Amazon Practice Questions, Discussions & Exam Topics by our Authors
A SysOps administrator is using IAM credentials to try to upload a file to a customer's Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The SysOps administrator is receiving an AccessDenied message....
To solve the AccessDenied error when uploading a file to an S3 bucket, we need to address permissions for both the SysOps administrator's IAM user and the S3 bucket policy. Let’s evaluate each option:
A) Add this IAM policy to the SysOps administrator user:
- Why it could be selected:
- IAM policy for the SysOps administrator: The SysOps administrator needs explicit permissions to upload objects to the S3 bucket. Without the necessary IAM permissions, the administrator would encounter an AccessDenied error.
- The IAM policy could grant permissions like `s3:PutObject` for the DOC-EXAMPLE-BUCKET, allowing the administrator to upload files.
- Key point: Granting the necessary permissions to the IAM user (SysOps administrator) is essential, as it's the identity trying to upload the file.
B) Add this IAM policy to the customer S3 bucket:
- Why it's rejected:
- While a bucket policy can grant permissions to certain IAM users, it doesn't directly solve the AccessDenied issue from an IAM user's perspective.
- A bucket policy is often used to allow access from specific sources or users, but it's not the best way to provide permissions for the SysOps administrator's IAM user to upload files. The IAM user's own policy should be in place to allow this access.
- It is generally a better practice to manage permissions through IAM policies rather than using bucket policies alone unless you're managing public access or access from a broader range of sources.
C) Add this IAM policy to the SysOps administrator user:
- Why it could be selected:
- This option would grant the SysOps administrator the necessary permissions to interact with the S3 bucket. Specifically, the IAM policy might include permissions like `s3:PutObject` or...
Author: Layla · Last updated Jul 17, 2026
A company uses AWS Organizations to host several applications across multiple AWS accounts. Several teams are responsible for building and maintaining the infrastructure of the applications across the AWS accounts.
A SysOps administrator must implement a solution to ensure that user accounts and permissions are centrally managed. The solution must be integrated with the company's existing on-premises Active Directory environment. The SysOps administrator...
Let's analyze the options to determine the most operationally efficient solution for managing user accounts and permissions across multiple AWS accounts, integrated with the company's existing on-premises Active Directory (AD) environment.
A) Create a Simple AD domain, and establish a forest trust relationship with the on-premises Active Directory domain. Set the Simple AD domain as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
- Why it's rejected:
- Simple AD is a managed directory that is a lightweight directory service based on Microsoft Active Directory, but it does not fully integrate with on-premises Active Directory.
- Setting up a forest trust relationship can be complex and would require more administrative effort to maintain, especially since Simple AD is not fully feature-complete compared to an on-premises AD or Active Directory Connector.
- It is not the most operationally efficient solution, as it introduces unnecessary complexity with a trust relationship and an additional directory service that is not directly synchronized with the on-premises AD.
B) Create an Active Directory domain controller on an Amazon EC2 instance that is joined to the on-premises Active Directory domain. Set the Active Directory domain controller as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
- Why it's rejected:
- This option involves setting up an Active Directory domain controller on an EC2 instance in AWS and joining it to the on-premises Active Directory domain. While this would provide direct integration with the on-premises AD, it introduces significant management overhead.
- Operationally inefficient: You would need to maintain the EC2 instance, ensure synchronization with the on-premises AD, and handle all AD domain controller-related tasks, such as patches, backups, and scaling.
- This setup requires substantial administrative effort, making it less efficient compared to other options that don't require managing a separate domain controller.
C) Create an AD Connector that is associated with the on-premises Active Directory domain. Set ...
Author: Kai99 · Last updated Jul 17, 2026
A company wants to apply an existing Amazon Route 53 private hosted zone to a new VPC to allow for customized resource name resolution within the VPC. The SysOps administrator created the VPC and added the appropriate resource record set...
To complete the setup of a private hosted zone in Amazon Route 53 and ensure it is used by a VPC, let's analyze the options carefully:
A) Associate the Route 53 private hosted zone with the VPC.
- Why it is selected:
- To allow a VPC to use a private hosted zone for DNS resolution, the private hosted zone needs to be explicitly associated with the VPC.
- Association between the private hosted zone and the VPC enables DNS queries from resources within that VPC to resolve to the resource records in the private hosted zone.
- Without this step, even though the records exist in the hosted zone, the VPC will not be able to use them for name resolution.
- This is the correct step to complete the setup, as it ensures the proper linkage between the private hosted zone and the VPC.
B) Create a rule in the default security group for the VPC that allows traffic to the Route 53 Resolver.
- Why it is rejected:
- By default, Route 53 Resolver (which is responsible for DNS queries) does not require special security group rules. The DNS traffic typically flows over UDP port 53, and standard security group rules already allow this traffic within the VPC.
- Route 53 Resolver is not directly controlled through security group settings in the way described here, making this option unnecessary and incorrect for completing the private hosted zone setup.
C) Ensure the VPC netwo...
Author: Leo · Last updated Jul 17, 2026
A company has an AWS Site-to-Site VPN connection between on-premises resources and resources that are hosted in a VPC. A SysOps administrator launches an Amazon EC2 instance that has only a private IP address into a private subnet in the VPC. The EC2 instance runs Microsoft Windows Server.
A security group for the EC2 instance has rules that allow inbound traffic from the on-premises network over the VPN connection. The on-premises environment contains a third-party network firewall. Rules in the third-party network firewall allow Remote Desktop Protocol ...
To troubleshoot this issue, the SysOps administrator needs to identify where the RDP traffic is being blocked or misdirected. Let’s evaluate each option based on the scenario:
A) Create Amazon CloudWatch logs for the EC2 instance to check for blocked traffic
- Rejected: CloudWatch logs are generally used for application and system-level logging on the EC2 instance. While this could show Windows-level logs, it wouldn't give direct visibility into network traffic being blocked or denied, especially from an external network like on-premises via VPN.
B) Create Amazon CloudWatch logs for the Site-to-Site VPN connection to check for blocked traffic
- Rejected: CloudWatch logs for the VPN connection focus on the VPN tunnel’s operational status, such as tunnel up/down status, and not specific network traffic (like whether RDP packets are getting through). It’s helpful for VPN tunnel troubleshooting, but it won’t provide visibility on whether traffic is specifically being dropped or rejected by security groups, NACLs, or firewalls.
C) Create VPC flow logs for the EC2 instance's elastic network interface to check for rejected traffic
- Selected: This is the most appropriate option. VPC Flow Logs can capture network traffic information at the elastic network interface (ENI) level, including accepted or rejected traffic based on security...
Author: Carlos Garcia · Last updated Jul 17, 2026
A SysOps administrator has set up a new Amazon EC2 instance as a web server in a public subnet. The instance uses HTTP port 80 and HTTPS port 443.
The SysOps administrator has confirmed internet connectivity by downloading operating system updates and software from public repositories. However, the SysOps administrator cannot access the insta...
To troubleshoot the issue of not being able to access the EC2 web server from a web browser, we need to focus on factors that could be blocking inbound traffic to the instance on ports 80 and 443, which are required for HTTP and HTTPS traffic.
A) Ensure that the inbound rules of the instance's security group allow traffic on ports 80 and 443
- Selected: The security group is the primary method for controlling inbound and outbound traffic for an EC2 instance. If the inbound rules do not allow traffic on HTTP (port 80) or HTTPS (port 443), the web server will not be accessible from the internet. Ensuring these ports are open in the security group is crucial for allowing the traffic.
B) Ensure that the outbound rules of the instance's security group allow traffic on ports 80 and 443
- Rejected: Outbound rules in a security group typically control the traffic leaving the instance. Since the web server is being accessed from the internet, this is an inbound traffic issue, not an outbound one. The outbound rules do not need to be configured for the issue you're facing (inbound access), so this step is not required.
C) Ensure that ephemeral ports 1024-65535 are allowed in the inbound rules of the network ACL that is associated with the instance's subnet
- Rejected: Ephemeral ports (1024-65535) are typically used for outgoing connections from the EC2 instance to the client (i.e., the response from the web server to the user's web browser). Since the issue is with inbound access (the client cannot reach the EC2 instance), configuring ephemeral ports in the inbound NACL is unnecessary. The focus should be on allowing traffic to ports 80 and 443 for HTTP/HTTPS.
D) Ensure that ephemeral ports 1024-65535 are allowed in the outbound rules of the network ACL that is associated wit...
Author: IceDragon2023 · Last updated Jul 17, 2026
A SysOps administrator needs to monitor a process that runs on Linux Amazon EC2 instances. If the process stops, the process must restart automatically. The Amazon CloudWatch agent is already ...
To meet the requirement of monitoring a process on a Linux EC2 instance and restarting it if it stops, we need to focus on using CloudWatch to monitor the process and then trigger an automated response (such as restarting the process). Let's evaluate each option:
A) Add a procstat monitoring configuration to the CloudWatch agent for the process. Create an Amazon EventBridge event rule that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.
- Selected: This option is ideal because:
- Procstat monitoring: The `procstat` feature of the CloudWatch agent is specifically designed for monitoring processes by their process ID (PID) or name. This will allow you to track whether the process is running.
- EventBridge rule: EventBridge can be used to monitor CloudWatch logs or metrics and trigger actions. In this case, if the process stops (as indicated by CloudWatch metrics or logs), an EventBridge event rule can be used to invoke the appropriate Systems Manager Automation runbook to restart the process.
B) Add a StatsD monitoring configuration to the CloudWatch agent for the process. Create a CloudWatch alarm that initiates an AWS Systems Manager Automation runbook to restart the process after the process stops.
- Rejected: StatsD is typically used for collecting and reporting metrics like counters or timers, which are useful for application-level metrics. While StatsD could help track the process’s performance, it's not designed to monitor whether a process is running or not. `procstat` is the more suitable option for directly monitoring the status of a process, making this approach less ideal for the given use case.
C) Add a StatsD monitoring configurati...
Author: Liam · Last updated Jul 17, 2026
A company has an application that uses an Amazon RDS for MariaDB Multi-AZ database. The application becomes unavailable for several minutes every time the database experiences a failover during a planned maintenance event.
...
To reduce the downtime of the application during failovers in a Multi-AZ Amazon RDS for MariaDB environment, the SysOps administrator needs a solution that minimizes the impact of failover events. Let’s evaluate the options:
A) Create an RDS for MariaDB DB cluster that has multiple writer instances. Configure the application to retry failed queries on another primary node during maintenance events.
- Rejected: Amazon RDS for MariaDB does not support multiple writer instances in a Multi-AZ configuration. Multi-AZ deployments have one primary node and one standby node for automatic failover. This option suggests a feature (multiple writer instances) that is not available in RDS for MariaDB. Additionally, retrying failed queries on another primary node is a good strategy, but it won’t address the inherent downtime during a failover, which is caused by DNS propagation time and connection re-establishment.
B) Configure the RDS maintenance window settings to pool connections while a failover is in process.
- Rejected: This option is not effective because the connection pooling during failover doesn’t reduce the actual downtime that occurs during a failover event. Even though RDS will automatically perform a failover, the application still experiences brief downtime because connections are lost while the failover process occurs. This setting doesn't minimize the overall downtime; it only affects connection handling during failover.
C) Configure an Amazon ElastiCache write-through cache for the database. Configure the application to connect to the cache instead of directly to the database.
- Rejected: While ElastiCache can improve application p...
Author: Liam · Last updated Jul 17, 2026
A SysOps administrator has noticed millions of LIST requests on an Amazon S3 bucket.
Which services or features can the administrator use to...
To investigate where the requests to an Amazon S3 bucket are coming from, the SysOps administrator needs to focus on services that provide detailed logging or event data on the usage and access of the S3 bucket. Let's evaluate the options:
A) AWS CloudTrail data events
- Selected: AWS CloudTrail is a service that logs API calls made on AWS resources, including S3. Specifically, CloudTrail data events can log the `LIST` operations on S3 buckets, providing detailed information about who is making the requests and where they are coming from. This service allows you to track access to your S3 bucket, including the source IP and AWS IAM user or role making the requests, which is critical for investigating large volumes of access requests.
B) Amazon EventBridge
- Rejected: Amazon EventBridge is used for event-driven architectures and helps route events to specific services based on triggers. While EventBridge can capture events related to AWS services, it is not designed specifically for tracking S3 access events (like `LIST` requests). It is more suited for creating workflows around application events rather than tracking resource access details in S3.
C) AWS Health Dashboard
- Rejected: The AWS Health Dashboard provides insights into AWS service issues and disruptions, such as outages or maintenance events. It does not track specific S3 requests or provide information about who or what is making the requests to an ...
Author: Zara · Last updated Jul 17, 2026
A SysOps administrator configures VPC flow logs to publish to Amazon CloudWatch Logs. The SysOps administrator reviews the logs in CloudWatch Logs and notices less traffic than expected. After the SysOps administrator compares the VPC flow logs to logs that were captured on premises, the SysOps administ...
When analyzing the situation of VPC flow logs showing incomplete traffic, we need to consider the possible reasons behind the discrepancy between the expected traffic and the data observed in CloudWatch Logs. Let's review each option in detail:
Option A: CloudWatch Logs throttling has been applied
- Explanation: If throttling is applied to CloudWatch Logs, it would limit the volume of logs being sent to CloudWatch. However, this typically affects the overall log ingestion process, and you would see logs missing intermittently or not being logged at all, rather than a consistent difference in expected traffic. The throttling would not selectively omit traffic from specific sources or destinations.
- Reason for rejection: The logs should still be ingested, just at a reduced rate or delayed. The missing traffic would not be selectively omitted in the manner described in the question.
- Scenario: This option might be more relevant if there was evidence of CloudWatch Log ingestion delays or errors.
Option B: The CloudWatch IAM role does not have a trust relationship with the VPC flow logs service
- Explanation: If the IAM role doesn't have the correct trust relationship with the VPC flow logs service, the logs would fail to be published to CloudWatch Logs entirely, or at least partially. However, if this were the case, you would typically see errors indicating that the flow logs couldn't be sent, not an incomplete or partial set of logs.
- Reason for rejection: The question doesn't mention any errors related to the IAM role or trust issues, and CloudWatch Logs would likely not receive logs at all in this case.
- Scenario: This option would be relevant if there were errors specifically around log delivery, but that’s not the issue presented.
Option C: The VPC flow log is still in the process of being created
- Explanation: VPC flow logs take a few minutes to be created and ...
Author: Ella · Last updated Jul 17, 2026
A company's SysOps administrator uses AWS IAM Identity Center (AWS Single Sign-On) to connect to an Active Directory. The SysOps administrator creates a new account that all the company's users need to access.
The SysOps administrator uses the Active Directory Domain Users group for permissions to the new account because ...
To resolve the access issue, let's break down each of the options and their relevance to the scenario where users are denied access despite being part of the correct Active Directory group:
Option A: Create a new group. Add users to the new group to provide access.
- Explanation: Creating a new group and adding users to it would only be a solution if the original group wasn’t properly configured or linked to the appropriate permissions for IAM Identity Center. However, if the Active Directory Domain Users group was intended to provide access and all users are members of it, creating a new group would not directly address the underlying cause of the access issue. This approach is more of a workaround rather than a fix.
- Reason for rejection: The issue is likely related to permissions or configuration, not the need for a new group. Creating a new group unnecessarily adds complexity without addressing the root cause.
Option B: Correct the time on the Active Directory domain controllers.
- Explanation: In environments that use Kerberos authentication (which is common with Active Directory), time synchronization is critical for successful authentication. If there is a significant time difference between the IAM Identity Center and the Active Directory domain controllers, authentication could fail. However, this is less likely to be the problem if the time configuration was already accurate or if the users are able to authenticate with other services.
- Reason for rejection: While time synchronization is important for authentication in some cases, this option is unlikely to resolve the issue directly related to group permissions and access control in IAM Identity Center.
Option C: Remove the account. Re-add the account to the organization that is integrated...
Author: VioletCheetah55 · Last updated Jul 17, 2026
A SysOps administrator has an Amazon S3 website and wants to restrict access to a single Amazon CloudFront distribution. Visitors to the website should not be able to circumvent CloudFront or view the S3 websi...
To meet the requirements of restricting access to the S3 website so that visitors can only access it through a single CloudFront distribution, we need to implement a method that ensures CloudFront is the only source that can access the S3 bucket, while all other direct access attempts to the S3 bucket are blocked.
Let’s break down each option and analyze them:
Option A: S3 bucket ACL (Access Control List)
- Explanation: S3 bucket ACLs are used to control access at the individual object or bucket level. They can be used to grant or deny access to specific AWS accounts or groups. However, they are not designed to specifically restrict access only to CloudFront distributions.
- Reason for rejection: While ACLs could allow restricting access to specific IAM users or other AWS services, they do not provide a mechanism to exclusively allow access from CloudFront, and direct access to the S3 bucket could still be possible. Therefore, ACLs alone will not meet the requirement of ensuring that only CloudFront can access the bucket.
Option B: AWS Firewall Manager
- Explanation: AWS Firewall Manager is a security management service that helps you configure and manage firewall rules across multiple accounts in your AWS environment. It is used to manage security group policies, web application firewall (WAF) rules, and other firewall-related policies.
- Reason for rejection: While Firewall Manager is useful for managing security rules at a higher level, it is not designed to specifically control access to S3 buckets or restrict direct access to S3 in favor of CloudFront. This service does not directly help with the S3-CloudFront access control scenario.
Option C: Amazon Route 53 private hosted zone
- E...
Author: Aria · Last updated Jul 17, 2026
A SysOps administrator is responsible for the security of a company's AWS account. The company has a policy that a user may stop or terminate Amazon EC2 instances only when the user is authenticated by using a multi-factor authenti...
To meet the requirement that a user must be authenticated using a multi-factor authentication (MFA) device before stopping or terminating Amazon EC2 instances, the SysOps administrator needs to create a policy that enforces MFA authentication for these specific actions.
Let's analyze the options for how to achieve this.
Key Requirements:
- The policy should ensure that a user must use MFA to perform specific EC2 actions (like stopping or terminating instances).
- The user should not be able to perform these actions without MFA authentication.
Option A: AWS Identity and Access Management (IAM) policy with a condition for MFA
- Explanation: An IAM policy can be created with a condition that requires MFA authentication for performing certain actions. AWS IAM allows you to enforce MFA using the `aws:MultiFactorAuthPresent` condition key in the policy. This condition can be applied to specific EC2 actions, such as stopping or terminating instances.
- For example:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:TerminateInstances",
"ec2:StopInstances"
],
"Resource": "",
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": "true"
}
}
}
]
}
```
- Reason for selection: This IAM policy will allow the user to stop or terminate EC2 instances only if they have successfully authenticated with MFA. The condition `aws:MultiFactorAuthPresent` ensures that the action can only be performed when MFA is enabled, meeting the company’s policy requirement.
Option B: AWS Organizations service control policies (SCP)
- Explanation: Service Control Policies (SCPs) are used to manage permissions for AWS accounts in an AWS Organization. SCPs are applied to accoun...
Author: Ahmed97 · Last updated Jul 17, 2026
A global company wants to allow anyone in the world to upload videos from a mobile phone. The company's mobile app uploads the videos across the public internet to an Amazon S3 bucket in the us-east-1 Region for further processing.
Videos that users upload from locations that are distant from us-east-1 have slower upload speeds than videos that users upload from close to us-east-1. In many cas...
To improve upload speeds for users located far from the S3 bucket in us-east-1, we need to address the latency and network bottlenecks that affect users' upload experiences. Let's analyze each option to determine the most suitable solution:
Option A: Enable S3 Transfer Acceleration on the S3 bucket. Change the mobile app to use the S3 Transfer Acceleration endpoint for uploads.
- Explanation: S3 Transfer Acceleration speeds up file uploads by routing the data through Amazon CloudFront’s globally distributed edge locations. When users upload files, the data is first sent to the nearest CloudFront edge location, and then transferred to the S3 bucket in us-east-1 over an optimized network path. This reduces latency and increases the upload speed for users, especially those in distant locations.
- Reason for selection: This solution is designed specifically to address slow uploads by leveraging the CloudFront CDN. It improves upload speed for users globally without requiring the deployment of additional infrastructure. It is a managed service and the simplest solution to implement.
Option B: Create an S3 access point for the S3 bucket in several AWS Regions across the world. Change the mobile app to use the S3 access point endpoint for uploads.
- Explanation: S3 Access Points allow for easier access management for shared datasets. However, the access points themselves don’t directly solve the issue of slow upload speeds for distant users. They primarily manage access permissions more easily across multiple applications, but they do not address performance or latency concerns.
- Reason for rejection: S3 access points are about managing access at scale and do not optimize the performance of uploads. They are not designed to improve upload speeds by themselves, especially for distant locations.
Option C: Use S3 ...
Author: Charlotte · Last updated Jul 17, 2026
A company is using AWS Certificate Manager (ACM) to manage public SSL/TLS certificates. A SysOps administrator needs to send an email notification when a certificate has less than 14 days until expira...
Let’s break down the options and assess each one based on operational overhead, complexity, and suitability for the requirement of notifying when an ACM certificate is about to expire:
Option A: Create a CloudWatch custom metric and EventBridge rule
- Steps:
- Create a custom CloudWatch metric to track certificate expiration.
- Set up an EventBridge rule based on this metric.
- Trigger an SNS notification when the DaysToExpiry is less than 14.
- Subscribe email addresses to the SNS topic.
- Pros:
- This method provides good control over monitoring with custom metrics.
- Can monitor across multiple certificates.
- Cons:
- This approach involves additional complexity, as it requires the creation of a custom CloudWatch metric to track certificate expiration.
- Adds operational overhead since you'll have to manage the metric manually.
- Suitability: This solution is more complicated than necessary for simply tracking certificate expiration, so it introduces operational overhead without providing significant additional benefit.
Option B: Create an EventBridge rule with ACM as the event source
- Steps:
- Use the AWS ACM event source for EventBridge, which natively emits expiration events.
- Configure the rule to check if `DaysToExpiry` is less than 14.
- Trigger SNS notifications to the relevant recipients.
- Pros:
- This is a more native solution, as ACM already integrates with EventBridge to emit expiration events.
- No need to create a custom metric, reducing the complexity.
- Fully managed with low operational overhead.
- Cons:
- Slightly less control over metrics or filtering than a custom metric would offer, but still an efficient solution.
- Suitability: This is the most straightforward solution, leveraging EventBridge’s native integration with ACM for a...
Author: William · Last updated Jul 17, 2026
A SysOps administrator created an AWS CloudFormation template that provisions an Amazon EventBridge rule that invokes an AWS Lambda function. The Lambda function is designed to write event details to an Amazon CloudWatch log group. The function has permissions to write events to Amazon CloudWatch Logs. However, t...
Let's analyze the options and determine the most suitable solution to resolve the issue where the Lambda function is not running in response to the EventBridge rule:
Option A: Update the CloudFormation stack to include an AWS::IAM::Role resource for EventBridge to invoke the function
- Explanation:
- This option focuses on granting the EventBridge rule the appropriate IAM role to invoke the Lambda function.
- Required IAM role for EventBridge: EventBridge needs an IAM role with permission to invoke the Lambda function. If this permission is missing, the function will not be triggered by the event rule.
- Pros:
- This solution addresses a common issue where EventBridge doesn't have the permissions to trigger the Lambda function.
- Cons:
- The Lambda function does not require permissions to be invoked directly by EventBridge in the form of an IAM role. Instead, permissions to invoke the function should be granted using the `AWS::Lambda::Permission` resource, not by adding a role for EventBridge.
- Suitability: This is not the right approach because EventBridge does not need a role to invoke the Lambda function in the way this option suggests.
Option B: Update the CloudFormation stack to include an AWS::IAM::Role resource for the Lambda function
- Explanation:
- This option focuses on granting the Lambda function itself an IAM role with the necessary permissions to execute actions (like writing to CloudWatch).
- Pros:
- This option ensures that the Lambda function has the necessary execution role to interact with CloudWatch logs (which is important if the function needs such permissions).
- Cons:
- While the Lambda execution role may be required, this does not resolve the issue of EventBridge not being able to invoke the Lambda function. The permissions for EventBridge to invoke the Lambda are a separate concern, which is the root cause in this case.
- Suitability: While this option might be useful for ensuring the Lambda function can perform its task (writing logs), it does not solve the issue of EventBridge being unable to invoke the Lambda function.
Option C: Update the CloudFormation stack with an AWS::Lambda::Permission resource to ensure ...
Author: RadiantJaguar56 · Last updated Jul 17, 2026
A company has an Amazon EC2 instance that has high CPU utilization. The EC2 instance is a t3.large instance and is running a test web application. The company discovers that the web application would operate better on a ...
Let's evaluate the available options to address the scenario where a SysOps administrator needs to change the instance type of an Amazon EC2 instance to a compute-optimized instance due to high CPU utilization.
Option A: Migrate the EC2 instance to a compute optimized instance by using AWS VM Import/Export
- Explanation:
- AWS VM Import/Export is a service that allows you to migrate virtual machines (VMs) from on-premises to EC2 instances and vice versa.
- Pros:
- Useful for moving workloads from physical or virtual servers outside of AWS to EC2.
- Cons:
- Not applicable for simply changing the instance type of an already running EC2 instance within AWS. This is overcomplicating the task and adds unnecessary overhead, as you are not migrating a virtual machine from outside AWS but only changing the instance type of a current EC2 instance.
- Suitability: This is not the correct approach in this case, as it introduces unnecessary complexity for a simple EC2 instance type change.
Option B: Enable hibernation on the EC2 instance. Change the instance type to a compute optimized instance. Disable hibernation on the EC2 instance
- Explanation:
- Hibernation allows an EC2 instance to be paused, and its state is saved to disk so it can be resumed later.
- Pros:
- Hibernation could theoretically help preserve the instance state during changes.
- Cons:
- This method is not needed for simply changing the instance type. Hibernation adds complexity and is generally used for saving and restoring the state of an instance, which is unnecessary when the instance type is being changed. Additionally, not all instance types support hibernation.
- Suitability: This adds unnecessary complexity to the process. Enabling hibernation is not required for simply changing the instance type.
Option C: Stop the EC2 instance. Change the instance type to a compute optimized in...
Author: Olivia Johnson · Last updated Jul 17, 2026
A development team created and deployed a new AWS Lambda function 15 minutes ago. Although the function was invoked many times, Amazon CloudWatch Log...
Let’s evaluate the possible causes for the issue where an AWS Lambda function is invoked multiple times but no log messages appear in Amazon CloudWatch Logs.
Option A: The developers did not enable log messages for this Lambda function
- Explanation:
- AWS Lambda functions automatically generate logs in CloudWatch Logs if the function contains `console.log()` or other logging mechanisms (for Node.js) or equivalent in other runtime environments.
- Pros:
- This could be a plausible cause if the developers forgot to include log statements in the function.
- Cons:
- However, the question indicates that the function was invoked many times. If log statements were entirely missing, we would not expect the function to have been invoked in a manner where log outputs were expected. This is unlikely, as the problem likely stems from a more systemic issue (such as permissions or exceptions).
- Suitability: This option seems less likely since the question implies that the function was expected to log outputs, and the issue is more related to the function's configuration or environment.
Option B: The Lambda function's role does not include permissions to create CloudWatch Logs items
- Explanation:
- For AWS Lambda to write logs to CloudWatch Logs, the Lambda function’s execution role must include the necessary permissions, specifically the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` permissions.
- Pros:
- If the function’s IAM role does not have the correct permissions, logs cannot be written to CloudWatch, even if logging is explicitly included in the function.
- Cons:
- This is a very common cause for missing CloudWatch logs. If the Lambda function's role lacks these permissions, it would explain the absence of logs, despite the function being invoked.
- Suitability: This is a strong candidate as the most likely cause of the issue.
Option C: The Lambda function raises an exception before the first log statement has been reached
- Ex...
Author: GlowingTiger · Last updated Jul 17, 2026
A company observes that a newly created Amazon CloudWatch alarm is not transitioning out of the INSUFFICIENT_DATA state. The alarm was created to track the mem_used_percent metric from an Amazon EC2 instance that is deployed in a public subnet.
A review of the EC2 instance shows that the unified CloudWatch agent is installed and is running. However, the metric ...
Let's go through each option and evaluate the most suitable solution for resolving the issue where a newly created CloudWatch alarm is stuck in the INSUFFICIENT_DATA state, and the metric (`mem_used_percent`) is not appearing in CloudWatch despite the unified CloudWatch agent being installed and running.
Option A: Enable CloudWatch detailed monitoring for the EC2 instance
- Explanation:
- CloudWatch detailed monitoring provides metrics at a 1-minute frequency (default is 5-minute frequency).
- However, detailed monitoring is primarily used for EC2 instance-level metrics like CPU utilization, disk I/O, and network traffic, not for custom metrics such as `mem_used_percent`.
- Pros:
- Detailed monitoring might be beneficial for some metrics.
- Cons:
- Enabling detailed monitoring does not address the issue of custom metrics (like `mem_used_percent`) being unavailable in CloudWatch. CloudWatch custom metrics require proper configuration with the CloudWatch agent, regardless of whether detailed monitoring is enabled or not.
- Suitability: This will not resolve the issue because `mem_used_percent` is a custom metric that needs to be properly configured and sent by the CloudWatch agent, which is not affected by detailed monitoring settings.
Option B: Create an IAM instance profile that contains CloudWatch permissions. Add the instance profile to the EC2 instance
- Explanation:
- For custom metrics (like `mem_used_percent`) to be successfully sent to CloudWatch, the EC2 instance must have the correct IAM permissions to allow the CloudWatch agent to publish data.
- An IAM instance profile containing permissions for CloudWatch is required for the EC2 instance to be able to send metrics to CloudWatch.
- Pros:
- This solution addresses the problem directly by ensuring that the EC2 instance has the proper permissions to send custom metrics to CloudWatch.
- Without the correct IAM role and permissions, the CloudWatch agent cannot publish custom metrics like `mem_used_percent`.
- Cons:
- None, as the solution directly addresses the missing permission issue.
- Suitability: This is the most likely solution. The issue is caused by the lack of proper IAM permissions for the CloudWatch agent to send custom metrics. Adding an IAM instance profile with t...
Author: Rohan · Last updated Jul 17, 2026
A company is uploading important files as objects to Amazon S3. The company needs to be informed if an object is corrupted during the upload.
...
To address the requirement of being informed if an object is corrupted during the upload to Amazon S3, the solution needs to focus on ensuring the integrity of the uploaded object. Let's evaluate each option:
A) Pass the Content-Disposition value as a request body during the object upload
- Explanation: The `Content-Disposition` header is used to specify if the object should be displayed inline or treated as an attachment. This is not related to verifying the integrity of the object during upload.
- Rejection Reason: This option does not help in verifying the integrity of the object during upload. It is used primarily for controlling the display of the file when it is downloaded, not for checking corruption.
B) Pass the Content-MD5 value as a request header during the object upload
- Explanation: The `Content-MD5` header is used to provide an MD5 hash of the file being uploaded. Amazon S3 checks the MD5 hash provided against the computed hash of the uploaded object. If the hashes do not match, the upload fails, thereby detecting any corruption that may occur during the upload process.
- Reasoning for Selection: This method ensures that the uploaded object’s integrity is verified and that the object is not corrupted during the upload. If there’s any corruption during tra...
Author: VenomousSerpent42 · Last updated Jul 17, 2026
A SysOps administrator needs to create a report that shows how many bytes are sent to and received from each target group member for an Application Load Balancer (ALB).
Which combination of ...
To create a report that shows how many bytes are sent to and received from each target group member for an Application Load Balancer (ALB), the SysOps administrator needs to gather relevant data regarding traffic metrics and then process and analyze them. Let's analyze the available options and explain which ones are suitable and why the others are rejected.
A) Enable access logging for the ALB. Save the logs to an Amazon S3 bucket.
- Explanation: Enabling access logging for the ALB and saving the logs to an Amazon S3 bucket is a valid step because the ALB access logs will contain detailed information about each request, including the bytes sent and received by the ALB. These logs can later be analyzed to calculate traffic per target.
- Reasoning for Selection: This option is necessary to gather the data needed for further analysis, and it's a prerequisite to use Amazon Athena to query the logs for specific metrics such as `sent_bytes` and `received_bytes`.
- Scenario: This is the first step in the process, providing the data that will be analyzed later.
B) Install the Amazon CloudWatch agent on the instances in the target group.
- Explanation: Installing the Amazon CloudWatch agent on the instances in the target group helps collect system-level metrics, such as CPU usage, memory, and disk space, but it does not directly provide the required data on the bytes sent and received through the ALB.
- Rejection Reason: This option does not directly contribute to gathering the specific traffic data needed for the report, which is focused on bytes sent and received via the ALB.
C) Use Amazon Athena to query the ALB logs. Query the table. Use the received_bytes and sent_bytes fields to calculate the total bytes grouped by the target port field.
- Explanation: After enabling access logging for the ALB, Athena can be used to query the access logs stored in S3. The `received_bytes` and `sent_bytes` fields in the logs will provide the necessary data to calculate the total bytes sent and received by each target. Grouping by the target port field ...
Author: Madison · Last updated Jul 17, 2026
A company runs thousands of Amazon EC2 instances that are based on the Amazon Linux 2 Amazon Machine Image (AMI). A SysOps administrator must implement a solution to record commands and output from any user that needs an interactive session on one of the EC2 instances. The solution must log the data to a durable storage location. The solution also must prov...
To meet the requirements of logging user command sessions, storing them in a durable location, and setting up automated notifications and alarms based on log data, let's evaluate each option.
Option A) Configure command session logging on each EC2 instance. Configure the unified Amazon CloudWatch agent to send session logs to Amazon CloudWatch Logs. Set up query filters and alerts by using Amazon Athena.
- Explanation: This option requires configuring command session logging on each EC2 instance, which involves capturing all command input/output and then sending those logs to Amazon CloudWatch Logs. Afterward, you can use Athena to query the logs and set up alerts.
- Challenges: While this approach could work, configuring logging on each EC2 instance could lead to operational overhead, especially for thousands of instances. Managing configurations on each instance and ensuring the CloudWatch agent is installed and correctly configured on every EC2 instance introduces more complexity, and errors could arise if any instance is misconfigured. Additionally, querying logs with Athena requires careful setup and could be more complex for monitoring real-time events.
- Rejection Reason: While this option meets the requirements, it introduces complexity and operational overhead, especially when managing thousands of EC2 instances.
---
Option B) Require all users to use a central bastion host when they need command-line access to an EC2 instance. Configure the unified Amazon CloudWatch agent on the bastion host to send session logs to Amazon CloudWatch Logs. Set up a metric filter and a metric alarm for relevant security findings in CloudWatch Logs.
- Explanation: This option suggests setting up a central bastion host that all users must use for accessing EC2 instances. Logs are sent to CloudWatch Logs from the bastion host, and CloudWatch alarms are set up for relevant findings.
- Challenges: A central bastion host could create a bottleneck or a single point of failure. Additionally, it doesn't directly fulfill the requirement of logging each individual session on each EC2 instance, which is crucial since users could be accessing different instances. This approach also doesn’t provide visibility into actions taken on the instances directly, as logs are only captured at the bastion host level.
- Rejection Reason: Although centralized, this approach does not provide sufficient granularity or efficiency in meeting the requirement for logging actions on the EC2 instances themselves, leading to reduced visibility and potential gaps in session logging.
---
Option C) Require all users to use AWS Systems Manager Session Manager when they need command-line access to an EC2 instance. Configure Session Manager to ...
Author: Scarlett · Last updated Jul 17, 2026
A company that uses AWS Organizations recently implemented AWS Control Tower=D1=8E The company now needs to centralize identity management. A SysOps administrator must federate AWS =D0=A8AM Identity Center with an external SAML 2.0 identity provider (IdP) to centrally manage access to all the company's accounts and cloud applicat...
To successfully federate AWS IAM Identity Center with an external SAML 2.0 identity provider (IdP) for centralized identity management across AWS accounts and cloud applications, certain prerequisites need to be in place. Let's evaluate the options and determine the correct prerequisites.
Option A) A copy of the IAM Identity Center SAML metadata
- Explanation: The IAM Identity Center SAML metadata is used by the external identity provider (IdP) to establish a trust relationship with AWS IAM Identity Center. This metadata provides the necessary details, such as the SAML endpoint and configuration information, for the IdP to communicate with AWS.
- Reasoning for Rejection: While the IAM Identity Center metadata is important for the IdP, the SysOps administrator will likely need the IdP metadata (not IAM Identity Center metadata) to configure the federation. The primary task is to configure the IdP to trust AWS Identity Center, not the other way around.
---
Option B) The IdP metadata including the public X.509 certificate
- Explanation: The IdP metadata, including the public X.509 certificate, is crucial for establishing a secure connection between the IdP and AWS Identity Center. The X.509 certificate allows AWS to verify the signatures of authentication requests coming from the IdP. This is a required component for configuring federation with an external SAML 2.0 IdP.
- Reasoning for Selection: This is the correct prerequisite for connecting AWS IAM Identity Center to an external IdP. AWS will use this certificate to ensure the identity and authenticity of the federated identity provider during the authentication process.
---
Option C) The IP address of the IdP
- Explanation: The IP address of the IdP is not typically needed for federating with AWS IAM Identity Center using SAML 2.0. The trust relationship is established through metadata exchange and certificate validation, not through specifying the IP address.
- Rejection Reason...
Author: Benjamin · Last updated Jul 17, 2026
A company recently moved its server infrastructure to Amazon EC2 instances. The company wants to use Amazon CloudWatch Logs to track the instance logs.
What should a SysOps adm...
To meet the requirement of tracking instance logs using Amazon CloudWatch Logs, the SysOps administrator should follow AWS best practices for monitoring and log management. Let’s analyze each option to determine the most appropriate solution.
Option A) Configure CloudWatch from the AWS Management Console for the instances. Wait for AWS to automatically install and configure the agents for the instances.
- Explanation: This option suggests relying on AWS to automatically install and configure the CloudWatch agent for the EC2 instances. However, AWS does not automatically install or configure the CloudWatch agent on EC2 instances. This means that while CloudWatch can be configured via the console, the agent needs to be manually installed and configured.
- Rejection Reason: AWS does not automatically install and configure the CloudWatch agent, so this option is not feasible.
---
Option B) Install and configure the CloudWatch agent on the instances. Attach an IAM role to allow the instances to write logs to CloudWatch.
- Explanation: This option follows AWS best practices. It involves manually installing and configuring the CloudWatch agent on the EC2 instances to send logs to CloudWatch Logs. Attaching an IAM role to the instances ensures they have the necessary permissions to write logs to CloudWatch. The IAM role provides the least privilege principle, granting just the necessary permissions to the instances.
- Reasoning for Selection: This is the correct solution, as it properly follows AWS best practices. Installing and configuring the CloudWatch agent ensures that logs are collected, and attaching an IA...
Author: James · Last updated Jul 17, 2026
A company uses AWS CloudFormation to deploy its infrastructure. The company recently retired an application. A cloud operations engineer initiates CloudFormation stack deletion, and the stack gets stuck in DELETE_FAILED status.
A SysOps administrator discovers that the stack had deployed a security group. The security group is referenced by other security groups in the environment. The SysO...
In this scenario, the company needs to delete the CloudFormation stack without affecting other applications that are referencing the security group. Let's evaluate each option in detail:
A) Create a new security group that has a different name. Apply identical rules to the new security group. Replace all other security groups that reference the new security group. Delete the stack.
- Analysis: This option is operationally complex because it involves creating a new security group, replicating its rules, and updating all references to the old security group in other security groups. This can require a lot of manual effort and is prone to errors, especially if there are many references to the security group. While it would allow the stack to be deleted, it is not the most efficient solution.
- Rejection Reason: This solution is tedious, error-prone, and involves considerable manual work. It's not operationally efficient.
B) Create a CloudFormation change set to delete the security group. Deploy the change set.
- Analysis: CloudFormation change sets are used to preview changes before they are applied. However, creating a change set to delete a security group is likely to fail if other security groups reference it. The change set would attempt to delete the security group, but because it's in use by other security groups, it will be blocked.
- Rejection Reason: The issue is that a change set won't solve the problem if there are dependencies, and attempting to delete the security group will cause failure.
C) Delete the stack again. Specify that the security group be retained.
- Analysis: Cloud...
Author: Amira99 · Last updated Jul 17, 2026
A company needs to monitor its website's availability to end users. The company needs a solution to provide an Amazon Simple Notification Service (Amazon SNS) notification if the website's uptime decreases to less than 99%. The monitoring must prov...
To meet the company's requirement of monitoring website availability and receiving an SNS notification when uptime drops below 99%, we need a solution that accurately reflects the end user's experience of the website. Let's analyze each option:
A) Create an Amazon CloudWatch alarm that is based on the website's logs that are published to a CloudWatch Logs log group. Configure the alarm to publish an SNS notification if the number of HTTP 4xx errors and 5xx errors exceeds a specified threshold.
- Analysis: While CloudWatch alarms based on log data (e.g., HTTP 4xx and 5xx errors) can alert the team about potential issues, this approach may not accurately reflect end-user experience. Errors like HTTP 4xx and 5xx may not necessarily indicate downtime, and even if they do, they don't directly measure the availability of the website from an end-user perspective.
- Rejection Reason: This method focuses on errors rather than actual user experience, so it may not reliably capture all uptime issues or provide an accurate view of availability.
B) Create an Amazon CloudWatch alarm that is based on the website's published metrics in CloudWatch. Configure the alarm to publish an SNS notification that is based on anomaly detection.
- Analysis: This option uses anomaly detection on metrics, which can be useful for detecting unusual patterns in traffic or performance. However, anomaly detection alone might not reliably capture precise uptime issues and could produce false positives or miss specific availability problems. It also does not directly measure user experience, making it less suited for this use case.
- Rejection Reason: Anomaly detection in CloudWatch doesn't directly measure user experience or website availability, which is the core requirement of this scenario.
C) Create an Amazon CloudWa...
Author: ShadowWolf101 · Last updated Jul 17, 2026
A company needs to track spending in its AWS account. The company must receive a notification when current costs and forecasted costs exceed specific thresholds.
Which ...
Let's analyze each of the provided options and evaluate them based on the requirements for tracking costs and receiving notifications when those costs exceed specific thresholds, with the least operational overhead.
A) Create a new IAM role. Attach the AWSPurchaseOrdersServiceRolePolicy AWS managed policy to the role. Check AWS Cost Explorer on a regular basis to monitor current costs and forecasted costs.
- Analysis: While creating an IAM role and attaching a policy might give access to relevant billing data, this option still requires manual intervention to check AWS Cost Explorer regularly. It does not provide automated notifications when costs exceed specific thresholds, which defeats the purpose of minimizing operational overhead.
- Rejection Reason: This solution requires manual monitoring, which creates unnecessary operational overhead and does not meet the requirement of automated notifications.
B) Create an AWS Cost and Usage Report. Create an AWS Step Functions state machine that runs when a new usage file is generated. Configure the state machine to pass the data to Amazon Forecast and to invoke an AWS Lambda function. Configure the Lambda function to parse the data and to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic if costs exceed the thresholds.
- Analysis: This option involves a complex workflow with multiple services (Step Functions, Lambda, Amazon Forecast) to process and analyze the data. While it is possible to create a highly customized solution, this comes with a lot of operational overhead, requiring maintenance and configuration of several services to perform basic cost tracking and notification tasks.
- ...
Author: FrostFalcon88 · Last updated Jul 17, 2026
A company uses a multi-account structure in the AWS Cloud. The company's environment includes a shared account for common resources. The environment also includes a development account for new application development. The company uses Amazon Route 53 for DNS management. The company manages all its Route 53 hosted zones from the shared account.
A SysOps administrator needs to...
Let's analyze each option in terms of obtaining an SSL/TLS certificate for an application deployed in the development account, while keeping in mind the multi-account structure and DNS management in the shared account:
A) Create a new AWS Key Management Service (AWS KMS) key in the shared account. Configure the key policy to give read access to the development account's root principal.
- Analysis: AWS KMS keys are primarily used for encryption purposes, not for managing SSL/TLS certificates. The SSL/TLS certificate itself is managed by AWS Certificate Manager (ACM), not by KMS. Thus, this option does not address the actual requirement of obtaining an SSL/TLS certificate.
- Rejection Reason: KMS keys are irrelevant for the SSL/TLS certificate request process. This option is not related to the task at hand.
B) Request a new certificate by using AWS Certificate Manager (ACM) from the shared account. Use Route 53 from the shared account to create validation record sets in the relevant hosted zone.
- Analysis: While this option suggests requesting a certificate from the shared account, it may not work as intended because ACM certificates are typically associated with the account that requests them. Additionally, validating the certificate in the development account's hosted zone (if it’s in the development account) is not addressed in this option.
- Rejection Reason: While possible, it does not directly solve the problem of requesting a certificate for the development account’s application, and the validation process may not work smoothly in the development account's hosted zone.
C) Request a new certificate by using AWS Certificate Manager (ACM) from the de...
Author: Amira · Last updated Jul 17, 2026
A company's SysOps administrator is troubleshooting communication between the components of an application. The company configured VPC flow logs to be published to Amazon CloudWatch Logs. However, there are no logs in Cloud...
Let’s analyze the possible reasons why the VPC flow logs might not be publishing to CloudWatch Logs and evaluate each option based on the troubleshooting process:
A) The IAM policy that is attached to the IAM role for the flow log is missing the logs CreateLogGroup permission
- Analysis: In order for VPC flow logs to be published to CloudWatch Logs, the IAM role associated with the flow log needs permissions to create log groups, log streams, and put log events. Specifically, the IAM role needs the `logs:CreateLogGroup` permission to create a new log group if it does not already exist.
- Rejection Reason: If this permission is missing, VPC flow logs would not be able to create the necessary log groups, which could prevent logs from being published. This is the most likely cause of the issue.
B) The IAM policy that is attached to the IAM role for the flow log is missing the logs CreateExportTask permission
- Analysis: The `logs:CreateExportTask` permission is required to export logs from CloudWatch Logs to Amazon S3, but it is not necessary for the direct publishing of flow logs to CloudWatch Logs. This permission would be relevant if the company were ...
Author: Kai · Last updated Jul 17, 2026
A company deploys a new application on three Amazon EC2 instances across three Availability Zones. The company uses a Network Load Balancer (NLB) to route traffic to the EC2 instances. A SysOps administrator must implement a solution so that the EC2 instances allow traffic from ...
To meet the requirements of allowing traffic from only the NLB to the EC2 instances with the least operational overhead, we need to evaluate each of the options:
Option A: Configure the security group that is associated with the EC2 instances to allow traffic from only the security group that is associated with the NLB
- Reasoning: A Security Group can reference another Security Group, which allows for easy configuration to restrict access. By associating the NLB with a Security Group and configuring the EC2 instances' Security Group to allow traffic only from this NLB Security Group, we can ensure that only traffic originating from the NLB will be allowed.
- Advantages: This approach is simple, effective, and leverages AWS's native capabilities with minimal operational overhead. It’s a flexible and scalable solution because you don’t need to manage IPs or additional layers of security.
- Why other options are rejected:
- Option B requires manually tracking the elastic network interfaces (ENIs) associated with the NLB, which could be prone to errors if the ENIs change dynamically.
- Option C would require managing Network ACLs, which are not as flexible or easy to manage compared to Security Groups. While network ACLs are stateless and allow more granular control, they are more complicated to configure and maintain.
- Option D involves setting up and maintaining a third-party firewall solution, which adds complexity and overhead with no additional security benefits compared to using AWS Security Groups.
Option B: Configure the security group that is associated with the EC2 instances to allow traffic from only the elastic network interfaces that ...
Author: VenomousSerpent42 · Last updated Jul 17, 2026
A company that uses ServiceNow has an AWS account where a sensitive workload runs. The necessary security groups are in place. The company needs to implement a solution to create an incident in ServiceNow every time the rules change i...
Let's evaluate each of the options based on the requirements: creating an incident in ServiceNow every time a security group changes, while minimizing operational effort.
Option A: Create an Amazon CloudWatch alarm that enters ALARM state when security groups change. Configure the alarm to invoke an AWS Lambda function that connects to ServiceNow to create an incident.
- Reasoning: CloudWatch alarms are generally used for monitoring specific metrics or states, not for tracking configuration changes like security group modifications. While you can use CloudTrail to monitor API calls and configure CloudWatch alarms for those events, it would require manually setting up the alarm to trigger on specific security group-related actions. Lambda could then be invoked to create an incident in ServiceNow.
- Why it’s rejected: This approach would require extensive configuration and might not be as efficient or direct as using EventBridge, which is specifically designed to respond to configuration changes and other AWS events. It could also be prone to missing or misfiring alarms depending on event configuration, adding complexity.
Option B: Enable AWS Security Hub. Create an AWS Lambda function that connects to ServiceNow to create an incident. Create an Amazon EventBridge rule to detect security group changes. Configure the event type as Security Hub Findings - Custom Action. Configure the EventBridge rule to invoke the Lambda function.
- Reasoning: AWS Security Hub is a great tool for monitoring security compliance and issues, and it integrates with EventBridge. However, it is generally used to detect security findings across AWS services and is not specifically designed to track configuration changes such as those in security groups. Enabling Security Hub just to track these changes could be an overkill and introduce unnecessary complexity.
- Why it’s rejected: This solution adds the complexity of enabling Security Hub, which is more suited for security findings than the specific task of tracking security group changes. Using it would be an unnecessary layer of abstraction.
Option C: Create an Am...
Author: Arjun · Last updated Jul 17, 2026
A company needs to enforce tagging requirements for Amazon DynamoDB tables in its AWS accounts. A SysOps administrator must implement a solution to identify and remediate all DynamoDB tables that do not have the appropr...
To address the requirement of enforcing tagging compliance for Amazon DynamoDB tables with minimal operational overhead, let's evaluate each option based on its efficiency, scalability, and ease of implementation.
Option A: Create a custom AWS Lambda function to evaluate and remediate all DynamoDB tables. Create an Amazon EventBridge scheduled rule to invoke the Lambda function.
- Reasoning: This solution would involve creating a custom Lambda function to check for the correct tags and remediate any violations, then scheduling it with EventBridge to run periodically. While this approach can achieve the desired result, creating a custom Lambda function and scheduling it with EventBridge introduces unnecessary complexity.
- Why it’s rejected: It requires custom development, maintenance, and manual configuration for both the Lambda function and the EventBridge rule. This could lead to more overhead in terms of management and monitoring compared to using a native AWS solution.
Option B: Create a custom AWS Lambda function to evaluate and remediate all DynamoDB tables. Create an AWS Config custom rule to invoke the Lambda function.
- Reasoning: AWS Config allows you to assess and enforce configuration compliance. Using AWS Config with a custom Lambda function is a reasonable approach. AWS Config rules can be set to monitor DynamoDB table tags and trigger the Lambda function for remediation. While this solution uses native AWS services, it still requires developing a custom Lambda function and managing AWS Config rules, which can be more complex than using a pre-built AWS Config managed rule.
- Why it’s rejected: While AWS Config is great for monitoring, the need to build and maintain a custom Lambda function adds complexity and operational overhead. It’s more effort than necessary when there are managed solutions available.
Option C: Use the required-tags AWS Config managed rule to eval...
Author: Layla · Last updated Jul 17, 2026
A company is preparing for a marketing campaign that will increase traffic to a new web application. The application uses Amazon API Gateway and AWS Lambda for the application logic. The application stores relevant user data in an Amazon Aurora MySQL DB cluster that has one Aurora Replica. Database queries ...
To scale the Amazon Aurora MySQL database as traffic increases for the marketing campaign, the SysOps administrator must focus on a solution that is both effective and efficient for scaling based on workload characteristics, primarily the read-heavy nature of the application (95% read and 5% write). Let's evaluate the options:
Option A: Configure Aurora Auto Scaling to add or remove Aurora Replicas in the cluster based on the average CPU utilization of the Aurora Replicas.
- Reasoning: Aurora Auto Scaling allows for dynamic management of Aurora Replicas. However, scaling based on the CPU utilization of the Aurora Replicas may not be ideal for a workload that is read-heavy. Aurora Replicas typically handle read traffic, and while CPU utilization is a factor, other metrics like the number of connections or the read-to-write traffic ratio might give better insights into when to scale.
- Why it’s rejected: Scaling based solely on CPU utilization may not be the most accurate indicator for this scenario, especially since it's a read-heavy application and the replica's CPU utilization might not directly correlate with the need for additional replicas.
Option B: Configure Aurora Auto Scaling to increase or decrease the size of the Aurora Replicas based on the average CPU utilization of the Aurora Replicas.
- Reasoning: This option involves adjusting the size of the Aurora Replicas (e.g., scaling up the instance size) rather than adding or removing replicas. This could be helpful if the traffic requires more CPU resources on existing replicas. However, since the application has a high read-to-write ratio (95% read), simply scaling up the size of the replicas may not be as effective as adding more replicas to handle additional read requests.
- Why it’s rejected: The need here is more about handling additional read traffic, not just processing power. Adding more replicas to distribute read traffic is generally more effective than increasing the size of existing replicas in a read-he...
Author: StarryEagle42 · Last updated Jul 17, 2026
A company is using Amazon S3 to set up a temporary static website that is public. A SysOps administrator creates an S3 bucket by using the default settings. The SysOps administrator updates the S3 bucket properties to configure static website hosting. The SysOps administrator then uploads objects that contain content for index html and error html.
When the SysOps administrator navigates to th...
In this scenario, the SysOps administrator receives an HTTP Status Code 403 (Forbidden) error when attempting to access a static website hosted on an Amazon S3 bucket. This suggests that the issue is related to permissions and access control. Let’s evaluate each option to identify the most appropriate solution.
Option A: Create an Amazon Route 53 DNS entry to point the entry to the S3 bucket.
- Reasoning: While creating a DNS entry in Route 53 is part of the setup process for a static website, it is not the cause of the HTTP 403 error. The error is likely due to insufficient permissions in the S3 bucket itself, not because of DNS misconfiguration.
- Why it’s rejected: The problem here is related to access control and permissions, not the DNS configuration. Thus, this option does not address the issue at hand.
Option B: Edit the S3 bucket permissions by turning off Block Public Access settings. Create a bucket policy to allow GetObject access on the S3 bucket.
- Reasoning: The default settings for S3 buckets include Block Public Access settings that prevent public access to objects in the bucket. When configuring a static website, it’s necessary to explicitly allow public read access to the objects, including the index and error HTML files. Turning off the Block Public Access setting allows the bucket to accept public requests. Additionally, creating a bucket policy to allow `GetObject` access ensures that the content can be accessed publicly.
- Advantages: This solution directly addresses the issue by enabling public access to the bucket and ...
Author: Sophia Clark · Last updated Jul 17, 2026
A company has internal hybrid applications that have resources in the AWS Cloud and on premises. Users report that the applications sometimes are not available. The company has configured an Amazon CloudWatch alarm to monitor the tunnel status of its AWS Site-to-Site VPN connection.
A SysOps administrator must implement a soluti...
Reasoning and Explanation of Options:
Option A: Create an Amazon Simple Notification Service (Amazon SNS) topic for the CloudWatch alarm. Subscribe the ticketing tool's endpoint to the SNS topic.
- Pros:
- Simple and effective method of notifying external systems.
- SNS is widely used for sending notifications, and subscribing an endpoint (like an HTTP/S endpoint) directly to an SNS topic is straightforward.
- Cons:
- This approach relies on the ticketing tool being able to directly process notifications from SNS, which may not always be the case. Typically, external systems require a more structured payload (like a JSON file) to create tickets.
- It doesn’t provide the flexibility of custom logic or ticket creation within AWS (like transformation of data) or support for error handling.
Use Case: This option can be useful if the ticketing system is capable of directly processing SNS notifications and creating tickets.
Option B: Create an Amazon Simple Queue Service (Amazon SQS) queue as the target for the CloudWatch alarm. Configure the queue to transform messages into tickets and to post the tickets to the ticketing tools endpoint.
- Pros:
- SQS provides reliable message queuing, and messages can be processed asynchronously.
- You can decouple the CloudWatch alarm notification from the ticketing system, allowing for retries and backlogs if the ticketing tool is temporarily unavailable.
- Cons:
- SQS doesn’t natively support transformation of messages or creation of tickets in an external system. This means additional logic (e.g., using an AWS Lambda function) would be required to handle the message transformation.
- While this option allows for message persistence and retrying, it requires more setup and is more complex.
Use Case: This option is suitable when there's a need for message persistence and retry logic. However, it requires extra configuration and might not be the simplest solution for creating tickets directly.
Option C: Create an AWS Lambda function. Configure the CloudWatch alarm to directly invoke the Lambda function to create individual tickets in the ticketing tool.
- Pros:
- Lambda functions can be highly customized....
Author: Liam123 · Last updated Jul 17, 2026
A SysOps administrator is troubleshooting an AWS CloudFormation stack creation that failed. Before the SysOps administrator can identify the problem, the stack and its resources are deleted. For future deployments, the SysOps administrator must preserve any resour...
Reasoning and Explanation of Options:
Option A: Set the value of the DisableRollback parameter to False during stack creation.
- Explanation: The DisableRollback parameter controls whether AWS CloudFormation should automatically roll back the stack when the creation fails. If set to False, CloudFormation will roll back the stack in case of a failure. This would not preserve resources created before the failure. Setting this to False would mean that resources would be deleted if the stack creation fails, which directly contradicts the requirement of preserving successfully created resources.
- Conclusion: This option does not meet the requirement since it leads to the deletion of resources in the event of a failure.
Option B: Set the value of the OnFailure parameter to DO_NOTHING during stack creation.
- Explanation: The OnFailure parameter controls what CloudFormation should do if the stack creation fails. Setting this to DO_NOTHING means that CloudFormation will not take any action (e.g., rollback) after a failure. This would leave any successfully created resources intact. DO_NOTHING ensures that no rollback occurs, and successfully created resources are preserved even after the failure.
- Conclusion: This option meets the requirement because it prevents CloudFormation from deleting resources after a failure, allowing the SysOps administrator to troubleshoot and identify the cause of the failure without losing resources.
Option C: Specify a rollback configuration that has a rollback trigger of DO_NOTHING during stack creation.
- Explanation: This option specifies a rollback configuration with a DO_NOTHING trigger. Rollback trigger...
Author: Ahmed · Last updated Jul 17, 2026
A company needs to implement a solution to install specific software on Amazon EC2 instances when the instances lau...
Reasoning and Explanation of Options:
Option A: Configure AWS Systems Manager State Manager associations to bootstrap the EC2 instances with the required software at launch.
- Explanation: AWS Systems Manager State Manager is a service that automates the configuration and management of instances. By creating a State Manager association, you can automatically install specific software when EC2 instances launch. State Manager allows you to specify commands, scripts, or other configurations to run when the instance is launched or after the instance starts.
- Pros:
- It is designed for managing configurations and can automate the installation of software.
- You can define associations that are automatically applied to EC2 instances at launch.
- Provides a repeatable and scalable solution.
- Supports both on-demand and scheduled execution.
- Conclusion: This is the most appropriate option to meet the requirement, as it directly provides a mechanism for software installation upon EC2 instance launch.
Option B: Use the Amazon CloudWatch agent to detect EC2 InstanceStart events and to inject the required software. Modify the InstanceRole IAM role to add permissions for the StartTask API operation.
- Explanation: CloudWatch is typically used for monitoring and logging purposes, and while you can use CloudWatch events to trigger actions, using it to install software directly is not a standard approach. Additionally, the StartTask API is related to ECS tasks, not EC2 instance launches, which makes this approach confusing.
- Cons:
- CloudWatch events can trigger actions, but it’s not a suitable tool for installing software on EC2 instances by itself. It’s better suited for monitoring and responding to events rather than for configuring instances.
- This would require unnecessary configuration and complexity, especially with permissions, making it less efficient for this use case.
- Conclusion: This app...
Author: Layla · Last updated Jul 17, 2026
A company is using Amazon CloudWatch alarms to monitor Amazon Elastic Kubernetes Service (Amazon EKS) workloads. The alarms are initiated through a threshold definition and are not helping the EKS cluster operate more efficiently.
A SysOps administrator must implement a solution that identi...
Reasoning and Explanation of Options:
Option A: Use CloudWatch anomaly detection to identify anomalies and provide recommendations.
- Explanation: CloudWatch Anomaly Detection is a feature that helps identify unusual patterns in metrics by analyzing historical data. It uses machine learning to detect anomalies and alert users when the metric deviates from normal behavior. However, CloudWatch anomaly detection by itself doesn't provide recommendations on how to fix or address the anomalies—it simply detects them.
- Cons: While anomaly detection can identify anomalies in EKS metrics, it doesn't offer built-in recommendations for addressing those anomalies.
- Conclusion: This option can detect anomalies but doesn’t meet the requirement of generating recommendations on how to address those anomalies.
Option B: Use CloudWatch Container Insights with Amazon DevOps Guru to identify anomalies and provide recommendations.
- Explanation: CloudWatch Container Insights provides deep visibility into containerized workloads on EKS, including metrics and logs, helping to identify performance bottlenecks and operational issues. When combined with Amazon DevOps Guru, which analyzes application behaviors and suggests improvements, it can detect anomalies and provide actionable insights and recommendations.
- Pros:
- CloudWatch Container Insights provides detailed insights into container metrics, logs, and performance.
- Amazon DevOps Guru offers intelligent recommendations on how to improve the system’s efficiency and performance, including resolving anomalies.
- This combination directly addresses both the anomaly detection and the generation of recommendations for resolving those anomalies.
- Conclusion: This solution meets the requirement fully by not only identifying anomalies but also providing actionable recommendations.
Option C: Use CloudWatch Container Insights to identify...
Author: Kai · Last updated Jul 17, 2026
A company has an application that uses Amazon DynamoDB tables. The tables are spread across AWS accounts and AWS Regions. The company uses AWS CloudFormation to deploy AWS resources.
A new team at the company is deleting unused AWS resources. The team accidentally deletes several production DynamoDB tables by running an AWS Lambda function that makes a DynamoDB DeleteTable API call. The table deletions cause an application outage.
A SysOps administrator must implement a solution that...
Reasoning and Explanation of Options:
Option A: Enable termination protection for the CloudFormation stacks that deploy the DynamoDB tables.
- Explanation: Termination protection for CloudFormation stacks prevents the stack from being deleted. However, termination protection only applies to deleting the stack itself. It does not specifically protect individual resources like DynamoDB tables from being deleted directly (e.g., by a Lambda function or a manual DeleteTable API call).
- Cons: This solution doesn't directly prevent DynamoDB tables from being deleted through other means such as API calls or Lambda functions. It focuses on the stack deletion, not on the individual resource.
- Conclusion: This option is not sufficient by itself because it only protects the entire stack, not individual resources like DynamoDB tables.
Option B: Enable deletion protection for the DynamoDB tables.
- Explanation: Deletion protection for DynamoDB tables is a feature that prevents accidental deletion of tables. If deletion protection is enabled on a table, any attempt to delete the table using the DeleteTable API call will result in an error, thereby preventing the deletion of the table.
- Pros:
- It directly protects the DynamoDB tables from being deleted by the Lambda function or other accidental deletions.
- This is an effective safeguard for preventing table deletions.
- Conclusion: This option directly addresses the need to protect DynamoDB tables from accidental deletions and is a crucial step to minimize the risk of losing important data.
Option C: Enable point-in-time recovery for the DynamoDB tables. Restore the tables if they are accidentally deleted.
- Explanation: Point-in-time recovery (PITR) for DynamoDB tables provides a mechanism to restore tables to any point in time within the last 35 days. This feature helps minimize data loss if a table is accidentally deleted or modified. In case of accidental deletion, you can restore the table and its data.
- Pros:
- PITR provides a mechanism to recover deleted tables, minimizing data loss by allowing recovery to a specific time before the deletion occurred.
- It’s an excellent solution for data protection and rapid recovery a...
Author: Mia · Last updated Jul 17, 2026
A company has created an AWS CloudFormation template that consists of the AWS::EC2::Instance resource and a custom CloudFormation resource. The custom CloudFormation resource is an AWS Lambda function that attempts to run automation on the Amazon EC2 instance.
During testing, the Lambda functio...
Let's break down the options one by one and analyze them in the context of the issue:
Problem Context:
The Lambda function is trying to run automation on the EC2 instance before the instance is actually launched. Therefore, you need to ensure that the EC2 instance is fully created before the Lambda function is triggered.
---
A) Add a DependsOn attribute to the custom resource. Specify the EC2 instance in the DependsOn attribute.
- Explanation:
The `DependsOn` attribute is used in CloudFormation to control the order of resource creation. By adding a `DependsOn` attribute and specifying the EC2 instance as a dependency, you ensure that the Lambda function (custom resource) only runs after the EC2 instance is successfully created.
- Why this works:
This solution ensures that the Lambda function will not execute until the EC2 instance is ready. It's the most appropriate and straightforward solution to control the sequence of resource creation.
- Rejection of other options:
- B) Updating the service token or the Lambda function’s endpoint doesn't solve the problem of ensuring sequence, as it doesn’t affect the order in which resources are created.
- C) The `cfn-response` module is used for responding to CloudFormation about the success or failure of custom resources, but it doesn't control the order in which resources are created.
- D) The `Fn::If` intrinsic function could potentially be used for conditional resource creation, but it is unnecessary in this case as you can control resource order directly using `DependsOn`.
- Scenario where this option is useful:
This is the correct approach when you want to control the execution order between two resources in CloudFormation.
---
B) Update the custom resource's service token to point to a valid Lambda function.
- Explanation:
The service token in CloudFormation custom resources specifies the Lambda function's ARN that handles the custom resource's requests. This option would be us...
Author: NebulaEagle11 · Last updated Jul 17, 2026
A SysOps administrator needs to ensure that an Amazon RDS for PostgreSQL DB instance has available backups. The DB instance has automated backups turned on with a backup retention period of 7 days. However, no automated backups for the DB in...
Let's analyze each option carefully to determine the cause of the lack of automated backups for the Amazon RDS for PostgreSQL DB instance:
---
A) The Amazon S3 bucket that stores the backups is full.
- Explanation:
Amazon RDS uses Amazon S3 for storing backups. However, RDS automatically manages the storage for backups, meaning it doesn't rely on a specific S3 bucket managed by the user. The backups are stored in a managed service in the backend, and AWS handles scaling the storage automatically. Therefore, the "full S3 bucket" issue wouldn't cause a lack of automated backups.
- Why this is rejected:
The issue isn't related to an S3 bucket being full. RDS manages backup storage automatically, and there is no direct user interaction with the S3 bucket that holds backups for RDS instances.
---
B) The DB instance is in the STORAGE_FULL state.
- Explanation:
If an RDS instance is in the `STORAGE_FULL` state, it means that the instance has run out of disk space. This could prevent RDS from taking automated backups, as backups require available storage to create snapshots.
- Why this works:
If the DB instance is in a `STORAGE_FULL` state, automated backups cannot be created because RDS would be unable to store the backups due to lack of space. This is a valid reason for no automated backups being created.
- Scenario where this option is useful:
If the DB instance is...
Author: Emma Brown · Last updated Jul 17, 2026
A company has a list of pre-approved Amazon Machine Images (AMIs) for developers to use to launch Amazon EC2 instances. However, developers are still launching EC2 instances from unapproved AMIs.
A SysOps administrator must implement a solution that automatica...
Let's break down the options in terms of how they can solve the problem of automatically terminating EC2 instances launched from unapproved AMIs.
---
A) Set up an AWS Config managed rule to check if instances are running from AMIs that are on the list of pre-approved AMIs. Configure an automatic remediation action so that an AWS Systems Manager Automation runbook terminates any instances that are noncompliant with the rule.
- Explanation:
AWS Config can monitor configurations of AWS resources, including EC2 instances, and check whether they comply with specific rules. You can create a custom or managed rule that checks whether the launched EC2 instance is using an AMI from a list of approved AMIs. Once a non-compliant instance is detected, AWS Config can trigger an automatic remediation action using AWS Systems Manager Automation to terminate the instance.
- Why this works:
This solution is ideal because AWS Config can continuously monitor compliance and automatically trigger remediation actions, ensuring that any EC2 instance launched from an unapproved AMI is automatically terminated. The solution is fully automated and leverages native AWS services.
- Rejection of other options:
- B) Launch templates are useful for configuring instances but don’t inherently have the ability to check the AMI against an approved list at runtime, making it less effective for automatically terminating non-compliant instances.
- C) CloudWatch metrics track instance states, but it doesn't directly support checking the AMI used for launching the instance. Furthermore, terminating instances via CloudWatch alarms is not a built-in feature.
- D) While Amazon Inspector can identify vulnerabilities or misconfigurations, it's designed for security assessments rather than operational management like terminating non-compliant EC2 instances. It would add complexity and overhead with additional services like SQS and Lambda.
- Scenario where this option is useful:
This is the most efficient and simplest solution for ensuring compliance with approved AMIs in an automated way using AWS-native tools.
---
B) Store the list of pre-approved AMIs in an Amazon DynamoDB global table that is replicated to all AWS Regions that the developers use. Create Regional EC2 launch templates. Configure the launch templates to check AMIs against the list and to terminate any instances that are not on the list.
- Explanation:
This option suggests using DynamoDB to store the list of approved AMIs and EC2 launch templates to enforce AMI checks. However, launch templates don't support the direct termination of instances if they are...
Author: SolarFalcon11 · Last updated Jul 17, 2026
Users of a company's internal web application recently experienced application performance issues for a brief period. The application includes frontend web servers that run in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The application also includes a backend Amazon Aurora PostgreSQL DB cluster that includes one DB instance.
A SysOps administrator determines that the source of the performance issues was high utilization of the DB cluster. The single writer instance experienced more than 90% utilization for 11 minutes. T...
Let's analyze each option in detail to determine the best approach to prevent performance issues during the scheduled report run.
---
A) Increase the size of the DB instance. Monitor the performance during the next scheduled run of the report.
- Explanation:
Increasing the size of the DB instance will provide more resources (CPU, memory, etc.) to handle higher workloads. This could improve performance and potentially avoid the 90% utilization seen during the report execution.
- Why this could work:
Scaling up the DB instance can provide the additional resources needed to handle the high demand during the report run. This approach can be effective in certain scenarios where the workload consistently requires more resources.
- Why this might not be the best solution:
While increasing the size of the DB instance may solve the immediate issue, it doesn’t address the underlying cause of high utilization, which is the specific, recurring workload (the report). Additionally, this approach doesn't scale well in terms of handling the load more efficiently, especially if the report becomes larger over time or if there are other bottlenecks.
---
B) Add a reader instance. Change the database connection string of the report application to use the newly created reader instance.
- Explanation:
Adding a reader instance to the Aurora PostgreSQL DB cluster provides a replica that can handle read queries, offloading some of the read traffic from the writer instance. In this case, if the report is primarily a read-heavy query, offloading the report's workload to the reader instance could reduce the load on the writer instance and prevent high utilization.
- Why this works:
Offloading read-heavy workloads to a reader instance can significantly reduce the load on the writer instance, allowing it to focus on write operations and general database management. This would help ensure that the report’s execution does not affect the overall performance of the application.
- Why this might not work:
If the report involves write operations (e.g., inserting data or updating records), offloading it to a reader instance will not resolve the issue, as reader instances are read-only and cannot handle writes. However, if the report is mainly read-heavy, this solution would be h...
Author: Liam · Last updated Jul 17, 2026
A company is using AWS to deploy a critical application on a fleet of Amazon EC2 instances. The company is rewriting the application because the application failed a security review. The application will take 12 months to rewrite. While this rewrite happens, the company needs to rotate IAM access keys that the application uses.
A SysOps administrator must implement an automated solution that finds and rotates IAM access keys tha...
Let's evaluate each of the options based on operational efficiency, automation, and simplicity:
---
A) Use an AWS Config rule to identify IAM access keys that are at least 30 days old. Configure AWS Config to invoke an AWS Systems Manager Automation runbook to rotate the identified IAM access keys.
- Explanation:
AWS Config is a powerful tool for monitoring and managing AWS resource configurations. You can set up an AWS Config rule to detect IAM access keys that are older than 30 days. Once identified, AWS Config can trigger a Systems Manager Automation runbook to rotate the keys automatically.
- Why this works:
This solution uses AWS Config to continuously monitor for non-compliant IAM access keys (those older than 30 days), and it automates the entire process by invoking an AWS Systems Manager Automation runbook to rotate the keys. It’s a fully managed, automated solution with minimal operational overhead.
- Why it might be better than other options:
This approach provides continuous monitoring, automated remediation (via the Systems Manager Automation), and uses native AWS services designed for operational efficiency. It’s more streamlined than the other options and is highly scalable.
---
B) Use AWS Trusted Advisor to identify IAM access keys that are at least 30 days old. Configure Trusted Advisor to invoke an AWS Systems Manager Automation runbook to rotate the identified IAM access keys.
- Explanation:
AWS Trusted Advisor offers insights into best practices for AWS accounts, including security checks. However, Trusted Advisor is more about providing recommendations rather than automating processes. It can flag IAM access keys that are older than 30 days, but it doesn’t have the ability to trigger automated actions like rotating keys directly.
- Why this is rejected:
AWS Trusted Advisor does not provide an automated way to take action based on the findings. While it can identify old keys, it cannot trigger actions like invoking a Systems Manager Automation runbook to rotate them. Therefore, this option would require additional manual intervention or custom automation, making it less efficient compared to the other options.
---
C) Create a script that checks the age of...
Author: Layla · Last updated Jul 17, 2026
A company receives an alert from an Amazon CloudWatch alarm. The alarm indicates that a web application that is running on Amazon EC2 instances is not responding to requests. The EC2 instances have a Red Hat Enterprise Linux operating system and are in an Auto Scaling group. The Auto Scaling group has a minimum capacity of 2 and a maximum capacity of 5.
An investigation reveals that the web application is experiencing out-of-memory errors. The company adds memory to the web application and wants to track operating sys...
To track operating system memory utilization in Amazon EC2 instances running Red Hat Enterprise Linux, you need to collect system-level metrics that are not provided by default in CloudWatch. Here's an analysis of the options:
A) Use an Amazon Machine Image (AMI) that includes the CloudWatch agent.
- Reasoning: The CloudWatch agent is required to collect operating system metrics such as memory usage, which are not available by default on EC2 instances (especially with Linux OS). The CloudWatch agent can collect detailed memory usage metrics and send them to CloudWatch for monitoring. Installing and configuring the CloudWatch agent on the EC2 instances will allow the EC2 instances to send memory utilization data to CloudWatch.
- Scenario for use: This is the correct option because it directly addresses the need for tracking memory utilization metrics on EC2 instances.
B) Turn on CloudWatch detailed monitoring.
- Reasoning: CloudWatch detailed monitoring provides more frequent data points for metrics such as CPU utilization, disk I/O, and network traffic, but it does not collect additional metrics like memory usage. Memory metrics are not part of CloudWatch's default or detailed monitoring metrics, so this option would not help track memory usage.
- Scenario for use: This option could be used if you need more frequent updates for default CloudWatch metrics (like CPU, disk, and network), but it does not solve the problem of monitoring memory utilization.
C) Turn on Instance Metadata Service Version 2 (IMDSv2).
- Reasoning: IMDSv2...
Author: Ava · Last updated Jul 17, 2026
A company is using an Amazon CloudWatch alarm to monitor the FreeLocalStorage metric for an Amazon Aurora PostgreSQL production database. The alarm goes into ALARM state and indicates that the database is running low on temporary storage. A SysOps administrator discovers that a weekly report is us...
To solve the problem of running low on temporary storage due to the weekly report, let’s analyze each option in detail to determine the best solution:
A) Turn on Aurora PostgreSQL query plan management.
- Reasoning: Aurora PostgreSQL query plan management is used to optimize and control query execution plans, which can improve performance by ensuring consistent and efficient query plans. However, this option does not address the issue of temporary storage usage directly. It would not help resolve the issue of the weekly report consuming temporary storage.
- Scenario for use: This option is suitable for improving query execution efficiency and ensuring stable query performance but does not directly solve the problem of high temporary storage usage due to specific reports.
- Rejected: This option doesn't address the immediate issue with temporary storage consumption.
B) Modify the configuration of the DB cluster to turn on storage auto-scaling.
- Reasoning: Aurora storage auto-scaling automatically increases the storage allocated to the database as needed. However, temporary storage (used for operations like sorts, joins, etc.) is different from database storage, and Aurora storage auto-scaling does not apply to temporary storage. The issue here is specifically with temporary storage, not database storage.
- Scenario for use: This option is useful if the database storage itself needs to scale, but does not solve the temporary storage issue caused by the weekly report.
- Rejected: This option doesn't solve the problem because it only applies to database storage, not temporary storage.
C) Add an Aurora read replica to the DB cluster. Modify the report to use the new read replica.
- Reasoning: Adding a read replica helps distribute read workloads, but temporary storage usage is still a concern for the database running the report, regardless of whether the query is exec...
Author: Liam123 · Last updated Jul 17, 2026
A company is running a development application on an Amazon EC2 instance. The application uploads 500,000 files that are 1 GB in size into a target Amazon S3 bucket that has default encryption enabled. The EC2 instance is in the same AWS Region where the S3 bucket is deployed.
The company uses performance logging that is built into the application software. The logs show that the application is constantly waiting for the files to be written to the S3 bucket. A SysOps administrator needs to improve ...
To improve the S3 upload performance, let's analyze each option carefully to determine the best solution for the problem of constant waiting during file uploads:
A) Enable S3 Transfer Acceleration on the S3 bucket.
- Reasoning: S3 Transfer Acceleration is designed to speed up transfers from clients to S3 by routing traffic through optimized edge locations in AWS. It is particularly useful when the source and destination are geographically distant. However, in this case, the EC2 instance and the S3 bucket are in the same AWS Region, meaning S3 Transfer Acceleration would not significantly improve the performance because the data is not traveling across long distances where edge locations can optimize the transfer. In-region transfers already have low latency and high performance.
- Scenario for use: This option is useful for transferring data from geographically distant locations to S3, but it won't offer much benefit when the source and destination are in the same region.
- Rejected: This option does not provide any meaningful benefit in the described scenario where both the EC2 instance and S3 bucket are in the same region.
B) Split the S3 write operations to use multiple bucket prefixes to write items in parallel.
- Reasoning: This is a highly effective method for improving S3 upload performance. By distributing the files across multiple bucket prefixes (i.e., organizing files into different "folders" within the bucket), S3 can handle the requests in parallel and reduce bottlenecks. S3 performance can be limited if multiple requests are made to the same prefix because S3 automatically applies serialization to requests on the same prefix. By spreading the uploads across multiple prefixes, you allow S3 to process the uploads concurrently and potentially speed up the overall throughput.
- Scenario for use: This approach is ideal for increasing upload throughput when multiple large files are being uploaded to a single S3 bucket in the same region.
- Selected: This is the most effective solution to improve throughput performance in this case.
C) Configure AWS PrivateLink for Amazon S3. Turn off encryption on the S3 bucket.
- Reasoning: AWS PrivateLink provides private connectivity...
Author: Evelyn · Last updated Jul 17, 2026
A company is using an Amazon EC2 Auto Scaling group to support a workload. A SysOps administrator finds that the Auto Scaling group is configured with two similar scaling policies.
One scaling policy adds 5 instances when CPU utilization reaches 80%. The other scaling policy...
To understand what happens when CPU utilization reaches the 80% threshold in this scenario, let's analyze the behavior of the two scaling policies and the way EC2 Auto Scaling works.
Scaling Policies:
1. First scaling policy: Adds 5 instances when CPU utilization reaches 80%.
2. Second scaling policy: Adds 10 instances when CPU utilization reaches 80%.
EC2 Auto Scaling Behavior:
- When multiple scaling policies are triggered by the same CloudWatch metric (in this case, CPU utilization reaching 80%), Amazon EC2 Auto Scaling will apply both policies. Each policy is evaluated independently based on the threshold (80% in this case).
- When both scaling policies are triggered (and they add instances in response to the same metric), the Auto Scaling group will add the total number of instances specified by both policies.
Therefore, when CPU utilization reaches 80%, both policies will trigger:
- One policy will add 5...
Author: Julian · Last updated Jul 17, 2026
An application uses an Amazon Aurora MySQL DB cluster that includes one Aurora Replica. The application's read performance degrades when there are more than 200 user connections. The number of user connections is approximately 180 on a consistent basis. Occasionally, the number of user connections increases rapidly to more than 200.
A SysOps administrator mu...
To meet the requirements of automatically scaling the application based on user demand, let's analyze each option in detail:
A) Modify the DB cluster by increasing the Aurora Replica instance size.
- Reasoning: Increasing the instance size for the Aurora Replica can help with read performance, but it doesn't address the issue of scaling based on the number of user connections. Increasing the instance size can improve performance, but it is a static change and does not automatically adjust based on user demand. This solution would not provide automatic scaling, and it would not help with the increase in connections if it happens frequently.
- Scenario for use: This option could be helpful in specific cases where a single larger replica is needed to handle a higher load, but it doesn't address the automatic scaling requirement.
- Rejected: This solution is a manual change and does not meet the need for dynamic scaling based on fluctuating user demand.
B) Modify the DB cluster by changing to serverless mode whenever the number of user connections exceeds 200.
- Reasoning: Aurora serverless mode automatically adjusts capacity based on the number of active connections or workload, scaling up and down as needed. While Aurora serverless could solve the problem by automatically scaling the compute resources, serverless mode does not support read replicas and may not provide the best performance for high-traffic applications that require consistent throughput. Also, migrating to serverless is not ideal for environments with predictable high throughput requirements.
- Scenario for use: This could be an option if your workload is highly variable, and you want to avoid over-provisioning compute. However, Aurora serverless is not ideal for consistent, high-performance workloads that require predictable read/write throughput.
- Rejected: Not the best fit for applications with consistent, predictable traffic patterns and the need for high performance.
C) Migrate to a new Aurora DB cluster that has multiple writer instances. Modify the application's database connection string.
- Reasoning: Aurora supports multi-master setups, where multiple writer instances can be used to ...
Author: Emma Brown · Last updated Jul 17, 2026
A company runs a single-page web application on AWS. The application uses Amazon CloudFront to deliver static content from an Amazon S3 bucket origin. The application also uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to serve API calls.
Users sometimes report that the website is not operational, even when monitoring shows that the index page is reachable and that the EKS cluster is healthy. A SysOps ...
To solve this problem, we need to choose a solution that proactively monitors the availability and operational status of the website, even before users report issues. The goal is to detect potential disruptions early. Let’s analyze each option in detail:
Option A: Create an Amazon CloudWatch Synthetics heartbeat monitor canary that points to the fully qualified domain name (FQDN) of the website.
- Reasoning: A heartbeat monitor is used to periodically check the availability of a website or an application by pinging it at regular intervals. The canary checks the website's FQDN (e.g., www.example.com) and sends heartbeats, reporting any failures to CloudWatch. This is a great option because it directly checks the availability of the public-facing website, which is often where the issue might be, especially when users report the site not being operational. The heartbeat monitor ensures that it can detect issues in the website’s overall availability or responsiveness, especially when users cannot access it.
- Why not others? This is the most straightforward method to monitor the overall availability of the website, and since the problem occurs on the website (not the API), a heartbeat monitor will be able to proactively detect and alert before user complaints are received.
Option B: Create an Amazon CloudWatch Synthetics API canary that monitors the availability of API endpoints from the EKS cluster.
- Reasoning: While this monitors the API endpoints and their availability, it doesn't directly address the primary concern of the website's availability. The issue reported by users is with the website, not necessarily the API. If the API is healthy but the website is still down, the API canary wouldn’t be sufficient to detect the problem. This would only help if the API was causing the outage, which doesn’t seem to be the main issue here.
- Why not others? While API monitoring is important, it doesn't address the full problem of website availability. The website's issues may be related to its static content or some other aspect unrelated to the...
Author: VenomousSerpent42 · Last updated Jul 17, 2026
A company hosts an application on Amazon EC2 instances. The instances are in an Amazon EC2 Auto Scaling group that uses a launch template. The amount of application traffic changes throughout the day. Scaling events happen frequently.
A SysOps administrator needs to help developers troubleshoot the application. When a scaling event removes an instance, EC2 Auto Scaling terminates the instance befo...
To help developers troubleshoot the application when an instance is about to be terminated during a scaling event, we need a solution that ensures the instance is protected from termination so that the developers can log in and investigate the issues.
Let’s analyze each option in detail:
Option A: Ensure that the Delete on termination setting is turned off in the UserData section of the launch template.
- Reasoning: The Delete on termination setting refers to whether the Amazon EBS volume attached to an instance is deleted when the instance is terminated. This setting does not directly address the problem of preventing the instance from being terminated. It only affects the EBS volume, not the EC2 instance itself. Turning off this setting would ensure that the EBS volume is preserved, but it won’t prevent the instance from being terminated during a scaling event.
- Why not others? This option is not relevant to the core issue of preventing instance termination. It is primarily about preserving the attached storage and not about protecting the instance itself.
Option B: Update the Auto Scaling group by enabling instance scale-in protection for newly launched instances.
- Reasoning: Instance scale-in protection allows you to prevent EC2 instances from being terminated during a scaling-in event (when the group is reducing its size). This is the most relevant and effective solution because it directly addresses the problem of preventing termination when scaling down. By enabling scale-in protection, the instance will not be terminated, even when Auto Scaling needs to reduce the number of instances in response to lower traffic. This would give developers the time they need to log in and troubleshoot the instance.
- Why not others? This option directly prevents instance termination during scaling events, which is the desired outcome. It’s th...
