340-380

A company runs a high performance computing (HPC) application on an Amazon EC2 instance. The company needs to scale this architecture to two or more EC2 instances. The EC2 instances will need to communicate with each other at high speeds with low latency to support the application.

The company wants to ensure that the network performance can support the required communication between the EC2 instances

What should a SysOps administrator do to meet these requirements?

• • A. Create a cluster placement group. Back up the existing EC2 instance to an Amazon Machine Image (AMI). Restore the EC2 instance from the AMI into the placement group. Launch the additional EC2 instances into the placement group.

• • B. Back up the existing EC2 instance to an Amazon Machine Image (AMI). Create a launch template from the existing EC2 instance by specifying the AMI. Create an Auto Scaling group and configure the desired instance count.

• • C. Create a Network Load Balancer (NLB) and a target group. Launch the new EC2 instances and register them with the target group. Register the existing EC2 instance with the target group. Pass all application traffic through the NLB.

• • D. Back up the existing EC2 instance to an Amazon Machine Image (AMI). Create additional clones of the EC2 instance from the AMI in the same Availability Zone where the existing EC2 instance is located.

  Show Suggested Answer

A developer creates an AWS Lambda function that runs when an object is put into an Amazon S3 bucket. The function reformats the object and places the object back into the S3 bucket. During testing, the developer notices a recursive invocation loop. The developer asks a SysOps administrator to immediately stop the recursive invocations.

What should the SysOps administrator do to stop the loop without errors?

• • A. Delete all the objects from the S3 bucket.

• • B. Set the function’s reserved concurrency to 0.

• • C. Update the S3 bucket policy to deny access for the function.

• • D. Publish a new version of the function.

  Show Suggested Answer

A company has an application that runs behind an Application Load Balancer (ALB) in the us-west-2 Region. An Amazon Route 53 record set contains an alias record for app.anycompany.com that references the ALB in us-west-2 and uses a simple routing policy. The application is experiencing an increase in users from other locations in the world. These users are experiencing high latency.

Most of the new users are close to the ap-southeast-2 Region. The company deploys a copy of the application to ap-southeast-2. A SysOps administrator must implement a solution that automatically routes requests to the lowest latency endpoint for users without changing the URL.

Which solution will meet these requirements?

• • A. Add a new value to the existing alias record for app.anycompany.com with the DNS name of the new ALB in ap-southeast-2.

• • B. Change the existing alias record to use a geolocation routing policy. Create two geolocation records, one record that references each ALSelect the location that is closest to each Region.

• • C. Change the existing alias record to use a latency routing policy. Create two latency records, one record that references each ALB.

• • D. Change the existing alias record to use a multivalue routing policy Add the DNS name of each ALB to the record.

  Show Suggested Answer

A company stores files on 50 Amazon S3 buckets in the same AWS Region. The company wants to connect to the S3 buckets securely over a private connection from its Amazon EC2 instances. The company needs a solution that produces no additional cost.

Which solution will meet these requirements?

• • A. Create a gateway VPC endpoint for each S3 bucket. Attach the gateway VPC endpoints to each subnet inside the VPC.

• • B. Create an interface VPC endpoint for each S3 bucket. Attach the interface VPC endpoints to each subnet inside the VPC.

• • C. Create one gateway VPC endpoint for all the S3 buckets. Add the gateway VPC endpoint to the VPC route table.

• • D. Create one interface VPC endpoint for all the S3 buckets. Add the interface VPC endpoint to the VPC route table.

A company's security policy states that connecting to Amazon EC2 instances is not permitted through SSH and ROP. If access is required, authorized staff can connect to instances by using AWS Systems Manager Session Manager.

Users report that they are unable to connect to one specific Amazon EC2 instance that is running Ubuntu and has AWS Systems Manager Agent (SSM Agent) pre-installed. These users are able to use Session Manager to connect to other instances in the same subnet, and they are in an IAM group that has Session Manager permission for all instances.

What should a SysOps administrator do to resolve this issue?

• • A. Add an inbound rule for port 22 in the security group associated with the Ubuntu instance.

• • B. Assign the AmazonSSMManagedInstanceCore managed policy to the EC2 instance profile for the Ubuntu instance.

• • C. Configure the SSM Agent to log in with a user name of “ubuntu”.

• • D. Generate a new key pair, configure Session Manager to use this new key pair, and provide the private key to the users.

  Show Suggested Answer

A SysOps administrator is configuring Amazon CloudWatch alarms. A particular is constantly in the ALARM state.

What could be the reason for this issue?

• • A. Alarms continue to evaluate metrics against configured thresholds, even after they are triggered.

• • B. After alarms are triggered, they remain in the ALARM state until they are manually disabled.

• • C. After an alarm is triggered and an action is performed, the application logic must reset the alarm to its normal state.

• • D. The alarm is not receiving appropriate metrics.

  Show Suggested Answer

A company has set up an IPsec tunnel between its AWS environment and its on-premises data center. The tunnel is reporting as UP, but the Amazon EC2 instances are not able to ping any on-premises resources.

What should a SysOps administrator do to resolve this issue?

• • A. Create a new inbound rule on the EC2 instances’ security groups to allow ICMP traffic from the on-premises CIDR.

• • B. Create a peering connection between the IPsec tunnel and the subnet of the EC2 instances.

• • C. Enable route propagation for the virtual private gateway in the route table that is assigned to the subnet of the EC2 instances.

• • D. Modify the VPC’s DHCP options set. Add the IPsec tunnel to the VPN section.

A company hosts a production MySQL database on an Amazon Aurora single-node DB cluster. The database is queried heavily for reporting purposes. The DB cluster is experiencing periods of performance degradation because of high CPU utilization and maximum connections errors. A SysOps administrator needs to improve the stability of the database.

Which solution will meet these requirements?

• • A. Create an Aurora Replica node. Create an Auto Scaling policy to scale replicas based on CPU utilization. Ensure that all reporting requests use the read-only connection string

• • B. Create a second Aurora MySQL single-node DB cluster in a second Availability Zone. Ensure that all reporting requests use the connection string for this additional node

• • C. Create an AWS Lambda function that caches reporting requests. Ensure that all reporting requests call the Lambda function

• • D. Create a multi-node Amazon ElastiCache cluster. Ensure that all reporting requests use the ElastiCache cluster. Use the database if the data is not in the cache.

  Show Suggested Answer

A company runs a web application that users access using the name www example com. The company manages the domain name example.com using Amazon Route 53. The company created an Amazon CloudFront distribution in front of the application and would like www.example.com to access the application through CloudFront.

What is the MOST cost-effective way to achieve this?

• • A. Create a CNAME record in Amazon Route 53 that points to the CloudFront distribution URL.

• • B. Create an ALIAS record in Amazon Route 53 that points to the CioudFront distribution URL.

• • C. Create an A record in Amazon Route 53 that points to the public IP address of the web application,

• • D. Create a PTR record in Amazon Route 53 that points to the public IP address of the web application.

A company is managing multiple AWS accounts in AWS Organizations. The company is reviewing internal security of its AWS environment. The company’s security administrator has their own AWS account and wants to review the VPC configuration of developer AWS accounts.

Which solution will meet these requirements in the MOST secure manner?

• • A. Create an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to an IAM user. Share the user credentials with the security administrator.

• • B. Create an IAM policy in each developer account that has administrator access to all Amazon EC2 actions, including VPC actions. Assign the policy to an IAM user. Share the user credentials with the security administrator.

• • C. Create an IAM policy in each developer account that has administrator access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.

• D. Create an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account