CloudFormation to create and reference secrets from within your AWS CloudFormation stack template. You can create a secret and then reference it from another part of the template.

Amazon Elastic Container Service (Amazon ECS), Amazon DocumentDB databases - Amazon ECS enables you to inject sensitive data into your containers by storing your sensitive data in Secrets Manager secrets and then referencing them in your container definition. Sensitive data stored in Secrets Manager secrets can be exposed to a container as environment variables or as part of the log configuration.

EMR, CloudFormation, and ECS are not supported for built-in rotation of secrets by the Secrets Manager, so these three options are incorrect.

References:

https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-built-in.html

https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating.html

Domain

Domain 4: Security and Compliance

Question 28Correct

A Systems Administrator is generating reports of CloudWatch alarms for maintenance and reporting purposes. In the The AWS/ApplicationELB namespace, the administrator comes across HTTPCode_ELB_4XX_Count metric.

What does this metric signify?

Your answer is correct

The number of HTTP 4XX client error codes that originate from the load balancer

The number of HTTP 4XX response codes generated by ELB targets

The number of requests where the load balancer chose a new target because it couldn't use an existing sticky session

The number of TLS connections initiated by the client that did not establish a session with the load balancer

Overall explanation

Correct option:

The number of HTTP 4XX client error codes that originate from the load balancer - HTTPCode_ELB_4XX_Count metric stands for the number of HTTP 4XX client error codes that originate from the load balancer. This count does not include response codes generated by targets.

Client errors are generated when requests are malformed or incomplete. These requests were not received by the target, other than in the case where the load balancer returns an HTTP 460 error code. This count does not include any response codes generated by the targets.

Incorrect options:

The number of HTTP 4XX response codes generated by ELB targets - As discussed above, this is incorrect.

The number of TLS connections initiated by the client that did not establish a session with the load balancer - ClientTLSNegotiationErrorCount metric stands for the number of TLS connections initiated by the client that did not establish a session with the load balancer due to a TLS error. Possible causes include a mismatch of ciphers or protocols or the client failing to verify the server certificate and closing the connection.

The number of requests where the load balancer chose a new target because it couldn't use an existing sticky session - The metric NonStickyRequestCount represents the number of requests where the load balancer chose a new target because it couldn't use an existing sticky session.

Reference:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html

Domain

Domain 2: Reliability and Business Continuity

Question 29Incorrect

A company uses Amazon Elastic File System (EFS) to share storage space across multiple instances of an application. As a SysOps Administrator, you work with an EFS mount helper to mount the file system.

Which of the following options are available with the EFS mount helper? (Select two)

Your selection is correct

Mounting with IAM authorization

Your selection is incorrect

Mounting from Amazon EC2 Windows instances

Correct selection

Auto-mounting when an EC2 instance reboots

Mounting from on-premises Windows instances

Mounting with Amazon Cognito authentication

Overall explanation

Correct options:

Mounting with IAM authorization - You can use the EFS mount helper to mount your Amazon EFS file system on Linux instances using AWS Identity and Access Management (IAM) authorization.

Auto-mounting when an EC2 instance reboots - To automatically remount your Amazon EFS file system directory when the Amazon EC2 instance reboots, use the file /etc/fstab. The /etc/fstab file contains information about file systems.

Using the EFS mount helper, you have the following options for mounting your Amazon EFS file system: 1. Mounting on supported EC2 instances 2. Mounting with IAM authorization 3. Mounting with Amazon EFS access points 4. Mounting with an on-premise Linux client 5. Auto-mounting when an EC2 instance reboots 6. Mounting a file system when a new EC2 instance launches

The EFS mount helper is part of the amazon-efs-utils package. The amazon-efs-utils package is an open-source collection of Amazon EFS tools.

Incorrect options:

Mounting from on-premises Windows instances

Mounting from Amazon EC2 Windows instances

Amazon EFS does not support mounting from Amazon EC2 Windows instances or on-premises Windows instances.

Mounting with Amazon Cognito authentication - Amazon Cognito cannot be used to secure access to data stored on an EFS file system.

Reference:

https://docs.aws.amazon.com/efs/latest/ug/mounting-fs.html

Domain

Domain 5: Networking and Content Delivery

Question 30Correct

A company uses AWS Service Catalog to create and manage catalogs of IT services that include virtual machine images, servers, software, and databases. A Systems Administrator has been tasked to share a reference of products and portfolios of one account with another AWS account in a way that all copies of the catalog remain in sync.

What is the right way of configuring this requirement?

Deploy a copy of the catalog into each of recipient AWS accounts

Catalogs cannot be shared but can be re-deployed or re-created in a different AWS account

Use stack sets to deploy your catalog to another AWS account

Your answer is correct

Use account-to-account sharing

Overall explanation

Correct option:

Use account-to-account sharing

To make your AWS Service Catalog products available to users who are not in your AWS account, such as users who belong to other organizations or other AWS accounts in your organization, you share your portfolios with them. You can share in several ways, including account-to-account sharing, organizational sharing, and deploying catalogs using stack sets.

When you share a portfolio using account-to-account sharing or AWS Organizations, you allow an AWS Service Catalog administrator of another AWS account to import your portfolio into his or her account and distribute the products to end-users in that account.

This imported portfolio isn't an independent copy. The products and constraints in the imported portfolio stay in sync with changes that you make to the shared portfolio, the original portfolio that you shared. The recipient administrator, the administrator with whom you share a portfolio, cannot change the products or constraints but can add AWS Identity and Access Management (IAM) access for end-users.

When you add products or constraints to the shared portfolio or remove products or constraints from it, the change propagates to all imported instances of the portfolio. For example, if you remove a product from the shared portfolio, that product is also removed from the imported portfolio. It is also removed from all local portfolios that the imported product was added. If an end-user launched a product before you removed it, the end user's provisioned product continues to run, but the product becomes unavailable for future launches.

Incorrect options:

Deploy a copy of the catalog into each of the recipient AWS accounts - When a copy of the catalog is created, it is not a reference to the original portfolio. Any changes made after the copy are not propagated to the copied version. Hence, this is not the right answer.

Use stack sets to deploy your catalog to another AWS account - You can use stack sets to deploy your catalog to many accounts at the same time. If you want to share a reference (an imported version of your portfolio that stays in sync with the original), you can use account-to-account sharing or you can share using AWS Organizations.

Catalogs cannot be shared but can be re-deployed or re-created in a different AWS account - This is incorrect. As discussed above, catalogs can be shared between different AWS accounts.

Reference:

https://docs.aws.amazon.com/servicecatalog/latest/adminguide/catalogs_portfolios_sharing.html

Domain

Domain 1: Monitoring, Logging, and Remediation

Question 31Incorrect

As a SysOps Administrator, you have been asked to create a custom rule that evaluates whether CloudTrail trails in your account are turned on and logging for all regions. AWS Config should run the evaluations for the rule every time a trail is created. Also, AWS Config should run the rule every 8 hours.

Which is the most optimal option to meet the given requirements?

Create the rule with configuration change

Correct answer

Create the rule with configuration change and periodic triggers

Create the rule with periodic triggers

Your answer is incorrect

Create two rules, one with configuration change and the other with periodic triggers

Overall explanation

Correct option:

Create the rule with configuration change and periodic triggers - When you add a rule to your account, you can specify when you want AWS Config to run the rule; this is called a trigger. AWS Config evaluates your resource configurations against the rule when the trigger occurs. There are two types of triggers:

Configuration changes: AWS Config runs evaluations for the rule when certain types of resources are created, changed, or deleted.

Periodic: AWS Config runs evaluations for the rule at a frequency that you choose (for example, every 24 hours).

If you choose configuration changes and periodic, AWS Config invokes your Lambda function when it detects a configuration change and also at the frequency that you specify. This is the requirement for the current use case.

Incorrect options:

Create the rule with configuration change - AWS Config runs evaluations for the rule when certain types of resources are created, changed, or deleted. This will meet the trigger on trail creation requirement. But, the requirement to run the rule every 8 hours will not be met.

Create the rule with periodic triggers - AWS Config runs evaluations for the rule at a frequency that you choose (for example, every 24 hours). This will not cater to the requirement of triggering the rule when a trail is created. Hence, this is not the right choice.

Create two rules, one with configuration change and the other with periodic triggers - This will be a management overhead and hence is not an optimal solution.

Reference:

https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config-rules.html

Domain

Domain 1: Monitoring, Logging, and Remediation

Question 32Correct

As a SysOps Administrator, you manage a large team of IAM user accounts that are part of multiple AWS accounts. With the growing team size, you have decided to divide IAM users into IAM groups to be able to manage the permissions and policies better.

Which of the following statements are valid about IAM Groups? (Select two)

Your selection is correct

Groups can be granted permissions using access control policies

Groups can be given security credentials to be able to access web services directly

An IAM user can belong to multiple IAM groups and an IAM group can be part of another IAM group

Groups cannot be given security credentials directly, however, these can take up an IAM Role to access web services directly

Your selection is correct

An IAM user can belong to multiple IAM groups. But, Groups cannot belong to other groups

Overall explanation

Correct options:

An IAM user can belong to multiple IAM groups. But, Groups cannot belong to other groups - A Group can contain many users, and a user can belong to multiple Groups. But, Groups can't be nested; they can contain only users, not other groups.

Groups can be granted permissions using access control policies - Groups can be granted permissions using access control policies. This makes it easier to manage permissions for a collection of users, rather than having to manage permissions for each user.

Incorrect options:

An IAM user can belong to multiple IAM groups and an IAM group can be part of another IAM group - As discussed above, groups cannot be nested.

Groups cannot be given security credentials directly, however, these can take up an IAM Role to access web services directly - You cannot assign an IAM Role to an IAM group.

Groups can be given security credentials to be able to access web services directly - Groups do not have security credentials, and cannot access web services directly; they exist solely to make it easier to manage user permissions.

References:

https://aws.amazon.com/iam/faqs/

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html

Domain

Domain 4: Security and Compliance

Question 33Correct

A container-based application accesses files in a NFS set up for shared application storage. The application generates various client reports which are to be saved in client-specific directories that should further be accessible only to the IAM roles defined for these directories.

As a SysOps Administrator, which of the following would you suggest as the most optimal way of implementing this requirement?

Implement Amazon EBS Multi-Attach

Use Amazon VPC Gateway endpoints

Your answer is correct

Configure Amazon EFS access points

Configure Amazon EFS mount targets

Overall explanation

Correct option:

Configure Amazon EFS access points - Amazon EFS access points are application-specific entry points into an EFS file system that makes it easier to manage application access to shared datasets. Access points can enforce a user identity, including the user's POSIX groups, for all file system requests that are made through the access point. Access points can also enforce a different root directory for the file system so that clients can only access data in the specified directory or its subdirectories.

You can use AWS Identity and Access Management (IAM) policies to enforce specific applications to use a specific access point. By combining IAM policies with access points, you can easily provide secure access to specific datasets for your applications.

You can use an access point to enforce user and group information for all file system requests made through the access point. To enable this feature, you need to specify the operating system identity to enforce when you create the access point.

Incorrect options:

Configure Amazon EFS mount targets - Mounting attaches the filesystem of an external device to the filesystem of a system. It instructs the operating system that the filesystem is ready to use and associate it with a particular point in the system's hierarchy. Mounting will make files, directories, and devices available to the users.

With Amazon EFS, you can create a file system, mount the file system on an Amazon EC2 instance, and then read and write data to and from your file system. You can mount an Amazon EFS file system in your VPC, through the Network File System (NFSv4) protocol.

A mount target provides an IP address for an NFSv4 endpoint at which you can mount an Amazon EFS file system. You use the EFS mount helper when mounting a file system using an access point. EFS mount targets cannot be used to manage application access to shared datasets for the given use case.

Use Amazon VPC Gateway endpoints - A VPC endpoint enables private connections between your VPC and supported AWS services and VPC endpoint services powered by AWS PrivateLink. Gateway endpoint is a type of VPC endpoint that supports only two AWS services - Amazon S3 and DynamoDB.

Implement Amazon EBS Multi-Attach - Amazon EBS Multi-Attach enables you to attach a single Provisioned IOPS SSD (io1 or io2) volume to multiple instances that are in the same Availability Zone. You can attach multiple Multi-Attach enabled volumes to an instance or set of instances. EBS, however, is block-level storage and not a file system storage solution.

References:

https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html

https://docs.aws.amazon.com/efs/latest/ug/how-it-works.html

Domain

Domain 6: Cost and Performance Optimization

Question 34Correct

A firm is looking at automating their network configuration so that it allows seamless network infrastructure duplication for on-demand development and staging environments.

As a SysOps Administrator, which option will you suggest for this use case?

Use AWS Elastic Beanstalk for managing and maintaining the network resources

Use AWS Service Catalog for managing and maintaining the network infrastructure

Use AWS Config for managing and maintaining the network infrastructure

Your answer is correct

Use AWS CloudFormation templates for managing and maintaining the network infrastructure

Overall explanation

Correct option:

Use AWS CloudFormation templates for managing and maintaining the network infrastructure

AWS CloudFormation gives you an easy way to model a collection of related AWS and third-party resources, provision them quickly and consistently, and manage them throughout their lifecycles, by treating infrastructure as code. A CloudFormation template describes your desired resources and their dependencies so you can launch and configure them together as a stack. You can use a template to create, update, and delete an entire stack as a single unit, as often as you need to, instead of managing resources individually. You can manage and provision stacks across multiple AWS accounts and AWS Regions.

You can manage resource scaling by sharing CloudFormation templates to be used across your organization, to meet safety, compliance, and configuration standards across all AWS accounts and regions. Templates and parameters enable easy scaling so you can share best practices and company policies. Additionally, CloudFormation StackSets enables you to create, update, or delete stacks across multiple AWS accounts and Regions, with a single operation.

To further automate resource management across your organization, you can integrate CloudFormation with other AWS services, including AWS Identity and Access Management (IAM) for access control, AWS Config for compliance, and AWS Service Catalog for turnkey application distribution and additional governance controls. Integrations with CodePipeline and other builder tools let you implement the latest DevOps best practices and improve automation, testing, and controls.

Incorrect options:

Use AWS Elastic Beanstalk for managing and maintaining the network resource - AWS Elastic Beanstalk is an easy-to-use service for deploying and scaling web applications and services developed with Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker on familiar servers such as Apache, Nginx, Passenger, and IIS. You can simply upload your code and Elastic Beanstalk automatically handles the deployment, from capacity provisioning, load balancing, auto-scaling to application health monitoring. At the same time, you retain full control over the AWS resources powering your application and can access the underlying resources at any time.

Elastic Beanstalk is a PaaS-like layer on top of AWS's IaaS services which abstracts away the underlying EC2 instances, Elastic Load Balancers, auto-scaling groups, etc. This makes it a lot easier for developers, who don't want to be dealing with all the systems stuff, to get their application quickly deployed on AWS.

CloudFormation, on the other hand, doesn't automatically do anything. It's simply a way to define all the resources needed for deployment in a huge JSON/YAML file. So a CloudFormation template might create two Elastic Beanstalk environments (production and staging), a couple of ElasticCache clusters, a DynamoDB table, and then the proper DNS in Route53.

Use AWS Config for managing and maintaining the network infrastructure - AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.

AWS Config records details of changes to your AWS resources to provide you with a configuration history. You can use the AWS Management Console, API, or CLI to obtain details of what a resource’s configuration looked like at any point in the past. AWS Config will also automatically deliver a configuration history file to the Amazon S3 bucket you specify.

Use AWS Service Catalog for managing and maintaining the network infrastructure - AWS Service Catalog was developed for organizations, IT teams, and managed service providers (MSPs) that need to centralize policies. It allows IT, administrators, to vend and manage AWS resources and services. For large organizations, it provides a standard method of provisioning cloud resources for thousands of users. It is also suitable for small teams, where front-line development managers can provide and maintain a standard dev/test environment.

Administrators use AWS Service Catalog to create catalogs of products by importing AWS CloudFormation templates. An end-user with access to a portfolio can use the AWS Management Console to find a standard dev/test environment product, for example, in the form of an AWS CloudFormation template, then manage the resulting resources using the AWS CloudFormation console. The products in Service Catalog are CloudFormation templates. Service Catalog can only allow product creation from within the catalog whereas CloudFormation is more seamless for automating infrastructure.

References:

https://aws.amazon.com/cloudformation/

https://stackoverflow.com/questions/14422151/what-is-the-difference-between-elastic-beanstalk-and-cloudformation-for-a-net-p

https://aws.amazon.com/servicecatalog/faqs/

Domain

Domain 3: Deployment, Provisioning, and Automation

Question 35Correct

Under the shared responsibility model, what are you NOT responsible for in Amazon S3?

Your answer is correct

S3 Server Side encryption

S3 bucket policies

S3 versioning

S3 ACLs

Overall explanation

Correct option:

S3 Server Side encryption

Security and Compliance is a shared responsibility between AWS and the customer. This shared model can help relieve the customer’s operational burden as AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates.

Controls that apply to both the infrastructure layer and customer layers, but in completely separate contexts or perspectives are called shared controls. In shared control, AWS provides the requirements for the infrastructure and the customer must provide their own control implementation within their use of AWS services. Configuration Management forms a part of shared controls - AWS maintains the configuration of its infrastructure devices, but a customer is responsible for configuring their own guest operating systems, databases, and applications.

For the given use-case, AWS is responsible for managing the S3 server-side encryption.

Shared Responsibility Model Overview:

via - https://aws.amazon.com/compliance/shared-responsibility-model/

Incorrect options:

S3 bucket policies

S3 versioning

S3 ACLs

These three options are the responsibilities of the customer.

Reference:

https://aws.amazon.com/compliance/shared-responsibility-model/

Domain

Domain 5: Networking and Content Delivery

Question 36Correct

A testing team has complained that they are unable to connect to services running on an Amazon Elastic Compute Cloud (Amazon EC2) instance. Inbound traffic to the necessary ports is configured for the Security Group as well as the Network Access Control List (Network ACL) associated with the instance.

What could be the reason for this behavior and how will you fix it?

Your answer is correct

Network ACLs are stateless, so you must allow both inbound and outbound traffic. Enable outbound traffic to fix the connectivity issue

Use multiple Availability Zone deployments so you have high availability

Security Groups are stateless, so you must allow both inbound and outbound traffic. Enable outbound traffic to fix the connectivity issue

Internet Gateway should be configured to access Amazon EC2 instance from the internet

Overall explanation

Correct option:

Network ACLs are stateless, so you must allow both inbound and outbound traffic. Enable outbound traffic to fix the connectivity issue - Security groups are stateful, so allowing inbound traffic to the necessary ports enables the connection. Network ACLs are stateless, so you must allow both inbound and outbound traffic.

To enable the connection to a service running on an instance, the associated network ACL must allow both:

Inbound traffic on the port that the service is listening on

Outbound traffic to ephemeral ports

When a client connects to a server, a random port from the ephemeral port range (1024-65535) becomes the client's source port.

The designated ephemeral port becomes the destination port for return traffic from the service. Outbound traffic to the ephemeral port must be allowed in the network ACL.

By default, network ACLs allow all inbound and outbound traffic. If your network ACL is more restrictive, then you need to explicitly allow traffic to the ephemeral port range.

Incorrect options:

Security Groups are stateless, so you must allow both inbound and outbound traffic. Enable outbound traffic to fix the connectivity issue - This statement is incorrect. Security groups are stateful, so allowing inbound traffic to the necessary ports enables the connection.

Internet Gateway should be configured to access Amazon EC2 instance from the internet - If you accept traffic from the internet, then you also must establish a route through an internet gateway. The use case does not mention anything about access over the internet, hence this option is not the right choice.

Use multiple Availability Zone deployments so you have high availability - AWS best practices suggest using multiple Availability Zone deployments for high availability. However, the connection to services running on EC2 instances should be possible irrespective of the deployment type chosen. Hence, this option is not correct for the given issue.

Reference:

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#Rules

Domain

Domain 4: Security and Compliance

Question 37Incorrect

As a SysOps Administrator, you maintain and manage the AWS environment for your company. You need to track AWS events that might affect your environment or specific operational issues that affect the AWS accounts you manage.

Which AWS service/tool will you choose to achieve this goal?

Use the Service Health Dashboard to view the status of each AWS service and their impact on your AWS resources

Your answer is incorrect

Run diagnostics directly inside AWS Personal Health Dashboard with the help of Lambda functions and integrate the outcome with your existing in-house management tools

Use the Trusted Advisor notification feature to help you stay up-to-date with the current status of your AWS resources

Correct answer

Use the AWS Health API, to integrate health data and notifications with your existing in-house management tools

Overall explanation

Correct option:

Use the AWS Health API, to integrate health data and notifications with your existing in-house management tools

AWS Personal Health Dashboard provides a personalized view of the health of the specific services that are powering your workloads and applications. Personal Health Dashboard proactively notifies you when AWS experiences any events that may affect you, helping provide quick visibility and guidance to help you minimize the impact of events in progress, and plan for any scheduled changes, such as AWS hardware maintenance.

The AWS Health API provides programmatic access to the AWS Health information that appears in the AWS Personal Health Dashboard. You can use the API operations to get information about events that might affect your AWS services and resources.

You must have a Business or Enterprise Support plan from AWS Support to use the AWS Health API. If you call the AWS Health API from an AWS account that doesn't have a Business or Enterprise Support plan, you receive a SubscriptionRequiredException error.

Incorrect options:

Use the Service Health Dashboard to view the status of each AWS service and their impact on your AWS resources - The Service Health Dashboard is a good way to view the overall status of each AWS service, but does not provide specific information in terms of how the health of those services is impacting your resources.

Use the Trusted Advisor notification feature to help you stay up-to-date with the current status of your AWS resources - The Trusted Advisor notification feature helps you stay up-to-date with your AWS resource deployment. You will be notified by weekly email when you opt-in for this service. However, the notification is about the resource deployment status and not the resource current status which is the main requirement for the given use case.

Run diagnostics directly inside AWS Personal Health Dashboard with the help of Lambda functions and integrate the outcome with your existing in-house management tools - At this time, running diagnostics directly inside AWS Personal Health Dashboard is not possible. However, you could attach a diagnostics automation script that will be executed by Lambda when an event occurs provided that the event is wired appropriately.

References:

https://docs.aws.amazon.com/health/latest/APIReference/Welcome.html

https://aws.amazon.com/premiumsupport/faqs/?

Domain

Domain 1: Monitoring, Logging, and Remediation

Question 38Correct

A company running Windows-based applications on the AWS cloud wants a managed storage service that supports Windows NTFS and SMB protocol while having the ability to integrate with Active Directory for authentication purposes.

Which AWS service is the best fit for this requirement?

Your answer is correct

Amazon FSx Windows File Server

Amazon Elastic File System (EFS)

AWS Storage Gateway

Amazon FSx for Lustre

Overall explanation

Correct option:

Amazon FSx Windows File Server - For Windows-based applications, Amazon FSx provides fully managed Windows file servers with features and performance optimized for "lift-and-shift" business-critical application workloads including home directories (user shares), media workflows, and ERP applications. It is accessible from Windows and Linux instances via the SMB protocol.

Many Windows-based business-critical applications and workloads, such as ERP, CRM, and custom applications, require shared file storage provided by Windows-based file systems (NTFS) and use the SMB protocol. Amazon FSx is built on Windows Server and provides you with the compatible Windows features and performance that your applications require from a file system. By providing fully managed Windows file storage with features like Microsoft Active Directory (Microsoft AD) integration and automatic backups, you can easily migrate your file-based applications to AWS.

Incorrect options:

Amazon FSx for Lustre - For compute-intensive and fast processing workloads, like high-performance computing (HPC), machine learning, EDA, and media processing, Amazon FSx for Lustre, provides a file system that’s optimized for performance, with input and output stored on Amazon S3. FSx for Lustre is designed for Linux workloads.

Amazon Elastic File System (EFS) - Amazon EFS is a file storage service for use with Amazon compute (EC2, containers, serverless) and on-premises servers. Amazon EFS provides a file system interface, file system access semantics (such as strong consistency and file locking), and concurrently-accessible storage for up to thousands of Amazon EC2 instances. Amazon EFS is not supported on Windows instances.

AWS Storage Gateway - AWS Storage Gateway is a set of hybrid cloud services that give you on-premises access to virtually unlimited cloud storage. Customers use Storage Gateway to integrate AWS Cloud storage with existing on-site workloads so they can simplify storage management and reduce costs for key hybrid cloud storage use cases. These include moving backups to the cloud, using on-premises file shares backed by cloud storage, and providing low latency access to data in AWS for on-premises applications. AWS Storage Gateway is not a storage service itself, it stores data on Amazon S3 storage service.

Reference:

https://aws.amazon.com/fsx/windows/

Domain

Domain 5: Networking and Content Delivery

Question 39Incorrect

An AWS Storage Gateway is connecting an on-premises data center to AWS Cloud and it has run into failure. This has resulted in a malfunctioning Gateway. As a SysOps Administrator, you were asked to troubleshoot the service.

Which of the following are the best practices to recover data from the Gateway? (Select two)

Your selection is incorrect

Recover the failed Gateway VM from your Amazon EC2 Amazon Machine Image (AMI)

Correct selection

For stored volumes gateways, you can recover data from your most recent Amazon EBS snapshot of the volume

Recover the failed Gateway VM from a snapshot that is created by your hypervisor

Your selection is correct

If your file system gets corrupted, you can use the fsck command to repair it

If the status of your volume is IRRECOVERABLE, you can no longer recover data from this volume

Overall explanation

Correct options:

For stored volumes gateways, you can recover data from your most recent Amazon EBS snapshot of the volume - If your gateway or virtual machine malfunctions, you can recover data that has been uploaded to AWS and stored on a volume in Amazon S3. For cached volumes gateways, you recover data from a recovery snapshot. For stored volumes gateways, you can recover data from your most recent Amazon EBS snapshot of the volume. For tape gateways, you recover one or more tapes from a recovery point to a new tape gateway.

If your file system gets corrupted, you can use the fsck command to repair it - If your file system gets corrupted, you can use the fsck command to check your file system for errors and repair it. If you can repair the file system, you can then recover your data from the volumes on the file system.

Incorrect options:

Recover the failed Gateway VM from your Amazon EC2 Amazon Machine Image (AMI)

Recover the failed Gateway VM from a snapshot that is created by your hypervisor

These two options are incorrect. Storage Gateway doesn’t support recovering a gateway VM from a snapshot that is created by your hypervisor or from your Amazon EC2 Amazon Machine Image (AMI). If your gateway VM malfunctions, you need to activate a new gateway and recover your data to that gateway using the instructions provided by AWS.

If the status of your volume is IRRECOVERABLE, you can no longer recover data from this volume - If the status of your volume is IRRECOVERABLE, you can no longer use this volume. For stored volumes, you can retrieve your data from the irrecoverable volume to a new volume by using the following steps:

Create a new volume from the disk that was used to create the irrecoverable volume.

Preserve existing data when you are creating the new volume.

Delete all pending snapshot jobs for the irrecoverable volume.

Delete the irrecoverable volume from the gateway.

Reference:

https://docs.aws.amazon.com/storagegateway/latest/userguide/recover-data-from-gateway.html

Domain

Domain 5: Networking and Content Delivery

Question 40Incorrect

A company has inherited a legacy relational database that produces a multitude of reports needed for accounting and operations. Now, the company also wants to use Amazon DynamoDB for customer-facing applications that need millisecond latencies.

Which is the most optimal way to integrate the existing relational system with DynamoDB?

Correct answer

DynamoDB Streams and AWS Lambda can be used to integrate DynamoDB seamlessly with the relational system

Your answer is incorrect

DynamoDB Accelerator (DAX) can be used to seamlessly integrate relational system with DynamoDB

Configure Amazon ElastiCache to use in-memory caching to integrate relational systems with DynamoDB

Configure Kinesis Data Streams to carry real-time updates from the relational system to DynamoDB

Overall explanation

Correct option:

DynamoDB Streams and AWS Lambda can be used to integrate DynamoDB seamlessly with the relational system

DynamoDB can take advantage of DynamoDB Streams and AWS Lambda to integrate seamlessly with one or more existing relational database systems. For this kind of integration to be implemented, essentially three kinds of interoperation must be provided:

Fill the DynamoDB cache incrementally - When an item is queried, look for it first in DynamoDB. If it is not there, look for it in the SQL system, and load it into DynamoDB.

Write through a DynamoDB cache - When a customer changes a value in DynamoDB, a Lambda function is triggered to write the new data back to the SQL system.

Update DynamoDB from the SQL system - When internal processes such as inventory management or pricing change a value in the SQL system, a stored procedure is triggered to propagate the change to the DynamoDB materialized view.

Integrating DynamoDB with relational systems:

via - https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/bp-hybrid.html#bp-hybrid-problems

Incorrect options:

DynamoDB Accelerator (DAX) can be used to seamlessly integrate the relational system with DynamoDB - DAX is a DynamoDB-compatible caching service that enables you to benefit from fast in-memory performance for demanding applications. In most cases, the DynamoDB response times can be measured in single-digit milliseconds. However, there are certain use cases that require response times in microseconds. For these use cases, DynamoDB Accelerator (DAX) delivers fast response times for accessing eventually consistent data. DAX cannot integrate a relational database with DynamoDB.

Configure Kinesis Data Streams to carry real-time updates from the relational system to DynamoDB - Amazon Kinesis Data Streams (KDS) is a massively scalable and durable real-time data streaming service. KDS can continuously capture gigabytes of data per second from hundreds of thousands of sources such as website clickstreams, database event streams, financial transactions, social media feeds, IT logs, and location-tracking events. The data collected is available in milliseconds to enable real-time analytics use cases. Such a KDS based solution would only facilitate updates from the relational system to DynamoDB, so this option is incorrect.

Configure Amazon ElastiCache to use in-memory caching to integrate relational databases with DynamoDB - The in-memory caching provided by Amazon ElastiCache can be used to significantly improve latency and throughput for many read-heavy application workloads or compute-intensive workloads. In-memory caching improves application performance by storing critical pieces of data in memory for low-latency access. ElastiCache cannot integrate relational databases with DynamoDB.

References:

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/bp-hybrid.html#bp-hybrid-problems

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.html

Domain

Domain 2: Reliability and Business Continuity

Question 41Correct

A financial services company runs a flagship application that hosts critical data for several clients. The company uses AWS CloudTrail to track user activities on various AWS resources. An audit firm has raised several security-specific questions about the CloudTrail logs. The company is looking at ways to secure these logs from being tampered.

What is the recommended way of implementing a solution for this requirement?

Use Amazon S3 MFA Delete to know the delete operations performed by any user on the logs stored in S3 buckets

Use Amazon S3 Versioning to keep all versions of the file created

Use KMS logfile security keys to keep the CloudTrail logs secure and tamper-proof

Your answer is correct

Use CloudTrail log file integrity to keep the logs tamper-proof

Overall explanation

Correct option:

Use CloudTrail log file integrity to keep the logs tamper-proof - A trail is a configuration that enables delivery of events to an Amazon S3 bucket that you specify.

To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation. This feature is built using industry-standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection.

When you enable log file integrity validation, CloudTrail creates a hash for every log file that it delivers. Every hour, CloudTrail also creates and delivers a file that references the log files for the last hour and contains a hash of each. This file is called a digest file. CloudTrail signs each digest file using the private key of a public and private key pair. After delivery, you can use the public key to validate the digest file. CloudTrail uses different key pairs for each AWS region.

The digest files are delivered to the same Amazon S3 bucket associated with your trail as your CloudTrail log files. If your log files are delivered from all regions or multiple accounts into a single Amazon S3 bucket, CloudTrail will deliver the digest files from those regions and accounts into the same bucket.

The digest files are put into a folder separate from the log files. This separation of digest files and log files enables you to enforce granular security policies and permits existing log processing solutions to continue to operate without modification. Each digest file also contains the digital signature of the previous digest file if one exists. The signature for the current digest file is in the metadata properties of the digest file Amazon S3 object.

Incorrect options:

Use KMS logfile security keys to keep the CloudTrail logs secure and tamper-proof - This is a made-up option and given only as a distractor.

Use Amazon S3 Versioning to keep all versions of the file created - Amazon S3 Versioning helps retain all the versions of a file created. CloudTrail log file integrity is a custom-made solution for the given requirement.

Use Amazon S3 MFA Delete to know the delete operations performed by any user on the logs stored in S3 buckets - If a bucket's versioning configuration is MFA Delete–enabled, the bucket owner must include the x-amz-mfa request header in requests to permanently delete an object version or change the versioning state of the bucket. This option does not address the use case.

References:

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html

https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html

Domain

Domain 1: Monitoring, Logging, and Remediation

Question 42Incorrect

The technology team at a startup is looking at moving their technology infrastructure to AWS Cloud. The team has hired you as a SysOps Administrator to help them understand the mechanics of the EC2 instance IP addressing in an Amazon Virtual Private Cloud (VPC).

Which of the following would you identify as correct regarding the configuration of IP addresses for EC2 instances? (Select three)

Correct selection

If the public IP address of your instance in a VPC has been released, it will not receive a new one if there is more than one network interface attached to your instance

Correct selection

You cannot manually associate or disassociate a public IP address from your instance

Your selection is incorrect

AWS releases your instance's public IP address when it is stopped or terminated. However, the IP address is retained if the instance is hibernated

Your selection is incorrect

An instance can have both - a public IP address and an Elastic IP address with it

Your selection is correct

By default, Amazon EC2 and Amazon VPC use the IPv4 addressing protocol; you can't disable this behavior

By default, AWS assigns a public IP address to instances launched in both- default and nondefault VPCs

Overall explanation

Correct option:

You cannot manually associate or disassociate a public IP address from your instance - A public IP address is assigned to your instance from Amazon's pool of public IPv4 addresses, and is not associated with your AWS account. You cannot manually associate or disassociate a public IP address from your instance.

By default, Amazon EC2 and Amazon VPC use the IPv4 addressing protocol; you can't disable this behavior - Amazon EC2 and Amazon VPC support both the IPv4 and IPv6 addressing protocols. By default, Amazon EC2 and Amazon VPC use the IPv4 addressing protocol; you can't disable this behavior. When you create a VPC, you must specify an IPv4 CIDR block (a range of private IPv4 addresses). You can optionally assign an IPv6 CIDR block to your VPC and subnets, and assign IPv6 addresses from that block to instances in your subnet.

If the public IP address of your instance in a VPC has been released, it will not receive a new one if there is more than one network interface attached to your instance - If the public IP address of your instance in a VPC has been released, it will not receive a new one if there is more than one network interface attached to your instance. If your instance's public IP address is released while it has a secondary private IP address that is associated with an Elastic IP address, the instance does not receive a new public IP address.

Incorrect options:

AWS releases your instance's public IP address when it is stopped or terminated. However, the IP address is retained if the instance is hibernated - AWS releases your instance's public IP address when it is stopped, hibernated, or terminated. Your stopped or hibernated instance receives a new public IP address when it is started.

An instance can have both - a public IP address and an Elastic IP address with it - AWS releases your instance's public IP address when you associate an Elastic IP address with it. When you disassociate the Elastic IP address from your instance, it receives a new public IP address.

By default, AWS assigns a public IP address to instances launched in both default and non-default VPCs - When you launch an instance in a default VPC, AWS assigns it a public IP address by default. When you launch an instance into a non-default VPC, the subnet has an attribute that determines whether instances launched into that subnet receive a public IP address from the public IPv4 address pool. By default, AWS does not assign a public IP address to instances launched in a non-default subnet.

Reference:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html

Domain

Domain 5: Networking and Content Delivery

Question 43Incorrect

Account A has enabled other AWS accounts to upload objects into an Amazon S3 bucket. The bucket owner now wants to give permissions on all objects in the given bucket to another AWS account B.

Which of the following options are correct for the given use case? (Select two)

The root user has access to all objects created under it. Use root user to delegate necessary permissions on objects in the S3 bucket

Your selection is incorrect

The owner should provide cross-account delegation to users in other AWS accounts

Correct selection

The AWS account that created the objects must first grant permission to the bucket owner for delegating permissions to other entities

Your selection is incorrect

The bucket owner is the owner of all objects in the bucket, irrespective of the AWS account that uploaded the objects

Correct selection

The bucket owner has no permissions on those objects created by other AWS accounts

Overall explanation

Correct options:

The bucket owner has no permissions on those objects created by other AWS accounts

The bucket owner has no permissions on those objects created by other AWS accounts and is not the owner of objects created by other AWS accounts.

The AWS account that created the objects must first grant permission to the bucket owner for delegating permissions to other entities

The bucket owner has no permissions on those objects created by other AWS accounts. So for the bucket owner to grant permissions on objects it does not own, the object owner, the AWS account that created the objects, must first grant permission to the bucket owner. The bucket owner can then delegate those permissions.

Incorrect options:

The bucket owner is the owner of all objects in the bucket, irrespective of the AWS account that uploaded the objects - The bucket owner has no permissions on those objects created by other AWS accounts and is not the owner of objects created by other AWS accounts.

The owner should provide cross-account delegation to users in other AWS accounts - Bucket owner account can delegate permissions to users in its own account, but it cannot delegate permissions to other AWS accounts, because cross-account delegation is not supported.

The root user has access to all objects created under it. Use root user to delegate necessary permissions on objects in the S3 bucket - AWS strongly recommends that you do not use the root user for your everyday tasks, even the administrative ones. Root user credentials should only be used to perform a few account and service management tasks. In addition, the root user cannot do cross-account delegation for objects created by another AWS account.

Reference:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example4.html

Domain

Domain 4: Security and Compliance

Question 44Incorrect

A project stores sensitive customer data on Amazon S3 buckets. This data needs to be encrypted at rest. Also, the encryption keys need to be rotated annually at least.

What is an easy way to implement this requirement?

Encrypt the data before sending it to Amazon S3

Correct answer

Use AWS KMS with automatic key rotation

Your answer is incorrect

Import a custom key into AWS KMS and automate the key rotation on an annual basis by using a Lambda function

Use SSE-C with automatic key rotation on an annual basis

Overall explanation

Correct option:

Use AWS KMS with automatic key rotation

Server-side encryption is the encryption of data at its destination by the application or service that receives it. Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. You have three mutually exclusive options, depending on how you choose to manage the encryption keys: Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3), Server-Side Encryption with Customer Master Keys (CMKs) Stored in AWS Key Management Service (SSE-KMS), Server-Side Encryption with Customer-Provided Keys (SSE-C).

When you use server-side encryption with AWS KMS (SSE-KMS), you can use the default AWS managed CMK, or you can specify a customer managed CMK that you have already created. If you don't specify a customer managed CMK, Amazon S3 automatically creates an AWS managed CMK in your AWS account the first time that you add an object encrypted with SSE-KMS to a bucket. By default, Amazon S3 uses this CMK for SSE-KMS.

You can choose to have AWS KMS automatically rotate CMKs every year, provided that those keys were generated within AWS KMS HSMs.

Incorrect options:

Encrypt the data before sending it to Amazon S3 - The act of encrypting data before sending it to Amazon S3 is called Client-Side encryption. You will have to handle the key generation, maintenance, and rotation process. This is not the easiest way to encrypt S3 data at rest. Hence, this is not the right choice here.

Import a custom key into AWS KMS and automate the key rotation on an annual basis by using a Lambda function - When you import a custom key, you are responsible for maintaining a copy of your imported keys in your key management infrastructure so that you can re-import them at any time. Also, automatic key rotation is not supported for imported keys. Using Lambda functions to rotate keys is a possible solution, but not an optimal one for the current use case.

Use SSE-C with automatic key rotation on an annual basis - With Server-Side Encryption with Customer-Provided Keys (SSE-C), you manage the encryption keys and Amazon S3 manages the encryption, as it writes to disks, and decryption when you access your objects. The keys are not stored anywhere in Amazon S3. There is no automatic key rotation facility for this option.

Reference:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html

Domain

Domain 4: Security and Compliance

Question 45Incorrect

A web application runs on multiple Amazon EC2 instances that are configured behind an Auto Scaling Group (ASG). The company wants the scaling action to begin as soon as CPU utilization crosses 50% for the instances.

Which is the right way to configure this scaling action?

Configure ASG to use predictive scaling

Configure ASG to scale based on a schedule

Your answer is incorrect

Configure ASG to scale based on events

Correct answer

Configure ASG to scale based on demand

Overall explanation

Correct option:

Configure ASG to scale based on demand - When you configure dynamic scaling ( Scaling on Demand), you define how to scale the capacity of your Auto Scaling group in response to changing demand.

For example, let's say that you have a web application that currently runs on two instances, and you want the CPU utilization of the Auto Scaling group to stay at around 50 percent when the load on the application changes. This gives you extra capacity to handle traffic spikes without maintaining an excessive number of idle resources.

You can configure your Auto Scaling group to scale dynamically to meet this need by creating a scaling policy. Amazon EC2 Auto Scaling can then scale out your group (add more instances) to deal with high demand at peak times, and scale in your group (run fewer instances) to reduce costs during periods of low utilization.

Incorrect options:

Configure ASG to use predictive scaling - You can also use Amazon EC2 Auto Scaling in combination with AWS Auto Scaling to scale resources across multiple services. AWS Auto Scaling can help you maintain optimal availability and performance by combining predictive scaling and dynamic scaling (proactive and reactive approaches, respectively) to scale your Amazon EC2 capacity faster. Scaling based on demand is a direct way to achieve the current requirement and hence is the correct option.

Configure ASG to scale based on a schedule - Scaling by schedule means that scaling actions are performed automatically as a function of time and date. This is useful when you know exactly when to increase or decrease the number of instances in your group, simply because the need arises on a predictable schedule.

Configure ASG to scale based on events - This is a made-up option and given only as a distractor.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scale-based-on-demand.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/scaling_plan.html

Domain

Domain 6: Cost and Performance Optimization

Question 46Incorrect

As a SysOps Administrator, you are tasked with creating an AWS Certificate Manager (ACM) certificate for Elastic Load Balancer that is fronting Amazon EC2 instances.

What are the key points to consider while creating certificates through ACM? (Select two)

Correct selection

You cannot use ACM certificates for email encryption

You can install an ACM certificate on your application running on an Amazon EC2 instance

Your selection is correct

ACM provides certificates for SSL/TLS protocols only

Your selection is incorrect

The private key for an ACM certificate can only be downloaded from an AWS root user account

ACM helps you request certificates for Amazon-owned domain names

Overall explanation

Correct options:

You cannot use ACM certificates for email encryption - Indeed, ACM certificates cannot be used for email encryption.

ACM provides certificates for SSL/TLS protocols only - AWS Certificate Manager (ACM) handles the complexity of creating, storing, and renewing public and private SSL/TLS X.509 certificates and keys that protect your AWS websites and applications. Therefore, ACM does not provide certificates for anything other than the SSL/TLS protocols.

Exceptions for ACM certifications:

via - https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html

Incorrect options:

ACM helps you request certificates for Amazon-owned domain names - You cannot request certificates for Amazon-owned domain names such as those ending in amazonaws.com, cloudfront.net, or elasticbeanstalk.com.

You can install an ACM certificate on your application running on an Amazon EC2 instance - You cannot directly install ACM certificates on your Amazon Elastic Compute Cloud (Amazon EC2) website or application. You can, however, use your certificate with any integrated service like Amazon CloudFront, Elastic Load Balancer, etc.

The private key for an ACM certificate can only be downloaded from an AWS root user account - This is incorrect. You cannot download the private key for an ACM certificate.

Reference:

https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html

Domain

Domain 4: Security and Compliance

Question 47Correct

A certificate was imported using AWS Certificate Manager (ACM) for configuring on an Application Load Balancer (ALB). The certificate, however, is not visible in ACM.

What can be the issue and how will you fix it?

ALB does not directly support ACM certificates. The certificate has to be installed on Amazon EC2 instance(s) backing the ALB

ACM is not directly integrated with ALB. You need to use Amazon CloudFront for using ACM certificates with ALB

To use the ACM certificates with ALB, the certificates must be imported or requested in the US East (N. Virginia) Region only

Your answer is correct

The ACM certificate wasn't requested in the same AWS Region as your load balancer

Overall explanation

Correct option:

The ACM certificate wasn't requested in the same AWS Region as your load balancer

To use a third-party certificate with a load balancer, you can either import the certificate into ACM or upload a certificate to AWS Identity and Access Management (IAM).

You won't find the imported certificate or ACM certificate if: 1. The certificate imported into ACM is using an algorithm other than 1024-bit RSA or 2048-bit RSA.

The ACM certificate wasn't requested in the same AWS Region as your load balancer or CloudFront distribution.

ACM certificates must be requested or imported in the same AWS Region as your Classic Load Balancer or Application Load Balancer.

Incorrect options:

To use the ACM certificates with ALB, the certificates must be imported or requested in the US East (N. Virginia) Region only - This statement is incorrect. To use the ACM certificates with Amazon CloudFront (and not an ALB), the certificates must be imported or requested in the US East (N. Virginia) Region.

ACM is not directly integrated with ALB. You need to use Amazon CloudFront for using ACM certificates with ALB - This is incorrect. ACM is integrated with Elastic Load Balancing. ACM certificates are supported by the following services: Elastic Load Balancing, Amazon CloudFront, AWS Elastic Beanstalk, AWS App Runner, Amazon API Gateway, AWS Nitro Enclaves, and AWS CloudFormation.

ALB does not directly support ACM certificates. The certificate has to be installed on Amazon EC2 instance(s) backing the ALB - As discussed above, ACM supports ALB, so this option is incorrect.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/acm-export-certificate/

https://docs.aws.amazon.com/acm/latest/userguide/acm-services.html

Domain

Domain 5: Networking and Content Delivery

Question 48Incorrect

A development team needs to add an alternate domain name to the application's CloudFront distribution for using the company's domain name in the application links instead of the generic CloudFront domain name.

Which of the following are the mandatory steps required to meet this requirement? (Select two)

Your selection is incorrect

Use Server Name Indication (SNI) to authorize the SSL/TLS certificate for your domain name

Register a private certificate with AWS Certificate Manager (ACM) that covers the domain name

Your selection is correct

Register the domain name with Route 53 or another domain registrar

Configure an AWS Global Accelerator to route to different registered domain names

Correct selection

Get an SSL/TLS certificate from an authorized certificate authority (CA) that covers the domain name

Overall explanation

Correct options:

Get an SSL/TLS certificate from an authorized certificate authority (CA) that covers the domain name

Register the domain name with Route 53 or another domain registrar

In CloudFront, an alternate domain name, also known as a CNAME, lets you use your domain name (for example, www.example.com) in your files’ URLs instead of using the domain name that CloudFront assigns to your distribution.

Point to keep in mind before you update your distribution to add an alternate domain name:

Register the domain name with Route 53 or another domain registrar.

Get an SSL/TLS certificate from an authorized certificate authority (CA) that covers the domain name. Add the certificate to your distribution to validate that you are authorized to use the domain.

Incorrect options:

Register a private certificate with AWS Certificate Manager (ACM) that covers the domain name - Private certificates identify resources within an organization, such as applications, services, devices, and users. In establishing a secure encrypted communications channel, each endpoint uses a certificate and cryptographic techniques to prove its identity to the other endpoint. A private certificate is a wrong choice since the resources will be accessed from the internet.

Use Server Name Indication (SNI) to authorize the SSL/TLS certificate for your domain name - If you want your viewers to use HTTPS and to use alternate domain names for your files, you use Server Name Indication (SNI). Server Name Indication (SNI) is an extension to the TLS protocol that is supported by browsers and clients released after 2010. If you configure CloudFront to serve HTTPS requests using SNI, CloudFront associates your alternate domain name with an IP address for each edge location.

Configure an AWS Global Accelerator to route to different registered domain names - AWS Global Accelerator is a networking service that helps you improve the availability and performance of the applications that you offer to your global users. It provides static IP addresses that provide a fixed entry point to your applications and eliminate the complexity of managing specific IP addresses for different AWS Regions and Availability Zones. This option has been added as a distractor.

References:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-https-dedicated-ip-or-sni.html

Domain

Domain 5: Networking and Content Delivery

Question 49Correct

Your bank has an on-premise key store and wants to migrate it to the cloud. The bank needs to ensure that the keys were isolated on a self-managed encryption module for compliance reasons.

What service do you recommend?

GuardDuty

KMS

Your answer is correct

CloudHSM

S3 SSE

Overall explanation

Correct option:

CloudHSM

AWS CloudHSM is a service for creating and managing cloud-based hardware security modules. A hardware security module (HSM) is a specialized security device that generates and stores cryptographic keys.

You should use AWS CloudHSM when you need to manage the HSMs that generate and store your encryption keys. In AWS CloudHSM, you create and manage HSMs, including creating users and setting their permissions. You also create the symmetric keys and asymmetric key pairs that the HSM stores.

Incorrect options:

KMS - If you need to secure your encryption keys in a service backed by FIPS-validated HSMs, but you do not need to manage the HSM, you should use AWS Key Management Service (KMS).

When you encrypt data, you need to protect your encryption key. If you encrypt your key, you need to protect its encryption key. Eventually, you must protect the highest level encryption key (known as a master key) in the hierarchy that protects your data. That's where AWS KMS comes in.

KMS lets you create, store, and manage customer master keys (CMKs) securely. Your CMKs never leave AWS KMS unencrypted. To use a CMK in a cryptographic operation, you call KMS.

KMS does not offer a self-managed encryption module.

S3 SSE - Server-side encryption protects data at rest. Amazon S3 encrypts each object with a unique key. As an additional safeguard, it encrypts the key itself with a master key that it rotates regularly. Amazon S3 server-side encryption uses one of the strongest block ciphers available to encrypt your data, 256-bit Advanced Encryption Standard (AES-256).

S3 SSE does not offer a self-managed encryption module.

GuardDuty - GuardDuty is a threat detection service that monitors malicious activity and unauthorized behavior to protect your AWS account. GuardDuty analyzes billions of events across your AWS accounts from AWS CloudTrail (AWS user and API activity in your accounts), Amazon VPC Flow Logs (network traffic data), and DNS Logs (name query patterns). GuardDuty cannot be used to segregate the environment your employees work in based on the department they belong to.

How GuardDuty Works:

via - https://aws.amazon.com/guardduty/

References:

https://docs.aws.amazon.com/cloudhsm/latest/userguide/introduction.html

https://docs.aws.amazon.com/crypto/latest/userguide/awscryp-choose-hsm.html

https://docs.aws.amazon.com/crypto/latest/userguide/awscryp-choose-kms.html

https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html

Domain

Domain 4: Security and Compliance

Question 50Correct

A financial services company has to maintain a log of all transactions for audit and compliance purposes. The company is planning stringent security measures for all of its CloudTrail log files.

As a SysOps Administrator, which of the following would you suggest as the LEAST effort options to secure the CloudTrail logs? (Select two)

Integrate with Amazon CloudWatch alarms to generate an alarm whenever changes are made to CloudTrail log files

Your selection is correct

Use Amazon S3 MFA Delete on the S3 bucket that holds CloudTrail logs and digest files

Your selection is correct

Enable CloudTrail log file integrity validation

To prevent access rights violation, use AWS root user account to manage CloudTrail logs

Enable Versioning on Amazon S3 buckets that store CloudTrail logs and digest files

Overall explanation

Correct options:

Enable CloudTrail log file integrity validation - Validated log files are invaluable in security and forensic investigations. For example, a validated log file enables you to assert positively that the log file itself has not changed, or that particular user credentials performed specific API activity. The CloudTrail log file integrity validation process also lets you know if a log file has been deleted or changed, or assert positively that no log files were delivered to your account during a given period of time.

When you enable log file integrity validation, CloudTrail creates a hash for every log file that it delivers. Every hour, CloudTrail also creates and delivers a file that references the log files for the last hour and contains a hash of each. This file is called a digest file. CloudTrail signs each digest file using the private key of a public and private key pair. After delivery, you can use the public key to validate the digest file. CloudTrail uses different key pairs for each AWS region.

Use Amazon S3 MFA Delete on the S3 bucket that holds CloudTrail logs and digest files - The digest files are delivered to the same Amazon S3 bucket associated with your trail as your CloudTrail log files. If your log files are delivered from all regions or from multiple accounts into a single Amazon S3 bucket, CloudTrail will deliver the digest files from those regions and accounts into the same bucket.

Configuring multi-factor authentication (MFA) ensures that any attempt to change the versioning state of your bucket or permanently delete an object version requires additional authentication. This helps prevent any operation that could compromise the integrity of your log files, even if a user acquires the password of an IAM user that has permission to permanently delete Amazon S3 objects.

Incorrect options:

Enable Versioning on Amazon S3 buckets that store CloudTrail logs and digest files - Versioning in Amazon S3 is a means of keeping multiple variants of an object in the same bucket. You can use the S3 Versioning feature to preserve, retrieve, and restore every version of every object stored in your buckets. With versioning, you can recover from both unintended user actions and application failures. Versioning would allow you to change the logs without raising any alarm/warning/notice.

Integrate with Amazon CloudWatch alarms to generate an alarm whenever changes are made to CloudTrail log files - CloudTrail and CloudWatch are closely integrated and it is possible to implement something like this. However, this requires additional effort compared to the correct options.

To prevent access rights violation, use AWS root user account to manage CloudTrail logs - Root user account should not be used for any operational use cases as a security best practice, so this option is incorrect.

References:

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html

Domain

Domain 4: Security and Compliance

Question 51Incorrect

An administrator has to generate reports on the Aurora DB Cluster and its replicas. The report needs to capture the maximum amount of lag between the primary instance and each Aurora DB instance in the DB cluster.

Which Aurora CloudWatch metric will help fetch this information?

Correct answer

AuroraReplicaLagMaximum

AuroraBinlogReplicaLag

Your answer is incorrect

AuroraReplicaLag

InsertLatency

Overall explanation

Correct option:

AuroraReplicaLagMaximum - This metric captures the maximum amount of lag between the primary instance and each Aurora DB instance in the DB cluster.

Incorrect options:

AuroraBinlogReplicaLag - This metric captures the amount of time a replica DB cluster running on Aurora MySQL-Compatible Edition lags behind the source DB cluster.

This metric reports the value of the Seconds_Behind_Master field of the MySQL SHOW SLAVE STATUS command. This metric is useful for monitoring replica lag between Aurora DB clusters that are replicating across different AWS Regions.

AuroraReplicaLag - This metric captures the amount of lag an Aurora replica experiences when replicating updates from the primary instance.

InsertLatency - This metric captures the average duration of insert operations.

Reference:

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.AuroraMySQL.Monitoring.Metrics.html

Domain

Domain 1: Monitoring, Logging, and Remediation

Question 52Incorrect

An Amazon Elastic Block Store (Amazon EBS) was deleted as the volume was no longer needed by the business. But the AWS Config rule continues to show the status of the EBS volume as compliant.

What is the reason for this behavior and suggest a fix to avoid confusion in future?

Correct answer

Amazon EBS volumes deleted with the TerminateInstances API call continue to show for some time on AWS Config console

The EBS volume was not deleted properly, probably owing to permission issues

Your answer is incorrect

The DeleteOnTermination attribute for the attached EBS volume is set to false, keeping the volume alive

Amazon EBS volumes deleted with the DeleteVolume API call continue to show for some time on AWS Config console

Overall explanation

Correct option:

Amazon EBS volumes deleted with the TerminateInstances API call continue to show for some time on AWS Config console

Terminated Amazon EC2 instances use the DeleteOnTermination attribute for each attached EBS volume to determine to delete the volume. Amazon EC2 deletes the Amazon EBS volume that has the DeleteOnTermination attribute set to true, but it does not publish the DeleteVolume API call. This is because AWS Config uses the DeleteVolume API call as a trigger with the rule, and the resource changes aren't recorded for the EBS volume. The EBS volume still shows as compliant or noncompliant.

AWS Config performs a baseline every six hours to check for new configuration items with the ResourceDeleted status. The AWS Config rule then removes the deleted EBS volumes from the evaluation results.

Incorrect options:

Amazon EBS volumes deleted with the DeleteVolume API call continue to show for some time on AWS Config console - Amazon EBS volumes deleted using the DeleteVolume API call invoke a DescribeVolumes API call on volume. The DescribeVolumes API call returns an InvalidVolume.NotFound error code and the Amazon EBS volume is removed from the list of resources in AWS Config. The updated configuration of the volume is recorded as a configuration item with the status as ResourceDeleted and then delivered to an Amazon Simple Storage Service (Amazon S3) bucket.

The DeleteOnTermination attribute for the attached EBS volume is set to false, keeping the volume alive - When an instance terminates, the value of the DeleteOnTermination attribute for each attached EBS volume determines whether to preserve or delete the volume. Enabling the flag does not mean that the EBS volume cannot be deleted.

The EBS volume was not deleted properly, probably owing to permission issues - Insufficient permissions will not let the delete operation on EBS volume succeed. If the deletion took place without an error, it is not a permissions issue.

Reference:

https://docs.amazonaws.cn/en_us/AWSEC2/latest/WindowsGuide/ebs-deleting-volume.html

Domain

Domain 5: Networking and Content Delivery

Question 53Incorrect

A SysOps Administrator is not able to launch EC2 instances with an encrypted AMI when using Amazon EC2 Auto Scaling with the instances. The AWS Identity and Access Management (IAM) identities used to create the Amazon EC2 Auto Scaling has administrator permissions.

What could be the underlying issue and how do you propose to fix it?

Correct answer

The AMIs may have been encrypted using customer-managed customer master keys (CMKs). Additional permissions need to be provided to the Auto Scaling Group to fix the issue

The service-linked role of the ASG might have been deleted. Check if the role still exists

Your answer is incorrect

The Auto Scaling Group needs service-linked role to access KMS. Create a service-linked role on the ASG to fix the issue

The AMIs may have been encrypted using AWS-managed customer master keys (CMKs). Additional permissions to be provided to the Auto Scaling Group to fix the issue

Overall explanation

Correct option:

The AMIs may have been encrypted using customer-managed customer master keys (CMKs). Additional permissions need to be provided to the Auto Scaling Group to fix the issue

Amazon EC2 Auto Scaling uses service-linked roles (SLR) for the required permissions to call other AWS services. The permissions for SLR are hardcoded by AWS and can't be changed. By default, permissions provided to Amazon EC2 Auto Scaling SLR don't include permissions to access customer master keys (CMKs).

There are two types of Amazon EC2 Auto Scaling service-linked roles:

The default service-linked role for your account, named AWSServiceRoleForAutoScaling. This role is automatically assigned to your Auto Scaling groups unless you specify a different service-linked role.

A service-linked role with a custom suffix that you specify when you create the role, for example, AWSServiceRoleForAutoScaling_mysuffix.

The permissions of a custom suffix service-linked role are identical to those of the default service-linked role. In both cases, you cannot edit the roles, and you also cannot delete them if they are still in use by an Auto Scaling group. The only difference is the role name suffix.

You can specify either role when you edit your AWS Key Management Service key policies to allow instances that are launched by Amazon EC2 Auto Scaling to be encrypted with your customer-managed CMK. However, if you plan to give granular access to a specific customer-managed CMK, you should use a custom suffix service-linked role. Using a custom suffix service-linked role provides you with:

More control over the CMK

The ability to track which Auto Scaling group made an API call in your CloudTrail logs

Incorrect options:

The AMIs may have been encrypted using AWS managed customer master keys (CMKs). Additional permissions to be provided to the Auto Scaling Group to fix the issue - You can use AWS managed CMKs or customer managed CMKs to encrypt Amazon Elastic Block Store (Amazon EBS) volumes or AMIs with Amazon EC2 Auto Scaling. Amazon EC2 Auto Scaling doesn't need additional permissions to use AWS managed CMKs.

The Auto Scaling Group needs a service-linked role to access KMS. Create a service-linked role on the ASG to fix the issue - Amazon EC2 Auto Scaling uses service-linked roles for the permissions that it requires to call other Amazon Web Services on your behalf. A service-linked role is a unique type of IAM role that is linked directly to an AWS service. The service-linked roles provide a secure way to delegate permissions to Amazon Web Services because only the linked service can assume a service-linked role. A service-linked role is mandatory for creating an ASG.

The service-linked role of the ASG might have been deleted. Check if the role still exists - You can delete a service-linked role only after first deleting the related dependent resources. This protects you from inadvertently revoking Amazon EC2 Auto Scaling permissions to your resources. If a service-linked role is used with multiple Auto Scaling groups, you must delete all Auto Scaling groups that use the service-linked role before you can delete it. So, it is not possible to delete the service-linked role when its connected ASG still exists.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/autoscaling-service-linked-role.html

https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role

Domain

Domain 4: Security and Compliance

Question 54Correct

A web application runs on a fleet of Amazon EC2 instances configured behind an Application Load Balancer (ALB). The ALB is configured as the origin for Amazon CloudFront distribution. ALB has sticky sessions enabled. However, the users are being forced into re-authentication.

What could be the issue and how can it be resolved?

Use CloudFront Origin Shield feature to forward authentication information to ALB

Your answer is correct

CloudFront cache behavior needs to be configured to forward all cookies to origin

Sticky sessions need to be enabled on CloudFront distribution too for avoiding re-authentication error

Configure CloudFront to cache requests at edge locations to minimize the necessity for re-authentication

Overall explanation

Correct option:

CloudFront cache behavior needs to be configured to forward all cookies to origin - By default, CloudFront doesn’t consider cookies when processing requests and responses, or when caching your objects in edge locations. If CloudFront receives two requests that are identical except for what’s in the Cookie header, then, by default, CloudFront treats the requests as identical and returns the same object for both requests.

You can configure CloudFront to forward to your origin some or all of the cookies in viewer requests, and to cache separate versions of your objects based on the cookie values that it forwards. When you do this, CloudFront uses some or all of the cookies in viewer requests — whichever ones it’s configured to forward—to uniquely identify an object in the cache.

To configure cookie forwarding, you update your distribution’s cache behavior. You can configure each cache behavior to do one of the following:

Forward all cookies to your origin – CloudFront includes all cookies sent by the viewer when it forwards requests to the origin. When your origin returns a response, CloudFront caches the response using the cookie names and values in the viewer request.

Forward a whitelist of cookies that you specify – CloudFront removes any cookies that the viewer sends that aren’t on the whitelist before it forwards a request to the origin. CloudFront caches the response using the names and values of the whitelisted cookies in the viewer request.

Don’t forward cookies to your origin – CloudFront doesn’t cache your objects based on cookies sent by the viewer. In addition, CloudFront removes cookies before forwarding requests to your origin and removes Set-Cookie headers from responses before returning responses to your viewers.

Incorrect options:

Sticky sessions need to be enabled on CloudFront distribution too for avoiding re-authentication error - This statement is incorrect, given only as a distractor.

Use CloudFront Origin Shield feature to forward authentication information to ALB - CloudFront Origin Shield is an additional layer in the CloudFront caching infrastructure that helps to minimize your origin’s load, improve its availability, and reduce its operating costs. With CloudFront Origin Shield, you get the following benefits: Better cache hit ratio, Reduced origin load, and Better network performance. Using CloudFront Origin Shield will not address the requirement for authentication.

Configure CloudFront to cache resources at edge locations to minimize the necessity for re-authentication - One of the purposes of using CloudFront is to reduce the number of requests that your origin server must respond to directly. With CloudFront caching, more objects are served from CloudFront edge locations, which are closer to your users. This reduces the load on your origin server and reduces latency. CloudFront uses edge locations inherently. Caching resources at edge locations will not address the requirement for authentication.

Reference:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Cookies.html

Domain

Domain 6: Cost and Performance Optimization

Question 55Correct

A SysOps Administrator has enabled AWS CloudTrail on an AWS account that spans across multiple regions via the AWS Management Console.

Which of the following represents a valid outcome of this action?

CloudTrail can deliver logs to S3 buckets in trail's home region. Configure an Amazon S3 bucket for each region to receive logs from all regions

CloudTrail cannot log from multiple regions of an AWS account

It is not possible to enable CloudTrail in all regions of an AWS account from console. This can only be done through CLI

Your answer is correct

CloudTrail can deliver log files from multiple regions to single Amazon S3 bucket of the AWS account

Overall explanation

Correct option:

CloudTrail can deliver log files from multiple regions to a single Amazon S3 bucket

You can configure CloudTrail to deliver log files from multiple regions to a single S3 bucket for a single account. For example, you have a trail in the US West (Oregon) Region that is configured to deliver log files to an S3 bucket, and a CloudWatch Logs log group. When you change an existing single-region trail to log all regions, CloudTrail logs events from all regions in your account. CloudTrail delivers log files to the same S3 bucket and CloudWatch Logs log group. As long as CloudTrail has permission to write to an S3 bucket, the bucket for a multi-region trail does not have to be in the trail's home region.

In the console, by default, you create a trail that logs events in all AWS Regions. This is a recommended best practice by AWS. Once you apply a trail in all regions, CloudTrail will create a new trail in all regions by replicating the trail configuration. CloudTrail will record and process the log files in each region and will deliver log files containing account activity across all AWS regions to a single S3 bucket and a single CloudWatch Logs log group. If you specified an optional SNS topic, CloudTrail will deliver SNS notifications for all log files delivered to a single SNS topic.

Incorrect options:

CloudTrail cannot log from multiple regions of an AWS account - As discussed above, this statement is incorrect.

CloudTrail can deliver logs to S3 buckets in the trail's home region. Configure an Amazon S3 bucket for each region to receive logs from all regions - As long as CloudTrail has permissions to write to an S3 bucket, the bucket for a multi-region trail does not have to be in the trail's home region.

It is not possible to enable CloudTrail in all regions of an AWS account from the console. This can only be done through CLI - This is incorrect. In the console, by default, you create a trail that logs events in all AWS Regions. To log events in a single region, you use the AWS CLI.

References:

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-regional-and-global-services

Domain

Domain 1: Monitoring, Logging, and Remediation

Question 56Incorrect

An application is running on Amazon EC2 instances behind an Elastic Load Balancer (ELB). The development team wants to analyze the network traffic passing through the ELB with details about the traffic flow such as client's IP addresses, latencies, request paths, server responses etc.

Which of the following options can be used for this analysis?

CloudTrail Logs

VPC Network Logs

Correct answer

Elastic Load Balancing Access Logs

Your answer is incorrect

VPC Flow Logs

Overall explanation

Correct option:

Elastic Load Balancing Access Logs - Elastic Load Balancing provides access logs that capture detailed information about requests sent to your load balancer. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses. You can use these access logs to analyze traffic patterns and troubleshoot issues.

Access logging is an optional feature of Elastic Load Balancing that is disabled by default. After you enable access logging for your load balancer, Elastic Load Balancing captures the logs and stores them in the Amazon S3 bucket that you specify as compressed files. You can disable access logging at any time.

There is no additional charge for access logs. You are charged storage costs for Amazon S3, but not charged for the bandwidth used by Elastic Load Balancing to send log files to Amazon S3.

Incorrect options:

CloudTrail Logs - Elastic Load Balancing is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in Elastic Load Balancing. CloudTrail captures all API calls for Elastic Load Balancing as events. The calls captured include calls from the AWS Management Console and code calls to the Elastic Load Balancing API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for Elastic Load Balancing. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. You cannot use CloudTrail Logs to analyze the network traffic passing through the ELB.

VPC Flow Logs - You can use VPC Flow Logs to capture detailed information about the traffic going to and from your Network Load Balancer. Create a flow log for each network interface for your load balancer. There is one network interface per load balancer subnet. VPC Flow Logs will not provide details on the latencies and server responses, so this option is not the right fit for the given use case.

VPC Network Logs - There is no such thing as VPC Network Logs. This option has been added as a distractor.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-monitoring.html

Domain

Domain 5: Networking and Content Delivery

Question 57Correct

Your consumer-facing website is a high-risk target for a DDoS attack and you would like to get 24/7 support in case they happen, as well as AWS bill reimbursement for the incurred costs during the attack.

What service should you use?

AWS Shield

AWS WAF

AWS DDoS OpsTeam

Your answer is correct

AWS Shield Advanced

Overall explanation

Correct option:

AWS Shield Advanced

AWS Shield Standard is activated for all AWS customers, by default. For higher levels of protection against attacks, you can subscribe to AWS Shield Advanced. With Shield Advanced, you also have exclusive access to advanced, real-time metrics and reports for extensive visibility into attacks on your AWS resources. With the assistance of the DRT (DDoS response team), AWS Shield Advanced includes intelligent DDoS attack detection and mitigation not only for network layer (layer 3) and transport layer (layer 4) attacks but also for application layer (layer 7) attacks.

AWS Shield Advanced includes intelligent DDoS attack detection and mitigation not only for the network layer (layer 3) and transport layer (layer 4) attacks but also for application layer (layer 7) attacks. AWS Shield Advanced is a paid service that provides additional protections for internet-facing applications. Additionally, you get DDoS cost protection for scaling, a feature that protects your AWS bill from usage spikes on your AWS Shield Advanced protected EC2, Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Amazon Route 53 resources as a result of a DDoS attack.

Incorrect options:

AWS WAF - AWS WAF is a web application firewall that helps protect web applications from attacks by allowing you to configure rules that allow, block, or monitor (count) web requests based on conditions that you define. These conditions include IP addresses, HTTP headers, HTTP body, URI strings, SQL injection, and cross-site scripting. WAF cannot be used to detect and get notified about any security gaps when port 846 is opened. WAF cannot protect your AWS bill from usage spikes due to DDoS attacks.

How WAF Works:

via - https://aws.amazon.com/waf/

AWS Shield - AWS Shield Standard cannot protect your AWS bill from usage spikes due to DDoS attacks.

AWS DDoS OpsTeam - This is a made-up option and has been added as a distractor.

References:

https://aws.amazon.com/shield/

https://aws.amazon.com/waf/

Domain

Domain 6: Cost and Performance Optimization

Question 58Correct

A media company uses Amazon EC2 instances with EBS volumes as the instance storage. The volumes have scheduled backups as part of the maintenance plans mandated by the company. One of the EBS volumes shows the status of error.

As a SysOps Administrator, how will you restore the data and get the EBS volume working again?

Your answer is correct

The error status indicates that the underlying hardware related to the EBS volume has failed. The given EBS volume cannot be recovered but the data can be restored from the backup to a new EBS volume

The error status indicates that the communication channel between EBS volume and the instance has been disrupted. Restart the instance to fix the error

Restart the instance the EBS volume is connected to. In case the data doesn't show up, you can restore the data from the scheduled backups

You can restore the EBS volume from Amazon Data Lifecycle Manager, by shifting the volume to another EC2 instance configured with the Data Lifecycle Manager

Overall explanation

Correct option:

The error status indicates that the underlying hardware related to the EBS volume has failed. The given EBS volume cannot be recovered but the data can be restored from the backup to a new EBS volume

The error status indicates that the underlying hardware related to your EBS volume has failed. The data associated with the volume is unrecoverable and Amazon EBS processes the volume as lost. A notification appears on your account's Personal Health Dashboard when a volume enters an error state.

You can't recover a volume in an error state, you can restore the lost data from your backup. It’s a best practice to keep backups of your EC2 resources, including EBS volumes. You can use Amazon Data Lifecycle Manager, AWS Backup, or regular EBS snapshots for maintaining regular backups of your critical volumes to avoid data loss.

Restore the lost data from your backup using one of the following:

If you have an EBS snapshot of the volume, you can restore that volume from your snapshot.

If you don't have an EBS snapshot of the volume, create a new EBS volume, and then restore the data to it using the manual backup solution you prefer.

Incorrect options:

You can restore the EBS volume from Amazon Data Lifecycle Manager, by shifting the volume to another EC2 instance configured with the Data Lifecycle Manager - You can use Amazon Data Lifecycle Manager to automate the creation, retention, and deletion of EBS snapshots and EBS-backed AMIs. You cannot, however, restore the actual volume that is in an error state.

Restart the instance the EBS volume is connected to. In case the data doesn't show up, you can restore the data from the scheduled backups - As discussed above, it is a problem with the underlying hardware which will not be fixed by restarting the instance.

The error status indicates that the communication channel between EBS volume and the instance has been disrupted. Restart the instance to fix the error - This is an incorrect statement, given only as a distractor.

Reference:

https://aws.amazon.com/premiumsupport/knowledge-center/ebs-error-status/

Domain

Domain 5: Networking and Content Delivery

Question 59Incorrect

An Amazon EC2 instance has been marked non-compliant by the AWS Config rule. After a periodic rule evaluation, the resource continues to be in a non-compliant state.

What is the outcome of this periodic rule evaluation?

Correct answer

AWS Config will not send a new notification

Your answer is incorrect

AWS Config will send a notification with the current status of the resource

AWS Config will not record configuration changes that did not result from API activity on the resource. Hence, the Config rule is not triggered

Once a resource is marked non-compliant, the Config rule will not run on the resource again till the state changes

Overall explanation

Correct option:

AWS Config will not send a new notification

AWS Config sends notifications only when the compliance status changes. If a resource was previously non-compliant and is still non-compliant, Config will not send a new notification. If the compliance status changes to “compliant”, you will receive a notification for the change in status.

Incorrect options:

AWS Config will send a notification with the current status of the resource - As discussed above, this is incorrect.

Once a resource is marked non-compliant, the Config rule will not run on the resource again till the state changes - This statement is incorrect. The Config rule continues to be evaluated on the resource.

AWS Config will not record configuration changes that did not result from API activity on the resource. Hence, the Config rule is not triggered - AWS Config records configuration changes that did not result from API activity on the configured resource.

Reference:

https://aws.amazon.com/config/features/

Domain

Domain 1: Monitoring, Logging, and Remediation

Question 60Correct

As part of an internal IT audit, you must provide proof that AWS has the necessary ISO certifications.

How can you gain access to these documents?

Contact the AWS Support

Fill out an ISO Penetration Testing form

Use AWS GuardDuty

Your answer is correct

Use AWS Artifact

Overall explanation

Correct option:

Use AWS Artifact

AWS Artifact is your go-to, central resource for compliance-related information that matters to your organization. It provides on-demand access to AWS’ security and compliance reports and select online agreements. Different types of agreements are available in AWS Artifact Agreements to address the needs of customers subject to specific regulations. For example, the Business Associate Addendum (BAA) is available for customers that need to comply with the Health Insurance Portability and Accountability Act (HIPAA). It is not a service, it's a no-cost, self-service portal for on-demand access to AWS’ compliance reports.

You can use AWS Artifact Reports to download AWS security and compliance documents, such as AWS ISO certifications, Payment Card Industry (PCI), and System and Organization Control (SOC) reports.

Incorrect options:

Contact the AWS Support - You do not need to contact AWS Support to download AWS security and compliance documents, such as AWS ISO certifications.

Use AWS GuardDuty - GuardDuty is a threat detection service that monitors malicious activity and unauthorized behavior to protect your AWS account. GuardDuty analyzes billions of events across your AWS accounts from AWS CloudTrail (AWS user and API activity in your accounts), Amazon VPC Flow Logs (network traffic data), and DNS Logs (name query patterns). GuardDuty cannot be used to segregate the environment your employees work in based on the department they belong to.

How GuardDuty Works:

via - https://aws.amazon.com/guardduty/

Fill out an ISO Penetration Testing form - This is a made-up option and has been added as a distractor.

References:

https://aws.amazon.com/artifact/faq/

https://aws.amazon.com/guardduty/

Domain

Domain 3: Deployment, Provisioning, and Automation

Question 61Correct

A SysOps Administrator is updating Amazon S3 bucket policies for a project. The development team has requested read-only access permissions for all the S3 buckets used in the project.

Which of the following is the correct JSON policy for specifying the necessary permissions?

{
"Statement": [
{
"Sid": "AllowEveryoneReadOnlyAccess",
"Effect": "deny",
"Principal": ".",
"Action": [ "s3:GetObject", "s3:GetBucket" ],
"Resource": ["urn:aws:s3:::mybucket"]
}
]
}

{
"Statement": [
{
"Sid": "ReadOnlyAccess",
"Effect": "read-only",
"Principal": "*.*",
"Action": [ "s3:GetObject", "s3:ListBucket" ],
"Resource": ["urn:aws:s3:::mybucket*"]
}
]
}

{
"Statement": [
{
"Sid": "AllowEveryoneReadOnlyAccess",
"Effect": "Allow",
"Principal": "*",
"Action": [ "s3:ReadObject", "s3:ListBucket" ],
"Resource": ["urn:aws:s3:::mybucket"]
}
]
}

Your answer is correct

{
"Statement": [
{
"Sid": "AllowEveryoneReadOnlyAccess",
"Effect": "Allow",
"Principal": "*",
"Action": [ "s3:GetObject", "s3:ListBucket" ],
"Resource": ["urn:aws:s3:::mybucket","urn:aws:s3:::mybucket/*"]
}
]
}

Overall explanation

Correct option:

{
"Statement": [
{
"Sid": "AllowEveryoneReadOnlyAccess",
"Effect": "Allow",
"Principal": "*",
"Action": [ "s3:GetObject", "s3:ListBucket" ],
"Resource": ["urn:aws:s3:::mybucket","urn:aws:s3:::mybucket/*"]
}
]
}

This policy is the right fit for providing read-only access to all users.

Resource: Buckets, objects, access points, and jobs are the Amazon S3 resources for which you can allow or deny permissions. In a policy, you use the Amazon Resource Name (ARN) to identify the resource. urn:aws:s3:::mybucket","urn:aws:s3:::mybucket/* are the resources for which the policy is defined.

Effect: Effect is the effect will be when the user requests the specific action—this can be either allow or deny. If you do not explicitly grant access to (allow) a resource, access is implicitly denied. You can also explicitly deny access to a resource.

Action: For each resource, Amazon S3 supports a set of operations called actions. GetObject and ListBucket actions help list the objects in the bucket and access the objects.

Principal: The account or user who is allowed access to the actions and resources in the statement. In a bucket policy, the principal is the user, account, service, or other entity that is the recipient of this permission. * signifies that any principal can access this S3 bucket.

Incorrect options:

{
"Statement": [
{
"Sid": "AllowEveryoneReadOnlyAccess",
"Effect": "Allow",
"Principal": "*",
"Action": [ "s3:ReadObject", "s3:ListBucket" ],
"Resource": ["urn:aws:s3:::mybucket"]
}
]
}

There is no action like s3:ReadObject. Hence, this policy is incorrect.

{
"Statement": [
{
"Sid": "ReadOnlyAccess",
"Effect": "read-only",
"Principal": "*.*",
"Action": [ "s3:GetObject", "s3:ListBucket" ],
"Resource": ["urn:aws:s3:::mybucket*"]
}
]
}

Effect can be either allow or deny. read-only is not a valid effect and hence this policy is incorrect.

{
"Statement": [
{
"Sid": "AllowEveryoneReadOnlyAccess",
"Effect": "deny",
"Principal": ".",
"Action": [ "s3:GetObject", "s3:GetBucket" ],
"Resource": ["urn:aws:s3:::mybucket"]
}
]
}

There is no GetBucket action. Moreover, deny will not provide the necessary permissions, as is the need for the use case.

Reference:

https://docs.amazonaws.cn/en_us/AmazonS3/latest/userguide/access-policy-language-overview.html

Domain

Domain 4: Security and Compliance

Question 62Incorrect

As a SysOps Administrator, you have been tasked to optimize the costs for an AWS Storage Gateway. The development team has reported that the cache disk space of the Gateway is not even utilized to 50 percent of its actual capacity.

Which of the following would you recommend for this use case?

Correct answer

Create a new gateway with the cache space that you need

Your answer is incorrect

Shut down the gateway before removing the disk. After the gateway is shut down, you can remove the cache disk and attach a different one

Reduce the extra storage on the cache disk by decreasing the upload buffer size from Storage Gateway console

Remove the disk(s) that are allocated as cache disks for the existing gateway and resize the disk to the capacity needed

Overall explanation

Correct option:

Create a new gateway with the cache space that you need

Don't remove disks that are allocated as cache disks for an existing gateway—doing this can break your gateway's functionality. You can't decrease the size of a cache disk after it's allocated to an existing gateway. Instead, you must create a new gateway with the cache space that you need. Then, you can migrate your data to the new gateway.

Incorrect options:

Remove the disk(s) that are allocated as cache disks for the existing gateway and resize the disk to the capacity needed - As discussed above, removing cache disks can break the gateway's functionality and hence is not the right option.

Shut down the gateway before removing the disk. After the gateway is shut down, you can remove the cache disk and attach a different one - For disks that are allocated as upload buffer for an existing gateway, you need to first shut down the gateway before removing the disk. After the gateway is shut down, you can remove the upload buffer disk. Then, you can allocate a new disk with the reduced upload buffer size. This works for only disks allocated as upload buffers and not for cache disks.

Reduce the extra storage on the cache disk by decreasing the upload buffer size from Storage Gateway console - This is a made-up option, given only as a distractor.

References:

https://docs.aws.amazon.com/storagegateway/latest/userguide/ManagingLocalStorage-common.html

https://docs.aws.amazon.com/storagegateway/latest/userguide/migrate-data.html

Domain

Domain 5: Networking and Content Delivery

Question 63Incorrect

While checking different deployment options, a development team has realized that there is a significant increase in latency when data on a new EBS volume (created from a snapshot) is accessed for the first time. This seems to be the general behavior of all the EBS volumes used by Amazon EC2 instances for different applications.

What should the team do to reduce the latency and increase the performance of EBS volumes before moving them to production?

Correct answer

Initialize the EBS volume or pre-warm it before moving the volumes to production

Use RAID 0 to maximize utilization of instance resources

Your answer is incorrect

Use an Amazon EBS–optimized instance

Increase read-ahead for high-throughput, read-heavy workloads on st1 and sc1

Overall explanation

Correct option:

Initialize the EBS volume or pre-warm it before moving the volumes to production

There is a significant increase in latency when you first access each block of data on a new EBS volume that was created from a snapshot. You can avoid this performance lag by using one of the following options:

Access each block before putting the volume into production. This process is called initialization (formerly known as pre-warming).

Enable fast snapshot to restore on a snapshot to ensure that the EBS volumes created from it are fully-initialized at creation and instantly deliver all of their provisioned performance.

Incorrect options:

Increase read-ahead for high-throughput, read-heavy workloads on st1 and sc1 - Some workloads are read-heavy and access the block device through the operating system page cache (for example, from a file system). In this case, to achieve the maximum throughput, AWS recommends that you configure the read-ahead setting to 1 MiB. This is a per-block-device setting that should only be applied to your HDD volumes.

Use RAID 0 to maximize utilization of instance resources - Some instance types can drive more I/O throughput than what you can provision for a single EBS volume. You can join multiple volumes together in a RAID 0 configuration to use the available bandwidth for these instances.

Use an Amazon EBS–optimized instance - An Amazon EBS–optimized instance uses an optimized configuration stack and provides additional, dedicated capacity for Amazon EBS I/O. This optimization provides the best performance for your EBS volumes by minimizing contention between Amazon EBS I/O and other traffic from your instance.

All of the three options above are meant to improve the performance of EBS volumes in general. But, the requirement for the given use case is best achieved by just pre-warming the volumes.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSPerformance.html

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-optimized.html

Domain

Domain 5: Networking and Content Delivery

Question 64Correct

A company's security policy mandates end-to-end encryption of data as it passes through different stages of the workload life cycle. To implement this policy, a team wants to use the same SSL certificate for the Application Load Balancer and the Amazon EC2 instances behind it.

As a SysOps Administrator, which of the following would you suggest as the right way to configure Amazon-issued certificates on the EC2 instances?

Use AWS Certificate Manager service to expose the existing certificate of Load Balancer to Amazon EC2 instances

Use a self-signed certificate on Amazon EC2 instance to secure data

Import the Amazon-issued SSL certificate for the Load Balancer to the Amazon EC2 instances via the CLI

Your answer is correct

Amazon-issued certificates can’t be installed on an EC2 instance. To enable end-to-end encryption, you must use a third-party SSL certificate

Overall explanation

Correct option:

Amazon-issued certificates can’t be installed on an EC2 instance. To enable end-to-end encryption, you must use a third-party SSL certificate - Amazon-issued certificates can’t be installed on an EC2 instance. To enable end-to-end encryption for the given use case, you must use a third-party SSL certificate which should be installed on the EC2 instances. Then, associate the third-party certificate with a load balancer by importing it into AWS Certificate Manager (ACM).

Please check the first link in the reference section to know the detailed steps involved in implementing the above solution.

Incorrect options:

Import the Amazon-issued SSL certificate for the Load Balancer to the Amazon EC2 instances via the CLI - As discussed above, Amazon-issued certificates can’t be installed on an EC2 instance.

Use AWS Certificate Manager service to expose the existing certificate of Load Balancer to Amazon EC2 instances - AWS Certificate Manager (ACM) does not support installing Amazon-issued certificates on an EC2 instance. ACM certificates are supported by the following services: Elastic Load Balancing, Amazon CloudFront, AWS Elastic Beanstalk, AWS App Runner, Amazon API Gateway, AWS Nitro Enclaves, and AWS CloudFormation.

Use a self-signed certificate on Amazon EC2 instance to secure data - A self-signed certificate is acceptable for testing but not production. If you expose your self-signed certificate to the internet, visitors to your site would receive warm greetings in the form of security warnings.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/acm-ssl-certificate-ec2-elb/

https://docs.aws.amazon.com/acm/latest/userguide/acm-services.html

Domain

Domain 4: Security and Compliance

Question 65Incorrect

Two AWS CloudFormation stack policies are shared below.

As a SysOps Administrator, can you identify the actions that are possible when the policies are applied to a stack?

Policy-1:

{
"Statement" : [
{
"Effect" : "Deny",
"Action" : "Update:*",
"Principal": "*",
"Resource" : "LogicalResourceId/MyDatabase"
},
{
"Effect" : "Allow",
"Action" : "Update:*",
"Principal": "*",
"Resource" : "*"
}
]
}

Policy-2:

{
"Statement" : [
{
"Effect" : "Allow",
"Action" : "Update:*",
"Principal": "*",
"NotResource" : "LogicalResourceId/MyDatabase"
}
]
}

Policy-2 denies updates on MyDatabase, whereas, Policy-1 allows updates on MyDatabase

Both the policies allow updates on all resources

Correct answer

Both the policies deny all update actions on the database with the MyDatabase logical ID. And they allow all update actions on all other stack resources

Your answer is incorrect

Policy-1 denies updates on MyDatabase, whereas, Policy-2 allows updates on MyDatabase

Overall explanation

Correct option:

Both the policies deny all update actions on the database with the MyDatabase logical ID. And they allow all update actions on all other stack resources

Policy-1 denies all update actions on the database with the MyDatabase logical ID. It allows all update actions on all other stack resources with an Allow statement. The Allow statement doesn't apply to the MyDatabase resource because the Deny statement always overrides allow actions.

You can achieve the same result by using a default denial. When you set a stack policy, AWS CloudFormation denies any update that is not explicitly allowed. Policy-2 allows updates to all resources except for the MyDatabase, which is denied by default.

If a stack policy includes overlapping statements (both allowing and denying updates on a resource), a Deny statement always overrides an Allow statement. To ensure that a resource is protected, use a Deny statement for that resource.

Incorrect options:

Policy-1 denies updates on MyDatabase, whereas, Policy-2 allows updates on MyDatabase

Policy-2 denies updates on MyDatabase, whereas, Policy-1 allows updates on MyDatabase

Both the policies allow updates on all resources

These three options contradict the explanation above, so these options are incorrect.

References:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html#nested

Domain

Domain 3: Deployment, Provisioning, and Automation

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Expanded view

Beta

0 / 10used queries