Question1: Your VPC automatically comes with a modifiable default network ACL, which by default _____.
Question2: A SysOps Administrator must ensure all Amazon EBS volumes currently in use, and those created in the future, are encrypted with a specific AWS KMS customer master key (CMK).
What is the MOST efficient way for the Administrator to meet this requirement?
Question3: When an EC2 EBS-backed (EBS root) instance is stopped, what happens to the data on any ephemeral store volumes?
Question4: You can create a CloudWatch alarm that watches a single metric. The alarm performs one or more actions based on the value of the metric relative to a threshold over a number of time periods. Which of the following states is possible for the CloudWatch alarm?
Question5: You are attempting to connect to an instance in Amazon VPC without success.
You have already verified that the VPC has an Internet Gateway (IGW) the instance has an associated Elastic IP (EIP) and correct security group rules are in place.
Which VPC component should you evaluate next?
Question6: A sys admin has enabled a log on ELB. Which of the below mentioned activities are not captured by the log?
Question7: An organization (Account ID 123412341234. has attached the below mentioned IAM policy to a user. What does this policy statement entitle the user to perform?
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "AllowUsersAllActionsForCredentials",
"Effect": "Allow",
"Action": [
"iam:*LoginProfile",
"iam:*AccessKey*",
"iam:*SigningCertificate*"
],
"Resource": ["arn:aws:iam:: 123412341234:user/${aws:username}"]
}]
}
Question8: Your EC2-Based Multi-tier application includes a monitoring instance that periodically makes application
-level read only requests of various application components and if any of those fail more than three times 30 seconds calls CloudWatch lo fire an alarm, and the alarm notifies your operations team by email and SMS of a possible application health problem. However, you also need to "watch the watcher" --the monitoring instance itself - and be notified if it becomes unhealthy.
Which of the following is a simple way to achieve that goal?
Question9: You receive a frantic call from a new DBA who accidentally dropped a table containing all your customers.
Which Amazon RDS feature will allow you to reliably restore your database to within 5 minutes of when the mistake was made?
Question10: A company has mandated the use factor authentication (MFA) for all user, and requires users to make all API calls using CLI. However, uses are not prompted to enter MFA token, and able to return CLI commands without MF
Question11: An IAM user has two conflicting policies as part of two separate groups. One policy allows him to access an S3 bucket, while another policy denies him the access. Can the user access that bucket?
Question12: A SysOps Administrator has set up a new Application Load Balancer (ALB) in front of a pair of private web server in multiple Availability Zones. After deployment an updates CloudFormation template with many changes, user now goes to one web server only.
What is the NOST likely reason that the traffic is not being balanced between both servers?
Question13: A database is running on an Amazon RDS Multi-AZ DB instance. A recent security audit found the database to be cut of compliance because it was not encrypted.
Which approach will resolve the encryption requirement?
Question14: A company has a web application that is used across all company divisions. Each application request contains a header that includes the name of the division making the request. The SysOps Administrator wants to identify and count the requests from each division.
Which condition should be added to the web ACL of the AWS WAF to accomplish this?
Question15: A user is planning to use AWS Cloudformation.
Which of the below mentioned functionalities does not help him to correctly understand Cloudfromation?
Question16: Exhibit:
Based on the information provided what is causing the lack of access to S3 from the instance?
Question17: A mobile application must allow users to securely access their own content stored in a shared Amazon S3 bucket.
Which AWS services should be used to enable this access? (Choose two.)
Question18: A root AWS account owner is trying to understand various options to set the permission to AWS S3. Which of the below mentioned options is not the right option to grant permission for S3?
Question19: A user has created a photo editing software and hosted it on EC2.
The software accepts requests from the user about the photo format and resolution and sends a message to S3 to enhance the picture accordingly.
Which of the below mentioned AWS services will help make a scalable software with the AWS infrastructure in this scenario?
Question20: A SySOps Administrator is managing an AWS account where Developers are authorized to launch Amazon EC2 instances to test new code. To limit costs, the Administrator must ensure that the EC2 instances in the account are terminated 24 hours after launch.
How should the Administrator meet these requirements?
Question21: Your business is building a new application that will store its entire customer database on a RDS MySQL database, and will have various applications and users that will query that data for different purposes.
Large analytics jobs on the database are likely to cause other applications to not be able to get the query results they need to, before time out. Also, as your data grows, these analytics jobs will start to take more time, increasing the negative effect on the other applications.
How do you solve the contention issues between these different workloads on the same data?
Question22: In IAM, can you attach more than one inline policy to a particular entity such a user, role, or group?
Question23: An organization is generating digital policy files which are required by the admins for verification. Once
the files are verified they may not be required in the future unless there is some compliance issue. If the
organization wants to save them in a cost effective way, which is the best possible solution?
Question24: A user has created a photo editing software and hosted it on EC2. The software accepts requests from the user about the photo format and resolution and sends a message to S3 to enhance the picture accordingly.Which of the below mentioned AWS services will help make a scalable software with the AWS infrastructure in this scenario?
Question25: A user has configured Auto Scaling with the minimum capacity as 2 and the desired capacity as 2. The user is trying to terminate one of the existing instance with the command:
What will Auto Scaling do in this scenario?
Question26: Your mission is to create a lights-out datacenter environment, and you plan to use AWS OpsWorks to accomplish this. First you created a stack and added an App Server layer with an instance running in it. Next you added an application to the instance, and now you need to deploy a MySQL RDS database instance.
Which of the following answers accurately describe how to add a backend database server to an OpsWorks stack? (Choose three.)
Question27: A user has launched two EBS backed EC2 instances in the US-East-1a region. The user wants to change the zone of one of the instances. How can the user change it?
Question28: A user has enabled session stickiness with ELB. The user does not want ELB to manage the cookie;
instead he wants the application to manage the cookie. What will happen when the server instance, which
is bound to a cookie, crashes?
Question29: A sysadmin has created the below mentioned policy and applied to an S3 object named aws.jpg. The aws.jpg is inside a bucket named cloudacademy. What does this policy define?
"Statement": [{
"Sid": "Stmt1388811069831",
"Effect": "Allow",
"Principal": { "AWS": "*"},
"Action": [ "s3:GetObjectAcl", "s3:ListBucket", "s3:GetObject"],
"Resource": [ "arn:aws:s3:::cloudacademy/*.jpg"]
}]
Question30: What does Amazon ELB stand for?
Question31: In Amazon CloudFront, if you have chosen On for Logging, the access logs are stored in
_______________.
Question32: A Chief Financial Officer has asked fof a breakdown of costs per project in a single AWS account using Cost Explorer Which combination of options should be set to accomplish this? (Select TWO.)
Question33: Which method can be used to prevent an IP address block from accessing public objects in an S3 bucket?
Question34: What is a security group in Amazon AWS?
Question35: An Amazon EC2 instance is unable to connect an SMTP server in a different subnet. Other instances are successfully communicating with the SMTP server, however VPC Flow Logs have been enabled on the SMTP server's network interface and show the following information:
2 223342798652 eni-abe77dab 10.1.1.200 10.100.1.10 1123 25 17 70 48252 1515534437
1515535037 REJECT OK
What can be done to correct this problem?
Question36: You are attempting to connect to an instance in Amazon VPC without success You have already verified
that the VPC has an Internet Gateway (IGW) the instance has an associated Elastic IP (EIP) and correct
security group rules are in place.
Which VPC component should you evaluate next?
Question37: A user has configured an EC2 instance in the US-East-1a zone. The user has enabled detailed monitoring of
the instance. The user is trying to get the data from CloudWatch using a CLI. Which of the below mentioned
CloudWatch endpoint URLs should the user use?
Question38: A company is running a popular social media site on EC2 instances. The application stores data in an Amazon RDS for MySQL DB instance and has implemented read caching by using an ElastiCache for Redis (cluster mode enabled) cluster to improve read times. A social event is happening over the weekend, and the SysOps Administrator expects website traffic to triple.
What can a SysOps Administrator do to ensure improved read times for users during the social event?
Question39: A user is using the AWS EC2. The user wants to make so that when there is an issue in the EC2 server, such as instance status failed, it should start a new instance in the user's private cloud. Which AWS service helps to achieve this automation?
Question40: A SysOps Administrator is configuring AWS SSO tor the first time The Administrator has already created a directory in the master account using AWS Directory Service and enabled ful access in AWS Organizations What should the Administrator do next to configure the service?
Question41: A user has set the Alarm for the CPU utilization > 50%. Due to an internal process, the current CPU utilization will be 80% for 6 hours. How can the user ensure that the CloudWatch alarm does not perform any action?
Question42: An organization is generating digital policy files which are required by the admins for verification. Once the files are verified they may not be required in the future unless there is some compliance issue. If the organization wants to save them in a cost effective way, which is the best possible solution?
Question43: A user wants to make so that whenever the CPU utilization of the AWS EC2 instance is above 90%, some
sort of notification is sent to him. Which of the below mentioned AWS services is helpful for this purpose?
Question44: A user has provisioned 2000 IOPS to the EBS volume. The application hosted on that EBS is
experiencing less IOPS than provisioned. Which of the below mentioned options does not affect the IOPS
of the volume?
Question45: The fastest way to load 300 TB of data to AWS is _____.
Question46: What is a placement group in Amazon EC2?
Question47: What would happen to an RDS (Relational Database Service) multi-Availability Zone deployment if the primary DB instance fails?
Question48: A route table in VPC can be associated with multiple subnets. However, a subnet can be associated with only
______ route table(s) at a time.
Question49: A user has created an Auto Scaling group with default configurations from CLI. The user wants to setup the CloudWatch alarm on the EC2 instances, which are launched by the Auto Scaling group. The user has setup an alarm to monitor the CPU utilization every minute. Which of the below mentioned statements is true?
Question50: A photo-sharing site delivers content worldwide from a library on Amazon S3 using Amazon CloudFront.
Users are trying to access photos that either do not exist or they are not authorized to view.
What should be monitored to better understand the extent of this issue?
Question51: A SysOps Administrator has an AWS Lambda function that stops all Amazon EC2 instances in a test environment at night and on the weekend. Stopping instances causes some servers to become corrupt due to the nature of the applications running on them.
What can the SysOps Administrator use to identify these EC2 instances?
Question52: An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants that one particular group of IAM users should only access the test instances and not the production ones. How can the organization set that as a part of the policy?
Question53: A SysOps Administrator must take a team's single existing AWS CloudFormation template and split it into smaller, service-specific templates. All of the services in the template reference a single, shared Amazon S3 bucket.
What should the Administrator do to ensure that this S3 bucket can be referenced by all the service templates?
Question54: An organization is trying to create various IAM users. Which of the below mentioned options is not a valid
IAM username?
Question55: You have been asked to leverage Amazon VPC BC2 and SOS to implement an application that submits and receives millions of messages per second to a message queue. You want to ensure your application has sufficient bandwidth between your EC2 instances and SQS
Which option will provide (he most scalable solution for communicating between the application and SOS?
Question56: Two companies will be working on several development projects together. Each company has an AWS account with a single VPC in us-east-1. Two companies would like to access one another's development servers. The IPv4 CIDR blocks in the two VPCs does not overlap.
What can the SysOps Administrators for each company do to set up network routing?
Question57: An application is currently deployed on several Amazon EC2 instances that reside within a VPC. Due to compliance requirements the EC2 instances cannot have access to the public internet. SysOps Administrator require SSH access to EC2 instances from their corporate office to perform maintenance and other administrative tasks.
Which combination of actions should be taken to permit SSH access to the EC2 instances while meeting the compliance requirement? (Select TWO)
Question58: What is an Auto Scaling group?
Question59: A user is using a small MySQL RDS DB. The user is experiencing high latency due to the Multi AZ feature.
Which of the below mentioned options may not help the user in this situation?
Question60: A user is planning to schedule a backup for an EBS volume. The user wants security of the snapshot data.
How can the user achieve data encryption with a snapshot?
Question61: Development teams are maintaining several workloads on AWS. Company management is concerned about rising costs and wants the SysOps Administrator to configure alerts so teams are notified when spending approaches preset limits.
Which AWS service will satisfy these requirements?
Question62: An enterprise is using federated Security Assertion Markup Language (SAML) to access the AWS Management Console.
How should the SAML assertion mapping be configured?
Question63: A user has launched an EC2 instance and deployed a production application in it. The user wants to prohibit any mistakes from the production team to avoid accidental termination. How can the user achieve this?
Question64: A user has setup a web application on EC2. The user is generating a log of the application performance at every second. There are multiple entries for each second. If the user wants to send that data to CloudWatch every minute, what should he do?
Question65: Which two AWS services provide out-of-the-box user configurable automatic backup-as-a-service and backup
rotation options? (Choose two.)
Question66: A user has configured the AWS CloudWatch alarm for estimated usage charges in the US East region.
Which of the below mentioned statements is not true with respect to the estimated charges?
Question67: A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB?
Question68: A company has an AWS account for each department and wants to consolidate billing and reduce overhead.
The company wants to make sure that the finance team is denied from accessing services other than Amazon EC2, the security team is denied from accessing services other than AWS CloudTrail, and IT can access any resource.
Which solution meets these requirements with the LEAST amount of operational overhead?
Question69: A SysOps Administrator needs to confirm that security best practices are being followed with the AWS account root user.
How should the Administrator ensure that this is done?
Question70: An organization is planning to use AWS for their production roll out. The organization wants to implement automation for deployment such that it will automatically create a LAMP stack, download the latest PHP installable from S3 and setup the ELB. Which of the below mentioned AWS services meets the requirement for making an orderly deployment of the software?
Question71: What does Amazon IAM stand for?
Question72: A user has launched two EBS backed EC2 instances in the US-East-1a region. The user wants to change the
zone of one of the instances. How can the user change it?
Question73: A SysOps administrator recently launched an application consisting of web servers running on Amazon EC2 instances, an Amazon ElastiCache cluster communicating on port 6379, and an Amazon RDS for PostgreSQL DB instance communicating on port 5432. The web servers are in the security group web-sg, the ElastiCache cluster is in the security group cache-sg, and the DB instance is in the security group database-sg.
The application fails on start, with the error message "Unable to connect to the database".
The rules in web-sg are as follows.
Which change should the SysOps administrator make to web-sg to correct the issue without compromising security?
Question74: A SysOps Administrator discovers the organization's tape archival system is no longer functioning in its on-
premises data center.
What AWS service can be used to create a virtual tape interface to replace the physical tape system?
Question75: A user has enabled versioning on an S3 bucket.
The user is using server side encryption for data at rest.
If the user is supplying his own keys for encryption (SSE-C., what is recommended to the user for the purpose of security?
Question76: A user has launched an EC2 Windows instance from an instance store backed AMI. The user wants to convert the AMI to an EBS backed AMI. How can the user convert it?
Question77: After launching a new Amazon EC2 instance from a Microsoft Windows 2012 Amazon Machine Image (AMI), the SysOps Administrator is unable to connect to the instance using Remote Desktop Protocol (RDP). The instance is also unreachable. As part of troubleshooting, the Administrator deploys a second instance from a different AMI using the same configuration and is able to connect to the instance.
What should be the next logical step in troubleshooting the first instance?
Question78: An organization stores sensitive customer information in S3 buckets protected by bucket policies. Recently, there have been reports that unauthorized entities within the company have been trying to access the data on those S3 buckets. The Chief Information Security Officer (CISO) would like to know which buckets are being targeted and determine who is responsible for trying to access that information.
Which steps should a SysOps Administrator take to meet the CISO's requirement? (Choose two.)
Question79: A user has created a VPC with public and private subnets using the VPC wizard. Which of the below mentioned statements is not true in this scenario?
Question80: A new network is needed to run secure Amazon EC2 instance. This network cannot have direct access to the internet and must be separate from existing production instances. The instances will be manager using SSH from a Developer in a home office with a fixed IP address but without a VPN-capable router.
How should a SysOps Administrator create this network and manage these servers?
Question81: You are managing the AWS account of a big organization.
The organization has more than 1000+ employees and they want to provide access to the various services to most of the employees.
Which of the below mentioned options is the best possible solution in this case?
Question82: A company is auditing their infrastructure to obtain a compliance certification.
Which of the following options are the company's responsibility within the Shared Responsibility Model? (Select two.)
Question83: An application is currently deployed on several Amazon EC2 instances that reside within a VPC.
Due to compliance requirements, the EC2 instances cannot have access to the public internet.
SysOps Administrators require SSH access to EC2 instances from their corporate office to perform maintenance and other administrative tasks.
Which combination of actions should be taken to permit SSH access to the EC2 instances while meeting the compliance requirements? (Choose two.)
Question84: A user has created numerous EBS volumes. What is the general limit for each AWS account for the maximum number of EBS volumes that can be created?
Question85: You have been asked to design a layered security solution for protecting your organization's network infrastructure. You research several options and decide to deploy a network-level security control appliance, inline, where traffic is intercepted and analyzed prior to being forwarded to its final destination, such as an application server. Which of the following is NOT considered an inline threat protection technology?
Question86: A user has created a VPC with public and private subnets using the VPC wizard. Which of the below mentioned statements is not true in this scenario?
Question87: A custom application must be installed on all Amazon EC2 instances. The application is small, updated frequently and can be installed automatically.
How can the application be deployed on new EC2 instances?
Question88: A user is collecting 1000 records per second. The user wants to send the data to CloudWatch using a custom namespace. Which of the below mentioned options is recommended for this activi-ty?
Question89: An organization has created one IAM user and applied the below mentioned policy to the user. What entitlements do the IAM users avail with this policy?
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
{
"Effect": "Allow"
"Action": [
"cloudwatch:ListMetrics",
"cloudwatch:GetMetricStatistics",
"cloudwatch:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "autoscaling:Describe*",
"Resource": "*"
}
]
}
Question90: A user has setup an EBS backed instance and attached 2 EBS volumes to it. The user has setup a CloudWatch alarm on each volume for the disk data. The user has stopped the EC2 instance and detached the EBS volumes. What will be the status of the alarms on the EBS volume?
Question91: A kernel patch for AWS Linux has been released, and systems need to be updated to the new version. A SysOps administrator must apply an m-place update to an existing Amazon EC2 instance without replacing the instance.
How should the SysOps administrator apply the new software version to the instance?
Question92: The billing process for Amazon EC2 instances was updated as of October 2, 2017. Which of the following statements is true regarding how you pay for Amazon EC2 instances? (Choose 2 answers)
Question93: A user has created a launch configuration for Auto Scaling where CloudWatch detailed monitoring is disabled.
The user wants to now enable detailed monitoring. How can the user achieve this?
Question94: You are attempting to connect to an instance in Amazon VPC without success.
You have already verified that the VPC has an Internet Gateway (IGW) the instance has an associated Elastic IP (EIP) and correct security group rules are in place.
Which VPC component should you evaluate next?
Question95: An image processing system runs asynchronously on AWS Lambda. A SysOps administrator is configuring a Lambda function to notify developers when an image falls to process after three attempts. The SysOps administrator has created an Amazon Simple Notification Service (Amazon SNS) topic to notify the developers.
Which additional action should the SysOps administrator take to meet this requirement?
Question96: While setting up an AWS managed VPN connection, a SysOPs Administrator creates a customer gateway resource in AWS. The customer gateway device resides in a data center with a NAT gateway in front of it.
What address should be used to create the customer gateway resource?
Question97: A root AWS account owner has created three IAM users: Bob, John and Michael. Michael is the IAM administrator. Bob and John are not the super users, but users with some pre-defined policies. John does not have access to modify his password. Thus, he asks Bob to change his password. How can Bob change John's password?
Question98: A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB?
Question99: You have set up an IAM policy for your users to access Elastic Load Balancers and you know that an IAM policy is a JSON document that consists of one or more statements. Which of the following elements is not a part of the statement in an IAM policy document?
Question100: An instance is launched into a VPC subnet with the network ACL configured to allow all inbound traffic and deny all outbound traffic. The instance's security group is configured to allow SSH from any IP address and deny all outbound traffic. What changes need to be made to allow SSH access to the instance?
Question101: A user is collecting 1000 records per second. The user wants to send the data to CloudWatch using the
custom namespace. Which of the below mentioned options is recommended for this activity?
Question102: A SysOps Administrator must take a team's single existing AWS CloudFormation template and split it into
smaller, service-specific templates. All of the services in the template reference a single, shared Amazon S3
bucket.
What should the Administrator do to ensure that this S3 bucket can be referenced by all the service templates?
Question103: A user has launched an EBS backed instance. The user started the instance at 9 AM in the morning.
Between 9 AM to 10 AM, the user is testing some script. Thus, he stopped the instance twice and restarted it. In the same hour the user rebooted the instance once. For how many instance hours will AWS charge the user?
Question104: ___________ is a fully managed service for real-time processing of streaming data at massive scale.
Question105: A company's data retention policy dictates that backups be stored for exactly two years. After that time, the data must be deleted.
How can Amazon EBS snapshots be managed to conform to this data retention policy?
Question106: When an EC2 EBS-backed (EBS root) instance is stopped, what happens to the data on any ephemeral store volumes?
Question107: A user has created a web application with Auto Scaling. The user is regularly monitoring the application and he observed that the traffic is highest on Thursday and Friday between 8 AM to 6 PM. What is the best solution to handle scaling in this case?
Question108: A financial service company is running distributed computing software to manage a fleet of 20 servers for their calculations. There are 2 control nodes and 18 worker nodes to run the calculations. Worker nodes can be automatically started by the control nodes when required.
Currently, all nodes are running on demand, and the worker nodes are used for approximately 4 hours each day.
Which combination of actions will be MOST cost-effective? (Choose two.)
Question109: A company has 50 AWS accounts and wants to create an identical Amazon VPC in each account. Any
changes the company makes to the VPCs in the future must be implemented on every VPC.
What is the SIMPLEST method to deploy and update the VPCs in each account?
Question110: A user has launched an EBS backed EC2 instance in the US-East-1a region. The user stopped the instance and started it back after 20 days. AWS throws up an 'InsufficientInstanceCapacity' error. What can be the possible reason for this?
Question111: A user is having data generated randomly based on a certain event. The user wants to upload that data to CloudWatch. It may happen that event may not have data generated for some period due to andomness. Which of the below mentioned options is a recommended option for this case?
Question112: An organization has configured a VPC with an Internet Gateway (IGW). pairs of public and private subnets (each with one subnet per Availability Zone), and an Elastic Load Balancer (ELB) configured to use the public subnets. The application s web tier leverages the ELB. Auto Scaling and a mum-AZ RDS database instance The organization would like to eliminate any potential single points ft failure in this design.
What step should you take to achieve this organization's objective?
Question113: A root account owner has given full access of his S3 bucket to one of the IAM users using the bucket ACL. When the IAM user logs in to the S3 console, which actions can he perform?
Question114: An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants a particular group of IAM users to access only the test instances and not the production ones. They want to deploy the instances in various locations based on the factors that will change from time to time, especially in the test group. They expect instances will often need to be churned, i.e. deleted and replaced, especially in the testing group. This means the five instances they have created now will soon be replaced by a different set of five instances. The members of each group, production and testing, will not change in the foreseeable future. Given the situation, what choice below is the most efficient and time-saving strategy to define the IAM policy?
Question115: A user has two EC2 instances running in two separate regions. The user is running an internal memory
management tool, which captures the data and sends it to CloudWatch in US East, using a CLI with the
same namespace and metric. Which of the below mentioned options is true with respect to the above
statement?
Question116: A user is trying to understand the CloudWatch metrics for the AWS services. It is required that the user should first understand the namespace for the AWS services. Which of the below mentioned is not a valid namespace for the AWS services?
Question117: You are using ElastiCache Memcached to store session state and cache database queries in your infrastructure. You notice in CloudWatch that Evictions and GetMisses are Doth very high.
What two actions could you take to rectify this? (Choose two.)
Question118: A company is auditing their infrastructure to obtain a compliance certification.
Which of the following options are the company's responsibility within the Shared Responsibility Model?
(Select two.)
Question119: _________ is a fast, reliable, scalable, fully managed message queuing service.
Question120: A root AWS account owner is trying to understand various options to set the permission to AWS S3.
Which of the below mentioned options is not the right option to grant permission for S3?
Question121: A root AWS account owner is trying to understand various options to set the permission to AWS S3. Which of the below mentioned options is not the right option to grant permission for S3?
Question122: A customer is using AWS for Dev and Test. The customer wants to setup the Dev environment with Cloudformation. Which of the below mentioned steps are not required while using Cloudformation?
Question123: A SysOps Administrator manages an application that stores object metadata in Amazon S3. There is a requirement to have S2 server-side encryption enabled on all new objects in the bucket.
How can the Administrator ensure that all new objects to the bucket satisfy this requirement?
Question124: A user has configured an Auto Scaling group with ELB. The user has enabled detailed CloudWatch monitoring on Elastic Load balancing. Which of the below mentioned statements will help the user understand this functionality better?
Question125: When creation of an EBS snapshot Is initiated but not completed the EBS volume?
Question126: Could you use IAM to grant access to Amazon DynamoDB resources and API actions?
Question127: Your business is building a new application that will store its entire customer database on a RDS MySQL database, and will have various applications and users that will query that data for different purposes.
Large analytics jobs on the database are likely to cause other applications to not be able to get the query results they need to, before time out. Also, as your data grows, these analytics jobs will start to take more time, increasing the negative effect on the other applications.
How do you solve the contention issues between these different workloads on the same data?
Question128: A user has configured an ELB to distribute the traffic among multiple instances. The user instances are
facing some issues due to the back-end servers. Which of the below mentioned CloudWatch metrics
helps the user understand the issue with the instances?
Question129: A SysOps Administrator is implementing SSL for a domain of an internet-facing application running behind an Application Load Balancer (ALB). The Administrator decides to use an SSL certificate from Amazon Certificate Manager (ACM) to secure it.
Upon creating a request for the ALB fully qualified domain name (FQDN), it fails, and the error message
"Domain Not Allowed" is displayed.
How can the Administrator fix this issue?
Question130: A user is using the AWS EC2. The user wants to make so that when there is an issue in the EC2 server, such as instance status failed, it should start a new instance in the user's private cloud. Which AWS service helps to achieve this automation?
Question131: A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR
2 0.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the
public subnet (port 80) and a DB server in the private subnet (port 3306). The user is configuring a
security group for the public subnet (WebSecGrp) and the private subnet (DBSecGrp). Which of the below
mentioned entries is required in the web server security group (WebSecGrp)?
Question132: Which of the below mentioned options is not a best practice to securely manage the AWS access credentials?
Question133: Which of the following statements about this S3 bucket policy is true?
Question134: A user has launched five instances and have registered them with an ELB. How can the user add the sixth EC2 instance to the ELB?
Question135: Which of the below mentioned AWS RDS logs cannot be viewed from the console for MySQL?
Question136: A company uses many Amazon Elastic Block Store (Amazon EBS) volumes. The company wants to use Amazon Data Lifecycle Manager (Amazon DLM) to manage the lifecycle of EBS snapshots that have tags of "Production" and "Compliance".
Which combination of the following are needed to turn on this feature? (Choose two.)
Question137: In configuring an Amazon Route 53 health check, a SysOps Administrator selects 'Yes' to the String Matching option in the Advanced Configuration section. In the Search String box, the Administrator types the following text: /html.
This is to ensure that the entire page is loading during the health check. Within 5 minutes of enabling the health check, the Administrator receives an alert stating that the check failed. However, when the Administrator navigates to the page, it loads successfully.
What is the MOST likely cause of this false alarm?
Question138: How can you secure data at rest on an EBS volume?
Question139: An organization is running multiple applications for their customers. Each application is deployed by running a base AWS CloudFormation template that configures a new VPC. All applications are run in the same AWS account and AWS Region. A SysOps Administrator has noticed that when trying to deploy the same AWS CloudFormation stack, it fails to deploy.
What is likely to be the problem?
Question140: Amazon (with AWS account ID 111122223333) has created 50 IAM users for its organization's employees. What will be the AWS console URL for these associates?
Question141: What does Amazon VPC stand for?
Question142: A new application runs on Amazon EC2 instances and accesses data in an Amazon RDS database instance.
When fully deployed in production, the application fails. The database can be queried from a console on a bastion host. When looking at the web server logs, the following error is repeated multiple times:
*** Error Establishing a Database Connection.
Which of the following may be causes of the connectivity problems? (Choose two.)
Question143: A user has moved an object to Glacier using the life cycle rules. The user requests to restore the archive after
6 months. When the restore request is completed the user accesses that archive. Which of the below mentioned statements is not true in this condition?
Question144: An organization has been running their website on several m2 Linux instances behind a Classic Load Balancer for more than two years. Traffic and utilization have been constant and predictable.
What should the organization do to reduce costs?
Question145: Two companies will be working on several development projects together. Each company has an AWS account with a single VPC in us-east-1. Two companies would like to access one another's development servers. The IPv4 CIDR blocks in the two VPCs does not overlap.
What can the SysOps Administrators for each company do to set up network routing?
Question146: An application is running on multiple EC2 instances. As part of an initiative to improve overall infrastructure
security, the EC2 instances were moved to a private subnet. However, since moving, the EC2 instances have
not been able to automatically update, and a SysOps Administrator has not been able to SSH into them
remotely.
Which two actions could the Administrator take to securely resolve these issues? (Choose two.)
Question147: A company manages more than 1,000 Amazon EC2 instances running Amazon Linux 2 in multiple VPCs. A SysOps administrator must change the statically configured DNS server IP address on all the EC2 instances.
Which solution will require the LEAST amount of effort?
Question148: In EC2, what happens to the data in an instance store if an instance reboots (either intentionally or unintentionally)?
Question149: A user has created a web application with Auto Scaling. The user is regularly monitoring the application
and he observed that the traffic is highest on Thursday and Friday between 8 AM to 6 PM. What is the
best solution to handle scaling in this case?
Question150: When an EC2 instance that is backed by an S3-based AMI is terminated, what happens to the data on me root volume?
Question151: What does Amazon IAM provide?
Question152: A company is releasing a new static website hosted on Amazon S3. The static website hosting feature was enabled on the bucket and content was uploaded; however, upon navigating to the site, the following error message is received:
403 Forbidden - Access Denied
What change should be made to fix this error?
Question153: Which of the following statements is true of Elastic Load Balancing?
Question154: A user is using the AWS SQS to decouple the services.
Which of the below mentioned operations is not supported by SQS?
Question155: A new network is needed to run secure Amazon EC2 instance. This network cannot have direct access to the internet and must be separate from existing production instances. The instances will be manager using SSH from a Developer in a home office with a fixed IP address but without a VPN- capable router.
How should a SysOps Administrator create this network and manage these servers?
Question156: Which of the following statements is NOT true of CloudWatch?
Question157: A company has deployed a NAT instance to allow web servers to obtain software updates from the internet.
There latency on the NAT instance as the network grows. A SysOps Administrator needs to reduce latency on the instance in a manner that a efficient, cost effective, and allow for scaling with future demand.
Which action should be taken to accomplish this?
Question158: A company is running a popular social media site on EC2 instances. The application stores data in an Amazon
RDS for MySQL DB instance and has implemented read caching by using an ElastiCache for Redis (cluster
mode enabled) cluster to improve read times. A social event is happening over the weekend, and the SysOps
Administrator expects website traffic to triple.
What can a SysOps Administrator do to ensure improved read times for users during the social event?
Question159: A user has launched an EBS backed instance with EC2-Classic. The user stops and starts the instance.
Which of the below mentioned statements is not true with respect to the stop/start action?
Question160: An application team has asked a sysops administrator to provision an additional environment for an application in four additional regions. The application is running on more than 100 instances in us-east-1, using fully baked AMIs, An AWS CloudFormation template has been created to deploy resources in us-east-1.
What must the sysops administrator do to provision the application quickly?
Question161: A SysOps Administrator is attempting to use AWS Systems Manager Session Manager to initiate a SSH session with an Amazon EC2 instance running on a custom Linux Amazon Machine Image (AMI). The Administrator cannot find the target instance in the Session Manager console.
Which combination of actions will solve this issue? (Choose two.)
Question162: A company's customers are reporting increased latency while accessing static web content from Amazon S3.
A SysOps Administrator observed a very high rate of read operations on a particular S3 bucket.
What will minimize latency by reducing load on the S3 bucket?
Question163: Which of the following steps are required to configure SAML 2.0 for federated access to AWS?
(Choose two.)
Question164: How can software determine the public and private IP addresses of the Amazon EC2 instance that it is running on?
Question165: _________ is a fast, reliable, scalable, fully managed message queuing service.
Question166: A company is deploying a web service to Amazon EC2 instances behind an Elastic Load Balancer. All resources will be defined and created in a single AWS CloudFormation stack using a template. The creation of each EC2 instance will not be considered complete until an initialization script has been run successfully on the EC2 instance. The Elastic Load Balancer cannot be created until all EC2 instances have been created.
Which CloudFormation resource will coordinate the Elastic Load Balancer creation in the CloudFormation stack template?
Question167: An organization has setup multiple IAM users. The organization wants that each IAM user accesses the IAM console only within the organization and not from outside. How can it achieve this?
Question168: A user has launched five instances and have registered them with an ELB. How can the user add the sixth EC2 instance to the ELB?
Question169: You have private video content in S3 that you want to serve to subscribed users on the Internet. User IDs, credentials, and subscriptions are stored in an Amazon RDS database.
Which configuration will allow you to securely serve private content to your users?
Question170: A user wants to upload a complete folder to AWS S3 using the S3 Management console. How can the
user perform this activity?
Question171: A SysOps Administrator is responsible for a large fleet of EC2 instances and must know whether any instances will be affected by upcoming hardware maintenance. Which option would provide this information with the LEAST administrative overhead?
Question172: A user is trying to connect to a running EC2 instance using SSH. However, the user gets a connection time out error. Which of the below mentioned options is not a possible reason for rejection?
Question173: The majority of your Infrastructure is on premises and you have a small footprint on AWS
Your company has decided to roll out a new application that is heavily dependent on low latency
connectivity to LOAP for authentication. Your security policy requires minimal changes to the company's
existing application user management processes.
What option would you implement to successfully launch this application1?
Question174: You are using ElastiCache Memcached to store session state and cache database queries in your
infrastructure. You notice in Cloud Watch that Evictions and GetMisses are Doth very high.
What two actions could you take to rectify this? Choose 2 answers
Question175: A user is trying to understand the ACL and policy for an S3 bucket. Which of the below mentioned policy permissions is equivalent to the WRITE ACL on a bucket?
Question176: AWS KMS(Key Management Service) uses symmetric key cryptography to perform encryption and decryption. Symmetric key cryptography uses the same algorithm and key to both encrypt and decrypt digital data. The unencrypted data is typically called plaintext whether it is text or not, and the encrypted data is typically called _____.
Question177: A SysOps administrator must deploy a company's infrastructure as code (laC). The administrator needs to write a single template that can be reused for multiple environments in a safe, repeatable manner.
How should the administrator meet this requirement by using AWS Cloud Formation?
Question178: For IAM user, a virtual Multi-Factor Authentication (MFA) device uses an application that gener-ates
______-digit authentication codes that are compatible with the time-based one-time password (TOTP) standard.
Question179: A company has a sales department and a marketing department. The company uses one AWS account. There is a need to determine what charges are incurred on the AWS platform by each department. There is also a need to receive notifications when a specified cost level is approached or exceeded.
Which actions must a SysOps administrator take to achieve both requirements with the LEAST amount of administrative overhead? (Select TWO.)
Question180: A user has created a VPC with CIDR 20.0.0.0/16. The user has created public and VPN only subnets along
with hardware VPN access to connect to the user's datacenter. The user wants to make so that all traffic
coming to the public subnet follows the organization's proxy policy. How can the user make this happen?
Question181: A user has setup a billing alarm using CloudWatch for $200.
The usage of AWS exceeded $200 after some days.
The user wants to increase the limit from $200 to $400.
What should the user do?
Question182: Your mission is to create a lights-out datacenter environment, and you plan to use AWS OpsWorks to accomplish this. First you created a stack and added an App Server layer with an instance running in it. Next you added an application to the instance, and now you need to deploy a MySQL RDS database instance.
Which of the following answers accurately describe how to add a backend database server to an OpsWorks stack? Choose 3 answers
Question183: How can you secure data at rest on an EBS volume?
Question184: How can the domain's zone apex for example "myzoneapexdomain com" be pointed towards an Elastic Load Balancer?
Question185: A company must ensure that any objects uploaded to an S3 bucket are encrypted.
Which of the following actions will meet this requirement? (Choose two.)
Question186: A company is running a new promotion that will result in a massive spike in traffic for a single application. The SysOps Administrator must prepare the application and ensure that the customers have a great experience. The application is heavy on memory and is running behind an AWS Application Load Balancer (ALB). The ALB has been pre-warmed, and the application is in an Auto Scaling group.
What built-in metric should be used to control the Auto Scaling group's scaling policy?
Question187: Security has identified an IP address that should be explicitly denied for both ingress and egress requests for all services in an Amazon VPC immediately.
Which feature can be used to meet this requirement?
Question188: A SysOps Administrator created an AWS CloudFormation template for the first time. The stack failed with a status of ROLLBACK_COMPLETE. The Administrator identified and resolved the template issue causing the failure.
How should the Administrator continue with the stack deployment?
Question189: A SysOps Administrator is troubleshooting Amazon EC2 connectivity issues to the internet. The EC2 instance is in a private subnet. Below is the route table that is applied to the subnet of the EC2 instance.
Destination - 10.2.0.0/16
Target - local
Status - Active
Propagated - No
Destination - 0.0.0.0/0
Target - nat-xxxxxxx
Status - Blackhole
Propagated - No
What has caused the connectivity issue?
Question190: In AWS Identity and Access Management (IAM), you can make use of the ______ APIs to grant users temporary access to your resources.
Question191: A user has configured ELB with two EBS backed instances. The user has stopped the instances for 1
week to save costs. The user restarts the instances after 1 week. Which of the below mentioned
statements will help the user to understand the ELB and instance registration better?
Question192: You have a Linux EC2 web server instance running inside a VPC The instance is In a public subnet and has an EIP associated with it so you can connect to It over the Internet via HTTP or SSH The instance was also fully accessible when you last logged in via SSH. and was also serving web requests on port 80.
Now you are not able to SSH into the host nor does it respond to web requests on port 80 that were working fine last time you checked You have double-checked that all networking configuration parameters (security groups route tables.
IGW'EIP. NACLs etc) are properly configured {and you haven't made any changes to those anyway since you were last able to reach the Instance).
You look at the EC2 console and notice that system status check shows "impaired." Which should be your next step in troubleshooting and attempting to get the instance back to a healthy state so that you can log in again?
Question193: A system admin is planning to setup event notifications on RDS. Which of the below mentioned services will help the admin setup notifications?
Question194: A SysOps Administrator has received a request from the Compliance Department to enforce encryption on all objects uploaded to the corp-compliance bucket.
How can the Administrator enforce encryption on all objects uploaded to the bucket?
Question195: In Amazon CloudFront, if you have chosen On for Logging, the access logs are stored in _______________.
Question196: A user is trying to connect to a running EC2 instance using SSH. However, the user gets a connection time out
error. Which of the below mentioned options is not a possible reason for rejection?
Question197: A company is storing monthly reports on Amazon S3. The company's security requirement states that traffic from the client VPC to Amazon S3 cannot traverse the internet.
What should the SysOps Administrator do to meet this requirement?
Question198: Which instance characteristics are required if an Administrator wants to ensure use of the Amazon EC2 auto- recovery option? (Choose two.)
Question199: What does Amazon S3 stand for?
Question200: What does the AWS Storage Gateway provide?
Question201: A user is having data generated randomly based on a certain event. The user wants to upload that data to
CloudWatch. It may happen that event may not have data generated for some period due to randomness.
Which of the below mentioned options is a recommended option for this case?
Question202: A customer has a web application that uses cookie Based sessions to track logged in users. It is deployed on AWS using ELB and Auto Scaling. The customer observes that when load increases. Auto Scaling launches new Instances but the load on the easting Instances does not decrease, causing all existing users have a sluggish experience.
Which two answer choices independently describe a behavior that could be the cause of the sluggish user experience? (Choose two.)
Question203: A company is expanding its use of AWS services across its portfolios. The company wants to provision AWS accounts for each team to ensure a separation of business processes for security, compliance, and billing.
Account creation and bootstrapping should be completed in a scalable and efficient way so new accounts are created with a defined baseline and governance guardrails in place. A SysOps administrator needs to design a provisioning process that saves time and resources.
Which action should be taken to meet these requirements?
Question204: A user has launched an RDS postgreSQL DB with AWS. The user did not specify the maintenance window during creation. The user has configured RDS to update the DB instance type from micro to large.
If the user wants to have it during the maintenance window, what will AWS do?
Question205: A user has moved an object to Glacier using the life cycle rules. The user requests to restore the archive after
6 months. When the restore request is completed the user accesses that archive. Which of the below
mentioned statements is not true in this condition?
Question206: An organization would like to set up an option for its Developers to receive an email whenever production Amazon EC2 instances are funning over 80% CPU utilization. How can this be accomplished using an Amazon CloudWatch alarm?
Question207: A company wants to ensure that each department operates within their own isolated environment, and they are only able to use pre-approved services.
How can this requirement be met?
Question208: What does Amazon SES stand for?
Question209: You have decided to change the Instance type for instances running in your application tier that are using Auto Scaling.
In which area below would you change the instance type definition?
Question210: A financial service company is running distributed computing software to manage a fleet of 20 servers for their calculations. There are 2 control nodes and 18 worker nodes to run the calculations. Worker nodes can be automatically started by the control nodes when required.
Currently, all nodes are running on demand, and the worker nodes are used for approximately 4 hours each day.
Which combination of actions will be MOST cost-effective? (Choose two.)
Question211: A company is using an Amazon ElastiCache for Redis cluster in a production environment. To align with the company's technical requirements, a SysOps administrator needs to select a deployment to provide increased availability and fault tolerance.
Which action should the SysOps administrator take to accomplish this goal?
Question212: What does Amazon SES provide?
Question213: A company must share monthly report files that are uploaded to Amazon S3 with a third party. The third- party user list is dynamic, is distributed, and changes frequently. The least amount of access must be granted to the third party. Administrative overhead must be low for the internal teams who manage the process.
How can this be accomplished while providing the LEAST amount of access to the third party?
Question214: A SysOps Administrator is receiving report from custom that they are unable to the website, which is being server through Amazon CloudFront. Customers are receiving HTTP response codes for both 4xx and 5xx errors.
Which metric can the Administrative use to monitor the elevated error rates in CloudFront?
Question215: Amazon EC2 provides virtual computing environments known as _____.
Question216: A user has created a launch configuration for Auto Scaling where CloudWatch detailed monitoring is disabled.
The user wants to now enable detailed monitoring. How can the user achieve this?
Question217: A sys admin has enabled a log on ELB. Which of the below mentioned activities are not captured by the log?
Question218: A user is collecting 1000 records per second. The user wants to send the data to CloudWatch using a custom namespace. Which of the below mentioned options is recommended for this activi-ty?
Question219: Your organization's security policy requires that all privileged users either use frequently rotated
passwords or one-time access credentials in addition to username/password.
Which two of the following options would allow an organization to enforce this policy for AWS users?
Choose 2 answers
Question220: You are attempting to connect to an instance in Amazon VPC without success You have already verified that the VPC has an Internet Gateway (IGW) the instance has an associated Elastic IP (EIP) and correct security group rules are in place.
Which VPC component should you evaluate next?
Question221: A user had aggregated the CloudWatch metric data on the AMI ID. The user observed some abnormal behavior of the CPU utilization metric while viewing the last 2 weeks of data.
The user wants to share that data with his manager. How can the user achieve this easily with the AWS console?
Question222: A user has scheduled the maintenance window of an RDS DB on Monday at 3 AM. Which of the below mentioned events may force to take the DB instance offline during the maintenance window?
Question223: A user is planning to setup infrastructure on AWS for the Christmas sales. The user is planning to use Auto Scaling based on the schedule for proactive scaling. What advise would you give to the user?
Question224: An AWS root account owner is trying to create a policy to access RDS. Which of the below mentioned statements is true with respect to the above information?
Question225: A company stores thousands of non-critical log files in an Amazon S3 bucket. A set of reporting scripts retrieve these log files daily.
Which of the following storage options will be the MOST cost-efficient for the company's use case?
Question226: A user is displaying the CPU utilization, and Network in and Network out CloudWatch metrics data of a single instance on the same graph. The graph uses one Y-axis for CPU utilization and Network in and another Y-axis for Network out. Since Network in is too high, the CPU utilization data is not visible clearly on graph to the user.
How can the data be viewed better on the same graph?
Question227: A system admin is planning to setup event notifications on RDS. Which of the below mentioned services
will help the admin setup notifications?
Question228: The networking team has created a VPC in an AWS account. The application team has asked for access to resources in another VPC in the same AWS account. The SysOps Administrator has created the VPC peering connection between both the accounts, but the resources in one VPC cannot communicate with the resources in the other VPC.
What could be causing this issue?
Question229: In AWS Identity and Access Management, roles can be used by an external user authenticated by an external identity provider (IdP) service that is compatible with _____.
Question230: The majority of your Infrastructure is on premises and you have a small footprint on AWS Your company has decided to roll out a new application that is heavily dependent on low latency connectivity to LOAP for authentication Your security policy requires minimal changes to the company's existing application user management processes.
What option would you implement to successfully launch this application1?
Question231: A user has launched an EC2 instance from an instance store backed AMI. The user has attached an additional instance store volume to the instance. The user wants to create an AMI from the running instance. Will the AMI have the additional instance store volume data?
Question232: A SysOps Administrator has set up a new Application Load Balancer (ALB) in front of a pair of private web server in multiple Availability Zones. After deployment an updates CloudFormation template with many changes, user now goes to one web server only. What is the NOST likely reason that the traffic is not being balanced between both servers?
Question233: What does Amazon SWF stand for?
Question234: A SysOps Administrator manages an application that stores object metadata in Amazon S3. There is a requirement to have S2 server-side encryption enabled on all new objects in the bucket.
How can the Administrator ensure that all new objects to the bucket satisfy this requirement?
Question235: A user has created a VPC with CIDR 20.0.0.0/24. The user has used all the IPs of CIDR and wants to increase the size of the VPC. The user has two subnets: public (20.0.0.0/28. and private (20.0.1.0/28.. How can the user change the size of the VPC?
Question236: A user has configured ELB with three instances. The user wants to achieve High Availability as well as redundancy with ELB. Which of the below mentioned AWS services helps the user achieve this for ELB?
Question237: A company has adopted a security policy that requires all customer data to be encrypted at rest.
Currently, customer data is stored on a central Amazon EFS file system and accessed by a number of different applications from Amazon EC2 instances.
How can the SysOps Administrator ensure that all customer data stored on the EFS file system meets the new requirement?
Question238: You have a web application leveraging an Elastic Load Balancer (ELB) In front of the web servers deployed using an Auto Scaling Group Your database is running on Relational Database Service (RDS) The application serves out technical articles and responses to them in general there are more views of an article than there are responses to the article. On occasion, an article on the site becomes extremely popular resulting in significant traffic Increases that causes the site to go down.
What could you do to help alleviate the pressure on the infrastructure while maintaining availability during these events? (Choose three.)
Question239: A user runs the command "dd if=/dev/xvdf of=/dev/null bs=1M" on an EBS volume created from a snapshot and attached to a Linux instance. Which of the below mentioned activities is the user performing with the step given above?
Question240: A SysOpsAdministrator is managing a large organization with multiple accounts on the Business Support plan all linked to a single payer account. The Administrator wants to be notified automatically of AWS Personal Health Dashboard events.
In the main payer account, the Administrator configures Amazon CloudWatch Events triggered by AWS Health events triggered by AWS Health triggered by AWS Health events to issue notifications using Amazon SNS, but alerts in the linked accounts failed to trigger.
Why did the alerts fail?
Question241: A media company produces new video files on-premises every day with a total size of around 100 GBS after
compression All files have a size of 1 -2 GB and need to be uploaded to Amazon S3 every night in a fixed time
window between 3am and 5am Current upload takes almost 3 hours, although less than half of the available
bandwidth is used.
What step(s) would ensure that the file uploads are able to complete in the allotted time window?
Question242: In Amazon S3, what is the document that defines who can access a particular bucket or object called?
Question243: Which two AWS services provide out-of-the-box user configurable automatic backup-as-a-service and backup
rotation options? (Choose two.)
Question244: Your EC2-Based Multi-tier application includes a monitoring instance that periodically makes application -level read only requests of various application components and if any of those fail more than three times 30 seconds calls CloudWatch lo fire an alarm, and the alarm notifies your operations team by email and SMS of a possible application health problem. However, you also need to watch the watcher -the monitoring instance itself - and be notified if it becomes unhealthy.
Which of the following is a simple way to achieve that goal?
Question245: An IAM user has two conflicting policies as part of two separate groups. One policy allows him to access an S3 bucket, while another policy denies him the access. Can the user access that bucket?
Question246: A company is using an Amazon ElastiCache for Redis cluster in a production environment. To align with the company's technical requirements, a SysOps administrator needs to select a deployment to provide increased availability and fault tolerance.
Which action should the SysOps administrator take to accomplish this goal?
Question247: Malicious traffic is reaching company web servers from a single IP address located in another country. The SysOps Administrator is tasked with blocking this IP address.
How should the Administrator implement the restriction?
Question248: An application is running on Amazon EC2 instances behind an Application Load Balancer (ALB).
The instances are configured in an Amazon EC2 Auto Scaling group. A SysOps Administrator must configure the application to scale based on the number of incoming requests.
Which solution accomplishes this with the LEAST amount of effort?
Question249: A company wants to store sensitive data in Amazon S3. The S3 bucket and its contents must be accessible only from the on-premises corporate network.
What should a SysOps administrator do to configure the S3 bucket policy statement?
Question250: An organization with a large IT department has decided to migrate to AWS. With different job functions in the IT department, it is not desirable to give all users access to all AWS resources.
Currently the organization handles access via LDAP group membership.
What is the BEST method to allow access using current LDAP credentials?
Question251: A user has created an ELB with three instances. How many security groups will ELB create by default?
Question252: A SysOps Administrator created an AWS Service Catalog portfolio and shared the portfolio with a second AWS account in the company. The second account is controlled by a different Administrator.
Which action will the Administrator of the second account be able to perform?
Question253: A user has enabled detailed CloudWatch metric monitoring on an Auto Scaling group.
Which of the below mentioned metrics will help the user identify the total number of instances in an Auto Scaling group cluding pending, terminating and running instances?
Question254: An organization is running multiple applications for their customers. Each application is deployed by running a base AWS CloudFormation template that configures a new VPC. All applications are run in the same AWS account and AWS Region. A SysOps Administrator has noticed that when trying to deploy the same AWS CloudFormation stack, it fails to deploy.
What is likely to be the problem?
Question255: A SysOps Administrator must take a team's single existing AWS CloudFormation template and split it into smaller, service-specific templates. All of the services in the template reference a single, shared Amazon S3 bucket.
What should the Administrator do to ensure that this S3 bucket can be referenced by all the service templates?
Question256: A user has configured ELB with Auto Scaling. The user temporarily suspended the Auto Scaling terminate process. What might the Availability Zone Rebalancing process (AZRebalance) consequently cause during this period?
Question257: A SysOps Administrator manages an application that stores object metadata in Amazon S3. There is a requirement to have S2 server-side encryption enabled on all new objects in the bucket.
How can the Administrator ensure that all new objects to the bucket satisfy this requirement?
Question258: Does Amazon RDS support SSL encryption for SQL Server DB Instances?
Question259: An IAM user has two conflicting policies as part of two separate groups. One policy allows him to access an S3 bucket, while another policy denies him the access. Can the user access that bucket?
Question260: A SysOps Administrator is deploying a test site running on Amazon EC2 instances. The application requires both incoming and outgoing connectivity to the Internet.
Which combination of steps are required to provide internet connectivity to the EC2 instances? (Choose two.)
Question261: A sys admin is trying to understand the sticky session algorithm. Please select the correct sequence of steps, both when the cookie is present and when it is not, to help the admin understand the implementation of the sticky session:
Question262: How can you secure data at rest on an EBS volume?
Question263: Your business is building a new application that will store its entire customer database on a RDS MySQL database, and will have various applications and users that will query that data for different purposes.
Large analytics jobs on the database are likely to cause other applications to not be able to get the query results they need to, before time out. Also, as your data grows, these analytics jobs will start to take more time, increasing the negative effect on the other applications.
How do you solve the contention issues between these different workloads on the same data?
Question264: A SysOps Administrator using AWS KMS needs to rotate all customer master keys (CMKs) every week to meet information security guidelines.
Which option would meet the requirement?
Question265: A user wants to capture errors that occur in the AWS MySQL RDS DB. Which of the below mentioned
activities may help the user to get the data easily?
Question266: A user has configured Auto Scaling with 3 instances. The user had created a new AMI after updating one
of the instances. If the user wants to terminate two specific instances to ensure that Auto Scaling
launches an instances with the new launch configuration, which command should he run?
Question267: Which two AWS services provide out-of-the-box user configurable automatic backup-as-a-service and backup
rotation options? (Choose two.)
Question268: A company's IT department noticed an increase in the spend of their Developer AWS account. There are over
50 Developers using the account, and the Finance team wants to determine the service costs incurred by each Developer.
What should a SysOps Administrator do to collect this information? (Choose two.)
Question269: A user has configured an Auto Scaling group with ELB. The user has enabled detailed CloudWatch monitoring on Auto Scaling. Which of the below mentioned statements will help the user understand the functionality better?
Question270: A system admin is planning to encrypt all objects being uploaded to S3 from an application. The system admin does not want to implement his own encryption algorithm; instead he is planning to use server side encryption by supplying his own key (SSE-C.. Which parameter is not required while making a call for SSE-C?
Question271: A user has created a VPC with public and private subnets using the VPC wizard. Which of the below mentioned statements is not true in this scenario?
Question272: An organization has developed a new memory-intensive application that is deployed to a large Amazon EC2 Linux fleet. There is concern about potential memory exhaustion, so the Development team wants to monitor memory usage by using Amazon CloudWatch.
What is the MOST efficient way to accomplish this goal?
Question273: A user has created an ELB with three instances. How many security groups will ELB create by default?
Question274: You are setting up a VPC and you need to set up a public subnet within that VPC. Which following requirement must be met for this subnet to be considered a public subnet?
Question275: A user has launched two EBS backed EC2 instances in the US-East-1a region. The user wants to change the zone of one of the instances. How can the user change it?
Question276: A user is creating a Cloudformation stack. Which of the below mentioned limitations does not hold true for
Cloudformation?
Question277: Can you configure multiple Load Balancers with a single Auto Scaling group?
Question278: A company runs a web application that users access using the domain name www.example.com. The company manages the domain name using Amazon Route 53. The company created an Amazon CloudFront distribution in front of the application and would like www.example.com to access the application though CloudFront.
What is the MOST cost-effective way to achieve this?
Question279: A SysOps Administrator deployed an AWS Elastic Beanstalk worker node environment that reads messages from an auto-generated Amazon Simple Queue Service (Amazon SQS) queue and deleted them from the queue after processing. Amazon EC2 Auto Scaling scales in and scales out the number of worker nodes based on CPU utilization. After some time, the Administrator notices that the number of messages in the SQS queue are increasing significantly.
Which action will remediate this issue?
Question280: A user is running a batch process on EBS backed EC2 instances. The batch process starts a few instances to
process hadoop Map reduce jobs which can run between 50 - 600 minutes or sometimes for more time. The
user wants to configure that the instance gets terminated only when the process is completed. How can the
user configure this with CloudWatch?
Question281: A user has launched two EBS backed EC2 instances in the US-East-1a region. The user wants to change the zone of one of the instances. How can the user change it?
Question282: A user is running a batch process on EBS backed EC2 instances. The batch process starts a few
instances to process hadoop Map reduce jobs which can run between 50 - 600 minutes or sometimes for
more time. The user wants to configure that the instance gets terminated only when the process is
completed. How can the user configure this with CloudWatch?
Question283: A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB?
Question284: A user had aggregated the CloudWatch metric data on the AMI ID. The user observed some abnormal behavior of the CPU utilization metric while viewing the last 2 weeks of data. The user wants to share that data with his manager. How can the user achieve this easily with the AWS console?
Question285: Which of the following services can receive an alert from CloudWatch?
Question286: A SysOps administrator wants to encrypt an existing Amazon RDS DB instance with AWS Key Management Service (AWS KMS).
How should the SysOps administrator accomplish this goal?
Question287: A user is trying to aggregate all the CloudWatch metric data of the last 1 week. Which of the below mentioned statistics is not available for the user as a part of data aggregation?
Question288: Network ACLs in a VPC operate at the ______.
Question289: A company has deployed a fleet of Amazon EC2 web servers for the upcoming release of a new product. The
SysOps Administrator needs to test the Amazon CloudWatch notification settings for this deployment to ensure
that a notification is sent using Amazon SNS if the CPU utilization of an EC2 instance exceeds 70%.
How should the Administrator accomplish this?
Question290: A financial service company is running distributed computing software to manage a fleet of 20 servers for their calculations. There are 2 control nodes and 18 worker nodes to run the calculations. Worker nodes can be automatically started by the control nodes when required.
Currently, all nodes are running on demand, and the worker nodes are used for approximately 4 hours each day.
Which combination of actions will be MOST cost-effective? (Choose two.)
Question291: A sys admin has enabled a log on ELB. Which of the below mentioned activities are not
captured by the log?
Question292: A user has configured ELB with a TCP listener at ELB as well as on the back-end instances. The user
wants to enable a proxy protocol to capture the source and destination IP information in the header.
Which of the below mentioned statements helps the user understand a proxy protocol with TCP
configuration?
Question293: In configuring an Amazon Route 53 health check, a SysOps Administrator selects `Yes' to the String Matching option in the Advanced Configuration section. In the Search String box, the Administrator types the following text: /html.
This is to ensure that the entire page is loading during the health check. Within 5 minutes of enabling the health check, the Administrator receives an alert stating that the check failed.
However, when the Administrator navigates to the page, it loads successfully.
What is the MOST likely cause of this false alarm?
Question294: A system admin is planning to encrypt all objects being uploaded to S3 from an application. The system admin does not want to implement his own encryption algorithm; instead he is planning to use server side encryption by supplying his own key (SSE-C.. Which parameter is not required while making a call for SSE-C?
Question295: A company issued SSL certificates to its users, and needs to ensure the private keys that are used to sign the certificates are encrypted. The company needs to be able to store the private keys and perform cryptographic signing operations in a secure environment.
Which service should be used to meet these requirements?
Question296: A SysOps administrator is testing a new batch job. The batch job will upload 20 GB of data from Amazon EC2 instances in a private subnet to an Amazon S3 bucket each day. After the first test is complete, a small cost is reported. The cost has the heading "NAT Gateway - Data Processed." Which change can the SysOps administrator make to eliminate this cost for future tests?
Question297: An organization has created 50 IAM users. The organization wants that each user can change their password but cannot change their access keys. How can the organization achieve this?
Question298: A SysOps Administrator is analyzing how Reserved Instance discounts are allocated to Amazon EC2 instances
across accounts in the company's consolidated bill.
Which AWS tool will provide the details necessary to understand the billing charges?
Question299: You have started a new job and are reviewing your company's infrastructure on AWS You notice one web
application where they have an Elastic Load Balancer (&B) in front of web instances in an Auto Scaling
Group When you check the metrics for the ELB in CloudWatch you see four healthy instances In
Availability Zone (AZ) A and zero in AZ B
There are zero unhealthy instances.
What do you need to fix to balance the instances across AZs?
Question300: When an EC2 EBS-backed (EBS root) instance is stopped, what happens to the data on any ephemeral
store volumes?
Question301: A SysOps Administrator management a fleet of instance store-backed Amazon Linux EC2 instances. The SSH key used to access these instances has been lost. How can SSH access be restored?
Question302: A user has launched an RDS MySQL DB with the Multi AZ feature. The user has scheduled the scaling of instance storage during maintenance window. What is the correct order of events during maintenance window?
1. Perform maintenance on standby
2. Promote standby to primary
3. Perform maintenance on original primary
4. Promote original master back as primary
Question303: An organization is measuring the latency of an application every minute and storing data inside a file in the JSON format. The organization wants to send all latency data to AWS CloudWatch. How can the organization achieve this?
Question304: A user is collecting 1000 records per second. The user wants to send the data to CloudWatch using a custom namespace. Which of the below mentioned options is recommended for this activity?
Question305: A user has configured Elastic Load Balancing by enabling a Secure Socket Layer (SSL) negotiation configuration known as a Security Policy. Which of the below mentioned options is not part of this secure policy while negotiating the SSL connection between the user and the client?
Question306: Which two AWS services provide out-of-the-box user configurable automatic backup-as-a-service and backup
rotation options? (Choose two.)
Question307: Pricing is ____ consumed for EC2 instances.
Question308: When using the following AWS services, which should be implemented in multiple Availability Zones for high availability solutions? Choose 2 answers
Question309: When an EC2 instance that is backed by an S3-based AMI Is terminated, what happens to the data on me root volume?
Question310: A SysOps Administrator must run a script on production servers to fix an issue. The company has a policy block all remote interface access to production servers. The Based on this situation how should the Administrator execute the script?
Question311: Pass4test has three AWS accounts. They have created separate IAM users within each account.
Pass4test wants a single IAM login URL such as https://pass4test.signin.aws.amazon.com/console/ for use by IAM users in all three accounts.
How can this be achieved?
Question312: Company A purchases company B and inherits three new AWS accounts. Company A would like to centralize billing and reserved instance benefits but wants to keep all other resources separate.
How can this be accomplished?
Question313: A company has an application that is running on an EC2 instance in one Availability Zone.
A SysOps Administrator has been tasked with making the application highly available. The Administrator created a launch configuration from the running EC2 instance. The Administrator also properly configured a load balancer.
What step should the Administrator complete next to make the application highly available?
Question314: A company's data retention policy dictates that backups be stored for exactly two years. After that time, the
data must be deleted.
How can Amazon EBS snapshots be managed to conform to this data retention policy?
Question315: An HTTP web application is launched on Amazon EC2 instances behind an ELB Application Load Balancer.
The EC2 instances run across multiple Availability Zones. A network ACL and a security group for the load
balancer and EC2 instances allow inbound traffic on port 80. After launch, the website cannot be reached over
the internet.
What additional step should be taken?
Question316: Which of the following statements about this S3 bucket policy is true?
Question317: A user has launched a large EBS backed EC2 instance in the US-East-1a region.
The user wants to achieve Disaster Recovery (DR. for that instance by creating another small instance in Europe.
How can the user achieve DR?
Question318: A user has configured an Auto Scaling group with ELB. The user has enabled detailed CloudWatch monitoring on Auto Scaling. Which of the below mentioned statements will help the user understand the functionality better?
Question319: You have set up an IAM policy for your users to access Elastic Load Balancers and you know that an IAM policy is a JSON document that consists of one or more statements. Which of the following elements is not a part of the statement in an IAM policy document?
Question320: When rebalancing, Auto Scaling launches new instances before terminating the old ones, so that rebalancing does not compromise the performance or availability of your application. Because Auto Scaling attempts to launch new instances before terminating the old ones, being at or near the specified maximum capacity could impede or completely halt rebalancing activities. What does Auto Scaling do in order to avoid this problem?
Question321: A user has created a Cloudformation stack. The stack creates AWS services, such as EC2 instances,
ELB, AutoScaling, and RDS. While creating the stack it created EC2, ELB and AutoScaling but failed to
create RDS. What will Cloudformation do in this scenario?
Question322: A SysOps Administrator is running Amazon EC2 instances in multiple AWS Regions. The Administrator wants to aggregate the CPU utilization for all instances onto an Amazon CloudWatch dashboard. Each region should be present on the dashboard and represented by a single graph that contains the CPU utilization for all instances in that region.
How can the Administrator meet these requirements?
Question323: An organization has configured two single availability zones. The Auto Scaling groups are configured in separate zones. The user wants to merge the groups such that one group spans across multiple zones. How can the user configure this?
Question324: A sys admin is trying to understand the Auto Scaling activities. Which of the below mentioned processes is not performed by Auto Scaling?
Question325: A user has launched an EC2 instance from an instance store backed AMI. The user has attached an additional instance store volume to the instance. The user wants to create an AMI from the running instance. Will the AMI have the additional instance store volume data?
Question326: An application resides on multiple EC2 instances in public subnets in two Availability Zones. To improve security, the Information Security team has deployed an Application Load Balancer (ALB) in separate subnets and pointed the DNS at the ALB instead of the EC2 instances.
After the change, traffic is not reaching the instances, and an error is being returned from the ALB.
What steps must a SysOps Administrator take to resolve this issue and improve the security of the application? (Select TWO.)
Question327: Your team Is excited about theuse of AWS because now they have access to programmable Infrastructure" You have been asked to manage your AWS infrastructure In a manner similar to the way you might manage application code You want to be able to deploy exact copies of different versions of your infrastructure, stage changes into different environments, revert back to previous versions, and identify what versions are running at any particular time (development test QA. production).
Which approach addresses this requirement?
Question328: A user has enabled instance protection for his Auto Scaling group that has spot instances. If Auto Scaling
wants to terminate an instance in this Auto Scaling group due to a CloudWatch trigger unre-lated to bid price,
what will happen?
Question329: Amazon Relational Database Service integrates with _____, a service that lets your organization create users
and groups under your organization's AWS account and assign unique security creden-tials to each user.
Question330: An organization finds that a high number of gp2 Amazon EBS volumes are running out of space.
Which solution will provide the LEAST disruption with MINIMAL effort?
Question331: A large company has multiple AWS accounts that are assigned to each department. A SysOps administrator needs to help the company reduce overhead and manage its AWS resources more easily. The SysOps administrator also must ensure that department users, including AWS account root users, have access only to AWS services that are essential for their job function.
Which solution will meet these requirements?
Question332: A local agency plans to deploy 50 Raspberry Pi devices throughout a city. All the devices need to be managed centrally, and their configurations need to be consistent.
What is the BEST service for managing these devices?
Question333: A SysOps administrator is setting up an automated process to recover an Amazon EC2 instance in the event of an underlying hardware failure. The recovered instance must have the same private IP address and the same Elastic IP address that the original instance had. The SysOps team must receive an email notification when the recovery process is initiated.
Which solution will meet these requirements?
Question334: A SysOps Administrator needs to retrieve a file from the GLACIER storage class of Amazon S3.
The Administrator wants to receive an Amazon SNS notification when the file is available for access.
What action should be taken to accomplish this?
Question335: An application you maintain consists of multiple EC2 instances in a default tenancy VPC. This application has undergone an internal audit and has been determined to require dedicated hardware for one instance. Your compliance team has given you a week to move this instance to single-tenant hardware.
Which process will have minimal impact on your application while complying with this requirement?
Question336: An application running on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones was deployed using an AWS CloudFormation template. The SysOps team has patched the Amazon Machine Image (AMI) version and must update all the EC2 instances to use the new AMI.
How can the SysOps Administrator use CloudFormation to apply the new AMI while maintaining a minimum level of active instances to ensure service continuity?
Question337: An organization (Account ID 123412341234. has attached the below mentioned IAM policy
to a user. What does this policy statement entitle the user to perform?
"Statement": [
{
"Sid": "AllowUsersAllActionsForCredentials",
"Effect": "Allow",
"Action": [
"iam:*AccessKey*",
],
"Resource": ["arn:aws:iam:: 123412341234:user/${aws:username}"]
}
]
Question338: A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB?
Question339: You are setting up a VPC and you need to set up a public subnet within that VPC. Which following requirement must be met for this subnet to be considered a public subnet?
Question340: Which of the following are characteristics of Amazon VPC subnets? (Choose two.)
Question341: An organization (account ID 123412341234. has configured the IAM policy to allow the user to modify his credentials. What will the below mentioned statement allow the user to perform?
{ "Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"iam:AddUserToGroup",
"iam:RemoveUserFromGroup",
"iam:GetGroup"
],
"Resource": "arn:aws:iam:: 123412341234:group/TestingGroup"
}]
Question342: How can software determine the public and private IP addresses of the Amazon EC2 instance that it is running on?
Question343: According to the shared responsibility model, for which of the following Amazon EC2 activities is AWS responsible? (Choose two.)
Question344: The information within an IAM policy is described through a series of ______.
Question345: A user has enabled the Multi AZ feature with the MS SQL RDS database server. Which of the below mentioned statements will help the user understand the Multi AZ feature better?
Question346: Your company Is moving towards tracking web page users with a small tracking Image loaded on each page Currently you are serving this image out of US-East, but are starting to get concerned about the time It takes to load the image for users on the west coast.
What are the two best ways to speed up serving this image? Choose 2 answers
Question347: A user has configured an Auto Scaling group with ELB. The user has enabled detailed CloudWatch monitoring on Auto Scaling. Which of the below mentioned statements will help the user understand the functionality better?
Question348: A sys admin has enabled logging on ELB. Which of the below mentioned fields will not be a part of the log file name?
Question349: A sysops administrator is creating two AWS Cloud Formation templates The first template will create a VPC with associated resources, such as subnets, route tables, and an internet gateway The second template will deploy application resources within the VPC that was created by the first template The second template should refer to the resources created by the first template How can this be accomplished with the LEAST amount of administrative effort?
Question350: Which of the following services is used to monitor the Amazon Web Services resources?
Question351: A user is trying to send custom metrics to CloudWatch using the PutMetricData APIs. Which of the below
mentioned points should the user needs to take care while sending the data to CloudWatch?
Question352: A company is using an Amazon ElastiCache for Redis cluster in a production environment. To align with the company's technical requirements, a SysOps administrator needs to select a deployment to provide increased availability and fault tolerance.
Which action should the SysOps administrator take to accomplish this goal?
Question353: A user has configured ELB with three instances.
The user wants to achieve High Availability as well as redundancy with ELB.
Which of the below mentioned AWS services helps the user achieve this for ELB?
Question354: A user has configured Auto Scaling with 3 instances. The user had created a new AMI after updating one
of the instances. If the user wants to terminate two specific instances to ensure that Auto Scaling
launches an instances with the new launch configuration, which command should he run?
Question355: How can you secure data at rest on an EBS volume?
Question356: What does Amazon SES provide?
Question357: A media company produces new video files on-premises every day with a total size of around 100 GBS after compression All files have a size of 1 -2 GB and need to be uploaded to Amazon S3 every night in a fixed time window between 3am and 5am Current upload takes almost 3 hours, although less than half of the available bandwidth is used.
What step(s) would ensure that the file uploads are able to complete in the allotted time window?
Question358: You have identified network throughput as a bottleneck on your m1.small EC2 instance when uploading data Into Amazon S3 In the same region.
How do you remedy this situation?
Question359: A user is checking the CloudWatch metrics from the AWS console. The user notices that the CloudWatch
data is coming in UTC. The user wants to convert the data to a local time zone. How can the user perform
this?
Question360: An organization is planning to create 5 different AWS accounts considering various security requirements.
The organization wants to use a single payee account by using the consolidated billing option. Which of
the below mentioned statements is true with respect to the above information?
Question361: A user has deployed an application on an EBS backed EC2 instance. For a better performance of application, it requires dedicated EC2 to EBS traffic. How can the user achieve this?
Question362: A user has created an application which will be hosted on EC2. The application makes calls to DynamoDB to fetch certain data. The application is using the DynamoDB SDK to connect with from the EC2 instance. Which of the below mentioned statements is true with respect to the best practice for security in this scenario?
Question363: A user has launched multiple EC2 instances for the purpose of development and testing in the same region. The user wants to find the separate cost for the production and development instances. How can the user find the cost distribution?
Question364: A sys admin is planning to subscribe to the RDS event notifications. For which of the below mentioned source categories the subscription cannot be configured?
Question365: How often is metric data is sent to CloudWatch when detailed monitoring is enabled on an Amazon EC2 instance?
Question366: A user has launched an RDS MySQL DB with the Multi AZ feature. The user has
scheduled the scaling of instance storage during maintenance window. What is the correct order of events during maintenance window?
Perform maintenance on standby Promote standby to primary Perform maintenance on original primary Promote original master back as primary
Question367: A user has created an ELB with three instances. How many security groups will ELB create by default?
Question368: A financial service company is running distributed computing software to manage a fleet of 20 servers for their calculations. There are 2 control nodes and 18 worker nodes to run the calculations. Worker nodes can be automatically started by the control nodes when required.
Currently, all nodes are running on demand, and the worker nodes are used for approximately 4 hours each day.
Which combination of actions will be MOST cost-effective? (Choose two.)
Question369: A user has configured ELB with SSL using a security policy for secure negotiation between the client and
load balancer. Which of the below mentioned SSL protocols is not supported by the security policy?
Question370: An organization is generating digital policy files which are required by the admins for verification.
Once the files are verified they may not be required in the future unless there is some compliance issue.
If the organization wants to save them in a cost effective way, which is the best possible solution?
Question371: What are characteristics of Amazon S3? Choose 2 answers
Question372: Your organization is preparing for a security assessment of your use of AWS.
In preparation for this assessment, which two IAM best practices should you consider implementing?
(Choose two.)
Question373: True or False: Amazon Route 53 provides highly available and scalable Domain Name System (DNS), domain name registration, and health-checking web services.
Question374: A user is trying to create an EBS volume with the highest PIOPS supported by EBS.
What is the minimum size of EBS required to have the maximum IOPS?
Question375: A user has configured ELB with three instances. The user wants to achieve High Availability as well as
redundancy with ELB. Which of the below mentioned AWS services helps the user achieve this for ELB?
Question376: An organization is planning to use AWS for 5 different departments. The finance department is responsible to pay for all the accounts. However, they want the cost separation for each account to map with the right cost center. How can the finance department achieve this?
Question377: A SysOps Administrator must evaluate storage solutions to replace a company's current user-shared drives infrastructure. Any solution must support security controls that enable Portable Operating System Interface (POSIX) permissions and Network File System protocols. Additionally, any solution must be accessible from multiple Amazon EC2 instances and on-premises servers connected to the Amazon VPC.
Which AWS service meets the user drive requirements?
Question378: Website users report that an application's pages are loading slowly at the beginning of the workday. The application runs on Amazon EC2 instances, and data is stored in an Amazon RDS database. The SysOps Administrator suspects the issue is related to high CPU usage on a component of this application.
How can the Administrator find out which component is causing the performance bottleneck?
Question379: A user has launched an ELB which has 5 instances registered with it. The user deletes the ELB by mistake.
What will happen to the instances?
Question380: A user has configured an Auto Scaling group with ELB. The user has enabled detailed CloudWatch monitoring on Auto Scaling. Which of the below mentioned statements will help the user understand the functionality better?
Question381: A security policy allows instances in the Production and Development accounts to write application logs to an Amazon S3 bucket belonging to the Security team's account. Only the Security team should be allowed to delete logs from the S3 bucket.
Using the "myAppRole" EC2 role, the production and development teams report that the application servers are not able to write to the S3 bucket.
Which changes need to be made to the policy to allow the application logs to be written to the S3 bucket?
Production Account: 111111111111
Dev Account: 222222222222
Security Account: 555555555555
Question382: Security groups in Amazon VPC ______.
Question383: A user has created a VPC with public and private subnets using the VPC wizard. Which of the below mentioned statements is true in this scenario?
Question384: A user has created a mobile application which makes calls to DynamoDB to fetch certain data. The application is using the DynamoDB SDK and root account access/secret access key to connect to DynamoDB from mobile. Which of the below mentioned statements is true with respect to the best practice for security in this scenario?
Question385: Which of the following requires a custom CloudWatch metric to monitor?
Question386: A SysOps Administrator has an AWS Lambda function that stops all Amazon EC2 instances in a test environment at night and on the weekend. Stopping instances causes some servers to become corrupt due to the nature of the applications running on them.
What can the SysOps Administrator use to identify these EC2 instances?
Question387: A company wants to increase the availability and durability of a critical business application. The application currently uses a MySQL database running on an Amazon EC2 instance. The company wants to minimize application changes.
How should the company meet these requirements?
Question388: Which two AWS services provide out-of-the-box user configurable automatic backup-as-aservice and backup rotation options?
Choose 2 answers
Question389: A user has created a VPC with a subnet and a security group. The user has launched an instance in that subnet and attached a public IP. The user is still unable to connect to the instance. The Internet gateway has also been created. What can be the reason for the error?
Question390: In Amazon EC2, can you create an EBS volume from a snapshot and attach it to another instance?
Question391: The IAM entity "AWS Account" is similar to:
Question392: A company website hosts patches for software that is sold globally. The website runs in AWS and performs well until a large software patch is released. The flood of downloads puts a strain on the web servers and leads to a poor customer experience.
What can the SysOps Administrator propose to enhance customer experience, create a more available web platform, and keep costs low?
Question393: A new website will run on Amazon EC2 instances behind an Application Load Balancer. Amazon Route 53 will be used to manage DNS records.
What type of record should be set in Route 53 to point the website's apex domain name (for example,
"company.com") to the Application Load Balancer?
Question394: A sys admin is using server side encryption with AWS S3. Which of the below mentioned statements
helps the user understand the S3 encryption functionality?
Question395: A SysOps Administration team is supporting an applications that stores a configuration file in an Amazon S3 bucket Previous revisions of the configuration file must be maintained for change control and rollback How should the S3 bucket be configured to meet these requirements?
Question396: A SysOps Administrator is building a process for sharing Amazon RDS database snapshots between different
accounts associated with different business units with the same company. All data must be encrypted at rest.
How should the Administrator implement this process?
Question397: A group in IAM can contain many users. Can a user belong to multiple groups?
Question398: A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB?
Question399: A SysOps Administrator is notified that a security vulnerability affects a version of MySQL that is being used
with Amazon RDS MySQL.
Who is responsible for ensuring that the patch is applied to the MySQL cluster?
Question400: A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB?
Question401: An organization has setup Auto Scaling with ELB. Due to some manual error, one of the instances got rebooted. Thus, it failed the Auto Scaling health check. Auto Scaling has marked it for replacement. How can the system admin ensure that the instance does not get terminated?
Question402: An organization has created one IAM user and applied the below mentioned policy to the user. What entitlements do the IAM users avail with this policy?
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
{
"Effect": "Allow"
"Action": [
"cloudwatch:ListMetrics",
"cloudwatch:GetMetricStatistics",
"cloudwatch:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "autoscaling:Describe*",
"Resource": "*"
}
]
}
Question403: A user has launched an EBS backed EC2 instance in the US-East-1a region. The user stopped the instance and started it back after 20 days. AWS throws up an 'InsufficientInstanceCapacity' error. What can be the possible reason for this?
Question404: A user has launched an EC2 instance. The user is planning to setup the CloudWatch alarm. Which of the below mentioned actions is not supported by the CloudWatch alarm?
Question405: You have set up Individual AWS accounts for each project. You have been asked to make sure your AWS Infrastructure costs do not exceed the budget set per project for each month.
Which of the following approaches can help ensure that you do not exceed the budget each month?
Question406: A user has created an application which will be hosted on EC2. The application makes
calls to DynamoDB to fetch certain data. The application is using the DynamoDB SDK to connect with from the EC2 instance. Which of the below mentioned statements is true with respect to the best practice for security in this scenario?
Question407: A SysOps Administrator is running Amazon EC2 instances in multiple AWS Regions. The Administrator wants to aggregate the CPU utilization for all instances onto an Amazon CloudWatch dashboard. Each region should be present on the dashboard and represented by a single graph that contains the CPU utilization for all instances in that region.
How can the Administrator meet these requirements?
Question408: What are characteristics of Amazon S3? (Choose two.)
Question409: An ecommerce site is using Amazon ElastiCache with Memcached to store session state for a web application and to cache frequently used data. For the last month, users have been complaining about performance. The metric data for the Amazon EC2 instances and the Amazon RDS instance appear normal, but the eviction count metrics are high.
What should be done to address this issue and improve performance?
Question410: A SysOps Administrator must take a team's single existing AWS CloudFormation template and split it into smaller, service-specific templates. All of the services in the template reference a single, shared Amazon S3 bucket.
What should the Administrator do to ensure that this S3 bucket can be referenced by all the service templates?
Question411: A SysOps Administrator is reviewing AWS Trusted Advisor warnings and encounters a warning for an S3 bucket policy that has open access permissions. While discussing the issue the bucket owner, the Administrator realizes the S3 bucket is an origin for an Amazon CloudFront web distribution.
Which action should the Administrator take to ensure that users access objects in Amazon S3 by using only CloudFront URLs?
Question412: A user has configured Auto Scaling with 3 instances. The user had created a new AMI after updating one
of the instances. If the user wants to terminate two specific instances to ensure that Auto Scaling
launches an instances with the new launch configuration, which command should he run?
Question413: A user has created a VPC with public and private subnets using the VPC Wizard. The VPC has CIDR
20.0.0.0/16. The private subnet uses CIDR 20.0.0.0/24. Which of the below mentioned entries are required in the main route table to allow the instances in VPC to communicate with each other?
Question414: A user wants to disable connection draining on an existing ELB.
Which of the below mentioned statements helps the user disable connection draining on the ELB?
Question415: A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted.
What is the SIMPLEST approach the SysOps administrator can take to ensure S3 buckets in those accounts can never be deleted?
Question416: A user is publishing custom metrics to CloudWatch. Which of the below mentioned statements will help the user understand the functionality better?
Question417: An organization has configured the custom metric upload with CloudWatch. The organization has given permission to its employees to upload data using CLI as well SDK. How can the user track the calls made to CloudWatch?
Question418: During a security investigation, it is determined that there is a coordinated attack on the web applications deployed on Amazon EC2. The attack is performed through malformed HTTP headers.
What AWS service of feature would prevent this traffic from reaching the EC2 instances?
Question419: A user has created a VPC with the public and private subnets using the VPC wizard.
The VPC has CIDR 20.0.0.0/16.
The public subnet uses CIDR 20.0.1.0/24.
The user is planning to host a web server in the public subnet (port 80. and a DB server in the private subnet (port 3306..
The user is configuring a security group for the public subnet (WebSecGrp. and the private subnet (DBSecGrp..
Which of the below mentioned entries is required in the web server security group (WebSecGrp.?
Question420: An instance has enabled basic monitoring only for CloudWatch. What is the minimum time period available for basic monitoring?
Question421: You have been asked to automate many routine systems administrator backup and recovery activities.
Your current plan is to leverage AWS-managed solutions as much as possible and automate the rest with the AWS CU and scripts.
Which task would be best accomplished with a script?
Question422: A user has enabled detailed CloudWatch metric monitoring on an Auto Scaling group. Which of the below
mentioned metrics will help the user identify the total number of instances in an Auto Scaling group cluding pending, terminating and running instances?
Question423: A company is managing a website with a global user base hosted on Amazon EC2 with an Application Load Balancer (ALB). To reduce the load on the web servers, a SysOps administrator configures an Amazon CloudFront distribution with the ALB as the origin. After a week of monitoring the solution, the administrator notices that requests are still being served by the ALB and there is no change in the web server load.
What are possible causes for this problem? (Choose two.)
Question424: An Auto Scaling group scales up and down based on Average CPU Utilization. The alarm is set to trigger a scaling event when the Average CPU Utilization exceeds 80% for 5 minutes.
Currently, the Average CPU has been 95% for over two hours and new instances are not being added.
What could be the issue?
Question425: A user has setup Auto Scaling with ELB on the EC2 instances.
The user wants to configure that whenever the CPU utilization is below 10%, Auto Scaling should remove one instance.
How can the user configure this?
Question426: An Amazon EBS volume attached to an EC2 instance was recently modified. Part of the modification included increasing the storage capacity. The SysOps Administrator notices that the increased storage capacity is not reflected in the file system.
Which step should the Administrator complete to use the increased storage capacity?
Question427: An Amazon EC2 instance is unable to connect an SMTP server in a different subnet. Other instances are successfully communicating with the SMTP server, however VPC Flow Logs have been enabled on the SMTP server's network interface and show the following information:
2 223342798652 eni-abe77dab 10.1.1.200 10.100.1.10 1123 25 17 70 48252 1515534437 1515535037 REJECT OK What can be done to correct this problem?
Question428: A large company has multiple AWS accounts that are assigned to each department. A SysOps administrator needs to help the company reduce overhead and manage its AWS resources more easily. The SysOps administrator also must ensure that department users, including AWS account root users, have access only to AWS services that are essential for their job function.
Which solution will meet these requirements?
Question429: A user has created a VPC with public and private subnets using the VPC wizard. Which of the below mentioned statements is not true in this scenario?
Question430: A company has multiple web applications running on Amazon EC2 instances in private subnets. The EC2 instances require connectivity to the internet for patching purposes, but cannot be publicly accessible.
Which step will meet these requirements?
Question431: Each SysOps Administrator al a company has a unique 1AM user account Each user is a member of the SysOps 1AM group that has an 1AM policy applied A recent change to the IT security policy states that employees must now use their on-premises Active Directory user accounts to access the AWS Management Console Which solution should be used to satisfy these requirements?
Question432: When an EC2 EBS-backed (EBS root) instance is stopped, what happens to the data on any ephemeral store volumes?
Question433: What does Amazon EBS stand for?
Question434: A user has configured ELB with Auto Scaling. The user temporarily suspended the Auto Scaling terminate process. What might the Availability Zone Rebalancing process (AZRebalance) conse-quently cause during this period?
Question435: How can an EBS volume that is currently attached to an EC2 instance be migrated from one Availability Zone to another?
Question436: A user is planning to setup notifications on the RDS DB for a snapshot. Which of the below mentioned
event categories is not supported by RDS for this snapshot source type?
Question437: According to the shared responsibility model, for which of the following Amazon EC2 activities is AWS responsible? (Choose two.)
Question438: An organization with large IT department has decided to migrate to AWS. With different job functions in the IT department, it is desirable to give all users access to all AWS resources. Currently the organization handles access via LDAP group membership.
What is the BEST method to allow access using current LDAP credentials?
Question439: A sysops administrator is managing an application on AWS that uses Amazon EC2 instances and Amazon Aurora MySQL. The EC2 instances and Aurora instances are in two different subnets. The application servers running in EC2 cannot connect to the Aurora database.
The EC2 subnet is 192.168.87.0/24 and has a security group named sg-123456 with the following configuration.
The Aurora subnet is 192.168.88.0/24 and has a security group named sg-abcdef with the following configuration.
Which action should the sysops administrator take to allow the EC2 instances to connect to the Aurora database?
Question440: An Applications team has successfully deployed an AWS CloudFormation stack consisting of 30 t2-medium Amazon EC2 instances in the us-west-2 Region. When using the same template to launch a stack in us-east-
2, the launch failed and rolled back after launching only 10 EC2 instances.
What is a possible cause of this failure?
Question441: A root AWS account owner is trying to understand various options to set the permission to AWS S3. Which of the below mentioned options is not the right option to grant permission for S3?
Question442: A Security team is concerned about the potential of intellectual property leaking to the internet. A SysOps
Administrator is tasked with identifying controls to address the potential problem. The servers in question
reside in a VPC and cannot be allowed to send traffic to the internet.
How can these requirements be met?
Question443: Which two AWS services provide out-of-the-box user configurable automatic backup-as-a-service and backup
rotation options? (Choose two.)
Question444: The majority of your Infrastructure is on premises and you have a small footprint on AWS Your company has decided to roll out a new application that is heavily dependent on low latency connectivity to LOAP for authentication Your security policy requires minimal changes to the company's existing application user management processes.
What option would you implement to successfully launch this application1?
Question445: A company's static website hosted on Amazon S3 was launched recently, and is being used by tens of thousands of users. Subsequently, website users are experiencing 503 service unavailable errors.
Why are these errors occurring?
Question446: A user had aggregated the CloudWatch metric data on the AMI ID. The user observed some abnormal
behavior of the CPU utilization metric while viewing the last 2 weeks of data. The user wants to share that data
with his manager. How can the user achieve this easily with the AWS console?
Question447: In the 'Detailed' monitoring data available for your Amazon EBS volumes, Provisioned IOPS volumes automatically send _____ minute metrics to Amazon CloudWatch.
Question448: A sysops administrator is creating two AWS Cloud Formation templates The first template will create a VPC with associated resources, such as subnets, route tables, and an internet gateway The second template will deploy application resources within the VPC that was created by the first template The second template should refer to the resources created by the first template How can this be accomplished with the LEAST amount of administrative effort?
Question449: A system admin is planning to setup event notifications on RDS. Which of the below mentioned services will help the admin setup notifications?
Question450: Which of the following services is used to monitor the Amazon Web Services resources?
Question451: The CFO of a company wants to allow one of his employees to view only the AWS usage report page. Which of the below mentioned IAM policy statements allows the user to have access to the AWS usage report page?
Question452: What does Amazon Route53 provide?
Question453: Which two AWS services provide out-of-the-box user configurable automatic backup-as-a-service and backup
rotation options? (Choose two.)
Question454: A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. Which of the below mentioned security policies is supported by ELB?
Question455: A web application runs on Amazon EC2 instances behind an ELB Application Load Balancer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones. Amazon Route 53 is used for DNS and points to the load balancer. A SysOps Administrator has launched a new Auto Scaling group with a new version of the application, and wants to gradually shift traffic to the new version.
How can this be accomplished?
Question456: A user is planning to schedule a backup for an EBS volume. The user wants security of the snapshot data.
How can the user achieve data encryption with a snapshot?
Question457: A user has created numerous EBS volumes. What is the general limit for each AWS account for the maximum number of EBS volumes that can be created?
Question458: By default, how many Elastic IP addresses can you have per region for your EC2 instances?
Question459: A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB?
Question460: An organization has setup multiple IAM users. The organization wants that each IAM user accesses the IAM console only within the organization and not from outside. How can it achieve this?
Question461: An organization has configured a VPC with an Internet Gateway (IGW). pairs of public and private
subnets (each with one subnet per Availability Zone), and an Elastic Load Balancer (ELB) configured to
use the public subnets The application s web tier leverages the ELB.
Auto Scaling and a mum-AZ RDS database instance The organization would like to eliminate any
potential single points ft failure in this design.
What step should you take to achieve this organization's objective?
Question462: When attached to an Amazon VPC, which two components provide connectivity with external networks?
(Choose two.)
Question463: In IAM, a policy has to include the information about who (user) is allowed to access the resource, known as the _____.
Question464: A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB?
Question465: A user has launched an RDS MySQL DB with the Multi AZ feature. The user has scheduled the scaling of instance storage during maintenance window. What is the correct order of events during maintenance window?
Perform maintenance on standby
Promote standby to primary
Perform maintenance on original primary
Promote original master back as primary
Question466: What is a "vault" in Amazon Glacier?
Question467: A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group across multiple Availability Zones. A SysOps administrator notices that some of these EC2 instances show up as healthy in the Auto Scaling group but show up as unhealthy in the ALB target group.
What is a possible reason for this issue?
Question468: A user is using Cloudformation to launch an EC2 instance and then configure an application after the
instance is launched. The user wants the stack creation of ELB and AutoScaling to wait until the EC2
instance is launched and configured properly. How can the user configure this?
Question469: A user has enabled detailed CloudWatch metric monitoring on an Auto Scaling group. Which of the below
mentioned metrics will help the user identify the total number of instances in an Auto Scaling group
including pending, terminating and running instances.
Question470: A new Amazon Redshift Spectrum Cluster has been launched for a team of Business Analysis. When the team attempts to use the cluster to query the data in Amazon S3, they receive the following error:
What is one cause of this?
Question471: A user has stored data on an encrypted EBS volume. The user wants to share the data with his friend's
AWS account. How can user achieve this?
Question472: A SysOps Administrator management a fleet of instance store-backed Amazon Linux EC2 instances. The SSH key used to access these instances has been lost.
How can SSH access be restored?
Question473: A user has enabled detailed CloudWatch monitoring with the AWS Simple Notification Service. Which of the below mentioned statements helps the user understand detailed monitoring better?
Question474: An instance has enabled basic monitoring only for CloudWatch. What is the minimum time period available for basic monitoring?
Question475: Which of the following is an incorrect statement about Amazon CloudWatch?
Question476: An organization (account ID 123412341234. has configured the IAM policy to allow the user to modify his credentials.
What will the below mentioned statement allow the user to perform?
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"iam:AddUserToGroup",
"iam:RemoveUserFromGroup",
"iam:GetGroup"
],
"Resource": "arn:aws:iam:: 123412341234:group/TestingGroup"
}]
Question477: A company three-tier web application is not performing as well as expected. A manager has asked a System Administrator to analyser all the system involved and identity where the performance bottleneck exist.
Which AWS service can be help find bottleneck?
Question478: A sysops administrator must generate a report that provides a breakdown of all API activity by a specific user over the course of a year. AWS CloudTrail has already been enabled.
How should this report be generated?
Question479: A SysOps Administrator needs Amazon EC2 instances in two different VPCs in private subnets to be able to communicate. A peering connection between the two VPCs has been created using the AWS Management Console and shows a status of Active. The instances are still unable to send traffic to each other.
Why are the EC2 instances unable to communicate?
Question480: Elasticity is one of the benefits of using Elastic Beanstalk. Which of the following best describes the concept of elasticity?
Question481: AWS KMS (Key Management Service) uses symmetric key cryptography to perform encryption and decryption. Symmetric key cryptography uses the same algorithm and key to both encrypt and decrypt digital data. The unencrypted data is typically called plaintext whether it is text or not, and the encrypted data is typically called _____.
Question482: A company needs to migrate an on-premises asymmetric key management system into AWS.
Which AWS service should be used to accomplish this?
Question483: A user is trying to create an EBS volume with the highest PIOPS supported by EBS. What is the minimum size of EBS required to have the maximum IOPS?
Question484: A user is displaying the CPU utilization, and Network in and Network out CloudWatch metrics data of a single
instance on the same graph. The graph uses one Y-axis for CPU utilization and Network in and another Y-axis
for Network out. Since Network in is too high, the CPU utilization data is not visible clearly on graph to the user.
How can the data be viewed better on the same graph?
Question485: A SysOps Administrator is troubleshooting Amazon EC2 connectivity issues to the internet. The EC2 instance is in a private subnet. Below is the route table that is applied to the subnet of the EC2 instance.
Destination - 10.2.0.0/16
Target - local
Status - Active
Propagated - No
Destination - 0.0.0.0/0
Target - nat-xxxxxxx
Status - Blackhole
Propagated - No
What has caused the connectivity issue?
Question486: An Amazon S3 bucket in a SysOps Administrator's account can be accesses by users in other SWS accounts.
How can the Administrator ensure that the bucket is only accessible to members of the Administrator's AWS account?
Question487: A syslog Administrator is created additional Amazon EC2 instances and receive an Instancelimitexceeded error.
What is the cause of the issue and how can it be resolve?
Question488: A user wants to disable connection draining on an existing ELB. Which of the below mentioned statements helps the user disable connection draining on the ELB?
Question489: How can an EBS volume that is currently attached to an EC2 instance be migrated from one Availability Zone to another?
Question490: A user has launched 10 instances from the same AMI ID using Auto Scaling.
The user is trying to see the average CPU utilization across all instances of the last 2 weeks under the CloudWatch console.
How can the user achieve this?
Question491: When you put objects in Amazon S3, what is the indication that an object was successfully stored?
Question492: A company has an AWS account for each department and wants to consolidate billing and reduce overhead.
The company wants to make sure that the finance team is denied from accessing services other than Amazon EC2: the security team is denied from accessing services other than AWS CloudTrail. and IT can access any resource.
Which solution meets these requirements with the LEAST amount of operational overhead''
Question493: A SysOps Administrator must take a team's single existing AWS CloudFormation template and split it into smaller, service-specific templates. All of the services in the template reference a single, shared Amazon S3 bucket.
What should the Administrator do to ensure that this S3 bucket can be referenced by all the service templates?
Question494: A user accidentally deleted a file from an Amazon EBS volume. The SysOps Administrator identified a recent snapshot for the volume.
What should the Administrator do to restore the user's file from the snapshot?
Question495: A user has configured Auto Scaling with 3 instances. The user had created a new AMI after updating one of the instances. If the user wants to terminate two specific instances to ensure that Auto Scaling launches an instances with the new launch configuration, which command should he run?
Question496: The Statement element, of an AWS IAM policy, contains an array of individual statements. Each individual statement is a(n) ______ block enclosed in braces { }.
Question497: A company stores thousands of non-critical log files in an Amazon S3 bucket. A set of reporting scripts retrieve these log files daily.
Which of the following storage options will be the MOST cost-efficient for the company's use case?
Question498: AWS IAM permissions can be assigned in two ways:
Question499: Where is an object stored in Amazon S3?
Question500: A user has created a VPC with public and private subnets using the VPC wizard. Which of the below mentioned statements is not true in this scenario?
Question501: A user has created a CloudFormation stack. The stack creates AWS services, such as EC2 instances,
ELB, AutoScaling, and RDS. While creating the stack it created EC2, ELB and AutoScaling but failed to
create RDS. What will CloudFormation do in this scenario?
Question502: A SysOps Administrator is managing a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2 Auto Scaling group. The administrator wants to set an alarm for when all target instances associated with the ALB are unhealthy.
Which condition should be used with the alarm?
Question503: An organization has added 3 of his AWS accounts to consolidated billing.
One of the AWS accounts has purchased a Reserved Instance (RI. of a small instance size in the US-East-1a zone.
All other AWS accounts are running instances of a small size in the same zone.
What will happen in this case for the RI pricing?
Question504: What does Amazon S3 stand for?
Question505: A Syslog Administrator is troubleshooting an Amazon EC2 server and discovers a bottleneck in reading and writing data to the attached Amazon EBS block storage volume. The instance is a larger and the EBS is io1 with 1,000 IOPS provisioned initially, the Administrator increase the provisioned IOPS to 2,000, but performance does not improve.
What should the Administrator do next?
Question506: A user has created a VPC with the public subnet. The user has created a security group for that VPC. Which of the below mentioned statements is true when a security group is created?
Question507: A SysOps Administrator is receiving multiple reports from customers that they are unable to connect to the company's website. which is being served through Amazon CloudFront. Customers are receiving HTTP response codes for both 4XX and 5XX errors.
Which metric can the Administrator use to monitor the elevated error rates in CloudFront?
Question508: An organization has configured a VPC with an Internet Gateway (IGW). pairs of public and private subnets (each with one subnet per Availability Zone), and an Elastic Load Balancer (ELB) configured to use the public subnets. The application s web tier leverages the ELB. Auto Scaling and a mum-AZ RDS database instance The organization would like to eliminate any potential single points ft failure in this design.
What step should you take to achieve this organization's objective?
Question509: A user has created an ELB with the availability zone US-East-1.
The user wants to add more zones to ELB to achieve High Availability. How can the user add more zones to the existing ELB?
Question510: Which service is offered by Auto Scaling?
Question511: A user is using the AWS SQS to decouple the services. Which of the below mentioned operations is not supported by SQS?
Question512: An organization has created one IAM user and applied the below mentioned policy to the user. What entitlements do the IAM users avail with this policy?
Question513: A user is launching an EC2 instance in the US East region. Which of the below mentioned options is
recommended by AWS with respect to the selection of the availability zone?
Question514: A sysops administrator created an AWS Lambda function within a VPC with no access to the Internet. The Lambda function pulls messages from an Amazon SQS queue and stores them in an Amazon RDS instance in the same VPC. After executing the Lambda function, the data is not showing up on the RDS instance.
Which of the following are possible causes for this? (Choose two.)
Question515: What does enabling a sticky session with ELB do?
Question516: A user is planning to evaluate AWS for their internal use. The user does not want to incur any charge on his
account during the evaluation. Which of the below mentioned AWS services would incur a charge if used?
Question517: A website uses Elastic Load Balancing (ELB) in front of several Amazon EC2 instances backed by an Amazon RDS database. The content served is dynamically generated for visitors of a website based on the geographic location, and a updated daily.
Some of the generated objects are large in size and are longer to download than they should, resulting in a poor user experience.
Which approach will improve the user experience?
Question518: A sys admin has created the below mentioned policy and applied to an S3 object named aws.jpg. The aws.jpg is inside a bucket named cloudacademy. What does this policy define?
"Statement": [{
"Sid": "Stmt1388811069831",
"Effect": "Allow",
"Principal": { "AWS": "*"},
"Action": [ "s3:GetObjectAcl", "s3:ListBucket", "s3:GetObject"],
"Resource": [ "arn:aws:s3:::cloudacademy/*.jpg"]
}]
Question519: A security policy allows instances in the Production and Development accounts to write application logs to an Amazon S3 bucket belonging to the Security team's account. Only the Security team should be allowed to delete logs from the S3 bucket.
Using the "myAppRole" EC2 role, the production and development teams report that the application servers are not able to write to the S3 bucket.
Which changes need to be made to the policy to allow the application logs to be written to the S3 bucket?
Production Account: 111111111111
Dev Account: 222222222222
Security Account: 555555555555
Question520: A user has created a public subnet with VPC and launched an EC2 instance within it.
The user is trying to delete the subnet.
What will happen in this scenario?
Question521: Can you use CloudWatch to monitor memory and disk utilization usage for your Amazon EC2 Linux instances?
Question522: A user is trying to save some cost on the AWS services.
Which of the below mentioned options will not help him save cost?
Question523: As part of a federated identity configuration, an IAM policy is created and attached to an IAM role.
Who is responsible for creating the IAM policy and attaching it to the IAM role, according to the shared responsibility model?
Question524: A user is launching an EC2 instance in the US East region. Which of the below mentioned options is recommended by AWS with respect to the selection of the availability zone?
Question525: An application is being migrated to AWS with the requirement that archived data be retained for at least 7 years.
What Amazon Glacier configuration option should be used to meet this compliance requirement?
Question526: A SysOps Administrator noticed that the cache hit ratio for an Amazon CloudFront distribution is less than 10%. Which collection of configuration changes will increase the cache hit ratio for the distribution? (Select two.)
Question527: A sys admin has created a shopping cart application and hosted it on EC2. The EC2 instances are
running behind ELB. The admin wants to ensure that the end user request will always go to the EC2
instance where the user session has been created. How can the admin configure this?
Question528: An application running on Amazon EC2 needs login credentials to access a database. The login credentials are stored in AWS Systems Manager Parameter Store as secure string parameters.
What is the MOST secure way to grant the application access to the credentials?
Question529: An organization has created 5 IAM users.
The organization wants to give them the same login ID but different passwords.
How can the organization achieve this?
Question530: A user is trying to create a PIOPS EBS volume with 4000 IOPS and 100 GB size. AWS does not allow the user to create this volume. What is the possible root cause for this?
Question531: A SysOps administrator is creating two AWS CloudFormation templates. The first template will create a VPC with associated resources, such as subnets, route tables, and an internet gateway. The second template will deploy application resources within the VPC that was created by the first template. The second template should refer to the resources created by the first template.
How can this be accomplished with the LEAST amount of administrative effort?
Question532: You have identified network throughput as a bottleneck on your m1.small EC2 instance when uploading data Into Amazon S3 In the same region.
How do you remedy this situation?
Question533: A user has received a message from the support team that an issue occurred 1 week back between 3 AM to 4 AM and the EC2 server was not reachable. The user is checking the CloudWatch metrics of that instance. How can the user find the data easily using the CloudWatch console?
Question534: You use S3 to store critical data for your company Several users within your group currently have lull permissions to your S3 buckets You need to come up with a solution mat does not impact your users and also protect against the accidental deletion of objects.
Which two options will address this issue? Choose 2 answers
Question535: A company has an application database on Amazon RDS that runs a resource-intensive reporting job. This is causing other applications using the database to run slowly.
What should the SysOps Administrator do to resolve this issue?
Question536: A user is trying to pre-warm a blank EBS volume attached to a Linux instance. Which of the below
mentioned steps should be performed by the user?
Question537: An organization stores sensitive customer in S3 buckets protected by bucket policies. recently, there have been reports that unauthorized entities within the company have been trying to access the data on those S3 buckets. The Chief Information Security Officer (CISO) would like to know which buckets are being targeted and determine who is responsible for trying to access that information.
Which steps should a SysOps Administrator take to meet the CISO's requirement? (Choose two.)
Question538: A user is having data generated randomly based on a certain event.
The user wants to upload that data to CloudWatch.
It may happen that event may not have data generated for some period due to andomness.
Which of the below mentioned options is a recommended option for this case?
Question539: An organization has configured the custom metric upload with CloudWatch. The organization has given permission to its employees to upload data using CLI as well SDK. How can the user track the calls made to CloudWatch?
Question540: A user is planning to evaluate AWS for their internal use.
The user does not want to incur any charge on his account during the evaluation.
Which of the below mentioned AWS services would incur a charge if used?
Question541: A user wants to upload a complete folder to AWS S3 using the S3 Management console. How can the user perform this activity?
Question542: An organization has two AWS accounts: Development and Production. A SysOps Administrator manages access of IAM users to both accounts. Some IAM users in Development should have access to certain resources in Production.
How can this be accomplished?
Question543: A user has configured a VPC with a new subnet.
The user has created a security group.
The user wants to configure that instances of the same subnet communicate with each other.
How can the user configure this with the security group?
Question544: An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants a particular group of IAM users to access only the test instances and not the production ones. They want to deploy the instances in various locations based on the factors that will change from time to time, especially in the test group. They expect instances will often need to be churned, i.e. deleted and replaced, especially in the testing group. This means the five instances they have created now will soon be replaced by a different set of five instances. The members of each group, production and testing, will not change in the foreseeable future.
Given the situation, what choice below is the most efficient and time-saving strategy to define the IAM policy?
Question545: A user is trying to save some cost on the AWS services. Which of the below mentioned options will not help him save cost?
Question546: A user has created a VPC with public and private subnets using the VPC wizard. Which of the below
mentioned statements is not true in this scenario?
Question547: An organization has been using AWS for a few months. The finance team wants to visualize the pattern of
AWS spending. Which of the below AWS tools will help for this requirement?
Question548: Your organization is preparing for a security assessment of your use of AWS.
In preparation for this assessment, which two IAM best practices should you consider implementing? (Choose two.)
Question549: The compliance department within your multi-national organization requires that all data for your customers that reside in the European Union (EU) must not leave the EU and also data for customers that reside in the US must not leave the US without explicit authorization.
What must you do to comply with this requirement for a web based profile management application running on EC2?
Question550: A company has a multi-account AWS environment that includes the following:
A central identity account that contains all IAM users and groups
Several member accounts that contain IAM roles
A SysOp administrator must grant permissions for a particular IAM group to assume o role in one of the member accounts How should the SysOps administrator accomplish this task?
Question551: An errant process is known to use in an entire processor and run at 100%. A SysOps Administrator wants to automate restarting the instance once the problem occurs for more than minutes.
How can this be accomplished?
Question552: A company has attached the following policy to an IAM user.
What of the following actions are allowed for the IAM user?
Question553: You have a web-style application with a stateless but CPU and memory-intensive web tier running on a cc2 8xlarge EC2 instance inside of a VPC The instance when under load is having problems returning requests within the SLA as defined by your business The application maintains its state in a DynamoDB table, but the data tier is properly provisioned and responses are consistently fast.
How can you best resolve the issue of the application responses not meeting your SLA?
Question554: You have a web application leveraging an Elastic Load Balancer (ELB).
In front of the web servers deployed using an Auto Scaling Group.
Your database is running on Relational Database Service (RDS).
The application serves out technical articles and responses to them in general there are more views of an article than there are responses to the article.
On occasion, an article on the site becomes extremely popular resulting in significant traffic Increases that causes the site to go down.
What could you do to help alleviate the pressure on the infrastructure while maintaining availability during these events? (Choose three)
Question555: A sys admin has created the below mentioned policy and applied to an S3 object named aws.jpg. The aws.jpg is inside a bucket named cloudacademy. What does this policy define?
Question556: An organization's security policy requires multiple copies of all critical data to be replicated across at least a primary and backup data center. The organization has decided to store some critical data on Amazon S3.
Which option should you implement to ensure this requirement is met?
Question557: A user has created a VPC with CIDR 20.0.0.0/16 with only a private subnet and VPN connection using the
VPC wizard. The user wants to connect to the instance in a private subnet over SSH. How should the user
define the security rule for SSH?
Question558: How can an EBS volume that is currently attached to an EC2 instance be migrated from one Availability Zone to another?
Question559: A route table in VPC can be associated with multiple subnets. However, a subnet can be associated with only ______ route table(s) at a time.
Question560: A user has configured ELB with two EBS backed instances. The user has stopped the instances for 1 week to save costs. The user restarts the instances after 1 week. Which of the below mentioned statements will help the user to understand the ELB and instance registration better?
Question561: Which two AWS services provide out-of-the-box user configurable automatic backup-as-a-service and backup
rotation options? (Choose two.)
Question562: A financial service company is running distributed computing software to manage a fleet of 20 servers for their calculations. There are 2 control nodes and 18 worker nodes to run the calculations. Worker nodes can be automatically started by the control nodes when required.
Currently, all nodes are running on demand, and the worker nodes are used for approximately 4 hours each day.
Which combination of actions will be MOST cost-effective? (Choose two.)
Question563: A user has stored data on an encrypted EBS volume. The user wants to share the data with his friend's AWS
account. How can user achieve this?
Question564: A company must share monthly report files that are uploaded to Amazon S3 with a third party. The third-party
user list is dynamic, is distributed, and changes frequently. The least amount of access must be granted to the
third party. Administrative overhead must be low for the internal teams who manage the process.
How can this be accomplished while providing the LEAST amount of access to the third party?
Question565: What does AMI stand for?
Question566: A SysOps Administrator created an AWS CloudFormation template for the first time. The stack failed with a status of ROLLBACK_COMPLETE. The Administrator identified and resolved the template issue causing the failure.
How should the Administrator continue with the stack deployment?
Question567: A user has launched 5 instances in EC2-CLASSIC and attached 5 elastic IPs to the five different instances in the US East region. The user is creating a VPC in the same region. The user wants to assign an elastic IP to the VPC instance. How can the user achieve this?
Question568: Your entire AWS infrastructure lives inside of one Amazon VPC You have an Infrastructure monitoring application running on an Amazon instance in Availability Zone (AZ) A of the region, and another application instance running in AZ B.
The monitoring application needs to make use of ICMP ping to confirm network reachability of the instance hosting the application.
Can you configure the security groups for these instances to only allow the ICMP ping to pass from the monitoring instance to the application instance and nothing else'' If so how?
Question569: A company has attached the following policy to an IAM user.
What of the following actions are allowed for the IAM user?
Question570: A company has several accounts between different teams and wants to increase its auditing and compliance capabilities. The accounts are managed through AWS Organizations. Management wants to provide the security team with secure access to the account logs while also restricting the possibility for the logs to be modified.
How can a SysOps administrator achieve this is with the LEAST amount of operational overhead?
Question571: An organization has created 10 IAM users. The organization wants each of the IAM users to have access to a separate DyanmoDB table. All the users are added to the same group and the organization wants to setup a group level policy for this. How can the organization achieve this?
Question572: An organization (account ID 123412341234) has configured the IAM policy to allow the user to modify his
credentials. What will the below mentioned statement allow the user to perform?
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"iam:AddUserToGroup",
"iam:RemoveUserFromGroup",
"iam:GetGroup"
],
"Resource": "arn:aws:iam:: 123412341234:group/TestingGroup"
}]
Question573: Which services allow the customer to retain full administrative privileges of the underlying EC2 instances?
Choose 2 answers
Question574: You are tasked with the migration of a highly trafficked Node JS application to AWS in order to comply with organizational standards Chef recipes must be used to configure the application servers that host this application and to support application lifecycle events.
Which deployment option meets these requirements while minimizing administrative burden?
Question575: A financial service company is running distributed computing software to manage a fleet of 20 servers for their calculations. There are 2 control nodes and 18 worker nodes to run the calculations. Worker nodes can be automatically started by the control nodes when required.
Currently, all nodes are running on demand, and the worker nodes are used for approximately 4 hours each day.
Which combination of actions will be MOST cost-effective? (Choose two.)
Question576: An organization wants to move to Cloud. They are looking for a secure encrypted database storage option.
Which of the below mentioned AWS functionalities helps them to achieve this?
Question577: An organization is planning to use AWS for their production roll out. The organization wants to implement automation for deployment such that it will automatically create a LAMP stack, download the latest PHP installable from S3 and setup the ELB. Which of the below mentioned AWS services meets the requirement for making an orderly deployment of the software?
Question578: What is a placement group?
Question579: A user has setup a VPC with CIDR 20.0.0.0/16.
The VPC has a private subnet (20.0.1.0/24. and a public subnet (20.0.0.0/24..
The user's data centre has CIDR of 20.0.54.0/24 and 20.1.0.0/24.
If the private subnet wants to communicate with the data centre, what will happen?
Question580: An organization has created 5 IAM users. The organization wants to give them the same login ID but different passwords. How can the organization achieve this?
Question581: A user is planning to schedule a backup for an existing EBS volume. The user wants the backup to be created through snapshot, and for it to be encrypted. How can the user achieve data encryption with a snapshot?
Question582: You have a server with a 5O0GB Amazon EBS data volume. The volume is 80% full. You need to back up the volume at regular intervals and be able to re-create the volume in a new Availability Zone in the shortest time possible. All applications using the volume can be paused for a period of a few minutes with no discernible user impact.
Which of the following backup methods will best fulfill your requirements?
Question583: Which two AWS services provide out-of-the-box user configurable automatic backup-as-a-service and backup
rotation options? (Choose two.)
Question584: A user has enabled session stickiness with ELB. The user does not want ELB to manage the cookie; instead he wants the application to manage the cookie. What will happen when the server instance, which is bound to a cookie, crashes?
Question585: A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB?
Question586: A company has mandated the use of multi-factor authentication (MFA) for all IAM users, and requires users to make all API-calls using the CLI. However, users are not prompted to enter MFA tokens, and are able to run CLI commands without MFA. In an attempt to enforce MFA, the company attached an IAM policy to all users that denies API calls that have not been authenticated with MFA.
What additional step must be taken to ensure that API calls are authenticated using MFA?
Question587: A user is using the AWS SQS to decouple the services. Which of the below mentioned operations is not
supported by SQS?
Question588: N NO: 648
A company wants to ensure that each department operates within their own isolated environment, and they are only able to use pre-approved services.
How can this requirement be met?
Question589: Which of the following statements is true of IAM?
Question590: You have established a virtual private cloud (VPC) peering relationship between VPC 1 and VPC
2. VPC 1 has routes to VPC 2, yet hosts in VPC 1 cannot connect to hosts in VPC 2.
Which of the following is possible cause?
Question591: Two companies will be working on several development projects together. Each company has an AWS
account with a single VPC in us-east-1. Two companies would like to access one another's development
servers. The IPv4 CIDR blocks in the two VPCs does not overlap.
What can the SysOps Administrators for each company do to set up network routing?
Question592: You are using ElastiCache Memcached to store session state and cache database queries in your infrastructure. You notice in CloudWatch that Evictions and GetMisses are Doth very high.
What two actions could you take to rectify this? (Choose two.)
Question593: Your organization's security policy requires that all privileged users either use frequently rotated passwords or one-time access credentials in addition to username/password.
Which two of the following options would allow an organization to enforce this policy for AWS users?
Choose 2 answers
Question594: A user is trying to create an EBS volume with the highest PIOPS supported by EBS. What is the minimum size
of EBS required to have the maximum IOPS?
Question595: A sys admin has created the below mentioned policy and applied to an S3 object named aws.jpg. The aws.jpg is inside a bucket named cloudacademy. What does this policy define?
Question596: A user has setup an EBS backed instance and a CloudWatch alarm when the CPU utilization is more than
6 5%. The user has setup the alarm to watch it for 5 periods of 5 minutes each. The CPU utilization is 60%
between 9 AM to 6 PM. The user has stopped the EC2 instance for 15 minutes between 11 AM to 11:15
AM. What will be the status of the alarm at 11:30 AM?
Question597: Which two AWS services provide out-of-the-box user configurable automatic backup-as-a-service and backup
rotation options? (Choose two.)
Question598: A user has created a mobile application which makes calls to DynamoDB to fetch certain data.
The application is using the DynamoDB SDK and root account access/secret access key to connect to DynamoDB from mobile.
Which of the below mentioned statements is true with respect to the best practice for security in this scenario?
Question599: A company has configured a library of IAM roles that grant access to various AWS resources. Each employee has an AWS IAM user, some of which have the permission to launch Amazon EC2 instances. The SysOps Administrator has attached the following policy to those users:
What would be the result of this policy?
Question600: Which of the following are characteristics of Amazon VPC subnets? (Choose two.)
Question601: ______ in VPC are stateful where return traffic is automatically allowed, regardless of any rules.
Question602: A company is using an Amazon ElastiCache for Redis cluster in a production environment. To align with the company's technical requirements, a SysOps administrator needs to select a deployment to provide increased availability and fault tolerance.
Which action should the SysOps administrator take to accomplish this goal?
Question603: A SysOps Administrator discovers the organization's tape archival system is no longer functioning in its on-premises data center.
What AWS service can be used to create a virtual tape interface to replace the physical tape system?
Question604: In the 'Detailed' monitoring data available for your Amazon EBS volumes, Provisioned IOPS volumes automatically send _____ minute metrics to Amazon CloudWatch.
Question605: A root account owner has given full access of his S3 bucket to one of the IAM users using the bucket ACL.
When the IAM user logs in to the S3 console, which actions can he perform?
Question606: A user is using the AWS SQS to decouple the services. Which of the below mentioned operations is not supported by SQS?
Question607: A user is planning to schedule a backup for an EBS volume. The user wants security of the snapshot data.
How can the user achieve data encryption with a snapshot?
Question608: What would happen to an RDS (Relational Database Service) multi-Availability Zone deployment of the primary OB instance fails?
Question609: An organization has created 5 IAM users. The organization wants to give them the same login ID but different passwords. How can the organization achieve this?
Question610: An AWS account owner has setup multiple IAM users. One IAM user only has CloudWatch access. He has setup the alarm action which stops the EC2 instances when the CPU utilization is below the threshold limit.
What will happen in this case?
Question611: An organization has developed a new memory-intensive application that is deployed to a large Amazon EC2 Linux fleet. There is concern about potential memory exhaustion, so the Development team wants to monitor memory usage by using Amazon CloudWatch.
What is the MOST efficient way to accomplish this goal?
Question612: An application stores data in an Amazon RDS database instance. Automated RDS snapshots are taken during specified backup windows every night. In addition, a SysOps Administrator takes monthly manual RDS snapshots. During a maintenance window, the RDS instance was accidentally deleted. How can the Administrator restore the DRS database instance?
Question613: A company has a multi-account AWS environment that includes the following:
- A central identity account that contains all IAM users and groups
- Several member accounts that contain IAM roles
A SysOps administrator must grant permissions for a particular IAM group to assume a role in one of the member accounts.
How should the SysOps administrator accomplish this task?
Question614: An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants that
one particular group of IAM users should only access the test instances and not the production ones. How
can the organization set that as a part of the policy?
Question615: A user runs the command "dd if=/dev/zero of=/dev/xvdfbs=1M" on a fresh blank EBS volume attached to a Linux instance.
Which of the below mentioned activities is the user performing with the command given above?
Question616: A SysOps administrator needs a secure way to connect to AWS Key Management Service (AWS KMS) within a VPC. The SysOps administrator must ensure that connections to AWS KMS do not traverse the internet.
What is the MOST secure solution that meets these requirements?
Question617: A user is trying to setup a recurring Auto Scaling process. The user has setup one process to scale up every day at 8 am and scale down at 7 PM. The user is trying to setup another recurring process which scales up on the 1st of every month at 8 AM and scales down the same day at 7 PM. What will Auto Scaling do in this scenario?
Question618: A user is trying to create a PIOPS EBS volume with 4000 IOPS and 100 GB size.
AWS does not allow the user to create this volume.
What is the possible root cause for this?
Question619: A user has created an ELB with the availability zone US-East-1
Question620: A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB?
Question621: A company is migrating its production file server to AWS. All data that is stored on the file server must remain accessible if an Availability Zone becomes unavailable or when system maintenance is performed. Users must be able to interact with the file server through the SMB protocol. Users also must have the ability to manage file permissions by using Windows ACLs.
Which solution will net these requirements?
Question622: A .NET application that you manage is running in Elastic Beanstalk. Your developers tell you they will need access to application log files to debug issues that arise. The infrastructure will scale up and down.
How can you ensure the developers will be able to access only the log files?
Question623: A user has configured ELB with SSL using a security policy for secure negotiation between the client and load balancer. Which of the below mentioned SSL protocols is not supported by the security policy?
Question624: A SysOps Administrator has been notified that some Amazon EC2 instances in the company's environment might have a vulnerable software version installed.
What should be done to check all of the instances in the environment with the LEAST operational overhead?
Question625: The Database Administration team is interested in performing manual backups of an Amazon RDS Oracle DB instance.
What steps should be taken to perform the backups?
Question626: A SysOps Administrator must take a team's single existing AWS CloudFormation template and split it into smaller, service-specific templates. All of the services in the template reference a single, shared Amazon S3 bucket.
What should the Administrator do to ensure that this S3 bucket can be referenced by all the service templates?
Question627: A user has configured the Auto Scaling group with the minimum capacity as 3 and the maximum capacity as
5. When the user configures the AS group, how many instances will Auto Scaling launch?
Question628: You have private video content in S3 that you want to serve to subscribed users on the Internet. User IDs, credentials, and subscriptions are stored in an Amazon RDS database.
Which configuration will allow you to securely serve private content to your users?
Question629: A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet (port 80. and a DB server in the private subnet (port 3306). The user is configuring a security group for the public subnet (WebSecGrp. and the private subnet (DBSecGrp). Which of the below mentioned entries is required in the private subnet database security group (DBSecGrp)?
Question630: A SysOps administrator is maintaining an application running on Amazon EBS-backed Amazon EC2 instances in an Amazon EC2 Auto scaling group. The application is set to automatically terminate unhealthy instances. The administrator wants to preserve application logs from these instances for failure analysis.
Which action will accomplish this?
Question631: An organization is planning to use AWS for 5 different departments.
The finance department is responsible to pay for all the accounts.
However, they want the cost separation for each account to map with the right cost centre.
How can the finance department achieve this?
Question632: A user is trying to delete an Auto Scaling group from CLI. Which of the below mentioned steps are to be performed by the user?
Question633: An organization is planning to create a user with IAM. They are trying to understand the
limitations of IAM so that they can plan accordingly. Which of the below mentioned statements is not true with respect to the
limitations of IAM?
Question634: An organization has hired an external firm to audit unauthorized changes on the company's AWS environment, the external auditor needs appropriate access.
How can this be accomplished?
Question635: A SysOps Administrator responsible for an e-commerce web application observes the application does not launch new Amazon EC2 instances at peak times, even though the maximum capacity of the Auto Scaling group has not been reached.
What should the Administrator do to identify the underlying problem? (Choose two.)
Question636: A company needs to have real-time access to image data while seamlessly maintaining a copy of the images in an offsite location Which AWS solution would allow access to the image data locally while also providing for disaster recovery?
Question637: When an EC2 instance that is backed by an S3-based AMI Is terminated, what happens to the data on me root volume?
Question638: A company is using an Amazon ElastiCache for Redis cluster in a production environment. To align with the company's technical requirements, a SysOps administrator needs to select a deployment to provide increased availability and fault tolerance.
Which action should the SysOps administrator take to accomplish this goal?
Question639: A user is planning to use AWS Cloudformation. Which of the below mentioned functionalities does not help him to correctly understand Cloudfromation?
Question640: An Application Load Balancer (ALB) is configured in front of Amazon EC2 instances. The current target group health check configuration is:
* Interval: 30 seconds
* Unhealthy threshold: 10
* Healthy threshold: 5
Which steps should a SysOps Administrator take to reduce the amount of time needed to remove unhealthy instances? (Choose two.)
Question641: A SysOps Administrator needs to confirm that security best practices are being followed with the AWS account root user.
How should the Administrator ensure that this is done?
Question642: A financial service company is running distributed computing software to manage a fleet of 20 servers for their calculations. There are 2 control nodes and 18 worker nodes to run the calculations. Worker nodes can be automatically started by the control nodes when required.
Currently, all nodes are running on demand, and the worker nodes are used for approximately 4 hours each day.
Which combination of actions will be MOST cost-effective? (Choose two.)
Question643: A company has Sales department and Marketing department. The company uses one AWS account. There is a need to determine what charges are incurred on the AWS platform by each department. There is also a need to receive notifications when a specified cost level is approached or exceeded.
Which two actions must a SysOps Administrator take to achieve both requirements with the LEAST amount of administrative overhead? (Choose two.)
Question644: A user has created a VPC with public and private subnets using the VPC Wizard. The VPC has CIDR
20.0.0.0/16. The private subnet uses CIDR 20.0.0.0/24. Which of the below mentioned entries are required in the main route table to allow the instances in VPC to communicate with each other?
Question645: A user has launched an EC2 instance and deployed a production application in it. The user wants to prohibit any mistakes from the production team to avoid accidental termination. How can the user achieve this?
Question646: A SysOps Administrator is managing an application that runs on Amazon EC2 instance behind an application Load Balancer. The instance run in an Auto multiple Availability Zones. The application stores data in an Amazon RDS MySQL DB instance. The Administrator must ensure that application stays available if the database becomes unresponsive.
How can these requirement be met?
Question647: A user has enabled versioning on an S3 bucket.
The user is using server side encryption for data at Rest.
If the user is supplying his own keys for encryption (SSE-C., which of the below mentioned statements is true?
Question648: A user has configured a VPC with a new subnet. The user has created a security group. The user wants to configure that instances of the same subnet communicate with each other. How can the user configure this with the security group?
Question649: A SysOps Administrator wants to prevent Developers from accidentally terminating Amazon EC2 instances.
How can this be accomplished?
Question650: You have been asked to leverage Amazon VPC BC2 and SOS to implement an application that submits and receives millions of messages per second to a message queue. You want to ensure your application has sufficient bandwidth between your EC2 instances and SQS Which option will provide the most scalable solution for communicating between the application and SQS?
Question651: You have been asked to propose a multi-region deployment of a web-facing application where a controlled portion of your traffic is being processed by an alternate region.
Which configuration would achieve that goal?
Question652: You have a proprietary data store on-premises that must be backed up daily by dumping the data store contents to a single compressed 50GB file and sending the file to AWS.
Your SLAs state that any dump file backed up within the past 7 days can be retrieved within 2 hours.
Your compliance department has stated that all data must be held indefinitely.
The time required to restore the data store from a backup is approximately 1 hour.
Your on-premise network connection is capable of sustaining 1gbps to AWS.
Which backup methods to AWS would be most cost-effective while still meeting all of your requirements?
Question653: A user has created an application which will be hosted on EC2. The application makes calls to DynamoDB to
fetch certain data. The application is using the DynamoDB SDK to connect with from the EC2 instance. Which
of the below mentioned statements is true with respect to the best practice for security in this scenario?
Question654: A user is trying to understand the detailed CloudWatch monitoring concept. Which of the below mentioned services does not provide detailed monitoring with CloudWatch?
Question655: An Auto Scaling group is running at the desired capacity of 5 instances and receives a trigger from the Cloudwatch Alarm to increase the capacity by 1. The cool down period is 5 minutes.
Cloudwatch sends another trigger after 2 minutes to decrease the desired capacity by 1. What will be the count of instances at the end of 4 minutes?
Question656: A user has configured ELB with two EBS backed EC2 instances. The user is trying to understand the DNS access and IP support for ELB. Which of the below mentioned statements may not help the user understand the IP mechanism supported by ELB?
Question657: A user has created a VPC with public and private subnets using the VPC Wizard. The VPC has CIDR
20.0.0.0/16. The private subnet uses CIDR 20.0.0.0/24. Which of the below mentioned entries are required in the main route table to allow the instances in VPC to communicate with each other?
Question658: A user has setup an Auto Scaling group. The group has failed to launch a single instance for more than 24 hours. What will happen to Auto Scaling in this condition?
Question659: A user has created a VPC with the public subnet.
The user has created a security group for that VPC.
Which of the below mentioned statements is true when a security group is created?
Question660: Two companies will be working on several development projects together. Each company has an AWS account with a single VPC in us-east-1. Two companies would like to access one another's development servers. The IPv4 CIDR blocks in the two VPCs does not overlap.
What can the SysOps Administrators for each company do to set up network routing?
Question661: An application running on Amazon EC2 allows users to launch batch jobs for data analysis. The jobs are run asynchronously, and the user is notified when they are complete. While multiple jobs can run concurrently, a user's request need not be fulfilled for up to 24 hours. To run a job, the application launches an additional EC2 instance that performs all the analytics calculations. A job takes between 75 and 110 minutes to complete and cannot be interrupted.
What is the MOST cost-effective way to run this workload?
Question662: A user has created a subnet in VPC and launched an EC2 instance within it. The user has not selected the option to assign the IP address while launching the instance. Which of the below mentioned statements is true with respect to this scenario?
Question663: A SysOps Administrator is configuring AWS SSO tor the first time. The Administrator has already created a directory in the master account using AWS Directory Service and enabled full access in AWS Organizations What should the Administrator do next to configure the service?
Question664: A SysOps Administrator noticed that the cache hit ratio for an Amazon CloudFront distribution is less than 10%.
Which collection of configuration changes will increase the cache hit ratio for the distribution? (Select two.)
Question665: An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants that one particular group of IAM users should only access the test instances and not the production ones. How can the organization set that as a part of the policy?
Question666: An existing data management application is running on a single Amazon EC2 instance and needs to be moved to a new AWS Region in another AWS account How can a SysOps Administrator achieve this while maintaining the security of the application*?
Question667: A user has developed an application which is required to send the data to a NoSQL database.
The user wants to decouple the data sending such that the application keeps processing and sending data but does not wait for an acknowledgement of DB.
Which of the below mentioned applications helps in this scenario?
Question668: A user has created a VPC with CIDR 20.0.0.0/16 with only a private subnet and VPN connection using the VPC wizard. The user wants to connect to the instance in a private subnet over SSH. How should the user define the security rule for SSH?
Question669: A SysOps Administrator is responsible for managing a set of 12.micro Amazon EC2 instances. The
Administrator wants to automatically reboot any instance that exceeds 80% CPU utilization.
Which of these solutions would meet the requirements?
Question670: A user is publishing custom metrics to CloudWatch. Which of the below mentioned statements will help the user understand the functionality better?
Question671: In AWS Storage Gateway, Gateway-cached volumes allow you to retain ________________.
Question672: A user has launched an EC2 instance. The instance got terminated as soon as it was launched. Which of the below mentioned options is not a possible reason for this?
Question673: A company wants to increase the availability and durability of a critical business application. The application currently uses a MySQL database running on an Amazon EC2 instance. The company wants to minimize application changes.
How should the company meet these requirements?
Question674: A SysOps Administrator needs to create a replica of a company's existing AWS infrastructure in a new AWS account. Currently, an AWS Service Catalog portfolio is used to create and manage resources.
What is the MOST efficient way to accomplish this?
Question675: A user runs the command "dd if=/dev/zero of=/dev/xvdfbs=1M" on a fresh blank EBS
volume attached to a Linux instance. Which of the below mentioned activities is the user performing with the command given above?
Question676: What does Amazon RDS perform?
Question677: Which of the following services can receive an alert from CloudWatch?
Question678: A sys admin is maintaining an application on AWS. The application is installed on EC2 and user has configured ELB and Auto Scaling. Considering future load increase, the user is planning to launch new servers proactively so that they get registered with ELB. How can the user add these instances with Auto Scaling?
Question679: The Database Administration team is interested in performing manual backups of an Amazon RDS Oracle DB instance.
What steps should be taken to perform the backups?
Question680: A company has configured a library of IAM roles that grant access to various AWS resources. Each employee
has an AWS IAM user, some of which have the permission to launch Amazon EC2 instances. The SysOps
Administrator has attached the following policy to those users:
What would be the result of this policy?
Question681: The majority of your Infrastructure is on premises and you have a small footprint on AWS.
Your company has decided to roll out a new application that is heavily dependent on low latency connectivity to LOAP for authentication Your security policy requires minimal changes to the company's existing application user management processes.
What option would you implement to successfully launch this application1?
Question682: A company is running multiple AWS Lambda functions in a non-VPC environment. Most of the functions are
application-specific; an operational function is involved synchronously every hour.
Recently, the Applications team deployed new functions that are triggered based on an Amazon S3 event to
process multiple files that are uploaded to an S3 bucket simultaneously. The SysOps Administrator notices that
the operational function occasionally fails to execute due to throttling.
What step should the Administrator take to make sure that the operational function executes?
Question683: A user is launching an instance.
He is on the "Tag the instance" screen.
Which of the below mentioned information will not help the user understand the functionality of an AWS tag?
Question684: A SysOps Administrator has an AWS Direct Connect connection in place in region us-east-1, between an AWS account and a data center. The Administrator is now required to connect the data center to a VPC in another AWS Region, us-west-2, which must have consistent network performance and low-latency.
What is the MOST efficient and quickest way to establish this connectivity?
Question685: A user is trying to create a PIOPS EBS volume with 8 GB size and 200 IOPS. Will AWS create the volume?
Question686: A SysOps Administrator must generate a report that provides a breakdown of all API activity by a specific user the course of a year.
Given that AWS Cloud Trail was enabled, how can this report be generated?
Question687: A SysOps Administrator attempting to delete an Amazon S3 bucket ran the following command:
aws s3 rb s3://my bucket
The command failed and bucket still exists. The administrator validated that no files existed in the bucket by running aws s3 1s s3://mybucket and getting an empty response.
Why is the Administrator unable to delete the bucket, and what must be done to accomplish this task?
Question688: You have a business-to-business web application running in a VPC consisting of an Elastic Load Balancer (ELB), web servers, application servers and a database. Your web application should only accept traffic from pre-defined customer IP addresses.
Which two options meet this security requirement? (Choose two.)
Question689: An Amazon S3 bucket in a SysOps administrator account can be accessed by users in other AWS accounts.
How can the Administrator ensure that the bucket is only accessible to members of the Administrator's AWS account?
Question690: What does Amazon VPC stand for?
Question691: A system admin wants to add more zones to the existing ELB.
The system admin wants to perform this activity from CLI.
Which of the below mentioned command helps the system admin to add new zones to the existing ELB?
Question692: Which two AWS services provide out-of-the-box user configurable automatic backup-as-a-service and backup
rotation options? (Choose two.)
Question693: A SysOps Administrator has an AWS Direct Connect connection in place in region us-east-1, between an AWS account and a data center. The Administrator is now required to connect the data center to a VPC in another AWS Region, us-west-2, which must have consistent network performance and low-latency.
What is the MOST efficient and quickest way to establish this connectivity?
Question694: An organization has added 3 of his AWS accounts to consolidated billing. One of the AWS accounts has purchased a Reserved Instance (RI. of a small instance size in the US-East-1a zone. All other AWS accounts are running instances of a small size in the same zone. What will happen in this case for the RI pricing?
Question695: If an IAM policy has multiple conditions, or if a condition has multiple keys, its boolean outcome will be
calculated using a logical ______ operation.
Question696: Spot instances are ideally designed for which purpose below?
Question697: A root AWS account owner has created three IAM users: Bob, John and Michael. Michael is the IAM administrator. Bob and John are not the super users, but users with some pre-defined policies. John does not have access to modify his password. Thus, he asks Bob to change his password. How can Bob change John's password?
Question698: A sys admin is planning to subscribe to the RDS event notifications. For which of the below mentioned
source categories the subscription cannot be configured?
Question699: A user has configured an SSL listener at ELB as well as on the back-end instances. Which of the below mentioned statements helps the user understand ELB traffic handling with respect to the SSL listener?
Question700: A company received its latest bill with a large increase in the number of requests against Amazon SQS as
compared to the month prior. The company is not aware of any changes in its SQS usage. The company is
concerned about the cost increase and who or what was making these calls.
What should the SysOps Administrator use to validate the calls made to SQS?
Question701: A web application runs on Amazon EC2 instances with public IPs assigned behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones.
The application stores data in an Amazon RDS Multi-AZ DB instance. The Application Load Balancer, EC2 instances, and RDS DB instance all run in separate sets of subnets. The EC2 instances can communicate with the DB instance, but cannot connect with external services.
What is the MOST likely solution?
Question702: An organization wants to move to Cloud. They are looking for a secure encrypted database storage option. Which of the below mentioned AWS functionalities helps them to achieve this?
Question703: A SysOps Administrator is running Amazon EC2 instances in multiple AWS Regions. The Administrator wants to aggregate the CPU utilization for all instances onto an Amazon CloudWatch dashboard. Each region should be present on the dashboard and represented by a single graph that contains the CPU utilization for all instances in that region.
How can the Administrator meet these requirements?
Question704: A user has launched an EBS backed EC2 instance in the US-East-1a region. The user stopped the instance and started it back after 20 days. AWS throws up an 'InsufficientInstanceCapacity' error. What can be the possible reason for this?
Question705: A company has an existing web application that runs on two Amazon EC2 instances behind an Application Load Balancer (ALB) across two Availability Zones. The application uses an Amazon RDS Multi-AZ DB Instance. Amazon Route 53 record sets route requests for dynamic content to the load balancer and requests for static content to an Amazon S3 bucket. Site visitors are reporting extremely long loading times.
Which actions should be taken to improve the performance of the website? (Choose two.)
Question706: A SysOps Administrator has been able to consolidate multiple, secure websites onto a single server, and each site is running on a different port. The Administrator now wants to start a duplicate server in a second Availability Zone and put both behind a load balancer for high availability.
What would be the command line necessary to deploy one of the sites' certificates to the load balancer?
A:
B:
C:
D:
Question707: A user has launched an EC2 instance from an instance store backed AMI. If the user restarts the instance, what will happen to the ephermal storage data?
Question708: A user has configured two security groups which allow traffic as given below:
1: SecGrp1:
Inbound on port 80 for 0.0.0.0/0
Inbound on port 22 for 0.0.0.0/0
2: SecGrp2:
Inbound on port 22 for 10.10.10.1/32
If both the security groups are associated with the same instance, which of the below mentioned statements is true?