AWS-SysOps Practice Exam Questions and Answers

A.  

Create an Amazon CloudWatch alarm for the Amazon EC2 instance with basic monitoring. Enable an action to restart the instance.

B.  

Create a CloudWatch alarm for the EC2 instance with detailed monitoring. Enable an action to restart the instance.

C.  

Create an AWS Lambda function to restart the EC2 instance, triggered on a scheduled basis every 2 minutes.

D.  

Create a Lambda function to restart the EC2 instance, triggered by EC2 health checks.

A.  

Create an IAM policy in each developer account that has read-only access related to VPC resources Assign the policy to an IAM user Share the user credentials with the security administrator

B.  

Create an IAM policy in each developer account that has administrator access to all Amazon EC2 actions, including VPC actions Assign the policy to an IAM user Share the user credentials with the security administrator

C.  

Create an IAM policy in each developer account that has administrator access related to VPC resources Assign the policy to a cross-account IAM role Ask the security administrator to assume the role from their account

D.  

Create an IAM policy m each developer account that has read-only access related to VPC resources Assign the policy to a cross-account IAM role Ask the security administrator to assume the role from their account

A.  

Create an Amazon CloudWatch alarm to monitor application latency and increase the size of each EC2 instance if the desired threshold is reached.

B.  

Create an Amazon EventBridge (Amazon CloudWatch Events) rule to monitor application latency and add an EC2 instance to the ALB if the desired threshold is reached.

C.  

Deploy the application to an Auto Scaling group of EC2 instances with a target tracking scaling policy. Attach the ALB to the Auto Scaling group.

D.  

Deploy the application to an Auto Scaling group of EC2 instances with a scheduled scaling policy. Attach the ALB to the Auto Scaling group.

A.  

Users that assume an IAM role with a logical ID that begins with "Production" are prevented from running the update-stack command.

B.  

Users can update all resources in the stack except for resources that have a logical ID that begins with "Production".

C.  

Users can update all resources in the stack except for resources that have an attribute that begins with "Production".

D.  

Users in an IAM group with a logical ID that begins with "Production" are prevented from running the update-stack command.

A.  

Configure the file system for Provisioned Throughput.

B.  

Enable encryption in transit on the file system.

C.  

Identify any unused files in the file system, and remove the unused files.

D.  

Resize the Amazon Elastic Block Store (Amazon EBS) volume of each of the EC2 instances.

A.  

Perform a CloudWatch Logs Insights query that uses the stats command and count function.

B.  

Perform a CloudWatch Logs search that uses the groupby keyword and count function.

C.  

Perform an Amazon Athena query that uses the SELECT and GROUP BY keywords.

D.  

Perform an Amazon RDS query that uses the SELECT and GROUP BY keywords.

A.  

Stream the CloudTrail logs to Amazon CloudWatch Logs to store logs at a secondary location.

B.  

Enable log file integrity validation and use digest files to verify the hash value of the log file.

C.  

Replicate the S3 log bucket across regions, and encrypt log files with S3 managed keys.

D.  

Enable S3 server access logging to track requests made to the log bucket for security audits.

A.  

Store the digital content in an Amazon S3 bucket that does not have public access blocked. Use signed URLs to access the S3 bucket through CloudFront.

B.  

Store the digital content in an Amazon S3 bucket that has public access blocked. Use an origin access identity (OAI) to deliver the content through CloudFront. Restrict S3 bucket access with signed URLs in CloudFront.

C.  

Store the digital content in an Amazon S3 bucket that has public access blocked. Use an origin access identity (OAI) to deliver the content through CloudFront. Enable field-level encryption.

D.  

Store the digital content in an Amazon S3 bucket that does not have public access blocked. Use signed cookies for restricted delivery of the content through CloudFront.

A.  

On the default ACL. create inbound Allow rules of type TCP with the ephemeral port range and the source as the database subnets.

B.  

On the default ACL, create outbound Allow rules of type MySQL/Aurora (3306). Specify the destinations as the database subnets.

C.  

On the network ACLs for the database subnets, create an inbound Allow rule of type MySQL/Aurora (3306). Specify the source as the third web subnet.

D.  

On the network ACLs for the database subnets, create an outbound Allow rule of type TCP with the ephemeral port range and the destination as the third web subnet.

E.  

On the network ACLs for the database subnets, create an outbound Allow rule of type MySQL/Aurora (3306). Specify the destination as the third web subnet.

A.  

AWS Config aggregator

B.  

IAM user permissions boundaries

C.  

AWS Organizations service control policies (SCPs)

D.  

AWS Security Hub conformance packs