225>274

A SysOps administrator wants to monitor the free disk space that is available on a set of Amazon EC2 instances that have Amazon Elastic Block Store (Amazon EBS) volumes attached. The SysOps administrator wants to receive a notification when the used disk space of the EBS volumes exceeds a threshold value, but only when the DiskReadOps metric also exceeds a threshold value. The SysOps administrator has set up an Amazon Simple Notification Service (Amazon SNS) topic.

How can the SysOps administrator receive notification only when both metrics exceed their threshold values?

• • D. Configure detailed monitoring for the EC2 instances. Create a metric alarm for the disk space and a metric alarm for the DiskReadOps metric. Create a composite alarm that includes the two metric alarms to publish a notification to the SNS topic.

  Show Suggested Answer

  
  

• • C. Create a metric alarm for the EBSByteBalance% metric and a metric alarm for the DiskReadOps metric. Create a composite alarm that includes the two metric alarms to publish a notification to the SNS topic.

  
  

• • B. Install the Amazon CloudWatch agent on the EC2 instances. Create a metric alarm for the disk space and a metric alarm for the DiskReadOps metric. Configure each alarm to publish a notification to the SNS topic.

  
  

• • A. Install the Amazon CloudWatch agent on the EC2 instances. Create a metric alarm for the disk space and a metric alarm for the DiskReadOps metric. Create a composite alarm that includes the two metric alarms to publish a notification to the SNS topic.

  
  

A company updates its security policy to prohibit the public exposure of any data in Amazon S3 buckets in the company's account.

What should a SysOps administrator do to meet this requirement?

• • D. Use S3 Object Lambda to examine S3 ACLs and to change any public S3 ACLs to private.

  Show Suggested Answer

  
  

• • C. Use Amazon Inspector to search for S3 buckets and to automatically reset S3 ACLs if any public S3 buckets are found.

  
  

• • B. Create an Amazon Event Bridge (Amazon CloudWatch Events) rule to enforce that all S3 objects are private.

  
  

• • A. Turn on S3 Block Public Access from the account level.

  
  

A company's SysOps administrator needs to change the AWS Support plan for one of the company's AWS accounts. The account has multi-factor authentication (MFA) activated, and the MFA device is lost.

What should the SysOps administrator do to sign in?

• • C. Sign in as an IAM user with administrator permissions. Reset the MFA device for the root user by adding a new device.

  
  

• • B. Sign in as an IAM user with administrator permissions. Resynchronize the MFA token by using the IAM console.

  
  

• • A. Sign in as a root user by using email and phone verification. Set up a new MFA device. Change the root user password.

  
  

• • D. Use the forgot-password process to verify the email address. Set up a new password and MFA device.

  Show Suggested Answer

  
  

A company is creating a new multi-account architecture. A SysOps administrator must implement a login solution to centrally manage user access and permissions across all AWS accounts. The solution must be integrated with AWS Organizations and must be connected to a third-party Security Assertion Markup Language (SAML) 2.0 identity provider (IdP).

What should the SysOps administrator do to meet these requirements?

• • A. Configure an Amazon Cognito user pool. Integrate the user pool with the third-party IdP.

  
  

• • C. Federate the third-party IdP with AWS Identity and Access Management (IAM) for each AWS account in the organization.

  
  

• • B. Enable and configure AWS Single Sign-On with the third-party IdP.

  
  

• • D. Integrate the third-party IdP directly with AWS Organizations.

  Show Suggested Answer

  
  

A company is managing many accounts by using a single organization in AWS Organizations. The organization has all features enabled. The company wants to turn on AWS Config in all the accounts of the organization and in all AWS Regions.

What should a SysOps administrator do to meet these requirements in the MOST operationally efficient way?

• • A. Use AWS CloudFormation Stack Sets to deploy stack instances that turn on AWS Config in all accounts and in all Regions.

  
  

• • B. Use AWS CloudFormation Stack Sets to deploy stack policies that turn on AWS Config in all accounts and in all Regions.

  
  

• • C. Use service control policies (SCPs) to configure AWS Config in all accounts and in all Regions.

  
  

• • D. Create a script that uses the AWS CLI to turn on AWS Config in all accounts in the organization. Run the script from the organization's management account.

  Show Suggested Answer

  
  

A company with multiple AWS accounts needs to obtain recommendations for AWS Lambda functions and identify optimal resource configurations for each Lambda function.

How should a SysOps administrator provide these recommendations?

• • A. Create an AWS Serverless Application Repository and export the Lambda function recommendations.

• • B. Enable AWS Compute Optimizer and export the Lambda function recommendations.

• • C. Enable all features of AWS Organizations and export the recommendations from AWS CloudTrail Insights.

• • D. Run AWS Trusted Advisor and export the Lambda function recommendations.

  Show Suggested Answer

A company uses AWS CloudFormation templates to deploy cloud infrastructure. An analysis of all the company's templates shows that the company has declared the same components in multiple templates. A SysOps administrator needs to create dedicated templates that have their own parameters and conditions for these common components.

• • A. Develop a CloudFormation change set.

• • B. Develop CloudFormation macros.

• • C. Develop CloudFormation nested stacks.

• • D. Develop CloudFormation stack sets.

  Show Suggested Answer

• A SysOps administrator is building a process for sharing Amazon RDS database snapshots between different accounts associated with different business units within the same company. All data must be encrypted at rest.
  
  How should the administrator implement this process

• • A. Write a script to download the encrypted snapshot, decrypt it using the AWS KMS encryption key used to encrypt the snapshot, then create a new volume in each account.

• • B. Update the key policy to grant permission to the AWS KMS encryption key used to encrypt the snapshot with all relevant accounts, then share the snapshot with those accounts.

• • C. Create an Amazon EC2 instance based on the snapshot, then save the instance's Amazon EBS volume as a snapshot and share it with the other accounts. Require each account owner to create a new volume from that snapshot and encrypt it.

• • D. Create a new unencrypted RDS instance from the encrypted snapshot, connect to the instance using SSH/RDP, export the database contents into a file, then share this file with the other accounts.

  Show Suggested Answer

A SysOps administrator configures an Amazon S3 gateway endpoint in a VPC. The private subnets inside the VPC do not have outbound internet access. User logs in to an Amazon EC2 instance in one of the private subnets and cannot upload a file to an Amazon S3 bucket in the same AWS Region.

Which solution will solve this problem?

• • A. Update the EC2 instance role policy to include s3:PutObject access to the target S3 bucket.

• • B. Update the EC2 security group to allow outbound traffic to 0.0.0.0/0 for port 80.

• • C. Update the EC2 subnet route table to include the S3 prefix list destination routes to the S3 gateway endpoint.

• • D. Update the S3 bucket policy to allow s3:PutObject access from the private subnet CIDR block.

A company uses Amazon S3 to aggregate raw video footage from various media teams across the US. The company recently expanded into new geographies in Europe and Australia. The technical teams located in Europe and Australia reported delays when uploading large video files into the destination S3 bucket in the United States.

What are the MOST cost effective ways to increase upload speeds into the S3 bucket? (Choose two.)

• • A. Create multiple AWS Direct Connect connections between AWS and branch offices in Europe and Australia for file uploads into the destination S3 bucket.

• • B. Create multiple AWS Site-to-Site VPN connections between AWS and branch offices in Europe and Australia for file uploads into the destination S3 bucket.

• • C. Use Amazon S3 Transfer Acceleration for file uploads into the destination S3 bucket.

• • D. Use AWS Global Accelerator for file uploads into the destination S3 bucket from the branch offices in Europe and Australia.

• • E. Use multipart uploads for file uploads into the destination S3 bucket from the branch offices in Europe and Australia.

  Show Suggested Answer