AWS-SysOps Free Practice Test

- (Exam Topic 1)
A company has a VPC with public and private subnets. An Amazon EC2 based application resides in the private subnets and needs to process raw .csv files stored in an Amazon S3 bucket. A SysOps administrator has set up the correct IAM role with the required permissions for the application to access the S3 bucket, but the application is unable to communicate with the S3 bucket.
Which action will solve this problem while adhering to least privilege access?

1. A. Add a bucket policy to the S3 bucket permitting access from the IAM role.
2. B. Attach an S3 gateway endpoint to the VP
3. C. Configure the route table for the private subnet.
4. D. Configure the route table to allow the instances on the private subnet access through the internet gateway.
5. E. Create a NAT gateway in a private subnet and configure the route table for the private subnets.

Correct Answer: B
Technology to use is a VPC endpoint - "A VPC endpoint enables private connections between your VPC and supported AWS services and VPC endpoint services powered by AWS PrivateLink. AWS PrivateLink is a technology that enables you to privately access services by using private IP addresses. Traffic between your VPC and the other service does not leave the Amazon network." S3 is an example of a gateway endpoint. We want to see services in AWS while not leaving the VPC.

- (Exam Topic 1)
A company wants to create an automated solution for all accounts managed by AWS Organizations to detect any worry groups that urn 0.0.0.0/0 as the source address for inbound traffic. The company also wants to automatically remediate any noncompliant security groups by restricting access to a specific CIDR block corresponds with the company's intranet.

1. A. Create an AWS Config rule to detect noncompliant security group
2. B. Set up automatic remediation to change the 0.0.0.0/0 source address to the approved CIDK block.
3. C. Create an IAM policy to deny the creation of security groups that have 0.0.0.0/0 as the source address Attach this 1AM policy to every user in the company.
4. D. Create an AWS Lambda function to inspect now and existing security groups check for a noncompliant 0.0.0.0A) source address and change the source address to the approved CIDR block.
5. E. Create a service control policy (SCP) for the organizational unit (OU) to deny the creation of security groups that have the 0.0.0.0/0 source addres
6. F. Set up automatic remediation to change Vie 0.0.0.0/0 source address to the approved CIDR block.

Correct Answer: A

- (Exam Topic 1)
A SysOps administrator receives notification that an application that is running on Amazon EC2 instances has failed to authenticate to an Amazon RDS database To troubleshoot, the SysOps administrator needs to investigate AWS Secrets Manager password rotation
Which Amazon CloudWatch log will provide insight into the password rotation?

1. A. AWS CloudTrail logs
2. B. EC2 instance application logs
3. C. AWS Lambda function logs
4. D. RDS database logs

Correct Answer: B

- (Exam Topic 1)
A company is running an application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are launched by an Auto Scaling group and are automatically registered in a target group. A SysOps administrator must set up a notification to alert application owners when targets fail health checks.
What should the SysOps administrator do to meet these requirements?

1. A. Create an Amazon CloudWatch alarm on the UnHealthyHostCount metri
2. B. Configure an action to send an Amazon Simple Notification Service (Amazon SNS) notification when the metric is greater than 0.
3. C. Configure an Amazon EC2 Auto Scaling custom lifecycle action to send an Amazon Simple Notification Service (Amazon SNS) notification when an instance is in the Pending:Wait state.
4. D. Update the Auto Scaling grou
5. E. Configure an activity notification to send an Amazon Simple Notification Service (Amazon SNS) notification for the Unhealthy event type.
6. F. Update the ALB health check to send an Amazon Simple Notification Service (Amazon SNS) notification when an instance is unhealthy.

Correct Answer: A

- (Exam Topic 1)
A SysOps administrator is creating two AWS CloudFormation templates. The first template will create a VPC with associated resources, such as subnets, route tables, and an internet gateway. The second template will deploy application resources within the VPC that was created by the first template. The second template should refer to the resources created by the first template.
How can this be accomplished with the LEAST amount of administrative effort?

1. A. Add an export field to the outputs of the first template and import the values in the second template.
2. B. Create a custom resource that queries the stack created by the first template and retrieves the required values.
3. C. Create a mapping in the first template that is referenced by the second template.
4. D. Input the names of resources in the first template and refer to those names in the second template as a parameter.

Correct Answer: A
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-exports.html