Timed Mode Set 6 – AWS Certified SysOps Administrator Associate

An organization has an application running in an Auto Scaling group of Amazon EC2 instances. You have been tasked to remotely execute shell scripts and securely manage the configuration of your instances.

Which of the following could help you achieve this requirement?

A company is using AWS CloudFormation to provision a set of AWS resources across multiple regions. The manager noticed that the infrastructure configuration differs from its previous state. As the company’s CloudOps Engineer, the task is to identify configuration changes across resources.

Which of the following could help you achieve this requirement?

A company is using AWS KMS to encrypt the data in its suite of financial applications deployed in different AWS accounts. Additionally, Amazon EC2 key pairs are used to manage SSH access to instances across these accounts. The CloudOps Engineer is instructed to capture all events related to AWS KMS and EC2 key pairs, including key creation, deletion, and rotation, across all accounts. This is required for security compliance and audit readiness.

Which of the following approach can be used to fulfill this requirement?

A financial organization has created a custom KMS key with imported key material. The key is used to encrypt the data of a Java web application. To meet strict security compliance requirements, the KMS key must be rotated every 6 months.

Which of the following could help you achieve this requirement?

A company has a requirement to connect their on-premises network to a new VPC on AWS to complete their hybrid cloud architecture. As the CloudOps Engineer of the company, you are responsible in both managing their cloud infrastructure as well as establishing connectivity to their other corporate data centers.

Which of the following should provide your resources on AWS the connectivity to external networks? (Select TWO.)

A company has multiple sets of running Amazon EC2 instances, each with an ELB to distribute traffic among the instances. It is important that the endpoints are reachable, and the CloudOps Engineer should be notified if something goes wrong. Amazon Route 53 health checks must be integrated with Amazon CloudWatch alarms to monitor endpoint health.

Which of the following are valid types of Route 53 health checks that can be used? (Select TWO.)

A research agency is performing a migration operation with its production file server to AWS. The CloudOps Engineer is required to ensure that the data stored on the file server in AWS will remain accessible even if an Availability Zone (AZ) is unavailable, system maintenance is ongoing, or unplanned service disruption occurs. In addition, users should be able to interact with the file server via SMB protocol and manage file permissions using Windows Access Control Lists (ACLs).

Which cloud solution can help the CloudOps Engineer accomplish the requirements?

A company with a multi-account AWS environment has several AWS resources that are shared with an external entity. To improve the security posture of the company’s cloud infrastructure, the CloudOps Engineer needs to preview any changes to be implemented in the existing resource permissions. The Administrator must ensure that the new policy changes grant only the intended public and cross-account access to their specified cloud resource. A weekly report is also necessary which contains a list of all the access and the external principal granted to each shared AWS resource.

What should the Engineer do to satisfy the given requirement?

A former colleague reached out to you for consultation. He uploads a Django project in Elastic Beanstalk through CLI using instructions he read in a blog post, but for some reason he could not create the environment he needs for his project. He encounters an error message saying “The instance profile aws-elasticbeanstalk-ec2-role associated with the environment does not exist.”

What are the possible causes of this issue? (SELECT TWO.)

A CloudOps Engineer is managing a web application that uses Amazon ElastiCache for Memcached to cache frequently accessed data. The customers have been complaining about the system performance for the past 3 months. The Engineer monitors the metrics of each service using Amazon CloudWatch. Upon checking, the metrics of the EC2 instances of the web tier are normal but the eviction count has exceeded its threshold.

What should the Engineer do to rectify this issue?

A facial recognition system is using an Auto Scaling group of On-Demand EC2 instances. It has one specific instance which is causing an error and must be terminated immediately. Using the AWS CLI, how can you terminate an instance from the specified Auto Scaling group without updating the size of the group?

A CloudOps Engineer needs to implement a highly available and scalable cloud architecture in AWS for the new online remittance system of the organization. The Engineer set up an Application Load Balancer and launched an Auto Scaling group of Spot EC2 instances on their UAT VPC. The QA team conducted performance testing on the new system and found out a defect in the application server. The Engineer wants to investigate the problem and make the necessary changes without invoking the scaling down processes, which is why the Engineer temporarily suspended the Terminate scaling process.

What will be its effect on the Auto Scaling group’s Availability Zone rebalancing process (AZRebalance) during this period?

A tech startup company plans to develop a mobile application that sends and fetches data to a DynamoDB table. The app is using the DynamoDB SDK and root account access keys to connect to DynamoDB.

Which of the following is the best option to improve the security of this architecture?

A leading insurance firm has a VPC in the US East (N. Virginia) region for their head office in New York and another VPC in the US West (N. California) for their regional office in California. There is a requirement to establish a low latency, high-bandwidth connection between their on-premises data center in Chicago and both of their VPCs in AWS.

As the SysOps Administrator of the firm, how could you implement this in a cost-effective manner?

A company currently has an application which is hosted in an On-Demand EC2 instance in one Availability Zone. You are instructed to redesign the architecture to make it scalable and highly available. Which of the following should you do to accomplish this task?

A CloudOps Engineer is using the AWS CloudFormation template to create AWS resources. The template specifically defines an Auto Scaling group of Amazon EC2 instances. The Auto Scaling group launch template includes a user data script to provision each EC2 instance. The team also uses AWS Systems Manager Automation Runbook to manage routine operational tasks on the EC2 instances. Unfortunately, the creation of the Auto Scaling group resource is failing because a wait condition isn’t receiving success signals.

Which solution must the CloudOps Engineer implement to resolve the error?

An IT Consulting company has three separate AWS accounts in different regions with one VPC on each account. A manager instructed connecting the three VPCs to each other and reminded that VPCs have no overlapping IPv4 or IPv6 CIDR blocks. The manager also considered using AWS Transit Gateway, but a more cost‑effective solution is required.

Which of the following is the most cost-effective connectivity option for this scenario?

A money transfer mobile app is heavily using RESTful web services, which are hosted in an Auto Scaling group of Spot Amazon EC2 instances across multiple Availability Zones and a Load Balancer. The monitoring system is being set up, and it is known that the web services currently utilize a significant amount of memory in order to function properly.

Which of the following should be implemented to properly monitor the memory usage of the EC2 instances?

A web application is hosted on three EC2 instances on different subnets behind an Application Load Balancer with an RDS MySQL database. The CloudOps Engineer configured a custom network ACL and security group for all the EC2 instances and the ALB that explicitly allows incoming traffic on ports 80 and 443. However, the website is still unavailable over the public internet via HTTP and HTTPS.

What should the CloudOps Engineer do to resolve the issue?

A company is using Amazon S3 to serve static content and Amazon CloudFront to speed up content delivery to its users across the globe. For the next business cycle, the company plans on improving these services to attract more customers and provide a better user experience. To plan the next step, the CloudOps Engineer requires more information regarding the activities occurring in the AWS resources. CloudFront includes a variety of reports that the Engineer can use to view usage and activity within the CloudFront distributions.

How can the Engineer utilize these reports for this purpose? (Select TWO.)

A company developed a new website that is ready to be deployed in AWS and be made publicly available over the Internet. But before they do so, the website should support HTTPS since it will be delivering confidential information over the network. The website is required to meet regulatory and compliance requirements for encryption of data in transit.

Which of the following services will enable the company to provision SSL/TLS certificates for its website for encryption of sensitive data in transit and authentication purposes?

The company’s AWS billing report is currently generated on a monthly basis. To strengthen financial monitoring, the accounting department instructed the CloudOps Engineer to implement a mechanism for receiving billing updates more frequently than once a month. A spreadsheet application will be used to view and analyze the billing data.

Which of the following is the MOST suitable solution that the Engineer should implement for this scenario?

A company has numerous AWS accounts and is managed using AWS Organizations. The finance department has requested a monthly breakdown of cloud expenditures for each department. AWS Systems Manager OpsCenter is used as a centralized location to manage operational work items of the corporate AWS resources across AWS accounts.

What sequence of actions should the CloudOps Engineer take in order to supply the required information? (Select TWO.)

A company is hosting a multi-tiered web application that consists of an e-commerce module as well as a blogging site that fetches data from a database. Some articles, which are static web pages, have lots of page hits and sometimes cause the application to behave slowly.

Which of the following can be used to alleviate the issue of slow loading times when many users are visiting the application for such pages, in the MOST cost-effective way?

A leading insurance firm has a customer portal that is hosted on a fleet of Spot EC2 instances which are part of an Auto Scaling Group. The application is being used quite extensively during office hours from 8 in the morning till 4 in the afternoon. Users are complaining that the performance of the application is slow during the start of the day after which the application works properly.

Which of the following can be done to ensure that the application works properly at the beginning of the day?

A CloudOps Engineer is setting up an Amazon CloudWatch Dashboard, which should track the memory and swap usage of all Linux Amazon EC2 Instances in Amazon VPC. There will be an upcoming IT audit, and this should be done as soon as possible.

Which of the following options should be implemented to fulfill this requirement?

An office supply store chain currently runs a five-day sale on its e-commerce web application using burstable EC2 instances in an Auto Scaling Group (ASG) fronted by an Application Load Balancer (ALB). The ASG scales out when the CPU Utilization reaches 70%.

Users report slow load times even though the administrator observes a 20% CPU utilization across all instances.

Which solution can resolve the issue in the most cost-effective way?

An IT Consulting company has a VPC in the us-east-1 (N. Virginia) region for its business operations. Last month, the entire us-east-1 AWS region went down, which totally rendered all of the cloud systems unavailable and eventually resulted in a financial loss. The engineer also uses synthetics:GetCanaryRuns to retrieve historical run data from Amazon CloudWatch Synthetics canaries. To prevent this from happening again, the CTO instructed the CloudOps Engineer to set up a notification system that provides alerts via a Slack messaging channel when AWS is experiencing events that may impact the cloud resources.

Which of the following options should the Engineer implement to meet this requirement?

A development team uses an AWS CloudFormation template to build the company’s infrastructure, including an Amazon EC2 instance and an Amazon RDS instance. The team needs to modify the template to ensure the EC2 instance is launched only after the RDS instance has been successfully created.

What actions should the CloudOps Engineer take to update the template correctly in this order?

An accounting firm has created a set of AWS CloudFormation stacks that are used to deploy various application environments in its VPC. Due to the tax filing season, one of the underlying Amazon EC2 instances, which was launched as part of the CloudFormation stack, needs to be changed and upgraded to a higher Instance type.

Which of the following is the best way to implement this change?

An online learning platform hosts its website application on Amazon EC2 instances in an Auto Scaling group (ASG). Occasionally, the site’s traffic increases during peak hours. This traffic spike causes the CPU Utilization to hit 80%, which triggers the ASG to scale out.

The CloudOps Engineer noticed that the new instances created by ASG take a lot of time to be available because of a long-running user data script that installs several software dependencies. She has to decrease the time it takes for the new instances to become available.

Which action should the CloudOps Engineer perform to ensure that the requirement is met?

A CloudOps Engineer needs to create a new subnet in a VPC with a CIDR block of 192.168.0.0/16. The subnet will be explicitly used for the staging environment of the development team. Also, the subnet’s size should be just enough to handle 30 EC2 instances to avoid any unused IP addresses.

Which of the following CIDR blocks should the Administrator use for the subnet?

A leading insurance company has recently adopted a hybrid cloud architecture in AWS. The organization must configure Amazon Route 53 so that if an enterprise application in the primary data center becomes unavailable, traffic is automatically redirected to the secondary data center.

Which routing policy in Route 53 should be implemented to achieve this requirement?

In the recently concluded IT audit in the company, it was discovered that the disaster recovery plan in place for the cloud infrastructure does not meet the strict compliance requirements.

The CloudOps Engineer has been requested to ensure that when the snapshots of Amazon EBS volumes are completed, these will be automatically copied to another region to improve data durability.

How can the engineer achieve this requirement? (Select TWO.)

An aerospace manufacturer and spaceflight services company has a set of AWS CloudFormation templates for its applications hosted in AWS. There is a requirement to ensure that all API calls to the CloudFormation templates are properly recorded for audit purposes.

Which of the following should be used to meet this requirement?

A telecommunications company monitors its AWS environment with Amazon CloudWatch and has configured several CloudWatch alarms to allow its IT Operations team to be notified and respond to any system outages. The development teams and the respective managers must receive a notification immediately when an alarm is triggered.

Which of the following is recommended to be used in this scenario?

A company is setting up a cloud architecture for a forex trading platform that will allow users to trade various currencies around the globe 24/7. The CloudOps Engineer is responsible for ensuring that the application is highly available to avoid any disruption of the service, which may cost the company thousands of dollars in lost revenue. Each load balancer node must be configured to distribute the incoming traffic evenly across the registered targets in all enabled Availability Zones.

Which of the following options are required in order to accomplish this? (Select TWO.)

A company plans to migrate a large dataset from an on-premises MySQL database to an existing Amazon RDS instance. The CloudOps Engineer must ensure that the migration process does not exceed the storage capacity of the existing RDS instance.

Which of the following metrics should be monitored during the load process?

A financial services company with a hybrid cloud architecture has hired a Cloud Engineer to manage its on-premises and cloud infrastructure. As part of its disaster recovery plan, the engineer should set up a durable backup and archiving system for corporate documents stored both on-premises and in cloud storage. These documents should be immediately accessible within minutes for 6 months and be available for another 10 years to meet data compliance requirements.

Which of the following is the best and most cost-effective approach to implement for this scenario?

A company is designing a distributed system in AWS using an SQS queue, an Auto Scaling group of EC2 instances, and an S3 bucket. The application that runs on each EC2 instance processes the message from the queue and should store the output in S3. The Auto Scaling group will scale in or out depending on the approximate number of messages available for retrieval from the SQS queue.

Which of the following attributes of the SQS <code>get-queue-attributes</code> command should you use to complete this architecture?

A technology company needs to ensure that all objects in their S3 bucket are encrypted at rest. In addition, the CloudOps Engineer should also configure proper permissions on the S3 bucket.

Which of the following is required to properly implement this requirement?

An accounting company has recently adopted a hybrid cloud infrastructure and they instructed you to set up a system to store each of their employee’s work files in an S3 bucket. You noticed that all documents, which are created after 3 months, are no longer accessed by the users.

As the company’s Systems Administrator, which of the following is the most suitable way to reduce the storage costs while still providing users access to the files?

A company has an e-commerce website that uses images and other media files from an S3 bucket. The website is also hosted in AWS but it has a custom domain name (shop.tutorialsdojo.com) registered using Route 53. There was a recent change in the bucket which hinders the website from showing the images hosted in S3.

Which of the following options should you do to fix this issue?

A company has multiple AWS accounts which are consolidated with AWS Organizations. You are instructed to ensure that the tags are consistently applied when your resources are created in AWS across all accounts.

Which of the following options should you do to satisfy this requirement? (Select TWO.)

A company has an enterprise web application that uses Amazon RDS PostgreSQL as its database. The Audit team requires that any sensitive data stored in the database be reviewed. For this reason, the company’s CloudOps Engineer must present a list of findings to the team.

Which action will accomplish the task in the most optimal way?

A logistics company is using AWS Organizations to manage its production environment centrally. The DevOps team manager requires that no Amazon S3 buckets in its production accounts should ever be deleted.

What is the SIMPLEST way to ensure that all the S3 buckets in production accounts can never be deleted?

A company has hundreds of AWS KMS keys used to secure Amazon S3 buckets, Amazon RDS instances, and other AWS resources. The CloudOps Engineer has been instructed to delete certain KMS Keys to reduce management overhead and minimize costs associated with maintaining unused keys.

In this scenario, which of the following statements are true regarding the deletion of KMS keys? (Select TWO.)

A web application is hosted on 4 On-Demand Amazon EC2 instances, which are deployed evenly across two Availability Zones behind an Application Load Balancer. Monitoring through Amazon CloudWatch indicates that one of the EC2 instances is operating at approximately 95% CPU utilization, while the other three instances only have 10% CPU utilization.

Which of the following is the most suitable fix for this issue?

An online food delivery website is hosted in an Amazon ECS Cluster and is using an RDS database instance. The company has recently deployed the new version of its delivery website which uses Amazon Aurora Serverless instead of RDS. Your manager instructed you to disable the backups of your RDS instance as these will no longer be used. You were able to successfully set the retention period to 1 with no issues but you encountered an error when you tried to set this at 0.

Which of the following could be the possible reason for this issue?

A business is serving thousands of media assets stored on Amazon S3 to customers all over the world. The company already has a CloudFront distribution in place with Amazon S3 as its origin. In order to improve content delivery to various devices, the company is deploying an on-the-fly image transformation. In line with this change, the CloudOps Engineer must think of a way to help reduce the number of requests hitting the origin and increase the percentage of content served directly by CloudFront.

Which action can help the CloudOps Engineer complete the task?

A CloudOps Engineer has detected a significant number of LIST requests being made to an Amazon S3 bucket. The engineer needs to identify the source of these requests.

Which of the following options can help the engineer trace the origin of these requests? (Select TWO.)

A digital media company relies on Amazon CloudFront to deliver static content, including images, to its audience. The marketing department has newly added 175 new static assets to the website, but some of them do not appear correctly for users. Upon investigation, the Cloud Engineer discovers that the default Time-to-Live (TTL) for the CloudFront cache is set to 5 days. The users are experiencing delays in seeing the updated content.

What is the MOST efficient way of refreshing the cache and ensuring the new assets are displayed immediately?

A company enforces a security baseline that restricts all inbound Secure Shell (SSH) and Remote Desktop Protocol (RDP) traffic to Amazon EC2 instances. Instance access is granted exclusively through AWS Systems Manager Session Manager.

A cloud engineer is troubleshooting a connectivity issue with one EC2 instance running Amazon Linux 2. The instance was launched from an AMI that includes the Systems Manager Agent (SSM Agent). Session Manager connections succeed on every other instance within the same Amazon VPC subnet. The engineer’s IAM group has an attached policy that grants Session Manager access across all EC2 instances in the account.

What should the CloudOps Engineer do to restore connectivity?

A financial services firm operating under a multi-account AWS Organizations structure is preparing for an upcoming regulatory audit. The compliance team must ensure that all AWS accounts are continuously evaluated against the Center for Internet Security (CIS) AWS Foundations Benchmark, including any accounts added in the future.

Which approach meets this requirement while minimizing ongoing manual effort?

A retail company suffered a cache failure during a high-traffic sales period, causing widespread application downtime. Following a post-incident review, the engineering team must redesign the existing Amazon ElastiCache (Redis OSS) deployment, which is used to cache application data, so it can recover automatically from infrastructure failures without manual intervention. The redesigned architecture must also minimize the recovery time objective (RTO).

Which configuration change would the engineering team implement to satisfy both requirements?