# AWS CloudOps — 65-Question Video Extraction & Study Guide > **Source:** the supplied 129-second quiz recording. The 65 questions change rapidly on screen. Wording has been cleaned academically where the image/OCR had clear transcription damage; service names and choices are normalized for readability. The options are converted from rectangular answer boxes into A/B/C/D/E lists. > > **How to read this guide:** Each item contains the reconstructed question/options, an easy scenario narrative, answer(s), rationale, rule of thumb, pitfall, a short decision sketch, and a durable memory cue. AWS documentation links are official documentation, checked for current service behavior as of **21 October 2026**. This is an independently reasoned study guide, not an official AWS answer key. > > **Source-text limitations:** Where the video/OCR has damaged or truncated a phrase, the question is reconstructed conservatively rather than inventing missing details. A few older questions use historical terminology such as *AWS SSO*, *CMK*, or *Amazon Glacier*; current terminology/nuance is noted where useful. ## High-yield map | Question | Main topic | Answer(s) | |---:|---|---| | 1 | An application uses EC2 instances to process messages from an Am | **C** | | 2 | Sensitive workloads must not be able to send traffic to the publ | **A (with route-table caveat)** | | 3 | A CloudOps Engineer needs to verify that root-user security best | **A** | | 4 | A production application currently runs its web interface and My | **A** | | 5 | Unauthorized attempts against several S3 buckets must be investi | **A, B** | | 6 | Company policy requires IAM access keys to be automatically disa | **D** | | 7 | A security vulnerability affects a Linux version running on EC2 | **C** | | 8 | CloudFront serves `www.sample.com`. Traffic to CloudFront must u | **A, E** | | 9 | An RDS for MySQL database is slow during peak load. CloudWatch C | **A** | | 10 | Deploy a web application on EC2 behind an ALB, with a separate E | **B** | | 11 | AWS notifies a CloudOps Engineer that an EBS-backed EC2 instance | **D** | | 12 | During migration, unnecessary objects were written to an S3 buck | **B, E** | | 13 | An administrator cannot find a custom-Linux-AMI EC2 instance in | **A, C** | | 14 | AWS Single Sign-On (now IAM Identity Center) has been enabled in | **A** | | 15 | An ALB-backed website receives repeated 404 requests from one so | **B** | | 16 | An EC2 instance transitions from `pending` to `terminated` immed | **D** | | 17 | A fleet is steady most of the day but has a predictable two-hour | **B** | | 18 | EC2 instances must lose public IP addresses but still reach S3 a | **B, C** | | 19 | A security policy says all EBS volumes must use a specific KMS c | **B** | | 20 | A hybrid application needs encryption at rest and encrypted traf | **B, C (application/data encryption pairing)** | | 21 | Lambda functions access an RDS database, but credentials are har | **C** | | 22 | A web app on one EC2 instance needs a stable public IP for a dom | **B, E** | | 23 | An administrator can SSH into an EC2 instance from the corporate | **C** | | 24 | Each AWS WAF-protected request contains a header with the front- | **D** | | 25 | An S3 static website returns HTTP 403 Forbidden even though stat | **C** | | 26 | A new member account is created through AWS Organizations. How a | **B** | | 27 | The virtual machine running an AWS Storage Gateway Volume Gatewa | **C (gateway service stopped, VM rebooted, gateway restarted)** | | 28 | An ALB has EC2 targets in an Auto Scaling group. Create a CloudW | **A** | | 29 | Data must be archived for at least seven years using Amazon S3 G | **B** | | 30 | EC2 instances have specific tags and only a group of users shoul | **B, D** | | 31 | A company needs to see how Reserved Instance discounts are alloc | **D** | | 32 | CloudWatch Agent sends custom metrics to a custom namespace. How | **D (A is the same workflow in compressed form)** | | 33 | A global static S3 website begins receiving HTTP 503 Service Una | **D** | | 34 | Private EC2 instances use a NAT gateway to reach peers on the in | **A** | | 35 | A company must prevent all users, including administrators/root | **B** | | 36 | After an incident, TCP port 80 must be blocked in security group | **A** | | 37 | EC2 instances cannot access S3 through an already created S3 VPC | **B** | | 38 | An Aurora cluster with a writer and reader experiences query lat | **C (for read-heavy load)** | | 39 | A CloudWatch alarm is repeatedly triggered and remains in ALARM | **A** | | 40 | An application uses a KMS customer-managed key with imported key | **D** | | 41 | An S3 bucket is in `us-east-1`; users in `ap-south-1` need faste | **C** | | 42 | Under the EC2 shared responsibility model, which TWO activities | **B, E** | | 43 | A CloudFormation template creates an Auto Scaling group with use | **B** | | 44 | Employees have separate standalone AWS accounts that must join t | **D** | | 45 | Across multiple Regions, EC2 security groups must never allow pu | **B, D (recommended native remediation pattern)** | | 46 | A first CloudFormation stack creation ends in `ROLLBACK_COMPLETE | **D** | | 47 | An EC2 application writes log files to an S3 bucket. What is the | **D** | | 48 | A memory leak is suspected across both EC2 Linux instances and o | **A** | | 49 | EC2 instances behind a Network Load Balancer cannot be reached f | **D** | | 50 | A Memcached ElastiCache cluster has more traffic and needs a lar | **C** | | 51 | Many EC2 instances upload logs to a third-party service that now | **A** | | 52 | The security team requires server-side encryption for all new ob | **A** | | 53 | A CloudFormation template creating a new VPC for each customer a | **C** | | 54 | A CloudOps Engineer needs to identify cost savings by downsizing | **A** | | 55 | A CloudFormation-deployed app uses EC2 in an Auto Scaling group | **C (closest listed choice; in practice choose a suitable rolling/instance-refresh strategy where appropriate)** | | 56 | A malicious IP must be explicitly denied for both inbound and ou | **C** | | 57 | CloudFront fronts an ALB, but mobile users sometimes receive des | **A** | | 58 | Systems Manager Patch Manager runs scheduled patches, but users | **B** | | 59 | A website serves dynamic content through an ALB/EC2 and static c | **C, D** | | 60 | SSM Agent and IAM permissions are configured, but Systems Manage | **B (assuming private subnet lacks SSM endpoint connectivity)** | | 61 | Two VPCs in different Regions must replicate data. All traffic m | **B** | | 62 | An Auto Scaling group has not reached maximum capacity but fails | **C, D (best direct diagnostic pair)** | | 63 | A Route 53 hosted zone and an ALB are in different AWS accounts. | **A** | | 64 | An S3 bucket is currently accessible to users in other AWS accou | **B** | | 65 | A computer on premises pings EC2 `172.31.10.10` across a Site-to | **B** | --- ## Question 1 — C ### Question + options An application uses EC2 instances to process messages from an Amazon SQS queue. Auto Scaling currently reacts to CPU utilization, but the queue backlog is increasing significantly. What change best addresses the backlog? A. Increase the SQS message-retention period. B. Scale the group on EC2 memory utilization instead of CPU. C. Scale the group using an SQS-backlog metric (ideally backlog per in-service instance). D. Add an Elastic Load Balancer in front of the EC2 instances. ### Scenario narrative Workers are not consuming messages as quickly as producers add them. CPU alone may not represent the actual amount of queued work. ### Correct answer(s) **C** ### Reasons Scale on a metric that represents pending work. AWS guidance recommends backlog per instance: approximate visible queue messages divided by the number of InService workers. Target tracking can then add capacity as work per worker rises. ### Rule of thumb > For queue workers, scale against queue backlog per worker and the acceptable processing latency—not a generic host metric alone. ### Pitfall to avoid Longer retention protects messages from expiring; it does not increase processing throughput. A raw queue-depth target can also over-scale because it ignores current fleet size. ### Flowchart / architecture sketch ```text Producer → SQS queue → EC2 worker Auto Scaling (backlog-per-instance) ``` ### Durable memory insight **Remember:** SQS backlog ÷ active workers = backlog per worker → compare with target → scale out/in. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-using-sqs-queue.html) --- ## Question 2 — A (with route-table caveat) ### Question + options Sensitive workloads must not be able to send traffic to the public internet. How should the VPC be configured? A. Launch the instances in private subnets, with no route to an internet gateway or NAT gateway unless explicitly needed. B. Ensure the instances have no Elastic IP addresses. C. Create a 'blackhole NAT gateway' to block outbound connections. D. Use instance-store volumes instead of EBS. ### Scenario narrative The security requirement is network egress prevention, not merely hiding a public address. ### Correct answer(s) **A (with route-table caveat)** ### Reasons A private subnet has no direct route to an internet gateway. To guarantee no internet egress, also ensure its route table has no NAT/egress path, and control alternate egress paths such as proxies or Transit Gateway routes. The other choices do not reliably block outbound traffic. ### Rule of thumb > No public IP + no public route + no NAT/egress route = no ordinary internet egress. ### Pitfall to avoid A subnet called 'private' can still reach the internet through a NAT gateway. An instance without an Elastic IP may also have a public IPv4 address unless networking is deliberately configured. ### Flowchart / architecture sketch ```text Private subnet instances → route table with no internet/NAT route → no internet egress ``` ### Durable memory insight **Remember:** Private subnet? → inspect route table → remove IGW/NAT routes when internet egress is prohibited. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html) · [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) --- ## Question 3 — A ### Question + options A CloudOps Engineer needs to verify that root-user security best practices are being followed. How should the Engineer check? A. Review AWS Trusted Advisor security checks for the root user. B. Use AWS Artifact compliance reports to inspect root-user configuration. C. Rotate root access keys periodically with the AWS CLI. D. Change the root password regularly with the AWS CLI. ### Scenario narrative The team needs a supported assessment of root-account security posture, not a home-grown rotation process. ### Correct answer(s) **A** ### Reasons Trusted Advisor provides security checks, including root-account security posture checks depending on support-plan/features. Independently verify MFA, root access keys, contact details, and recovery controls in the account's security credentials settings. Artifact provides compliance reports, not a live root-user configuration check. ### Rule of thumb > Protect root with MFA, avoid root access keys, and use root only for tasks requiring root. ### Pitfall to avoid AWS does not provide a normal CLI workflow to routinely rotate root user's password/access keys the way IAM user keys are managed. In general, do not create root access keys. ### Flowchart / architecture sketch ```text Root user → minimal use; MFA on; no root access keys → verify with security checks ``` ### Durable memory insight **Remember:** Account root → MFA + no access keys + Trusted Advisor/security review. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/awssupport/latest/user/security-checks.html) --- ## Question 4 — A ### Question + options A production application currently runs its web interface and MySQL database on one EC2 instance. Production must be highly available. What architecture is best? A. Move MySQL to RDS for MySQL Multi-AZ; run app EC2 instances in an Auto Scaling group across multiple AZs behind a load balancer. B. Move the database to another EC2 instance and keep a stopped standby AMI in another AZ. C. Move MySQL to Multi-AZ RDS and refactor the application into Lambda by using Application Migration Service. D. Back up both EC2 instances to AMIs and create a Lambda health-check/relaunch process. ### Scenario narrative A single instance is a single point of failure for both application and database tiers. ### Correct answer(s) **A** ### Reasons Separate the tiers and use managed multi-AZ database failover plus a horizontally redundant application tier. RDS Multi-AZ provides standby failover; an ALB and Auto Scaling group keep healthy application capacity across AZs. Option B's stopped EC2 copy is not a reliable HA database standby. ### Rule of thumb > For web apps: multi-AZ load-balanced app tier + managed database HA where possible. ### Pitfall to avoid Multi-AZ RDS is primarily high availability, not automatically extra read capacity. Do not assume the standby serves application reads. ### Flowchart / architecture sketch ```text Clients → ALB → EC2 ASG (AZ-a/AZ-b) → RDS Multi-AZ primary/standby ``` ### Durable memory insight **Remember:** Client → ALB → EC2 Auto Scaling across AZs → RDS Multi-AZ. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html) · [AWS documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html) --- ## Question 5 — A, B ### Question + options Unauthorized attempts against several S3 buckets must be investigated: which buckets are targeted and who is making requests? (Select TWO.) A. Use Athena to query S3 Server Access Logs for HTTP 403 responses and requester details. B. Enable S3 Server Access Logging for the affected buckets and deliver logs to a separate dedicated bucket. C. Query Server Access Logs for HTTP 503 errors to identify unauthorized IAM principals. D. Use S3 Analytics reports to identify HTTP 403 errors and principals. E. Enable S3 Analytics and generate a report of unauthorized requests. ### Scenario narrative The security team needs request-level evidence: bucket, time, request, status, and requester when recorded. ### Correct answer(s) **A, B** ### Reasons First enable S3 server access logging (or use CloudTrail S3 data events when stronger audit detail is required), storing logs separately. Then query the generated log data with Athena for 403/AccessDenied patterns. S3 Storage Class Analysis/Analytics does not provide an access-attempt audit trail. ### Rule of thumb > Logging first; querying second. Use 403/AccessDenied for denied access, and know what identity fields each log source records. ### Pitfall to avoid Athena cannot query logs that were never collected. Server access logs are best-effort and may be delayed; CloudTrail data events can be a better security audit source but incur charges. ### Flowchart / architecture sketch ```text S3 bucket access → server access logs/CloudTrail data events → Athena → 403 patterns ``` ### Durable memory insight **Remember:** Enable logs → central/separate log bucket → Athena query → investigate requester and target bucket. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html) · [AWS documentation](https://docs.aws.amazon.com/athena/latest/ug/s3-tables.html) --- ## Question 6 — D ### Question + options Company policy requires IAM access keys to be automatically disabled after 60 days. Which automation is most operationally effective? A. Run a custom key-age script from cron on an EC2 instance. B. Use Amazon Inspector to disable old keys automatically. C. Use CloudWatch to trigger a Lambda that disables old keys. D. Use AWS Config to identify noncompliant keys and a custom Systems Manager Automation remediation. ### Scenario narrative The company wants policy-driven detection and repeatable remediation, rather than a server-maintained script. ### Correct answer(s) **D** ### Reasons AWS Config's access-keys-rotated rule can evaluate a configured key-age threshold; a remediation action can run a controlled Automation document to disable noncompliant keys. Treat disabling keys as a potentially disruptive action: notify the owner and confirm the key is not a production dependency before remediation. ### Rule of thumb > Detect compliance declaratively; remediate with a governed, auditable runbook. ### Pitfall to avoid The managed rule detects rotation age; it does not, by itself, guarantee keys are disabled. Root-account keys are excluded from this Config rule. Use least-privilege remediation and an exception process. ### Flowchart / architecture sketch ```text IAM access key → AWS Config rule (60 days) → remediation runbook → disable/notify ``` ### Durable memory insight **Remember:** Config evaluates key age → NON_COMPLIANT → reviewed Automation disables key. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/config/latest/developerguide/access-keys-rotated.html) · [AWS documentation](https://docs.aws.amazon.com/config/latest/developerguide/remediation.html) --- ## Question 7 — C ### Question + options A security vulnerability affects a Linux version running on EC2 instances. How can exposure be mitigated with the least disruption? A. Reboot the instances to move them to new hosts. B. Redeploy all instances from an updated AMI using CloudFormation. C. Use AWS Systems Manager Patch Manager to patch the operating system. D. Use Amazon Inspector to generate recommendations only. ### Scenario narrative The issue is an OS vulnerability and the goal is a low-disruption remedial change. ### Correct answer(s) **C** ### Reasons Patch Manager can scan and install supported patches on managed nodes under a controlled maintenance window. Plan for package-specific restarts/reboots and roll out gradually. Inspector helps identify vulnerabilities, but does not itself patch the OS. ### Rule of thumb > Use the patch-management mechanism for OS patching; schedule disruptive reboots and deploy in batches. ### Pitfall to avoid A patch might require a reboot. 'Least disruption' does not mean never reboot—use maintenance windows, health checks, and staged rollout. ### Flowchart / architecture sketch ```text EC2 Linux → SSM Patch Manager → maintenance window → patch + validate ``` ### Durable memory insight **Remember:** Identify missing patch → maintenance window → patch a small batch → verify health → continue. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager.html) · [AWS documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/maintenance-windows.html) --- ## Question 8 — A, E ### Question + options CloudFront serves `www.sample.com`. Traffic to CloudFront must use HTTPS, and an ACM certificate already exists. Which TWO actions are required? A. Set each relevant cache behavior's Viewer Protocol Policy to redirect HTTP to HTTPS (or HTTPS-only). B. Enable CloudFront Origin Shield. C. Allow both HTTP and HTTPS in each cache behavior. D. Associate AWS WAF with the distribution. E. Add `www.sample.com` as an alternate domain name and select the custom ACM certificate. ### Scenario narrative The website needs viewer-to-CloudFront HTTPS and a certificate valid for the custom hostname. ### Correct answer(s) **A, E** ### Reasons The Viewer Protocol Policy controls viewer-side HTTP/HTTPS. A custom hostname also requires an alternate domain name and an ACM certificate in the US East (N. Virginia) Region for CloudFront. Origin Shield, WAF, and allowing HTTP do not satisfy the TLS requirement by themselves. ### Rule of thumb > For CloudFront custom HTTPS: hostname alias + certificate + viewer HTTPS policy. ### Pitfall to avoid Viewer-to-CloudFront TLS and CloudFront-to-origin TLS are separate hops. If encryption is required end-to-end, configure the origin protocol policy too. ### Flowchart / architecture sketch ```text Viewer → HTTPS policy → CloudFront distribution alias + ACM certificate → origin ``` ### Durable memory insight **Remember:** Browser → HTTPS CloudFront (certificate for `www.sample.com`) → origin using configured origin protocol. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html) · [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html) --- ## Question 9 — A ### Question + options An RDS for MySQL database is slow during peak load. CloudWatch CPU utilization approaches 100%. What should be done first? A. Resize the RDS instance to a larger class. B. Enable Multi-AZ to add compute capacity. C. Add RDS MySQL nodes to distribute writes horizontally. D. Use CloudFront to cache database queries. ### Scenario narrative A single RDS DB instance is CPU-bound and needs more compute resources. ### Correct answer(s) **A** ### Reasons Scaling the instance class vertically adds CPU and memory. Multi-AZ is an HA mechanism, not a general read/write scaling mechanism. For read-heavy workloads, read replicas or caching may help, but they do not transparently distribute normal writes across multiple RDS MySQL writers. ### Rule of thumb > CPU pinned on a database → inspect query/connection patterns, then right-size; scale reads separately when appropriate. ### Pitfall to avoid Do not choose Multi-AZ just to get more CPU; a standby is not normally a read replica. ### Flowchart / architecture sketch ```text Application → RDS MySQL (CPU saturated) → larger DB class / query optimization ``` ### Durable memory insight **Remember:** CPU near 100% → verify workload/query bottlenecks → scale instance class or tune SQL. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ModifyInstance.html) · [AWS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html) --- ## Question 10 — B ### Question + options Deploy a web application on EC2 behind an ALB, with a separate EC2 database tier. The design must be multi-AZ and minimize public exposure. Which subnet layout is best? A. Public ALB, public web servers, public database servers in each AZ. B. Public ALB subnets; private web-server subnets; private database subnets, across AZs. C. Public ALB; private web servers; public database servers. D. Public ALB and public web servers; private databases. ### Scenario narrative Only the entry point needs to accept public client connections; application and database tiers should not be directly public. ### Correct answer(s) **B** ### Reasons Place an internet-facing ALB in public subnets across AZs. Place target EC2 instances and database resources in private subnets and tightly scope security-group rules from ALB to web tier and web tier to database tier. Ensure private instances have only the egress paths they need. ### Rule of thumb > Public edge, private compute, private data. ### Pitfall to avoid A private subnet may still require NAT or VPC endpoints for outbound dependencies. Do not put database servers in public subnets merely because they need updates. ### Flowchart / architecture sketch ```text Internet → public ALB (AZ-a/b) → private web EC2 → private DB EC2 ``` ### Durable memory insight **Remember:** Internet → public ALB → private app tier → private database tier. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-example-private-subnets-nat.html) · [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html) --- ## Question 11 — D ### Question + options AWS notifies a CloudOps Engineer that an EBS-backed EC2 instance is on a degraded host scheduled for retirement during business-critical hours. What minimizes disruption? A. Restart it immediately to prevent retirement. B. Restart it outside business hours without stopping it. C. Write a Lambda function to migrate the running instance between hosts. D. Stop and start the instance outside business hours, before the retirement deadline. ### Scenario narrative AWS has flagged the underlying physical host; the workload must be moved before that host is retired. ### Correct answer(s) **D** ### Reasons For eligible EBS-backed instances, a stop/start generally moves the instance to a new host. Plan the downtime, ensure data is on persistent EBS rather than instance store, and verify the replacement host's availability and startup automation. ### Rule of thumb > Host retirement → planned stop/start (if supported) before the event, rather than relying on a reboot. ### Pitfall to avoid A simple reboot does not reliably relocate an instance. Stop/start changes the host, but public IPv4 addresses can change unless an Elastic IP is attached. ### Flowchart / architecture sketch ```text EC2 degraded host → stop/start (EBS-backed) → new host → health check ``` ### Durable memory insight **Remember:** Retirement notice → maintenance window → stop/start → verify instance and application health. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-retirement.html) · [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html) --- ## Question 12 — B, E ### Question + options During migration, unnecessary objects were written to an S3 bucket using Object Lock governance mode. What TWO actions allow deletion before the retention date? A. Extend the retention date. B. Use a principal with `s3:BypassGovernanceRetention` permission. C. Change governance mode to compliance mode. D. Use a principal with `s3:PutObjectRetention` only. E. Explicitly send the bypass-governance-retention flag/header with the delete request. ### Scenario narrative Governance retention protects object versions but permits authorized, explicit bypass by principals granted the special permission. ### Correct answer(s) **B, E** ### Reasons Both permission and explicit intent are required for a governance-mode bypass. With AWS CLI, use the relevant `--bypass-governance-retention` option for the supported delete operation. Compliance mode cannot be bypassed before expiry, and extending retention does the opposite of what's requested. ### Rule of thumb > Governance bypass requires BOTH authorization and an explicit bypass flag. ### Pitfall to avoid Do not confuse governance mode with compliance mode. A legal hold can still prevent deletion even when governance bypass is authorized. ### Flowchart / architecture sketch ```text Object Lock GOVERNANCE → `s3:BypassGovernanceRetention` + bypass flag → delete object version ``` ### Durable memory insight **Remember:** Check Object Lock mode → confirm no legal hold → authorized bypass permission + explicit bypass request → delete version. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html) --- ## Question 13 — A, C ### Question + options An administrator cannot find a custom-Linux-AMI EC2 instance in Session Manager and needs to start an SSH session through Session Manager. Which TWO actions help? A. Install/ensure SSM Agent is installed and running. B. Add long-lived access keys to the instance. C. Attach an instance profile with the required Systems Manager permissions. D. Run Systems Manager Inventory to refresh the instance list. ### Scenario narrative Session Manager requires a managed node, a working SSM Agent, IAM permissions, and connectivity to Systems Manager endpoints. ### Correct answer(s) **A, C** ### Reasons Ensure SSM Agent is installed, current, and running, and attach an instance profile with the standard managed-instance permissions (or a least-privilege equivalent). Also verify endpoint connectivity, tags/state where relevant, and the agent's logs. Inventory is not the mechanism that registers an instance for Session Manager. ### Rule of thumb > SSM Agent + IAM instance role + network reachability are the core prerequisites. ### Pitfall to avoid Do not embed access keys in an instance. For private subnets without NAT, configure the required Systems Manager VPC endpoints. ### Flowchart / architecture sketch ```text EC2 custom AMI → SSM Agent + IAM instance profile + SSM endpoint access → Session Manager ``` ### Durable memory insight **Remember:** Instance → SSM Agent + instance role + endpoint reachability → managed node → Session Manager. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-prerequisites.html) · [AWS documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html) --- ## Question 14 — A ### Question + options AWS Single Sign-On (now IAM Identity Center) has been enabled in the Organizations management account. What is the next step to configure user access? A. Create permission sets and assign them to directory users/groups and target AWS accounts. B. Create IAM users in the management account for everyone. C. Create IAM roles manually in each account and associate users directly with roles. D. Create SCPs and attach them to directory users or groups. ### Scenario narrative The organization wants centrally managed workforce identities and cross-account access. ### Correct answer(s) **A** ### Reasons IAM Identity Center permission sets define the permission policies and session settings that become IAM roles in assigned accounts. Assign a user/group to one or more AWS accounts and permission sets. SCPs are organization guardrails, not identity assignments. ### Rule of thumb > Identity Center users/groups + permission sets + account assignments. ### Pitfall to avoid Do not confuse a permission set with an SCP. A permission set grants a user capabilities; an SCP places maximum-permission guardrails on accounts/OUs. ### Flowchart / architecture sketch ```text IAM Identity Center → permission set → user/group assignment → AWS account ``` ### Durable memory insight **Remember:** Identity source → users/groups → permission sets → account assignments → role-based console/CLI access. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html) --- ## Question 15 — B ### Question + options An ALB-backed website receives repeated 404 requests from one source IP and may be scraped by a bot. Which service should block the activity? A. AWS Shield Standard. B. AWS WAF. C. Amazon Inspector. D. AWS CloudTrail. ### Scenario narrative This is application-layer request filtering or rate control, not primarily a volumetric DDoS event or vulnerability scan. ### Correct answer(s) **B** ### Reasons AWS WAF can use an IP set, rate-based rule, or request-matching conditions to block or challenge abusive requests at an ALB or CloudFront. CloudTrail audits API activity; Inspector finds software vulnerabilities; Shield focuses on DDoS protection. ### Rule of thumb > L7 HTTP abuse → AWS WAF; volumetric/network DDoS → Shield; API auditing → CloudTrail. ### Pitfall to avoid A 404 alone is not proof of malicious behavior. Tune conditions/rate limits and monitor false positives before blocking broad IP ranges. ### Flowchart / architecture sketch ```text Client requests → AWS WAF (rate/IP rules) → ALB → application ``` ### Durable memory insight **Remember:** Repeated HTTP pattern from IP → WAF rate/IP rule → block/count and review logs. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html) --- ## Question 16 — D ### Question + options An EC2 instance transitions from `pending` to `terminated` immediately after launch. Which is a plausible cause? A. The requested instance type has been restricted in the account. B. AWS has no spare On-Demand capacity. C. The account exceeded the regional instance limit. D. The root EBS volume is encrypted with a KMS key the launching principal cannot use. ### Scenario narrative The instance is terminating during launch rather than simply remaining pending. ### Correct answer(s) **D** ### Reasons Failure to access the KMS key for an encrypted EBS volume can prevent launch and lead to termination. Inspect the instance state transition reason, system log, CloudTrail, and KMS permissions/key state before assuming capacity or quota. Those other causes typically surface as launch errors or failed requests. ### Rule of thumb > For fast launch termination, inspect the state-transition reason and encrypted-volume/KMS authorization path. ### Pitfall to avoid Do not guess solely from the state name. Check the EC2 console reason codes and CloudTrail events to distinguish KMS, capacity, quota, and configuration causes. ### Flowchart / architecture sketch ```text EC2 launch → encrypted root EBS → KMS authorization check → instance state ``` ### Durable memory insight **Remember:** Launch → volume decrypt authorization fails → instance terminates; inspect KMS key policy/IAM grants. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html) --- ## Question 17 — B ### Question + options A fleet is steady most of the day but has a predictable two-hour surge daily. What is the most operationally efficient scaling strategy? A. Reduce desired capacity during non-peak periods. B. Create scheduled scaling to add EC2 capacity before the high-traffic window. C. Run larger instance types all day. D. Manually add instances before each traffic surge. ### Scenario narrative The workload's demand spike is predictable, so capacity can be provisioned ahead of time. ### Correct answer(s) **B** ### Reasons Scheduled scaling changes desired capacity based on a known schedule and avoids waiting for reactive metrics to cross thresholds. Combine with dynamic scaling for unexpected traffic and choose capacity using measured load/testing. ### Rule of thumb > Predictable pattern → scheduled scaling; unpredictable variation → dynamic target tracking/step scaling. ### Pitfall to avoid Do not rely only on scheduled scaling if traffic is also variable; retain dynamic scaling and sensible minimum/maximum capacity. ### Flowchart / architecture sketch ```text Known time-based surge → scheduled ASG scale-out → handle peak → scale down ``` ### Durable memory insight **Remember:** Before peak start → scheduled scale out → peak window → scheduled scale in, subject to demand signals. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/autoscaling/ec2/userguide/scheduled-scaling-create-scheduled-action.html) --- ## Question 18 — B, C ### Question + options EC2 instances must lose public IP addresses but still reach S3 and some internet services. Which TWO solutions preserve access? A. Add security-group outbound rules using S3 private IP addresses. B. Use a NAT gateway for general internet egress and configure route tables. C. Create an S3 VPC endpoint and associate it with the appropriate route tables. D. Configure the internet gateway to route S3 through private IP addresses. E. Use Direct Connect directly to S3 buckets. ### Scenario narrative Private instances need a private path to S3 and a controlled egress path for destinations outside the VPC. ### Correct answer(s) **B, C** ### Reasons An S3 gateway endpoint routes S3 traffic over the AWS network without NAT or public IPs. A NAT gateway provides outbound IPv4 connectivity to general public services for private-subnet instances. Use endpoint policies, bucket policies, route tables, and security controls as appropriate. ### Rule of thumb > S3 access → S3 gateway endpoint; general internet egress → NAT gateway. ### Pitfall to avoid Security groups do not support stable S3 service-private-IP targeting. A NAT gateway does not make arbitrary outbound access private; it gives outbound internet access with stateful return traffic. ### Flowchart / architecture sketch ```text Private EC2 → S3 gateway endpoint → S3; private EC2 → NAT gateway → public internet ``` ### Durable memory insight **Remember:** Private EC2 → (S3 route) gateway endpoint; (other internet destinations) NAT gateway. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html) · [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) --- ## Question 19 — B ### Question + options A security policy says all EBS volumes must use a specific KMS customer-managed key. What is the most efficient verification mechanism? A. Create an SCP that only allows encryption API actions using that key. B. Use AWS Config's encrypted-volumes rule with the required KMS key ID parameter. C. Manually export a filtered volume list each day. D. Run a Lambda each day using `describe-volumes --filters encrypted`. ### Scenario narrative The need is continuous compliance evaluation of volume encryption settings and the exact key, not merely checking that encryption is enabled. ### Correct answer(s) **B** ### Reasons AWS Config's encrypted-volumes managed rule can assess EBS encryption and, when configured with the key ID parameter, checks whether the specified KMS key is used. SCPs can prevent some API actions but are not a retrospective compliance report. A simple `encrypted` filter does not prove the correct key is in use. ### Rule of thumb > Use AWS Config for continuous detection; use preventive guardrails separately if required. ### Pitfall to avoid Encrypted=true is not enough when policy mandates a particular KMS key. Confirm the rule parameter and remediation approach in the Region/account scope. ### Flowchart / architecture sketch ```text EBS volumes → AWS Config encrypted-volumes rule (required KMS key) → compliance report ``` ### Durable memory insight **Remember:** Record EBS volume config → AWS Config rule checks encrypted + KMS key ID → compliance status. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/config/latest/developerguide/encrypted-volumes.html) --- ## Question 20 — B, C (application/data encryption pairing) ### Question + options A hybrid application needs encryption at rest and encrypted traffic across shared networks. Which TWO actions best match the stated requirements? A. Use CloudHSM to encrypt all data with a CMK. B. Use AWS KMS to manage data-encryption keys. C. Use AWS Certificate Manager to issue TLS/SSL certificates. D. Use AWS KMS to create TLS/SSL certificates. E. Configure an AWS Site-to-Site VPN between on-premises and AWS. ### Scenario narrative The requirement combines stored-data encryption with protected application traffic in transit. ### Correct answer(s) **B, C (application/data encryption pairing)** ### Reasons AWS KMS manages keys used to encrypt data at rest; AWS Certificate Manager issues TLS certificates that applications/endpoints can use to encrypt data in transit. If the requirement specifically calls for an encrypted site-to-site network tunnel, AWS Site-to-Site VPN is also a valid network-layer control—but it does not replace application TLS where end-to-end encryption is required. ### Rule of thumb > At rest → KMS/key management; application traffic in transit → TLS certificate; site-to-site tunnel → VPN where specifically required. ### Pitfall to avoid VPN encryption does not replace application-layer TLS where end-to-end application encryption is required. CloudHSM is a specialized HSM option, not the default for every application; KMS does not issue certificates. ### Flowchart / architecture sketch ```text Application data at rest → KMS; client/app traffic → TLS with ACM-issued certificate ``` ### Durable memory insight **Remember:** Stored data → KMS-managed key; network/application traffic → TLS certificate (and VPN if a site-to-site tunnel is required). **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html) · [AWS documentation](https://docs.aws.amazon.com/acm/latest/userguide/gs.html) · [AWS documentation](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html) --- ## Question 21 — C ### Question + options Lambda functions access an RDS database, but credentials are hard-coded. They must not be plaintext and must rotate every 30 days. What is best? A. Store credentials as Parameter Store SecureString and build a custom rotation Lambda plus EventBridge schedule. B. Encrypt each hard-coded password with KMS and keep ciphertext in Lambda environment variables. C. Store credentials in AWS Secrets Manager, enable managed/automatic database-secret rotation every 30 days, and update Lambdas to retrieve the secret. D. Keep the password in Lambda environment variables and schedule a function to update them. ### Scenario narrative Several consumers need a centrally managed database secret with a controlled rotation lifecycle. ### Correct answer(s) **C** ### Reasons Secrets Manager is designed for secret storage, retrieval, versioning, and automatic rotation workflows for supported RDS engines. The rotation mechanism updates the secret and the database credentials; Lambda functions fetch the current value at runtime. Ensure the rotation function can network to the DB and that consumers tolerate rotation safely. ### Rule of thumb > Database credentials + automatic rotation → Secrets Manager, not code or per-function environment variables. ### Pitfall to avoid KMS-encrypted ciphertext is still a secret-management burden; rotation must update both the database and the consumers' source of truth. Avoid caching credentials indefinitely. ### Flowchart / architecture sketch ```text Lambda consumers → Secrets Manager → RDS; rotation Lambda changes DB + secret every 30 days ``` ### Durable memory insight **Remember:** Lambda → Secrets Manager GetSecretValue → RDS; scheduled rotation updates both DB password and secret. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_turn-on-for-db.html) --- ## Question 22 — B, E ### Question + options A web app on one EC2 instance needs a stable public IP for a domain name, with minimal management effort. Which TWO actions meet the requirement? A. Create an Auto Scaling group with min 1 and max 2. B. Create a Route 53 A record for the EC2 public address. C. Create a CNAME record pointing directly to an IP address. D. Put an ALB in front of the single EC2 instance. E. Allocate an Elastic IP and associate it with the instance. ### Scenario narrative The key requirement is a fixed IPv4 address and domain mapping, not multi-instance scale-out. ### Correct answer(s) **B, E** ### Reasons An Elastic IP is a static public IPv4 address that can be associated with an instance; Route 53 A records map the domain name to the IPv4 address. A CNAME target is a DNS name, not an IP. An ALB adds cost and provides a DNS name rather than a static single IP. ### Rule of thumb > Static IPv4 on one EC2 instance → Elastic IP + Route 53 A record. ### Pitfall to avoid A single instance remains a single point of failure. If the requirement later changes to HA, consider an ALB and multi-AZ fleet rather than a fixed single-instance IP. ### Flowchart / architecture sketch ```text example.com → Route 53 A record → Elastic IP → EC2 ``` ### Durable memory insight **Remember:** Domain → Route 53 A → Elastic IP → EC2. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html) --- ## Question 23 — C ### Question + options An administrator can SSH into an EC2 instance from the corporate network but receives a timeout when working from home. What is the most likely cause? A. The instance IAM role does not allow SSH from home. B. The home network's route table lacks a route to the VPC internet gateway. C. The instance security group does not allow inbound SSH from the home public IP/CIDR. D. The SSH key pair blocks connections from home networks. ### Scenario narrative The same service works from one source network but times out from another. ### Correct answer(s) **C** ### Reasons Security groups must permit inbound TCP port 22 from the client's actual public source IP/CIDR (unless using VPN/bastion/SSM). A timeout commonly indicates dropped network traffic; IAM roles do not ordinarily govern standard SSH ingress, and key problems usually produce authentication errors rather than a network timeout. ### Rule of thumb > Timeout → route, NACL, security group, firewall; authentication failure → user/key/SSH configuration. ### Pitfall to avoid Do not open SSH to `0.0.0.0/0` as a quick fix. Use a narrow home IP rule, VPN, bastion, or Session Manager. ### Flowchart / architecture sketch ```text Home client → internet/VPN → EC2 security group TCP 22 allowlist ``` ### Durable memory insight **Remember:** Home IP → SG inbound TCP/22? → NACL/route checks → SSH auth. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html) --- ## Question 24 — D ### Question + options Each AWS WAF-protected request contains a header with the front-end server ID. What condition can match this header so requests can be counted per server? A. IP match statement. B. Size-constraint statement. C. ID match (as written in the video; not a standard AWS WAF statement type). D. String-match statement inspecting the specified request header. ### Scenario narrative The field to match is a textual identifier in an HTTP request header, not the client's IP address or body size. ### Correct answer(s) **D** ### Reasons AWS WAF can match strings in specified request components, including headers. Configure the header name and server-ID string, then use rule metrics/logs or labels to count requests. 'ID match' is not a standard AWS WAF rule-statement type, so among the listed choices the usable condition is String match. ### Rule of thumb > Header content → string/byte match with the correct header field. ### Pitfall to avoid A rule matching one server ID counts only that ID; to distinguish many IDs, use labels, per-rule metrics, or logs. Ensure any forwarded client headers are trustworthy if they can be spoofed. ### Flowchart / architecture sketch ```text Request header `X-Front-End-ID` → AWS WAF match statement → per-rule metrics/logs ``` ### Durable memory insight **Remember:** HTTP request → inspect `X-Front-End-ID` → string match → count/metric/log. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-string-match.html) --- ## Question 25 — C ### Question + options An S3 static website returns HTTP 403 Forbidden even though static website hosting is enabled and content uploaded. What fixes a public static website configuration? A. Remove any default bucket policy that denies reads, if safe and intended. B. Grant everyone broad read access to all bucket actions. C. Grant public `s3:GetObject` on the website objects (`bucket/*`), while correctly configuring Block Public Access for the intended public website model. D. Enable cross-Region replication. ### Scenario narrative The website endpoint can serve objects only if the object's read authorization allows it. ### Correct answer(s) **C** ### Reasons For a publicly hosted S3 website, the bucket policy should grant `s3:GetObject` on object ARNs, not broad bucket administration or upload permissions. Block Public Access settings must permit the intended design. AWS currently recommends using CloudFront with Origin Access Control for a more secure production static site where possible. ### Rule of thumb > S3 website 403 → verify object key/index document + public-read policy + Block Public Access settings. ### Pitfall to avoid Granting `s3:GetBucket*` alone does not grant object reads. Never make a sensitive data bucket public just to fix an unexplained 403. ### Flowchart / architecture sketch ```text Browser → S3 website hosting → object-level GetObject permission (or CloudFront/OAC design) ``` ### Durable memory insight **Remember:** Browser → S3 website endpoint → bucket policy `s3:GetObject` on `arn:aws:s3:::bucket/*`. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteAccessPermissionsReqd.html) · [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html) --- ## Question 26 — B ### Question + options A new member account is created through AWS Organizations. How are user-defined cost-allocation tags enabled for consolidated billing? A. Create the tag keys in the payer account's Billing console. B. Tag resources in the member account, then activate those tag keys as cost-allocation tags in the management/payer account's Billing and Cost Management console. C. Create user-defined tags only from the new account's Billing console. D. Create tags in Tag Editor and activate them only from the member account's Billing console. ### Scenario narrative Resource tags originate on resources in member accounts, but cost allocation is activated centrally for the consolidated bill. ### Correct answer(s) **B** ### Reasons Apply consistent user-defined tags to resources, then activate the relevant tag keys in Billing and Cost Management for the organization's consolidated billing view. Tags must be applied to supported resources and activated before they appear in cost reports; activation is not retroactive to all past data. ### Rule of thumb > Tag resources where they live; activate cost-allocation tag keys centrally. ### Pitfall to avoid Creating a tag key does not automatically apply it to resources or make it active for billing. Standardize spelling/case and apply tags consistently. ### Flowchart / architecture sketch ```text Member account resources tagged → payer/management account activates tags → consolidated cost reports ``` ### Durable memory insight **Remember:** Member resource tag → billing management account activates key → usage/cost reports include tag dimension. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) --- ## Question 27 — C (gateway service stopped, VM rebooted, gateway restarted) ### Question + options The virtual machine running an AWS Storage Gateway Volume Gateway must be rebooted. What is the correct operational sequence? A. Stop the VM, restart the gateway, then turn on the VM. B. Reboot the logical gateway and then reboot the VM. C. Stop/deactivate the gateway through the supported procedure, reboot the VM, then restart the gateway service/appliance. D. Synchronize the gateway and reboot without checking status. ### Scenario narrative A virtual appliance needs maintenance while preserving its connection to cloud storage. ### Correct answer(s) **C (gateway service stopped, VM rebooted, gateway restarted)** ### Reasons Follow the supported Storage Gateway appliance maintenance procedure: stop gateway operations cleanly, reboot/maintain the host VM, then ensure the VM and gateway are running and healthy. Avoid abrupt hypervisor actions while active writes or cache synchronization are in progress. ### Rule of thumb > Gracefully stop gateway functions before host maintenance; verify health and cache state afterward. ### Pitfall to avoid Exact console/CLI steps vary by gateway type and appliance version—follow the current Storage Gateway guide rather than blindly applying a generic server reboot procedure. ### Flowchart / architecture sketch ```text Applications → Storage Gateway → stop safely → reboot VM → validate gateway online ``` ### Durable memory insight **Remember:** Pause/stop gateway → reboot VM → wait for agent/network → confirm gateway ONLINE. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/storagegateway/latest/vgw/MaintenanceShutDown-common.html) --- ## Question 28 — A ### Question + options An ALB has EC2 targets in an Auto Scaling group. Create a CloudWatch alarm for when every target is unhealthy. What metric and condition should be used? A. In `AWS/ApplicationELB`, alarm when `HealthyHostCount` is zero (equivalently, less than 1). B. In `AWS/ApplicationELB`, alarm when `HealthyHostCount` is 1 or more. C. In `AWS/EC2`, alarm when `StatusCheckFailed_Instance` is 1 or more. D. In `AWS/EC2`, alarm when `StatusCheckFailed_System` is zero or less. ### Scenario narrative The alert should represent target health at the load balancer, not EC2 system reachability in isolation. ### Correct answer(s) **A** ### Reasons Use the ApplicationELB namespace and the appropriate load-balancer/target-group dimensions for `HealthyHostCount`; alarm when the count is 0. EC2 status-check metrics don't indicate whether the ALB health checks consider targets healthy. The screenshot's intended first choice is the zero-host condition. ### Rule of thumb > All targets unhealthy = HealthyHostCount = 0. ### Pitfall to avoid The literal condition `HealthyHostCount < 0` is impossible; use `<= 0` or `< 1`. Make sure the alarm dimensions point to the intended ALB and target group. ### Flowchart / architecture sketch ```text ALB target group → `HealthyHostCount == 0` → CloudWatch alarm/SNS ``` ### Durable memory insight **Remember:** ALB target health → HealthyHostCount → zero → alarm. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html) · [AWS documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html) --- ## Question 29 — B ### Question + options Data must be archived for at least seven years using Amazon S3 Glacier. Which control enforces a retention/compliance policy? A. A data retrieval policy. B. A Glacier Vault Lock policy (or the appropriate S3 Object Lock retention configuration for S3 Glacier storage). C. A vault notification. D. A vault access policy alone. ### Scenario narrative The requirement is immutable retention, not who receives notifications or how data is retrieved. ### Correct answer(s) **B** ### Reasons Vault Lock lets you lock a policy that enforces compliance controls such as minimum retention periods for archive vaults. For modern S3 Glacier storage classes in S3 buckets, use S3 Object Lock retention and legal holds as appropriate. Choose the product's actual storage model carefully because S3 Glacier Vault Lock and S3 Object Lock are different mechanisms. ### Rule of thumb > Retention compliance → lock/retention policy, not an access policy or notification. ### Pitfall to avoid An access policy controls who can call APIs; it does not itself guarantee a seven-year retention period. Compliance-mode controls can be irreversible, so validate before locking. ### Flowchart / architecture sketch ```text Archive → Vault Lock/S3 Object Lock retention policy → seven-year preservation ``` ### Durable memory insight **Remember:** Archive written → retention rule applied → lock policy enforces period → audit retention. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/amazonglacier/latest/dev/vault-lock-policy.html) · [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html) --- ## Question 30 — B, D ### Question + options EC2 instances have specific tags and only a group of users should be allowed to manage them. Which TWO IAM actions are needed? A. Attach an IAM role to the EC2 instances. B. Create an IAM policy with a `Condition` that matches the desired EC2 resource tags. C. Create an Auto Scaling group and tag it. D. Attach that IAM policy to the users or groups that need access. E. Create an IAM policy using only the `Principal` element to identify instances. ### Scenario narrative The requirement is to authorize human/role principals to act on tagged EC2 resources. ### Correct answer(s) **B, D** ### Reasons Use resource-tag condition keys in the IAM policy to constrain the target instances, then attach the identity-based policy to the relevant users/groups/roles. An instance profile is for permissions the workload itself uses, not a substitute for authorizing administrators to manage instances. ### Rule of thumb > Resource tag condition + policy attached to the requesting identity. ### Pitfall to avoid Tags are not access controls by themselves. All other applicable policy layers—explicit denies, SCPs, permission boundaries, session policies—still apply. ### Flowchart / architecture sketch ```text User/group → tag-conditioned IAM policy → EC2 actions on matching instances ``` ### Durable memory insight **Remember:** Caller identity policy → `ec2:ResourceTag/Environment` condition → only tagged instances are allowed. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html) --- ## Question 31 — D ### Question + options A company needs to see how Reserved Instance discounts are allocated in its consolidated bill. Which tool is most appropriate? A. AWS Organizations. B. Amazon Inspector. C. AWS Budgets. D. AWS Cost and Usage Report (CUR). ### Scenario narrative The question asks for detailed billing allocation, not account membership, vulnerability analysis, or threshold alerts. ### Correct answer(s) **D** ### Reasons The Cost and Usage Report provides detailed line-item billing and usage data, including discount allocation information suitable for analysis by account, resource, and usage type when configured with the required detail. Use Cost Explorer for interactive high-level analysis and CUR/Athena for deeper reconciliation. ### Rule of thumb > Need auditable line-item billing/discount allocation → CUR. ### Pitfall to avoid A budget alerts on amounts; it is not a ledger of which resources received Reserved Instance benefit. ### Flowchart / architecture sketch ```text AWS billing → Cost and Usage Report → Athena/BI → RI discount allocation ``` ### Durable memory insight **Remember:** Billing data line items → CUR export → query by account/resource/discount fields. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.html) --- ## Question 32 — D (A is the same workflow in compressed form) ### Question + options CloudWatch Agent sends custom metrics to a custom namespace. How do you show the metrics on a CloudWatch dashboard? A. Select the custom namespace, choose the metric, and add it to the dashboard/widget. B. Use CloudWatch Events to add metrics automatically. C. Create CloudWatch Logs metric filters for existing custom metrics. D. Choose a dashboard widget and select the relevant metrics from the custom namespace. ### Scenario narrative Metrics have already been published; the task is visualization, not metric creation. ### Correct answer(s) **D (A is the same workflow in compressed form)** ### Reasons Create or edit a dashboard, select a widget type, then browse the namespace and metric dimensions that the agent publishes. Logs metric filters are for deriving metrics from log events, not for displaying metrics already emitted by the agent. ### Rule of thumb > Published metric → dashboard widget → namespace + metric dimensions. ### Pitfall to avoid Custom metrics are often under `CWAgent` unless a custom namespace was configured. Dimensions must match the published metric series exactly. ### Flowchart / architecture sketch ```text CloudWatch Agent → custom namespace → dashboard widget → selected metric ``` ### Durable memory insight **Remember:** Choose widget → browse custom namespace → pick metric/dimensions → add to dashboard. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create_dashboard.html) · [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html) --- ## Question 33 — D ### Question + options A global static S3 website begins receiving HTTP 503 Service Unavailable errors soon after launch. What is the most likely cause? A. A problem with S3 Transfer Acceleration. B. Expired pre-signed URLs. C. Incorrect user permissions. D. Request rate increased quickly and S3 is temporarily returning 503 Slow Down while scaling. ### Scenario narrative The launch causes a sudden increase in read traffic across a large user base. ### Correct answer(s) **D** ### Reasons S3 scales to high request rates, but a sharp change in workload can temporarily produce 503 Slow Down while S3 optimizes its internal scaling. Use exponential backoff, retries, and well-distributed object prefixes/traffic patterns. A persistent permissions problem typically gives 403, not a throughput-related 503. ### Rule of thumb > S3 503 Slow Down → retry with exponential backoff; inspect request rate and prefix distribution. ### Pitfall to avoid Do not retry in a tight loop without backoff; it can increase pressure. Transfer Acceleration is unrelated unless the actual error pattern identifies it. ### Flowchart / architecture sketch ```text Global clients → S3 → transient 503 → exponential backoff + well-distributed request load ``` ### Durable memory insight **Remember:** 503 during ramp-up → backoff/jitter → retries → observe whether throttling subsides. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/optimizing-performance-design-patterns.html) --- ## Question 34 — A ### Question + options Private EC2 instances use a NAT gateway to reach peers on the internet, and NAT charges have increased. How can the Engineer identify which instances generate the most traffic? A. Enable VPC Flow Logs on the NAT gateway's network interface and query source IPs with CloudWatch Logs Insights. B. Search CloudTrail API events for calls to the NAT gateway. C. Give every instance an Elastic IP and monitor CloudWatch by instance ID. D. Use Cost and Usage Report grouped by EC2 instance ID to determine NAT bytes. ### Scenario narrative The need is source-level network traffic attribution behind shared egress infrastructure. ### Correct answer(s) **A** ### Reasons VPC Flow Logs record traffic metadata at the relevant ENI/subnet/VPC; query source and destination addresses, bytes, ports, and actions to attribute flows to private instance IPs. CloudTrail records API calls, not each data packet. Cost reports may identify NAT gateway processing charges but not necessarily the top private source instances without network telemetry. ### Rule of thumb > Network-volume attribution → Flow Logs + query; spend attribution → Cost Explorer/CUR. ### Pitfall to avoid Flow Logs are metadata rather than packet capture; they don't record payloads and are not instantaneous packet-by-packet telemetry. Choose sufficient aggregation and retention. ### Flowchart / architecture sketch ```text Private EC2 IPs → NAT gateway ENI VPC Flow Logs → Logs Insights group by source ``` ### Durable memory insight **Remember:** NAT ENI/subnet Flow Logs → Logs Insights group bytes by source IP → map IP to EC2 instance. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) --- ## Question 35 — B ### Question + options A company must prevent all users, including administrators/root users of member accounts, from using Amazon Redshift, while leaving other services available. What should it do? A. Attach RedshiftFullAccess to deny users in every member account. B. Attach an SCP denying Redshift actions to the organization root (or the relevant OUs/accounts). C. Create IAM denies in each member account for every user and root user. D. Replace the default SCP with a policy that denies all actions. ### Scenario narrative The restriction must be centrally enforced even against member-account administrators. ### Correct answer(s) **B** ### Reasons An SCP can set the maximum permissions available to principals in member accounts, including member-account root users, so a deny for Redshift actions at the organization root/OU blocks the service across those accounts. Attach narrowly scoped deny statements and retain the normal allow policy behavior for other services. ### Rule of thumb > Organization-wide service prohibition → SCP Deny at the appropriate organization level. ### Pitfall to avoid SCPs do not apply to the Organizations management account. Do not replace the default policy with a blanket deny-all unless a deny-all is genuinely intended; use a targeted Redshift deny. ### Flowchart / architecture sketch ```text Organizations root/OU → SCP Deny Redshift actions → member accounts ``` ### Durable memory insight **Remember:** SCP deny Redshift → member identities cannot use Redshift; other permissions remain governed by IAM and other guardrails. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) --- ## Question 36 — A ### Question + options After an incident, TCP port 80 must be blocked in security groups and compliance must be reported near real time. What should be configured? A. AWS Config's `restricted-common-ports` rule with port 80 specified. B. An hourly Lambda that scans all security groups. C. Amazon Inspector scans security groups and emails reports. D. Trusted Advisor Red checks with a CloudWatch alarm for unrestricted ports. ### Scenario narrative The requirement is continuous configuration compliance on security group rules and quick visibility of deviations. ### Correct answer(s) **A** ### Reasons AWS Config managed rules evaluate supported resource configurations as they change or on their configured trigger. Configure `restricted-common-ports` for port 80 and use Config notifications/remediation if needed. Hourly custom scans are not near real time and Inspector is not the primary security-group configuration compliance engine for this use case. ### Rule of thumb > Configuration compliance → AWS Config rule; correction → Config remediation/Automation or controlled event workflow. ### Pitfall to avoid Port 80 being open to an internal trusted source may be different from being public. Ensure rule scope and parameters match the actual policy (for example, prohibit all inbound HTTP or only public ingress). ### Flowchart / architecture sketch ```text Security group configuration → AWS Config `restricted-common-ports` (port 80) → report/notification ``` ### Durable memory insight **Remember:** Security-group change → Config evaluates port rule → compliant/noncompliant status → alert/remediate. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/config/latest/developerguide/restricted-common-ports.html) · [AWS documentation](https://docs.aws.amazon.com/config/latest/developerguide/remediation.html) --- ## Question 37 — B ### Question + options EC2 instances cannot access S3 through an already created S3 VPC endpoint whose endpoint policy is correct. What common configuration issue should be checked? A. The S3 bucket policy must allow all private IP addresses. B. The instances' subnet route table is not associated with the S3 gateway endpoint route. C. S3 Storage Class Analysis is disabled. D. The instances need Elastic IP addresses. ### Scenario narrative The endpoint exists, but route selection may not direct S3 traffic to it. ### Correct answer(s) **B** ### Reasons For an S3 gateway endpoint, associate the endpoint with the route tables used by the private subnets. AWS adds routes for the S3 managed prefix list. Also check endpoint policy, bucket policy, DNS, and IAM permissions, but route-table association is the most likely missing piece in this scenario. ### Rule of thumb > S3 gateway endpoint works only for subnets using route tables associated with the endpoint. ### Pitfall to avoid Gateway endpoints do not use interface endpoint ENIs or private IP addresses assigned to S3. The private route is represented by a prefix-list route target. ### Flowchart / architecture sketch ```text Private EC2 → associated route table → S3 gateway endpoint → S3 ``` ### Durable memory insight **Remember:** EC2 → subnet route table → S3 prefix-list route to gateway endpoint → S3. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html) --- ## Question 38 — C (for read-heavy load) ### Question + options An Aurora cluster with a writer and reader experiences query latency during demand spikes, including increased memory utilization. What low-disruption change can improve read performance? A. Increase cluster disk capacity. B. Convert the cluster to multi-master. C. Add an Aurora Replica to the cluster. D. Snapshot the cluster and build an entirely new cluster with larger instances. ### Scenario narrative The described writer/reader arrangement suggests a need for more read-serving capacity with minimal downtime. ### Correct answer(s) **C (for read-heavy load)** ### Reasons Adding an Aurora Replica increases reader capacity and lets read traffic be distributed across replicas or the reader endpoint. If the actual bottleneck is writer CPU/memory, a larger instance class or query tuning may be needed instead; replicas do not fix every writer-bound workload. ### Rule of thumb > Read throughput bottleneck → add/read-scale replicas; writer-bound bottleneck → tune or scale the writer. ### Pitfall to avoid More replicas increase read capacity and cost, but don't automatically relieve write-heavy transactions or a single saturated writer. Confirm Performance Insights and workload type first. ### Flowchart / architecture sketch ```text Application read requests → Aurora reader endpoint → writer + replica readers ``` ### Durable memory insight **Remember:** Read query volume high → add Aurora Replica → distribute read traffic through reader endpoint. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Replication.html) --- ## Question 39 — A ### Question + options A CloudWatch alarm is repeatedly triggered and remains in ALARM state. What is a plausible explanation? A. The monitored metric remains beyond the configured threshold. B. Any EC2 instance in a stopped state forces every alarm to ALARM. C. An alarm requires an IAM role to change state. D. An unverified SNS topic locks the alarm state. ### Scenario narrative The alarm state tracks evaluated metrics, not whether a notification destination is verified. ### Correct answer(s) **A** ### Reasons CloudWatch compares metric datapoints with configured thresholds over the evaluation period. If breaching datapoints continue, ALARM is expected. Check the metric, statistic, threshold, missing-data treatment, period, and evaluation periods before assuming a service fault. ### Rule of thumb > Persistent ALARM usually means persistent threshold breach or mis-specified metric/dimensions. ### Pitfall to avoid An alarm does not need an IAM role to change state. An instance stopping can cause certain metrics to become missing; the configured missing-data treatment determines behavior. ### Flowchart / architecture sketch ```text CloudWatch metric → threshold/evaluation periods → ALARM or OK → optional SNS notification ``` ### Durable memory insight **Remember:** Datapoints > threshold across evaluation window → ALARM; healthy datapoints for required period → OK. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html) --- ## Question 40 — D ### Question + options An application uses a KMS customer-managed key with imported key material, referenced through an alias. Policy requires rotation every six months. What process supports this? A. Replace it with an AWS managed key that rotates every six months and update the alias. B. Enable automatic rotation every six months on the imported-material key. C. Delete and re-import new material into the same key as a normal automatic rotation. D. Create a new KMS key, import new material, and move the alias to the new key. ### Scenario narrative The key uses imported key material, so the normal KMS automatic rotation feature is unavailable for that key type. ### Correct answer(s) **D** ### Reasons AWS KMS automatic rotation is not supported for keys with imported key material. Create a new key with the new imported material and move the application alias after a controlled migration. Existing ciphertext encrypted under the old key still needs the old key material/key for decryption, unless data is re-encrypted. ### Rule of thumb > Imported key material → plan manual key replacement and alias move; retain old-key decrypt capability. ### Pitfall to avoid Moving an alias changes future alias resolution; it does not re-encrypt existing data or make old ciphertext decrypt with the new key. ### Flowchart / architecture sketch ```text Application alias → new KMS key with imported material; old KMS key retained for old ciphertext ``` ### Durable memory insight **Remember:** New imported material → new KMS key → update alias → verify encryption/decryption paths → retire old key only after migration. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html) · [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html) --- ## Question 41 — C ### Question + options An S3 bucket is in `us-east-1`; users in `ap-south-1` need faster uploads and downloads for large files. What should be used? A. Reduce the number of prefixes in the bucket. B. Create another bucket with the same name in another Region. C. Enable S3 Transfer Acceleration and use the S3 accelerate endpoint. D. Change server-side encryption from AES to RSA. ### Scenario narrative Large files travel long distances between clients and the bucket's Region. ### Correct answer(s) **C** ### Reasons Transfer Acceleration routes uploads/downloads through AWS edge locations and the AWS backbone to the bucket's Region. Test performance with the intended client locations and object sizes. It does not replicate the bucket or change encryption algorithms. ### Rule of thumb > Long-distance S3 transfer speed → evaluate Transfer Acceleration and benchmark it. ### Pitfall to avoid Transfer Acceleration adds request/data-transfer charges and may not improve every route/file size. It must be enabled and clients must use the accelerate endpoint. ### Flowchart / architecture sketch ```text Remote client → S3 Transfer Acceleration endpoint → AWS edge/backbone → S3 region ``` ### Durable memory insight **Remember:** Client → nearest AWS edge → AWS backbone → regional S3 bucket. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html) --- ## Question 42 — B, E ### Question + options Under the EC2 shared responsibility model, which TWO activities are AWS's responsibility? A. Patching the guest operating system. B. Maintaining the underlying network infrastructure. C. Monitoring EBS volume utilization. D. Configuring EC2 security groups. E. Patching the hypervisor. ### Scenario narrative The distinction is between AWS security 'of' the cloud and customer security 'in' the cloud. ### Correct answer(s) **B, E** ### Reasons AWS operates data centers, physical networking, and the virtualization layer/hypervisor. Customers manage guest OS patching, security groups, application configuration, data, and most resource-level monitoring. Managed-service responsibility can differ from EC2's model. ### Rule of thumb > For EC2: AWS protects physical infrastructure/hypervisor; customer protects guest OS and workload configuration. ### Pitfall to avoid Do not generalize EC2 responsibility boundaries to every managed service. As the abstraction level rises, AWS manages more of the stack. ### Flowchart / architecture sketch ```text AWS data center/network/hypervisor | Customer OS/security groups/app/data ``` ### Durable memory insight **Remember:** Physical/network/hypervisor → AWS; guest OS, security groups, data, apps → customer. **AWS reference:** [AWS documentation](https://aws.amazon.com/compliance/shared-responsibility-model/) --- ## Question 43 — B ### Question + options A CloudFormation template creates an Auto Scaling group with user data initialization, but creation fails because the resource wait condition never receives enough signals. What should be changed? A. Set `AssociatePublicIpAddress` to true in the launch template. B. Call `cfn-signal` at the end of the user-data initialization after setup succeeds. C. Reduce the ASG desired capacity. D. Open outbound port 8080 in the instance security group. ### Scenario narrative CloudFormation is waiting for proof that instance bootstrap finished successfully. ### Correct answer(s) **B** ### Reasons Use a CreationPolicy with ResourceSignal and run `cfn-signal` after the software is installed and healthy. This lets each instance report success/failure and avoids CloudFormation timing out without signals. Check that the instance can reach CloudFormation endpoints and that the signal command reports the intended exit status. ### Rule of thumb > ResourceSignal wait → call `cfn-signal` after successful initialization. ### Pitfall to avoid Signal too early and CloudFormation may declare success before the application works; forget permissions/network connectivity and the signal may never arrive. ### Flowchart / architecture sketch ```text CloudFormation CreationPolicy → EC2 user data/bootstrap → `cfn-signal` → stack proceeds ``` ### Durable memory insight **Remember:** User data installs/configures → health check succeeds → `cfn-signal` → stack continues. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/cfn-signal.html) --- ## Question 44 — D ### Question + options Employees have separate standalone AWS accounts that must join the company's central AWS Organization. What should be done? A. Add the accounts using AWS IAM. B. Log in to each account and directly join the organization without an invitation. C. Create a new organization in each account and join them to the central organization. D. Send each standalone account an invitation from the central organization's management account; the account accepts it. ### Scenario narrative Existing accounts need to become member accounts in the central organization. ### Correct answer(s) **D** ### Reasons The organization's management account invites existing standalone AWS accounts using their account ID or email. An authorized administrator of each invited account must accept the invitation. Plan billing and governance changes because joining changes consolidated billing/policy relationships. ### Rule of thumb > Existing account → central organization invitation → invited account accepts. ### Pitfall to avoid An account cannot be a member of two organizations simultaneously. Organizations membership is not established by creating IAM users or roles. ### Flowchart / architecture sketch ```text Company Organizations → invite existing accounts → account owners accept ``` ### Durable memory insight **Remember:** Management account sends invite → existing account administrator accepts → account becomes member. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_invite-account.html) --- ## Question 45 — B, D (recommended native remediation pattern) ### Question + options Across multiple Regions, EC2 security groups must never allow public SSH (`0.0.0.0/0`), and detected violations must be automatically removed. Which TWO steps are best? A. Use EventBridge to detect security-group changes and invoke a Lambda to modify the group. B. Create an AWS Config rule that detects security groups allowing SSH from `0.0.0.0/0`. C. Use GuardDuty to detect any security group allowing public SSH. D. Create a Systems Manager Automation document to update/remediate the identified security group rules. E. Use CloudTrail only to send an SNS notification. ### Scenario narrative The company needs both configuration detection and automatic corrective action across accounts/Regions. ### Correct answer(s) **B, D (recommended native remediation pattern)** ### Reasons AWS Config evaluates the security-group configuration; configure remediation using an SSM Automation runbook to revoke the dangerous ingress permission. EventBridge+Lambda can also be engineered, but Config + automatic remediation is the direct, auditable compliance pattern among the options. Deploy regionally and aggregate compliance if needed. ### Rule of thumb > Detect drift with Config; remediate with a tested, least-privilege runbook. ### Pitfall to avoid Do not rely only on GuardDuty, which is threat detection rather than a complete control for every open security-group rule. Test remediation to avoid removing approved administrative access unexpectedly. ### Flowchart / architecture sketch ```text Security group rule → AWS Config SSH rule → SSM Automation remediation → corrected SG ``` ### Durable memory insight **Remember:** Rule detects public SSH → NON_COMPLIANT → SSM Automation revokes ingress → Config re-evaluates. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/config/latest/developerguide/remediation.html) · [AWS documentation](https://docs.aws.amazon.com/config/latest/developerguide/restricted-common-ports.html) --- ## Question 46 — D ### Question + options A first CloudFormation stack creation ends in `ROLLBACK_COMPLETE`. Template problems are fixed. How should deployment continue? A. Update the rolled-back stack. B. Run `validate-template` and the existing stack will resume. C. Execute a change set against the failed stack. D. Delete the failed stack and create a new stack from the corrected template. ### Scenario narrative The initial stack creation failed and rolled back to a completed rollback state. ### Correct answer(s) **D** ### Reasons A stack in `ROLLBACK_COMPLETE` after a failed create generally cannot be updated. Delete it and create a new stack with the corrected template. Preserve diagnostic events/logs before deleting if you need root-cause evidence. ### Rule of thumb > Create failure + `ROLLBACK_COMPLETE` → delete then recreate. ### Pitfall to avoid `validate-template` checks template syntax/structure, not whether every resource creation will succeed. Save events before deleting the stack if needed. ### Flowchart / architecture sketch ```text Failed CREATE → ROLLBACK_COMPLETE → delete stack → create corrected stack ``` ### Durable memory insight **Remember:** Inspect Events → fix template → delete rollback-complete stack → create new stack. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-describing-stacks.html) --- ## Question 47 — D ### Question + options An EC2 application writes log files to an S3 bucket. What is the most secure way to grant the instance access? A. Store long-lived access keys in the AMI. B. Create an IAM user and distribute its keys to the instance. C. Make the S3 bucket accessible to all EC2 instances. D. Create an IAM role with the required S3 permissions and attach it to the instance profile. ### Scenario narrative The application needs AWS credentials without embedding secrets into an image or application files. ### Correct answer(s) **D** ### Reasons An EC2 instance profile delivers temporary role credentials through instance metadata. Grant only the necessary S3 actions on the target bucket/prefix and optionally combine with a bucket policy. Credentials rotate automatically with the role session. ### Rule of thumb > EC2 workload identity → instance role; least privilege for the exact bucket/prefix. ### Pitfall to avoid Never bake long-lived IAM user keys into AMIs or source code. The role should allow only the specific required operations and object paths. ### Flowchart / architecture sketch ```text EC2 instance profile → least-privilege S3 role → bucket/prefix ``` ### Durable memory insight **Remember:** EC2 → instance profile/role → temporary credentials → S3 PutObject to approved prefix. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html) · [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html) --- ## Question 48 — A ### Question + options A memory leak is suspected across both EC2 Linux instances and on-premises servers. What is the simplest way to track memory utilization over time for both? A. Install/configure the CloudWatch Agent on both EC2 and on-premises servers to publish memory metrics. B. Write a custom script or buy third-party software. C. Use CloudWatch Agent for EC2 and different monitoring software on premises. D. Put on-premises servers and EC2 instances in Auto Scaling groups. ### Scenario narrative The team needs a common time series view of an OS metric that EC2 basic monitoring does not report by default. ### Correct answer(s) **A** ### Reasons CloudWatch Agent can collect OS-level memory metrics from EC2 and on-premises/hybrid servers that are configured as managed hosts or agent targets. Publish into a consistent namespace and use the same dashboards/alarms to compare trends. ### Rule of thumb > Memory utilization is an OS metric → CloudWatch Agent, not default EC2 hypervisor metrics alone. ### Pitfall to avoid EC2 basic monitoring commonly doesn't expose guest memory. Verify the agent config, IAM permissions, namespace, and network connectivity on on-premises nodes. ### Flowchart / architecture sketch ```text EC2 + on-prem servers → CloudWatch Agent → CloudWatch custom memory metrics → dashboard ``` ### Durable memory insight **Remember:** CloudWatch Agent on each host → common namespace → compare memory time series/alarms. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html) --- ## Question 49 — D ### Question + options EC2 instances behind a Network Load Balancer cannot be reached from an on-premises data center on port 8081. VPC Flow Logs show the return flow to an ephemeral client port is REJECT. What is the likely cause? A. The EC2 security group does not allow inbound traffic from the NLB. B. The NLB security group lacks an inbound rule from the data center. C. The on-premises firewall blocks traffic into the VPC. D. The subnet network ACL blocks outbound traffic to the client's ephemeral port range. ### Scenario narrative The flow-log evidence shows one direction accepted and the response direction rejected on the ephemeral port. ### Correct answer(s) **D** ### Reasons Network ACLs are stateless; they must allow both the request port and the return traffic's ephemeral port range. Security groups are stateful. If the REJECT record is the target's response toward the client ephemeral port, inspect NACL egress/return-path rules for that range. ### Rule of thumb > Flow direction + destination port + ACCEPT/REJECT reveals which network layer/direction is blocked. ### Pitfall to avoid Validate the actual five-tuple and subnet direction from the complete flow-log schema before changing rules. Do not open all ports if a narrower ephemeral range will satisfy the return path. ### Flowchart / architecture sketch ```text On-prem client → NLB:8081 → EC2 target; return flow → ephemeral port REJECT at NACL ``` ### Durable memory insight **Remember:** Inbound request accepted → response to ephemeral port rejected → check stateless NACL egress/return range. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) · [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) --- ## Question 50 — C ### Question + options A Memcached ElastiCache cluster has more traffic and needs a larger node type with more memory. Which API operation applies the change to the existing cluster? A. CreateReplicationGroup with a new CacheNodeType. B. ModifyCacheParameterGroup with a new CacheNodeType. C. ModifyCacheCluster for the existing cache cluster. D. CreateCacheCluster with a new node type and leave the old cluster untouched. ### Scenario narrative The question asks to resize an existing Memcached cluster rather than change parameter values or create a new deployment. ### Correct answer(s) **C** ### Reasons Use the ElastiCache cluster modification API/console to change `CacheNodeType` where supported. Plan the impact: Memcached data is cached and generally can be repopulated, but changing node type can trigger replacement/reconfiguration and application cache misses. Redis replication-group procedures are not interchangeable with Memcached cluster operations. ### Rule of thumb > Memcached cluster resize → ModifyCacheCluster/modify the existing cluster's node type. ### Pitfall to avoid A cache is not durable primary storage. Expect cold-cache effects and ensure the application handles cache misses during or after resizing. ### Flowchart / architecture sketch ```text Application → Memcached cluster → ModifyCacheCluster(CacheNodeType) → cache repopulates ``` ### Durable memory insight **Remember:** Select new node type → modify cluster → monitor node state/cache miss rate/application latency. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheCluster.html) --- ## Question 51 — A ### Question + options Many EC2 instances upload logs to a third-party service that now allows only one source IP. What should be changed? A. Route private instances through a NAT gateway and give the service the NAT gateway's Elastic IP. B. Attach one Elastic Network Interface to all instances and whitelist its EIP. C. Move all instances into one subnet and whitelist the subnet CIDR. D. Route all instances through an internet gateway and whitelist the gateway IP. ### Scenario narrative Multiple private instances need a common, stable outbound public IPv4 address. ### Correct answer(s) **A** ### Reasons A NAT gateway in a public subnet can use an Elastic IP and provide a single egress address for instances in private subnets. The third party can whitelist that EIP. Route tables for private subnets must direct default-route internet traffic through the NAT gateway. ### Rule of thumb > Single egress public IP for many private IPv4 workloads → NAT gateway + EIP. ### Pitfall to avoid An internet gateway does not itself have a single fixed egress address to whitelist for private instances. Avoid public IPs on every workload when a shared controlled egress IP is required. ### Flowchart / architecture sketch ```text Private EC2 fleet → NAT gateway (EIP) → third-party service whitelist ``` ### Durable memory insight **Remember:** Private instances → private route `0.0.0.0/0` to NAT → NAT EIP → third party allowlist. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) --- ## Question 52 — A ### Question + options The security team requires server-side encryption for all new objects uploaded to an S3 bucket. What is the best choice among the listed options? A. Configure the bucket's default encryption for the desired server-side encryption mode. B. Generate a pre-signed PUT URL that includes an encryption flag and distribute one URL to users. C. Add the shown policy statement to the IAM user permissions policy to deny unencrypted uploads (the OCR'd policy is malformed and appears to misuse `Principal`). ### Scenario narrative The security requirement is encryption at rest for new uploads, not a particular user's upload workflow. ### Correct answer(s) **A** ### Reasons S3 now automatically applies SSE-S3 to all new object uploads. For a desired SSE-KMS or DSSE-KMS default, configure bucket default encryption. If policy requires a specific customer-managed key or forbids callers from overriding the encryption choice, use a correctly scoped bucket policy with the relevant condition. A `Principal` element does not belong in an IAM identity policy. ### Rule of thumb > Default encryption covers new uploads automatically; use policy enforcement for a specific mandatory encryption configuration. ### Pitfall to avoid The source choices are from older S3 guidance. Do not copy the OCR'd JSON into production; it is syntactically and semantically malformed. Enabling default encryption provides encryption, while a separate bucket-policy guardrail may be needed if a specific key/algorithm is mandatory. ### Flowchart / architecture sketch ```text Client PUT → S3 bucket default encryption → SSE-S3 (or chosen SSE-KMS/DSSE-KMS); optional policy enforcement ``` ### Durable memory insight **Remember:** Upload → S3 default SSE-S3/SSE-KMS applied; if exact key mandated → bucket policy guardrail. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html) · [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html) --- ## Question 53 — C ### Question + options A CloudFormation template creating a new VPC for each customer application fails when creating a new customer environment. What is the most likely cause? A. The template is not the latest version. B. The AMI is unavailable in the selected Region. C. The account/Region has reached its VPC quota. D. Scheduled Region maintenance makes the Region temporarily unavailable. ### Scenario narrative A repeatable template that has worked before fails when provisioning yet another VPC in the same account and Region. ### Correct answer(s) **C** ### Reasons VPC and related networking resources have service quotas. If the account has reached the VPC quota, another stack's VPC creation fails until resources are removed or the quota increased. Confirm the failed resource and CloudFormation event before concluding that quota is the cause. ### Rule of thumb > Repeated per-customer VPC deployment → check VPC/service quotas first. ### Pitfall to avoid A generic stack failure is not proof of a quota issue; use CloudFormation Events and Service Quotas to verify. Templates can also fail due to CIDR overlap, permissions, or unavailable AMIs. ### Flowchart / architecture sketch ```text CloudFormation VPC resource → Service Quotas check → free capacity or request quota increase ``` ### Durable memory insight **Remember:** Stack fails at VPC create → inspect event/error → compare current usage with quota → request/clean up. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-describing-stacks.html) --- ## Question 54 — A ### Question + options A CloudOps Engineer needs to identify cost savings by downsizing underutilized EC2 instances with minimal effort. What should be used? A. AWS Cost Explorer rightsizing recommendations (and current Cost Optimization Hub where appropriate). B. A custom Lambda that calculates CPU utilization. C. Manually inspect all CloudWatch EC2 metrics. D. AWS Budgets alerts for underutilized instances. ### Scenario narrative This is a rightsizing analysis task across EC2 usage, not simply a budget threshold alert. ### Correct answer(s) **A** ### Reasons Cost Explorer's rightsizing recommendations analyze EC2 usage and identify downsizing/termination opportunities. Current AWS guidance also points to Cost Optimization Hub for broader optimization opportunities. Validate memory, network, disk, seasonality, and performance needs before applying recommendations. ### Rule of thumb > Rightsizing with low effort → Cost Explorer/Cost Optimization Hub. ### Pitfall to avoid Low average CPU alone does not prove an instance is safe to downsize. Check peak demand, memory, I/O, workload schedule, and business SLAs. ### Flowchart / architecture sketch ```text EC2 usage data → Cost Explorer/Cost Optimization Hub → savings candidate → validate then resize ``` ### Durable memory insight **Remember:** Usage history → rightsizing recommendation → engineer validates → resize with rollback plan. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/cost-management/latest/userguide/ce-rightsizing.html) --- ## Question 55 — C (closest listed choice; in practice choose a suitable rolling/instance-refresh strategy where appropriate) ### Question + options A CloudFormation-deployed app uses EC2 in an Auto Scaling group behind an ALB. A new version must be deployed without DNS changes and with rollback support. Which listed option is best? A. Use lifecycle hooks to deploy the new version on new instances and mark them healthy when ready. B. Build a new AMI and swap the launch configuration without a managed rollout policy. C. Use CloudFormation's AutoScalingReplacingUpdate strategy so the ASG is replaced and rollback can retain the old group until the new one succeeds. D. Deploy a second stack with a different ALB and change DNS to cut over. ### Scenario narrative The public traffic entry point should remain stable while application capacity is updated and failed deployments can be rolled back. ### Correct answer(s) **C (closest listed choice; in practice choose a suitable rolling/instance-refresh strategy where appropriate)** ### Reasons CloudFormation supports replacing the Auto Scaling group while retaining the old group until the new one succeeds, when configured with `AutoScalingReplacingUpdate`/creation signals. For a normal in-place fleet rollout, a rolling update or Auto Scaling instance refresh may be safer and more efficient. Keep the ALB/DNS name stable and validate new instances before shifting traffic. ### Rule of thumb > Stable ALB/DNS + health-checked capacity replacement + rollback guardrails. ### Pitfall to avoid The option wording is not the only modern deployment pattern. Use `AutoScalingRollingUpdate` or instance refresh for a rolling deployment where appropriate; full ASG replacement can temporarily double capacity/cost and requires correct target-group wiring. ### Flowchart / architecture sketch ```text Stable DNS → ALB → current ASG; CloudFormation safely replaces/updates the ASG with health checks and rollback ``` ### Durable memory insight **Remember:** Provision replacement capacity → wait for success signals/healthy targets → shift/remove old capacity; on failure retain/restore old capacity. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-attribute-updatepolicy.html) · [AWS documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/cfn-signal.html) --- ## Question 56 — C ### Question + options A malicious IP must be explicitly denied for both inbound and outbound traffic across the VPC's subnet resources immediately. What is the quickest fit among the choices? A. Install host-based firewalls on every EC2 instance. B. Remove the internet gateway and replace it with NAT. C. Add deny rules to the network ACLs associated with all relevant subnets. D. Add deny rules to EC2 security groups. ### Scenario narrative The rule must deny a specific IP in both directions across subnet traffic. ### Correct answer(s) **C** ### Reasons Network ACLs are stateless and support explicit DENY entries, so the IP can be blocked at subnet boundaries for inbound and outbound traffic. Security groups are stateful allow-only filters and cannot create explicit deny rules. Ensure rule numbers precede broader allow rules and apply the ACL to every relevant subnet. ### Rule of thumb > Explicit IP deny at subnet boundary → network ACL, not security group. ### Pitfall to avoid NACLs are stateless, so permitted return traffic must also be allowed; a higher-priority rule can shadow the deny if rule numbering is wrong. This only covers traffic through subnets where the ACL is applied. ### Flowchart / architecture sketch ```text Subnet boundary → NACL inbound DENY + outbound DENY for the malicious IP ``` ### Durable memory insight **Remember:** Threat IP → NACL deny rule in each direction → verify Flow Logs show REJECT. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) --- ## Question 57 — A ### Question + options CloudFront fronts an ALB, but mobile users sometimes receive desktop pages. The origin varies content by User-Agent. What should change? A. Forward/include the User-Agent header in CloudFront's origin request/cache configuration and include it in the cache key when responses vary by User-Agent. B. Add a fixed custom User-Agent header to all origin requests. C. Enable IPv6 on CloudFront and use a dualstack hostname. D. Enable IPv6 on the ALB and set CloudFront's origin to dualstack. ### Scenario narrative CloudFront may reuse a cached desktop response for a mobile request because the relevant variation isn't represented in caching behavior. ### Correct answer(s) **A** ### Reasons If the origin returns different content by User-Agent, configure the cache/origin request policy so the needed header reaches the origin and responses are cached separately where required. Modern best practice is to vary only on necessary headers, cookies, and query strings to avoid fragmenting the cache unnecessarily. ### Rule of thumb > If origin response varies by a request property, forward it and account for it in the cache key. ### Pitfall to avoid Forwarding a header without adding it to the cache key can still allow the wrong cached variant to be returned. Don't forward every header by default; it reduces cache efficiency. ### Flowchart / architecture sketch ```text Mobile/desktop viewer → CloudFront cache policy (required device/header variation) → ALB origin ``` ### Durable memory insight **Remember:** Mobile/Desktop request → cache key varies on required device signal → correct origin response/cache variant. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html) --- ## Question 58 — B ### Question + options Systems Manager Patch Manager runs scheduled patches, but users report poor response times while patching. What minimizes impact? A. Create a patched AMI and deploy it to exactly 10% of the fleet through a maintenance-window option. B. Configure the maintenance-window task's concurrency to patch 10% of instances at a time. C. Update all instances one by one using an AMI snapshot without automation. D. Create separate patch groups and update them at different times only. ### Scenario narrative The fleet is being patched simultaneously, consuming CPU/I/O or causing reboots that degrade the service. ### Correct answer(s) **B** ### Reasons Systems Manager maintenance windows support rate controls, including maximum concurrency as a count or percentage. Limit concurrency (for example, 10%), set an error threshold, and make sure load balancers and Auto Scaling capacity can absorb instances temporarily out of service. The exact percentage depends on fleet size and redundancy. ### Rule of thumb > Reduce patch concurrency and use maintenance windows so healthy capacity remains available. ### Pitfall to avoid A 10% concurrency setting is not universally safe; use service SLOs, AZ balance, batch size, and error threshold. An immutable AMI/instance refresh can be better for some fleets. ### Flowchart / architecture sketch ```text Fleet → SSM maintenance window (`MaxConcurrency: 10%`) → staged patch batches ``` ### Durable memory insight **Remember:** Maintenance window → patch 10% batch → verify service health → continue until complete. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/maintenance-windows.html) --- ## Question 59 — C, D ### Question + options A website serves dynamic content through an ALB/EC2 and static content from S3. Users report slow loading. Which TWO actions improve performance? A. Enable Route 53 latency-based routing. B. Move dynamic content from web servers to S3. C. Implement EC2 Auto Scaling for the web tier. D. Add CloudFront caching for static S3 content. E. Move static content from S3 onto the EC2 web servers. ### Scenario narrative The architecture needs both capacity elasticity for the dynamic tier and edge caching for static assets. ### Correct answer(s) **C, D** ### Reasons Auto Scaling adds/removes EC2 application capacity as demand changes. CloudFront caches static objects at edge locations close to users, reducing round trips to S3 and improving latency. Route 53 latency routing is most relevant when multiple regional endpoints are available; it does not cache static content itself. ### Rule of thumb > Dynamic throughput → scale the application tier; static global latency → CDN caching. ### Pitfall to avoid Do not move static files onto EC2 and thereby compete with dynamic compute. Ensure caching headers/TTLs and invalidation strategy fit content update frequency. ### Flowchart / architecture sketch ```text Dynamic: Route53/ALB → EC2 ASG; Static: users → CloudFront → S3 ``` ### Durable memory insight **Remember:** Dynamic requests → ALB → ASG; static requests → CloudFront edge cache → S3 origin. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html) · [AWS documentation](https://docs.aws.amazon.com/autoscaling/ec2/userguide/scheduled-scaling-create-scheduled-action.html) --- ## Question 60 — B (assuming private subnet lacks SSM endpoint connectivity) ### Question + options SSM Agent and IAM permissions are configured, but Systems Manager does not manage all EC2 instances in one subnet. What should be checked/fixed? A. Verify that instances have the right tags to grant Systems Manager access. B. Provide private-subnet connectivity to Systems Manager using the required interface VPC endpoints when no NAT/internet path exists. C. Use IAM Access Analyzer to identify and automatically repair the issue. D. Reinstall Inventory and wait for the next inventory run. ### Scenario narrative Agent and role are already valid, and failures are correlated to instances in one subnet, pointing toward network path differences. ### Correct answer(s) **B (assuming private subnet lacks SSM endpoint connectivity)** ### Reasons SSM Agent must reach Systems Manager service endpoints. In private subnets without a NAT route, configure the required VPC interface endpoints, endpoint security groups, DNS, and routes. Validate connectivity to the SSM, SSM Messages, and EC2 Messages endpoints appropriate for the Region/agent features. ### Rule of thumb > Subnet-specific SSM failures after IAM/agent checks → investigate endpoint/DNS/network reachability. ### Pitfall to avoid Tags can be used to target managed nodes but do not create connectivity. Inventory collects instance metadata; it does not make a disconnected instance become managed. ### Flowchart / architecture sketch ```text Private subnet EC2 → interface endpoints for Systems Manager → SSM control channel ``` ### Durable memory insight **Remember:** Agent + role present → endpoint/DNS/SG connectivity check → SSM managed node online. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html) · [AWS documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-prerequisites.html) --- ## Question 61 — B ### Question + options Two VPCs in different Regions must replicate data. All traffic must remain off the public internet and be encrypted in transit. What is a simple solution? A. Use NAT gateways in both VPCs. B. Create inter-Region VPC peering and update both VPC route tables. C. Create a managed VPN between the VPCs and configure routes. D. Use internet gateways as route targets. ### Scenario narrative The VPCs need private IP connectivity across Regions with encryption on the inter-Region path. ### Correct answer(s) **B** ### Reasons Inter-Region VPC peering provides private routing between VPCs without traversing the public internet, and AWS documents AES-256 encryption at the virtual network layer for inter-Region traffic. Update both route tables and security controls. If policy requires application-controlled encryption or complex transitive routing, add TLS or evaluate Transit Gateway/other architectures. ### Rule of thumb > Two VPCs, different Regions, direct private connectivity → inter-Region VPC peering + routes. ### Pitfall to avoid VPC peering is non-transitive and CIDR ranges must not overlap. NAT and IGWs are not the private inter-VPC connection mechanism. ### Flowchart / architecture sketch ```text VPC A route table ↔ inter-Region VPC peering ↔ VPC B route table ``` ### Durable memory insight **Remember:** VPC-A private CIDR → inter-Region peering link → VPC-B private CIDR. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/vpc/latest/peering/working-with-vpc-peering.html) · [AWS documentation](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-peering.html) --- ## Question 62 — C, D (best direct diagnostic pair) ### Question + options An Auto Scaling group has not reached maximum capacity but fails to launch instances during busy periods. Which TWO checks can identify the cause? A. Check AWS Health Dashboard for service/outage events. B. Monitor limits in Systems Manager. C. Inspect CloudTrail for the result/error of `RunInstances` requests. D. Use Trusted Advisor to check EC2 service limits. E. Use Amazon Inspector for instance performance reports. ### Scenario narrative The desired scaling event may be running but instance launch calls can fail because of quota, configuration, IAM, capacity, or subnet constraints. ### Correct answer(s) **C, D (best direct diagnostic pair)** ### Reasons CloudTrail helps reveal the API request and error code for `RunInstances`; Trusted Advisor service-limit checks can highlight limit problems. Also inspect Auto Scaling activity history, EC2 launch-template configuration, subnet IP capacity, instance-type capacity, and AWS Health when evidence points to a service event. ### Rule of thumb > ASG does not launch → activity history + CloudTrail error + service-quota check. ### Pitfall to avoid The maximum capacity not being reached does not prove enough launch capacity exists. A service limit, subnet exhaustion, invalid AMI, KMS permission, or launch-template error can still block launches. ### Flowchart / architecture sketch ```text ASG activity history → CloudTrail RunInstances error + Trusted Advisor quota check ``` ### Durable memory insight **Remember:** Scaling event fails → inspect ASG activity → examine RunInstances error → check quotas/health/capacity. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/autoscaling/ec2/userguide/scheduled-scaling-create-scheduled-action.html) · [AWS documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) --- ## Question 63 — A ### Question + options A Route 53 hosted zone and an ALB are in different AWS accounts. What is the most cost-effective and efficient way to point the domain to the ALB? A. Create an A/AAAA alias record pointing directly to the ALB's DNS name and canonical hosted-zone ID. B. Create another ALB in the hosted-zone account and forward traffic cross-account. C. Make a replicated hosted zone in the ALB account. D. Create a CNAME pointing to an alias record for the ALB. ### Scenario narrative DNS is centrally managed in one account while the application load balancer belongs to another account. ### Correct answer(s) **A** ### Reasons Route 53 supports alias records targeting an ELB load balancer in another account. Obtain the load balancer DNS name and canonical hosted-zone ID; the console may not list cross-account targets, so enter the target details manually. Alias records work at the zone apex and avoid an extra CNAME hop. ### Rule of thumb > Cross-account ALB DNS → Route 53 alias record; manually enter target DNS and load-balancer hosted-zone ID if not listed. ### Pitfall to avoid Do not use the domain's hosted-zone ID where the alias requires the load balancer's canonical hosted-zone ID. The ALB must be accessible to the intended clients. ### Flowchart / architecture sketch ```text Route 53 hosted zone (account A) → alias record → ALB (account B) ``` ### Durable memory insight **Remember:** Hosted zone account → alias A/AAAA → ALB DNS in application account. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-values-alias-common.html) --- ## Question 64 — B ### Question + options An S3 bucket is currently accessible to users in other AWS accounts. It must be accessible only to users in the owning account. What is the best control? A. Move the bucket to S3 One Zone-IA and disable versioning. B. Use a bucket policy that restricts principals to the owning account. C. Change the ACL to restrict access to the bucket owner. D. Create pre-signed URLs for objects. ### Scenario narrative The access boundary must be enforced at the bucket resource policy level for cross-account access. ### Correct answer(s) **B** ### Reasons Write a bucket policy that grants/permits the intended same-account principals and excludes or denies cross-account principals, taking other policy mechanisms into account. S3 Object Ownership settings can disable ACLs and simplify authorization. Pre-signed URLs can grant temporary access to other parties, the opposite of the goal. ### Rule of thumb > Cross-account access restriction → bucket policy and S3 Object Ownership/ACL review. ### Pitfall to avoid A policy 'allowing same-account principals' is not always enough if existing resource grants allow other principals; explicit Deny conditions may be required. Review access points and ACLs too. ### Flowchart / architecture sketch ```text Caller principal → bucket policy account boundary → same-account only ``` ### Durable memory insight **Remember:** Incoming request principal account ID → bucket policy condition → allow/deny. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html) --- ## Question 65 — B ### Question + options A computer on premises pings EC2 `172.31.10.10` across a Site-to-Site VPN but gets no reply. Flow Logs show the inbound request ACCEPT and the return packet REJECT. What is the most likely fix? A. Allow inbound traffic from the on-premises host in the EC2 security group. B. Modify the network ACL to allow outbound traffic to the on-premises host. C. Modify the network ACL to allow inbound traffic from the on-premises host. D. Modify the EC2 security group to allow outbound traffic to the on-premises host. ### Scenario narrative The echo request reaches the instance, but the return flow is rejected by a stateless subnet control. ### Correct answer(s) **B** ### Reasons Network ACLs are stateless, so the return ICMP traffic must be permitted by the outbound NACL rules. Security groups are stateful and automatically allow reply traffic for permitted inbound ICMP, subject to other network controls. The Flow Logs' ACCEPT/REJECT direction points to outbound NACL policy as the issue. ### Rule of thumb > Inbound accepted + reply rejected → examine outbound NACL rules and flow direction. ### Pitfall to avoid Do not add broad security-group rules without evidence. ICMP needs to be allowed in the correct direction, and NACL rule numbering can override later allows. ### Flowchart / architecture sketch ```text On-prem ICMP request → EC2 inbound ACCEPT → reply → subnet NACL outbound REJECT ``` ### Durable memory insight **Remember:** ICMP echo request ACCEPT → reply REJECT → add appropriate outbound NACL allow for the on-prem CIDR/ICMP. **AWS reference:** [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) · [AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) --- ## Cross-question durable memory sheet | Situation / clue | First service/control to consider | Remember | |---|---|---| | SQS backlog grows | EC2 Auto Scaling on backlog per instance | Queue depth is work waiting; CPU alone can mislead. | | No internet egress allowed | Private subnet route table + egress controls | “Private” is a route configuration, not just no public IP. | | Root-account hygiene | MFA, no root keys, Trusted Advisor/security review | Root is for tasks that require root. | | Production HA | Multi-AZ application tier + managed DB HA | HA differs from read scaling. | | S3 unauthorized attempts | CloudTrail data events and/or server access logs + Athena | Enable the evidence source before querying it. | | Key rotation policy | AWS Config for detection + controlled remediation | Detecting noncompliance is not the same as changing a key. | | OS vulnerabilities | Systems Manager Patch Manager | Stage changes and plan for reboots. | | CloudFront HTTPS | Viewer Protocol Policy + custom hostname/certificate | Viewer-to-edge and edge-to-origin are separate TLS hops. | | EC2-to-S3 credentials | Instance profile role | No long-lived keys embedded in AMIs. | | S3 private path | Gateway endpoint + subnet route-table association | Endpoint policy, bucket policy, IAM, and routes all matter. | | KMS imported key material | New key + alias migration for key replacement | Alias movement does not re-encrypt old ciphertext. | | Explicit IP deny at subnet edge | Network ACL | NACLs are stateless and support DENY; security groups are stateful allow-only. | | Config compliance | AWS Config rule + tested remediation | Detection, alerting, and remediation are distinct steps. | | ASG launch failure | Activity history + CloudTrail API errors + quotas | Maximum capacity not reached does not prove launches can succeed. | | Slow global static assets | CloudFront caching | CDN for static; Auto Scaling for dynamic throughput. | ## Official documentation references The per-question citations link directly to AWS service documentation. For exam preparation, favor current AWS documentation over memorized third-party answer keys, especially for areas where service defaults and naming have changed (S3 default encryption, AWS IAM Identity Center, KMS key rotation, S3 Glacier storage models, and Auto Scaling deployment mechanisms).